source3/smbd/smb2_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "smbprofile.h"
  29 #include "../lib/util/bitmap.h"
  30 #include "../librpc/gen_ndr/krb5pac.h"
  31 #include "lib/util/iov_buf.h"
  32 #include "auth.h"
  33 #include "lib/crypto/sha512.h"
  34
  35 static void smbd_smb2_connection_handler(struct tevent_context *ev,
  36                                          struct tevent_fd *fde,
  37                                          uint16_t flags,
  38                                          void *private_data);
  39 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn);
  40
  41 static const struct smbd_smb2_dispatch_table {
  42         uint16_t opcode;
  43         const char *name;
  44         bool need_session;
  45         bool need_tcon;
  46         bool as_root;
  47         uint16_t fileid_ofs;
  48         bool allow_invalid_fileid;
  49         bool modify;
  50 } smbd_smb2_table[] = {
  51 #define _OP(o) .opcode = o, .name = #o
  52         {
  53                 _OP(SMB2_OP_NEGPROT),
  54                 .as_root = true,
  55         },{
  56                 _OP(SMB2_OP_SESSSETUP),
  57                 .as_root = true,
  58         },{
  59                 _OP(SMB2_OP_LOGOFF),
  60                 .need_session = true,
  61                 .as_root = true,
  62         },{
  63                 _OP(SMB2_OP_TCON),
  64                 .need_session = true,
  65                 /*
  66                  * This call needs to be run as root.
  67                  *
  68                  * smbd_smb2_request_process_tcon()
  69                  * calls make_connection_snum(), which will call
  70                  * change_to_user(), when needed.
  71                  */
  72                 .as_root = true,
  73         },{
  74                 _OP(SMB2_OP_TDIS),
  75                 .need_session = true,
  76                 .need_tcon = true,
  77                 .as_root = true,
  78         },{
  79                 _OP(SMB2_OP_CREATE),
  80                 .need_session = true,
  81                 .need_tcon = true,
  82         },{
  83                 _OP(SMB2_OP_CLOSE),
  84                 .need_session = true,
  85                 .need_tcon = true,
  86                 .fileid_ofs = 0x08,
  87         },{
  88                 _OP(SMB2_OP_FLUSH),
  89                 .need_session = true,
  90                 .need_tcon = true,
  91                 .fileid_ofs = 0x08,
  92         },{
  93                 _OP(SMB2_OP_READ),
  94                 .need_session = true,
  95                 .need_tcon = true,
  96                 .fileid_ofs = 0x10,
  97         },{
  98                 _OP(SMB2_OP_WRITE),
  99                 .need_session = true,
 100                 .need_tcon = true,
 101                 .fileid_ofs = 0x10,
 102                 .modify = true,
 103         },{
 104                 _OP(SMB2_OP_LOCK),
 105                 .need_session = true,
 106                 .need_tcon = true,
 107                 .fileid_ofs = 0x08,
 108         },{
 109                 _OP(SMB2_OP_IOCTL),
 110                 .need_session = true,
 111                 .need_tcon = true,
 112                 .fileid_ofs = 0x08,
 113                 .allow_invalid_fileid = true,
 114                 .modify = true,
 115         },{
 116                 _OP(SMB2_OP_CANCEL),
 117                 .as_root = true,
 118         },{
 119                 _OP(SMB2_OP_KEEPALIVE),
 120                 .as_root = true,
 121         },{
 122                 _OP(SMB2_OP_QUERY_DIRECTORY),
 123                 .need_session = true,
 124                 .need_tcon = true,
 125                 .fileid_ofs = 0x08,
 126         },{
 127                 _OP(SMB2_OP_NOTIFY),
 128                 .need_session = true,
 129                 .need_tcon = true,
 130                 .fileid_ofs = 0x08,
 131         },{
 132                 _OP(SMB2_OP_GETINFO),
 133                 .need_session = true,
 134                 .need_tcon = true,
 135                 .fileid_ofs = 0x18,
 136         },{
 137                 _OP(SMB2_OP_SETINFO),
 138                 .need_session = true,
 139                 .need_tcon = true,
 140                 .fileid_ofs = 0x10,
 141                 .modify = true,
 142         },{
 143                 _OP(SMB2_OP_BREAK),
 144                 .need_session = true,
 145                 .need_tcon = true,
 146                 /*
 147                  * we do not set
 148                  * .fileid_ofs here
 149                  * as LEASE breaks does not
 150                  * have a file id
 151                  */
 152         }
 153 };
 154
 155 const char *smb2_opcode_name(uint16_t opcode)
 156 {
 157         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 158                 return "Bad SMB2 opcode";
 159         }
 160         return smbd_smb2_table[opcode].name;
 161 }
 162
 163 static const struct smbd_smb2_dispatch_table *smbd_smb2_call(uint16_t opcode)
 164 {
 165         const struct smbd_smb2_dispatch_table *ret = NULL;
 166
 167         if (opcode >= ARRAY_SIZE(smbd_smb2_table)) {
 168                 return NULL;
 169         }
 170
 171         ret = &smbd_smb2_table[opcode];
 172
 173         SMB_ASSERT(ret->opcode == opcode);
 174
 175         return ret;
 176 }
 177
 178 static void print_req_vectors(const struct smbd_smb2_request *req)
 179 {
 180         int i;
 181
 182         for (i = 0; i < req->in.vector_count; i++) {
 183                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
 184                         (unsigned int)i,
 185                         (unsigned int)req->in.vector[i].iov_len);
 186         }
 187         for (i = 0; i < req->out.vector_count; i++) {
 188                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
 189                         (unsigned int)i,
 190                         (unsigned int)req->out.vector[i].iov_len);
 191         }
 192 }
 193
 194 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
 195 {
 196         if (size < (4 + SMB2_HDR_BODY)) {
 197                 return false;
 198         }
 199
 200         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
 201                 return false;
 202         }
 203
 204         return true;
 205 }
 206
 207 bool smbd_smb2_is_compound(const struct smbd_smb2_request *req)
 208 {
 209         return req->in.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ);
 210 }
 211
 212 static NTSTATUS smbd_initialize_smb2(struct smbXsrv_connection *xconn,
 213                                      uint64_t expected_seq_low)
 214 {
 215         TALLOC_FREE(xconn->transport.fde);
 216
 217         xconn->smb2.credits.seq_low = expected_seq_low;
 218         xconn->smb2.credits.seq_range = 1;
 219         xconn->smb2.credits.granted = 1;
 220         xconn->smb2.credits.max = lp_smb2_max_credits();
 221         xconn->smb2.credits.bitmap = bitmap_talloc(xconn,
 222                                                    xconn->smb2.credits.max);
 223         if (xconn->smb2.credits.bitmap == NULL) {
 224                 return NT_STATUS_NO_MEMORY;
 225         }
 226
 227         xconn->transport.fde = tevent_add_fd(xconn->ev_ctx,
 228                                         xconn,
 229                                         xconn->transport.sock,
 230                                         TEVENT_FD_READ,
 231                                         smbd_smb2_connection_handler,
 232                                         xconn);
 233         if (xconn->transport.fde == NULL) {
 234                 return NT_STATUS_NO_MEMORY;
 235         }
 236
 237         /* Ensure child is set to non-blocking mode */
 238         set_blocking(xconn->transport.sock, false);
 239         return NT_STATUS_OK;
 240 }
 241
 242 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
 243 #define _smb2_setlen(_buf,len) do { \
 244         uint8_t *buf = (uint8_t *)_buf; \
 245         buf[0] = 0; \
 246         buf[1] = ((len)&0xFF0000)>>16; \
 247         buf[2] = ((len)&0xFF00)>>8; \
 248         buf[3] = (len)&0xFF; \
 249 } while (0)
 250
 251 static bool smb2_setup_nbt_length(struct iovec *vector, int count)
 252 {
 253         ssize_t len;
 254
 255         if (count == 0) {
 256                 return false;
 257         }
 258
 259         len = iov_buflen(vector+1, count-1);
 260
 261         if ((len == -1) || (len > 0xFFFFFF)) {
 262                 return false;
 263         }
 264
 265         _smb2_setlen(vector[0].iov_base, len);
 266         return true;
 267 }
 268
 269 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
 270 {
 271         if (req->first_key.length > 0) {
 272                 data_blob_clear_free(&req->first_key);
 273         }
 274         if (req->last_key.length > 0) {
 275                 data_blob_clear_free(&req->last_key);
 276         }
 277         return 0;
 278 }
 279
 280 void smb2_request_set_async_internal(struct smbd_smb2_request *req,
 281                                      bool async_internal)
 282 {
 283         req->async_internal = async_internal;
 284 }
 285
 286 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
 287 {
 288         TALLOC_CTX *mem_pool;
 289         struct smbd_smb2_request *req;
 290
 291 #if 0
 292         /* Enable this to find subtle valgrind errors. */
 293         mem_pool = talloc_init("smbd_smb2_request_allocate");
 294 #else
 295         mem_pool = talloc_tos();
 296 #endif
 297         if (mem_pool == NULL) {
 298                 return NULL;
 299         }
 300
 301         req = talloc_zero(mem_pool, struct smbd_smb2_request);
 302         if (req == NULL) {
 303                 talloc_free(mem_pool);
 304                 return NULL;
 305         }
 306         talloc_reparent(mem_pool, mem_ctx, req);
 307 #if 0
 308         TALLOC_FREE(mem_pool);
 309 #endif
 310
 311         req->last_session_id = UINT64_MAX;
 312         req->last_tid = UINT32_MAX;
 313
 314         talloc_set_destructor(req, smbd_smb2_request_destructor);
 315
 316         return req;
 317 }
 318
 319 static NTSTATUS smbd_smb2_inbuf_parse_compound(struct smbXsrv_connection *xconn,
 320                                                NTTIME now,
 321                                                uint8_t *buf,
 322                                                size_t buflen,
 323                                                struct smbd_smb2_request *req,
 324                                                struct iovec **piov,
 325                                                int *pnum_iov)
 326 {
 327         TALLOC_CTX *mem_ctx = req;
 328         struct iovec *iov;
 329         int num_iov = 1;
 330         size_t taken = 0;
 331         uint8_t *first_hdr = buf;
 332         size_t verified_buflen = 0;
 333         uint8_t *tf = NULL;
 334         size_t tf_len = 0;
 335
 336         /*
 337          * Note: index '0' is reserved for the transport protocol
 338          */
 339         iov = req->in._vector;
 340
 341         while (taken < buflen) {
 342                 size_t len = buflen - taken;
 343                 uint8_t *hdr = first_hdr + taken;
 344                 struct iovec *cur;
 345                 size_t full_size;
 346                 size_t next_command_ofs;
 347                 uint16_t body_size;
 348                 uint8_t *body = NULL;
 349                 uint32_t dyn_size;
 350                 uint8_t *dyn = NULL;
 351                 struct iovec *iov_alloc = NULL;
 352
 353                 if (iov != req->in._vector) {
 354                         iov_alloc = iov;
 355                 }
 356
 357                 if (verified_buflen > taken) {
 358                         len = verified_buflen - taken;
 359                 } else {
 360                         tf = NULL;
 361                         tf_len = 0;
 362                 }
 363
 364                 if (len < 4) {
 365                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 366                                    (int)len, 4));
 367                         goto inval;
 368                 }
 369                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
 370                         struct smbXsrv_session *s = NULL;
 371                         uint64_t uid;
 372                         struct iovec tf_iov[2];
 373                         NTSTATUS status;
 374                         size_t enc_len;
 375
 376                         if (xconn->protocol < PROTOCOL_SMB2_24) {
 377                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 378                                            "but dialect[0x%04X] is used\n",
 379                                            xconn->smb2.server.dialect));
 380                                 goto inval;
 381                         }
 382
 383                         if (xconn->smb2.server.cipher == 0) {
 384                                 DEBUG(10, ("Got SMB2_TRANSFORM header, "
 385                                            "but not negotiated "
 386                                            "client[0x%08X] server[0x%08X]\n",
 387                                            xconn->smb2.client.capabilities,
 388                                            xconn->smb2.server.capabilities));
 389                                 goto inval;
 390                         }
 391
 392                         if (len < SMB2_TF_HDR_SIZE) {
 393                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 394                                            (int)len, SMB2_TF_HDR_SIZE));
 395                                 goto inval;
 396                         }
 397                         tf = hdr;
 398                         tf_len = SMB2_TF_HDR_SIZE;
 399                         taken += tf_len;
 400
 401                         hdr = first_hdr + taken;
 402                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
 403                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
 404
 405                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
 406                                 DEBUG(1, ("%d bytes left, expected at least %d\n",
 407                                            (int)len,
 408                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
 409                                 goto inval;
 410                         }
 411
 412                         status = smb2srv_session_lookup_conn(xconn, uid, now,
 413                                                              &s);
 414                         if (s == NULL) {
 415                                 DEBUG(1, ("invalid session[%llu] in "
 416                                           "SMB2_TRANSFORM header\n",
 417                                            (unsigned long long)uid));
 418                                 TALLOC_FREE(iov_alloc);
 419                                 return NT_STATUS_USER_SESSION_DELETED;
 420                         }
 421
 422                         tf_iov[0].iov_base = (void *)tf;
 423                         tf_iov[0].iov_len = tf_len;
 424                         tf_iov[1].iov_base = (void *)hdr;
 425                         tf_iov[1].iov_len = enc_len;
 426
 427                         status = smb2_signing_decrypt_pdu(s->global->decryption_key,
 428                                                           xconn->smb2.server.cipher,
 429                                                           tf_iov, 2);
 430                         if (!NT_STATUS_IS_OK(status)) {
 431                                 TALLOC_FREE(iov_alloc);
 432                                 return status;
 433                         }
 434
 435                         verified_buflen = taken + enc_len;
 436                         len = enc_len;
 437                 }
 438
 439                 /*
 440                  * We need the header plus the body length field
 441                  */
 442
 443                 if (len < SMB2_HDR_BODY + 2) {
 444                         DEBUG(10, ("%d bytes left, expected at least %d\n",
 445                                    (int)len, SMB2_HDR_BODY));
 446                         goto inval;
 447                 }
 448                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
 449                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
 450                                    IVAL(hdr, 0)));
 451                         goto inval;
 452                 }
 453                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
 454                         DEBUG(10, ("Got HDR len %d, expected %d\n",
 455                                    SVAL(hdr, 4), SMB2_HDR_BODY));
 456                         goto inval;
 457                 }
 458
 459                 full_size = len;
 460                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
 461                 body_size = SVAL(hdr, SMB2_HDR_BODY);
 462
 463                 if (next_command_ofs != 0) {
 464                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
 465                                 goto inval;
 466                         }
 467                         if (next_command_ofs > full_size) {
 468                                 goto inval;
 469                         }
 470                         full_size = next_command_ofs;
 471                 }
 472                 if (body_size < 2) {
 473                         goto inval;
 474                 }
 475                 body_size &= 0xfffe;
 476
 477                 if (body_size > (full_size - SMB2_HDR_BODY)) {
 478                         /*
 479                          * let the caller handle the error
 480                          */
 481                         body_size = full_size - SMB2_HDR_BODY;
 482                 }
 483                 body = hdr + SMB2_HDR_BODY;
 484                 dyn = body + body_size;
 485                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
 486
 487                 if (num_iov >= ARRAY_SIZE(req->in._vector)) {
 488                         struct iovec *iov_tmp = NULL;
 489
 490                         iov_tmp = talloc_realloc(mem_ctx, iov_alloc,
 491                                                  struct iovec,
 492                                                  num_iov +
 493                                                  SMBD_SMB2_NUM_IOV_PER_REQ);
 494                         if (iov_tmp == NULL) {
 495                                 TALLOC_FREE(iov_alloc);
 496                                 return NT_STATUS_NO_MEMORY;
 497                         }
 498
 499                         if (iov_alloc == NULL) {
 500                                 memcpy(iov_tmp,
 501                                        req->in._vector,
 502                                        sizeof(req->in._vector));
 503                         }
 504
 505                         iov = iov_tmp;
 506                 }
 507                 cur = &iov[num_iov];
 508                 num_iov += SMBD_SMB2_NUM_IOV_PER_REQ;
 509
 510                 cur[SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
 511                 cur[SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
 512                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
 513                 cur[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
 514                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
 515                 cur[SMBD_SMB2_BODY_IOV_OFS].iov_len  = body_size;
 516                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
 517                 cur[SMBD_SMB2_DYN_IOV_OFS].iov_len   = dyn_size;
 518
 519                 taken += full_size;
 520         }
 521
 522         *piov = iov;
 523         *pnum_iov = num_iov;
 524         return NT_STATUS_OK;
 525
 526 inval:
 527         if (iov != req->in._vector) {
 528                 TALLOC_FREE(iov);
 529         }
 530         return NT_STATUS_INVALID_PARAMETER;
 531 }
 532
 533 static NTSTATUS smbd_smb2_request_create(struct smbXsrv_connection *xconn,
 534                                          const uint8_t *_inpdu, size_t size,
 535                                          struct smbd_smb2_request **_req)
 536 {
 537         struct smbd_server_connection *sconn = xconn->client->sconn;
 538         struct smbd_smb2_request *req;
 539         uint32_t protocol_version;
 540         uint8_t *inpdu = NULL;
 541         const uint8_t *inhdr = NULL;
 542         uint16_t cmd;
 543         uint32_t next_command_ofs;
 544         NTSTATUS status;
 545         NTTIME now;
 546
 547         if (size < (SMB2_HDR_BODY + 2)) {
 548                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
 549                 return NT_STATUS_INVALID_PARAMETER;
 550         }
 551
 552         inhdr = _inpdu;
 553
 554         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
 555         if (protocol_version != SMB2_MAGIC) {
 556                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
 557                          protocol_version));
 558                 return NT_STATUS_INVALID_PARAMETER;
 559         }
 560
 561         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 562         if (cmd != SMB2_OP_NEGPROT) {
 563                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
 564                          cmd));
 565                 return NT_STATUS_INVALID_PARAMETER;
 566         }
 567
 568         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
 569         if (next_command_ofs != 0) {
 570                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
 571                          next_command_ofs));
 572                 return NT_STATUS_INVALID_PARAMETER;
 573         }
 574
 575         req = smbd_smb2_request_allocate(xconn);
 576         if (req == NULL) {
 577                 return NT_STATUS_NO_MEMORY;
 578         }
 579         req->sconn = sconn;
 580         req->xconn = xconn;
 581
 582         inpdu = talloc_memdup(req, _inpdu, size);
 583         if (inpdu == NULL) {
 584                 return NT_STATUS_NO_MEMORY;
 585         }
 586
 587         req->request_time = timeval_current();
 588         now = timeval_to_nttime(&req->request_time);
 589
 590         status = smbd_smb2_inbuf_parse_compound(xconn,
 591                                                 now,
 592                                                 inpdu,
 593                                                 size,
 594                                                 req, &req->in.vector,
 595                                                 &req->in.vector_count);
 596         if (!NT_STATUS_IS_OK(status)) {
 597                 TALLOC_FREE(req);
 598                 return status;
 599         }
 600
 601         req->current_idx = 1;
 602
 603         *_req = req;
 604         return NT_STATUS_OK;
 605 }
 606
 607 static bool smb2_validate_sequence_number(struct smbXsrv_connection *xconn,
 608                                           uint64_t message_id, uint64_t seq_id)
 609 {
 610         struct bitmap *credits_bm = xconn->smb2.credits.bitmap;
 611         unsigned int offset;
 612         uint64_t seq_tmp;
 613
 614         seq_tmp = xconn->smb2.credits.seq_low;
 615         if (seq_id < seq_tmp) {
 616                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
 617                         "%llu (sequence id %llu) "
 618                         "(granted = %u, low = %llu, range = %u)\n",
 619                         (unsigned long long)message_id,
 620                         (unsigned long long)seq_id,
 621                         (unsigned int)xconn->smb2.credits.granted,
 622                         (unsigned long long)xconn->smb2.credits.seq_low,
 623                         (unsigned int)xconn->smb2.credits.seq_range));
 624                 return false;
 625         }
 626
 627         seq_tmp += xconn->smb2.credits.seq_range;
 628         if (seq_id >= seq_tmp) {
 629                 DEBUG(0,("smb2_validate_sequence_number: bad message_id "
 630                         "%llu (sequence id %llu) "
 631                         "(granted = %u, low = %llu, range = %u)\n",
 632                         (unsigned long long)message_id,
 633                         (unsigned long long)seq_id,
 634                         (unsigned int)xconn->smb2.credits.granted,
 635                         (unsigned long long)xconn->smb2.credits.seq_low,
 636                         (unsigned int)xconn->smb2.credits.seq_range));
 637                 return false;
 638         }
 639
 640         offset = seq_id % xconn->smb2.credits.max;
 641
 642         if (bitmap_query(credits_bm, offset)) {
 643                 DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
 644                         "%llu (sequence id %llu) "
 645                         "(granted = %u, low = %llu, range = %u) "
 646                         "(bm offset %u)\n",
 647                         (unsigned long long)message_id,
 648                         (unsigned long long)seq_id,
 649                         (unsigned int)xconn->smb2.credits.granted,
 650                         (unsigned long long)xconn->smb2.credits.seq_low,
 651                         (unsigned int)xconn->smb2.credits.seq_range,
 652                         offset));
 653                 return false;
 654         }
 655
 656         /* Mark the message_ids as seen in the bitmap. */
 657         bitmap_set(credits_bm, offset);
 658
 659         if (seq_id != xconn->smb2.credits.seq_low) {
 660                 return true;
 661         }
 662
 663         /*
 664          * Move the window forward by all the message_id's
 665          * already seen.
 666          */
 667         while (bitmap_query(credits_bm, offset)) {
 668                 DEBUG(10,("smb2_validate_sequence_number: clearing "
 669                           "id %llu (position %u) from bitmap\n",
 670                           (unsigned long long)(xconn->smb2.credits.seq_low),
 671                           offset));
 672                 bitmap_clear(credits_bm, offset);
 673
 674                 xconn->smb2.credits.seq_low += 1;
 675                 xconn->smb2.credits.seq_range -= 1;
 676                 offset = xconn->smb2.credits.seq_low % xconn->smb2.credits.max;
 677         }
 678
 679         return true;
 680 }
 681
 682 static bool smb2_validate_message_id(struct smbXsrv_connection *xconn,
 683                                      const uint8_t *inhdr)
 684 {
 685         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 686         uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
 687         uint16_t credit_charge = 1;
 688         uint64_t i;
 689
 690         if (opcode == SMB2_OP_CANCEL) {
 691                 /* SMB2_CANCEL requests by definition resend messageids. */
 692                 return true;
 693         }
 694
 695         if (xconn->smb2.credits.multicredit) {
 696                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 697                 credit_charge = MAX(credit_charge, 1);
 698         }
 699
 700         DEBUG(11, ("smb2_validate_message_id: mid %llu (charge %llu), "
 701                    "credits_granted %llu, "
 702                    "seqnum low/range: %llu/%llu\n",
 703                    (unsigned long long) message_id,
 704                    (unsigned long long) credit_charge,
 705                    (unsigned long long) xconn->smb2.credits.granted,
 706                    (unsigned long long) xconn->smb2.credits.seq_low,
 707                    (unsigned long long) xconn->smb2.credits.seq_range));
 708
 709         if (xconn->smb2.credits.granted < credit_charge) {
 710                 DEBUG(0, ("smb2_validate_message_id: client used more "
 711                           "credits than granted, mid %llu, charge %llu, "
 712                           "credits_granted %llu, "
 713                           "seqnum low/range: %llu/%llu\n",
 714                           (unsigned long long) message_id,
 715                           (unsigned long long) credit_charge,
 716                           (unsigned long long) xconn->smb2.credits.granted,
 717                           (unsigned long long) xconn->smb2.credits.seq_low,
 718                           (unsigned long long) xconn->smb2.credits.seq_range));
 719                 return false;
 720         }
 721
 722         /*
 723          * now check the message ids
 724          *
 725          * for multi-credit requests we need to check all current mid plus
 726          * the implicit mids caused by the credit charge
 727          * e.g. current mid = 15, charge 5 => mark 15-19 as used
 728          */
 729
 730         for (i = 0; i <= (credit_charge-1); i++) {
 731                 uint64_t id = message_id + i;
 732                 bool ok;
 733
 734                 DEBUG(11, ("Iterating mid %llu charge %u (sequence %llu)\n",
 735                            (unsigned long long)message_id,
 736                            credit_charge,
 737                            (unsigned long long)id));
 738
 739                 ok = smb2_validate_sequence_number(xconn, message_id, id);
 740                 if (!ok) {
 741                         return false;
 742                 }
 743         }
 744
 745         /* substract used credits */
 746         xconn->smb2.credits.granted -= credit_charge;
 747
 748         return true;
 749 }
 750
 751 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req)
 752 {
 753         int count;
 754         int idx;
 755
 756         count = req->in.vector_count;
 757
 758         if (count < 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
 759                 /* It's not a SMB2 request */
 760                 return NT_STATUS_INVALID_PARAMETER;
 761         }
 762
 763         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 764                 struct iovec *hdr = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
 765                 struct iovec *body = SMBD_SMB2_IDX_BODY_IOV(req,in,idx);
 766                 const uint8_t *inhdr = NULL;
 767
 768                 if (hdr->iov_len != SMB2_HDR_BODY) {
 769                         return NT_STATUS_INVALID_PARAMETER;
 770                 }
 771
 772                 if (body->iov_len < 2) {
 773                         return NT_STATUS_INVALID_PARAMETER;
 774                 }
 775
 776                 inhdr = (const uint8_t *)hdr->iov_base;
 777
 778                 /* Check the SMB2 header */
 779                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
 780                         return NT_STATUS_INVALID_PARAMETER;
 781                 }
 782
 783                 if (!smb2_validate_message_id(req->xconn, inhdr)) {
 784                         return NT_STATUS_INVALID_PARAMETER;
 785                 }
 786         }
 787
 788         return NT_STATUS_OK;
 789 }
 790
 791 static void smb2_set_operation_credit(struct smbXsrv_connection *xconn,
 792                                       const struct iovec *in_vector,
 793                                       struct iovec *out_vector)
 794 {
 795         const uint8_t *inhdr = (const uint8_t *)in_vector->iov_base;
 796         uint8_t *outhdr = (uint8_t *)out_vector->iov_base;
 797         uint16_t credit_charge = 1;
 798         uint16_t credits_requested;
 799         uint32_t out_flags;
 800         uint16_t cmd;
 801         NTSTATUS out_status;
 802         uint16_t credits_granted = 0;
 803         uint64_t credits_possible;
 804         uint16_t current_max_credits;
 805
 806         /*
 807          * first we grant only 1/16th of the max range.
 808          *
 809          * Windows also starts with the 1/16th and then grants
 810          * more later. I was only able to trigger higher
 811          * values, when using a very high credit charge.
 812          *
 813          * TODO: scale up depending on load, free memory
 814          *       or other stuff.
 815          *       Maybe also on the relationship between number
 816          *       of requests and the used sequence number.
 817          *       Which means we would grant more credits
 818          *       for client which use multi credit requests.
 819          */
 820         current_max_credits = xconn->smb2.credits.max / 16;
 821         current_max_credits = MAX(current_max_credits, 1);
 822
 823         if (xconn->smb2.credits.multicredit) {
 824                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
 825                 credit_charge = MAX(credit_charge, 1);
 826         }
 827
 828         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 829         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
 830         credits_requested = MAX(credits_requested, 1);
 831         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
 832         out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
 833
 834         SMB_ASSERT(xconn->smb2.credits.max >= xconn->smb2.credits.granted);
 835
 836         if (xconn->smb2.credits.max < credit_charge) {
 837                 smbd_server_connection_terminate(xconn,
 838                         "client error: credit charge > max credits\n");
 839                 return;
 840         }
 841
 842         if (out_flags & SMB2_HDR_FLAG_ASYNC) {
 843                 /*
 844                  * In case we already send an async interim
 845                  * response, we should not grant
 846                  * credits on the final response.
 847                  */
 848                 credits_granted = 0;
 849         } else {
 850                 uint16_t additional_possible =
 851                         xconn->smb2.credits.max - credit_charge;
 852                 uint16_t additional_max = 0;
 853                 uint16_t additional_credits = credits_requested - 1;
 854
 855                 switch (cmd) {
 856                 case SMB2_OP_NEGPROT:
 857                         break;
 858                 case SMB2_OP_SESSSETUP:
 859                         /*
 860                          * Windows 2012 RC1 starts to grant
 861                          * additional credits
 862                          * with a successful session setup
 863                          */
 864                         if (NT_STATUS_IS_OK(out_status)) {
 865                                 additional_max = 32;
 866                         }
 867                         break;
 868                 default:
 869                         /*
 870                          * We match windows and only grant additional credits
 871                          * in chunks of 32.
 872                          */
 873                         additional_max = 32;
 874                         break;
 875                 }
 876
 877                 additional_max = MIN(additional_max, additional_possible);
 878                 additional_credits = MIN(additional_credits, additional_max);
 879
 880                 credits_granted = credit_charge + additional_credits;
 881         }
 882
 883         /*
 884          * sequence numbers should not wrap
 885          *
 886          * 1. calculate the possible credits until
 887          *    the sequence numbers start to wrap on 64-bit.
 888          *
 889          * 2. UINT64_MAX is used for Break Notifications.
 890          *
 891          * 2. truncate the possible credits to the maximum
 892          *    credits we want to grant to the client in total.
 893          *
 894          * 3. remove the range we'll already granted to the client
 895          *    this makes sure the client consumes the lowest sequence
 896          *    number, before we can grant additional credits.
 897          */
 898         credits_possible = UINT64_MAX - xconn->smb2.credits.seq_low;
 899         if (credits_possible > 0) {
 900                 /* remove UINT64_MAX */
 901                 credits_possible -= 1;
 902         }
 903         credits_possible = MIN(credits_possible, current_max_credits);
 904         credits_possible -= xconn->smb2.credits.seq_range;
 905
 906         credits_granted = MIN(credits_granted, credits_possible);
 907
 908         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
 909         xconn->smb2.credits.granted += credits_granted;
 910         xconn->smb2.credits.seq_range += credits_granted;
 911
 912         DEBUG(10,("smb2_set_operation_credit: requested %u, charge %u, "
 913                 "granted %u, current possible/max %u/%u, "
 914                 "total granted/max/low/range %u/%u/%llu/%u\n",
 915                 (unsigned int)credits_requested,
 916                 (unsigned int)credit_charge,
 917                 (unsigned int)credits_granted,
 918                 (unsigned int)credits_possible,
 919                 (unsigned int)current_max_credits,
 920                 (unsigned int)xconn->smb2.credits.granted,
 921                 (unsigned int)xconn->smb2.credits.max,
 922                 (unsigned long long)xconn->smb2.credits.seq_low,
 923                 (unsigned int)xconn->smb2.credits.seq_range));
 924 }
 925
 926 static void smb2_calculate_credits(const struct smbd_smb2_request *inreq,
 927                                 struct smbd_smb2_request *outreq)
 928 {
 929         int count, idx;
 930         uint16_t total_credits = 0;
 931
 932         count = outreq->out.vector_count;
 933
 934         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 935                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(inreq,in,idx);
 936                 struct iovec *outhdr_v = SMBD_SMB2_IDX_HDR_IOV(outreq,out,idx);
 937                 uint8_t *outhdr = (uint8_t *)outhdr_v->iov_base;
 938
 939                 smb2_set_operation_credit(outreq->xconn, inhdr_v, outhdr_v);
 940
 941                 /* To match Windows, count up what we
 942                    just granted. */
 943                 total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
 944                 /* Set to zero in all but the last reply. */
 945                 if (idx + SMBD_SMB2_NUM_IOV_PER_REQ < count) {
 946                         SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
 947                 } else {
 948                         SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
 949                 }
 950         }
 951 }
 952
 953 DATA_BLOB smbd_smb2_generate_outbody(struct smbd_smb2_request *req, size_t size)
 954 {
 955         if (req->current_idx <= 1) {
 956                 if (size <= sizeof(req->out._body)) {
 957                         return data_blob_const(req->out._body, size);
 958                 }
 959         }
 960
 961         return data_blob_talloc(req, NULL, size);
 962 }
 963
 964 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req)
 965 {
 966         struct smbXsrv_connection *xconn = req->xconn;
 967         TALLOC_CTX *mem_ctx;
 968         struct iovec *vector;
 969         int count;
 970         int idx;
 971         bool ok;
 972
 973         count = req->in.vector_count;
 974         if (count <= ARRAY_SIZE(req->out._vector)) {
 975                 mem_ctx = req;
 976                 vector = req->out._vector;
 977         } else {
 978                 vector = talloc_zero_array(req, struct iovec, count);
 979                 if (vector == NULL) {
 980                         return NT_STATUS_NO_MEMORY;
 981                 }
 982                 mem_ctx = vector;
 983         }
 984
 985         vector[0].iov_base      = req->out.nbt_hdr;
 986         vector[0].iov_len       = 4;
 987         SIVAL(req->out.nbt_hdr, 0, 0);
 988
 989         for (idx=1; idx < count; idx += SMBD_SMB2_NUM_IOV_PER_REQ) {
 990                 struct iovec *inhdr_v = SMBD_SMB2_IDX_HDR_IOV(req,in,idx);
 991                 const uint8_t *inhdr = (const uint8_t *)inhdr_v->iov_base;
 992                 uint8_t *outhdr = NULL;
 993                 uint8_t *outbody = NULL;
 994                 uint32_t next_command_ofs = 0;
 995                 struct iovec *current = &vector[idx];
 996
 997                 if ((idx + SMBD_SMB2_NUM_IOV_PER_REQ) < count) {
 998                         /* we have a next command -
 999                          * setup for the error case. */
1000                         next_command_ofs = SMB2_HDR_BODY + 9;
1001                 }
1002
1003                 if (idx == 1) {
1004                         outhdr = req->out._hdr;
1005                 } else {
1006                         outhdr = talloc_zero_array(mem_ctx, uint8_t,
1007                                                    OUTVEC_ALLOC_SIZE);
1008                         if (outhdr == NULL) {
1009                                 return NT_STATUS_NO_MEMORY;
1010                         }
1011                 }
1012
1013                 outbody = outhdr + SMB2_HDR_BODY;
1014
1015                 /*
1016                  * SMBD_SMB2_TF_IOV_OFS might be used later
1017                  */
1018                 current[SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1019                 current[SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1020
1021                 current[SMBD_SMB2_HDR_IOV_OFS].iov_base  = (void *)outhdr;
1022                 current[SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1023
1024                 current[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)outbody;
1025                 current[SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1026
1027                 current[SMBD_SMB2_DYN_IOV_OFS].iov_base  = NULL;
1028                 current[SMBD_SMB2_DYN_IOV_OFS].iov_len   = 0;
1029
1030                 /* setup the SMB2 header */
1031                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
1032                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
1033                 SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
1034                       SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
1035                 SIVAL(outhdr, SMB2_HDR_STATUS,
1036                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
1037                 SSVAL(outhdr, SMB2_HDR_OPCODE,
1038                       SVAL(inhdr, SMB2_HDR_OPCODE));
1039                 SIVAL(outhdr, SMB2_HDR_FLAGS,
1040                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
1041                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
1042                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
1043                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
1044                 SIVAL(outhdr, SMB2_HDR_PID,
1045                       IVAL(inhdr, SMB2_HDR_PID));
1046                 SIVAL(outhdr, SMB2_HDR_TID,
1047                       IVAL(inhdr, SMB2_HDR_TID));
1048                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
1049                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
1050                 memcpy(outhdr + SMB2_HDR_SIGNATURE,
1051                        inhdr + SMB2_HDR_SIGNATURE, 16);
1052
1053                 /* setup error body header */
1054                 SSVAL(outbody, 0x00, 0x08 + 1);
1055                 SSVAL(outbody, 0x02, 0);
1056                 SIVAL(outbody, 0x04, 0);
1057         }
1058
1059         req->out.vector = vector;
1060         req->out.vector_count = count;
1061
1062         /* setup the length of the NBT packet */
1063         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1064         if (!ok) {
1065                 return NT_STATUS_INVALID_PARAMETER_MIX;
1066         }
1067
1068         DLIST_ADD_END(xconn->smb2.requests, req);
1069
1070         return NT_STATUS_OK;
1071 }
1072
1073 void smbd_server_connection_terminate_ex(struct smbXsrv_connection *xconn,
1074                                          const char *reason,
1075                                          const char *location)
1076 {
1077         struct smbXsrv_client *client = xconn->client;
1078
1079         DEBUG(10,("smbd_server_connection_terminate_ex: conn[%s] reason[%s] at %s\n",
1080                   smbXsrv_connection_dbg(xconn), reason, location));
1081
1082         if (client->connections->next != NULL) {
1083                 /* TODO: cancel pending requests */
1084                 DLIST_REMOVE(client->connections, xconn);
1085                 TALLOC_FREE(xconn);
1086                 return;
1087         }
1088
1089         /*
1090          * The last connection was disconnected
1091          */
1092         exit_server_cleanly(reason);
1093 }
1094
1095 static bool dup_smb2_vec4(TALLOC_CTX *ctx,
1096                         struct iovec *outvec,
1097                         const struct iovec *srcvec)
1098 {
1099         const uint8_t *srctf;
1100         size_t srctf_len;
1101         const uint8_t *srchdr;
1102         size_t srchdr_len;
1103         const uint8_t *srcbody;
1104         size_t srcbody_len;
1105         const uint8_t *expected_srcbody;
1106         const uint8_t *srcdyn;
1107         size_t srcdyn_len;
1108         const uint8_t *expected_srcdyn;
1109         uint8_t *dsttf;
1110         uint8_t *dsthdr;
1111         uint8_t *dstbody;
1112         uint8_t *dstdyn;
1113
1114         srctf  = (const uint8_t *)srcvec[SMBD_SMB2_TF_IOV_OFS].iov_base;
1115         srctf_len = srcvec[SMBD_SMB2_TF_IOV_OFS].iov_len;
1116         srchdr  = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
1117         srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
1118         srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
1119         srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
1120         expected_srcbody = srchdr + SMB2_HDR_BODY;
1121         srcdyn  = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
1122         srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
1123         expected_srcdyn = srcbody + 8;
1124
1125         if ((srctf_len != SMB2_TF_HDR_SIZE) && (srctf_len != 0)) {
1126                 return false;
1127         }
1128
1129         if (srchdr_len != SMB2_HDR_BODY) {
1130                 return false;
1131         }
1132
1133         if (srctf_len == SMB2_TF_HDR_SIZE) {
1134                 dsttf = talloc_memdup(ctx, srctf, SMB2_TF_HDR_SIZE);
1135                 if (dsttf == NULL) {
1136                         return false;
1137                 }
1138         } else {
1139                 dsttf = NULL;
1140         }
1141         outvec[SMBD_SMB2_TF_IOV_OFS].iov_base = (void *)dsttf;
1142         outvec[SMBD_SMB2_TF_IOV_OFS].iov_len = srctf_len;
1143
1144         /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
1145          * be allocated with size OUTVEC_ALLOC_SIZE. */
1146
1147         dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
1148         if (dsthdr == NULL) {
1149                 return false;
1150         }
1151         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
1152         outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
1153
1154         /*
1155          * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
1156          * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
1157          * then duplicate this. Else use talloc_memdup().
1158          */
1159
1160         if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
1161                 dstbody = dsthdr + SMB2_HDR_BODY;
1162         } else {
1163                 dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
1164                 if (dstbody == NULL) {
1165                         return false;
1166                 }
1167         }
1168         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
1169         outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
1170
1171         /*
1172          * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
1173          * pointing to
1174          * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
1175          * then duplicate this. Else use talloc_memdup().
1176          */
1177
1178         if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
1179                 dstdyn = dsthdr + SMB2_HDR_BODY + 8;
1180         } else if (srcdyn == NULL) {
1181                 dstdyn = NULL;
1182         } else {
1183                 dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
1184                 if (dstdyn == NULL) {
1185                         return false;
1186                 }
1187         }
1188         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
1189         outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
1190
1191         return true;
1192 }
1193
1194 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
1195 {
1196         struct smbd_smb2_request *newreq = NULL;
1197         struct iovec *outvec = NULL;
1198         int count = req->out.vector_count;
1199         int i;
1200         bool ok;
1201
1202         newreq = smbd_smb2_request_allocate(req->xconn);
1203         if (!newreq) {
1204                 return NULL;
1205         }
1206
1207         newreq->sconn = req->sconn;
1208         newreq->xconn = req->xconn;
1209         newreq->session = req->session;
1210         newreq->do_encryption = req->do_encryption;
1211         newreq->do_signing = req->do_signing;
1212         newreq->current_idx = req->current_idx;
1213
1214         outvec = talloc_zero_array(newreq, struct iovec, count);
1215         if (!outvec) {
1216                 TALLOC_FREE(newreq);
1217                 return NULL;
1218         }
1219         newreq->out.vector = outvec;
1220         newreq->out.vector_count = count;
1221
1222         /* Setup the outvec's identically to req. */
1223         outvec[0].iov_base = newreq->out.nbt_hdr;
1224         outvec[0].iov_len = 4;
1225         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
1226
1227         /* Setup the vectors identically to the ones in req. */
1228         for (i = 1; i < count; i += SMBD_SMB2_NUM_IOV_PER_REQ) {
1229                 if (!dup_smb2_vec4(outvec, &outvec[i], &req->out.vector[i])) {
1230                         break;
1231                 }
1232         }
1233
1234         if (i < count) {
1235                 /* Alloc failed. */
1236                 TALLOC_FREE(newreq);
1237                 return NULL;
1238         }
1239
1240         ok = smb2_setup_nbt_length(newreq->out.vector,
1241                                    newreq->out.vector_count);
1242         if (!ok) {
1243                 TALLOC_FREE(newreq);
1244                 return NULL;
1245         }
1246
1247         return newreq;
1248 }
1249
1250 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
1251 {
1252         struct smbXsrv_connection *xconn = req->xconn;
1253         int first_idx = 1;
1254         struct iovec *firsttf = NULL;
1255         struct iovec *outhdr_v = NULL;
1256         uint8_t *outhdr = NULL;
1257         struct smbd_smb2_request *nreq = NULL;
1258         NTSTATUS status;
1259         bool ok;
1260
1261         /* Create a new smb2 request we'll use
1262            for the interim return. */
1263         nreq = dup_smb2_req(req);
1264         if (!nreq) {
1265                 return NT_STATUS_NO_MEMORY;
1266         }
1267
1268         /* Lose the last X out vectors. They're the
1269            ones we'll be using for the async reply. */
1270         nreq->out.vector_count -= SMBD_SMB2_NUM_IOV_PER_REQ;
1271
1272         ok = smb2_setup_nbt_length(nreq->out.vector,
1273                                    nreq->out.vector_count);
1274         if (!ok) {
1275                 return NT_STATUS_INVALID_PARAMETER_MIX;
1276         }
1277
1278         /* Step back to the previous reply. */
1279         nreq->current_idx -= SMBD_SMB2_NUM_IOV_PER_REQ;
1280         firsttf = SMBD_SMB2_IDX_TF_IOV(nreq,out,first_idx);
1281         outhdr_v = SMBD_SMB2_OUT_HDR_IOV(nreq);
1282         outhdr = SMBD_SMB2_OUT_HDR_PTR(nreq);
1283         /* And end the chain. */
1284         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
1285
1286         /* Calculate outgoing credits */
1287         smb2_calculate_credits(req, nreq);
1288
1289         if (DEBUGLEVEL >= 10) {
1290                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
1291                         (unsigned int)nreq->current_idx );
1292                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
1293                         (unsigned int)nreq->out.vector_count );
1294                 print_req_vectors(nreq);
1295         }
1296
1297         /*
1298          * As we have changed the header (SMB2_HDR_NEXT_COMMAND),
1299          * we need to sign/encrypt here with the last/first key we remembered
1300          */
1301         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
1302                 status = smb2_signing_encrypt_pdu(req->first_key,
1303                                         xconn->smb2.server.cipher,
1304                                         firsttf,
1305                                         nreq->out.vector_count - first_idx);
1306                 if (!NT_STATUS_IS_OK(status)) {
1307                         return status;
1308                 }
1309         } else if (req->last_key.length > 0) {
1310                 status = smb2_signing_sign_pdu(req->last_key,
1311                                                xconn->protocol,
1312                                                outhdr_v,
1313                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1314                 if (!NT_STATUS_IS_OK(status)) {
1315                         return status;
1316                 }
1317         }
1318
1319         nreq->queue_entry.mem_ctx = nreq;
1320         nreq->queue_entry.vector = nreq->out.vector;
1321         nreq->queue_entry.count = nreq->out.vector_count;
1322         DLIST_ADD_END(xconn->smb2.send_queue, &nreq->queue_entry);
1323         xconn->smb2.send_queue_len++;
1324
1325         status = smbd_smb2_flush_send_queue(xconn);
1326         if (!NT_STATUS_IS_OK(status)) {
1327                 return status;
1328         }
1329
1330         return NT_STATUS_OK;
1331 }
1332
1333 struct smbd_smb2_request_pending_state {
1334         struct smbd_smb2_send_queue queue_entry;
1335         uint8_t buf[NBT_HDR_SIZE + SMB2_TF_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
1336         struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
1337 };
1338
1339 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1340                                             struct tevent_timer *te,
1341                                             struct timeval current_time,
1342                                             void *private_data);
1343
1344 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
1345                                          struct tevent_req *subreq,
1346                                          uint32_t defer_time)
1347 {
1348         NTSTATUS status;
1349         struct timeval defer_endtime;
1350         uint8_t *outhdr = NULL;
1351         uint32_t flags;
1352
1353         if (!tevent_req_is_in_progress(subreq)) {
1354                 /*
1355                  * This is a performance optimization,
1356                  * it avoids one tevent_loop iteration,
1357                  * which means we avoid one
1358                  * talloc_stackframe_pool/talloc_free pair.
1359                  */
1360                 tevent_req_notify_callback(subreq);
1361                 return NT_STATUS_OK;
1362         }
1363
1364         req->subreq = subreq;
1365         subreq = NULL;
1366
1367         if (req->async_te) {
1368                 /* We're already async. */
1369                 return NT_STATUS_OK;
1370         }
1371
1372         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1373         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1374         if (flags & SMB2_HDR_FLAG_ASYNC) {
1375                 /* We're already async. */
1376                 return NT_STATUS_OK;
1377         }
1378
1379         if (req->async_internal) {
1380                 /*
1381                  * An SMB2 request implementation wants to handle the request
1382                  * asynchronously "internally" while keeping synchronous
1383                  * behaviour for the SMB2 request. This means we don't send an
1384                  * interim response and we can allow processing of compound SMB2
1385                  * requests (cf the subsequent check) for all cases.
1386                  */
1387                 return NT_STATUS_OK;
1388         }
1389
1390         if (req->in.vector_count > req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
1391                 /*
1392                  * We're trying to go async in a compound request
1393                  * chain. This is only allowed for opens that cause an
1394                  * oplock break or for the last operation in the
1395                  * chain, otherwise it is not allowed. See
1396                  * [MS-SMB2].pdf note <206> on Section 3.3.5.2.7.
1397                  */
1398                 const uint8_t *inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1399
1400                 if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
1401                         /*
1402                          * Cancel the outstanding request.
1403                          */
1404                         bool ok = tevent_req_cancel(req->subreq);
1405                         if (ok) {
1406                                 return NT_STATUS_OK;
1407                         }
1408                         TALLOC_FREE(req->subreq);
1409                         return smbd_smb2_request_error(req,
1410                                 NT_STATUS_INTERNAL_ERROR);
1411                 }
1412         }
1413
1414         if (DEBUGLEVEL >= 10) {
1415                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
1416                         (unsigned int)req->current_idx );
1417                 print_req_vectors(req);
1418         }
1419
1420         if (req->current_idx > 1) {
1421                 /*
1422                  * We're going async in a compound
1423                  * chain after the first request has
1424                  * already been processed. Send an
1425                  * interim response containing the
1426                  * set of replies already generated.
1427                  */
1428                 int idx = req->current_idx;
1429
1430                 status = smb2_send_async_interim_response(req);
1431                 if (!NT_STATUS_IS_OK(status)) {
1432                         return status;
1433                 }
1434                 if (req->first_key.length > 0) {
1435                         data_blob_clear_free(&req->first_key);
1436                 }
1437
1438                 req->current_idx = 1;
1439
1440                 /*
1441                  * Re-arrange the in.vectors to remove what
1442                  * we just sent.
1443                  */
1444                 memmove(&req->in.vector[1],
1445                         &req->in.vector[idx],
1446                         sizeof(req->in.vector[0])*(req->in.vector_count - idx));
1447                 req->in.vector_count = 1 + (req->in.vector_count - idx);
1448
1449                 /* Re-arrange the out.vectors to match. */
1450                 memmove(&req->out.vector[1],
1451                         &req->out.vector[idx],
1452                         sizeof(req->out.vector[0])*(req->out.vector_count - idx));
1453                 req->out.vector_count = 1 + (req->out.vector_count - idx);
1454
1455                 if (req->in.vector_count == 1 + SMBD_SMB2_NUM_IOV_PER_REQ) {
1456                         /*
1457                          * We only have one remaining request as
1458                          * we've processed everything else.
1459                          * This is no longer a compound request.
1460                          */
1461                         req->compound_related = false;
1462                         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1463                         flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
1464                         SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
1465                 }
1466         }
1467         if (req->last_key.length > 0) {
1468                 data_blob_clear_free(&req->last_key);
1469         }
1470
1471         defer_endtime = timeval_current_ofs_usec(defer_time);
1472         req->async_te = tevent_add_timer(req->sconn->ev_ctx,
1473                                          req, defer_endtime,
1474                                          smbd_smb2_request_pending_timer,
1475                                          req);
1476         if (req->async_te == NULL) {
1477                 return NT_STATUS_NO_MEMORY;
1478         }
1479
1480         return NT_STATUS_OK;
1481 }
1482
1483 static DATA_BLOB smbd_smb2_signing_key(struct smbXsrv_session *session,
1484                                        struct smbXsrv_connection *xconn)
1485 {
1486         struct smbXsrv_channel_global0 *c = NULL;
1487         NTSTATUS status;
1488         DATA_BLOB key = data_blob_null;
1489
1490         status = smbXsrv_session_find_channel(session, xconn, &c);
1491         if (NT_STATUS_IS_OK(status)) {
1492                 key = c->signing_key;
1493         }
1494
1495         if (key.length == 0) {
1496                 key = session->global->signing_key;
1497         }
1498
1499         return key;
1500 }
1501
1502 static NTSTATUS smb2_get_new_nonce(struct smbXsrv_session *session,
1503                                    uint64_t *new_nonce_high,
1504                                    uint64_t *new_nonce_low)
1505 {
1506         uint64_t nonce_high;
1507         uint64_t nonce_low;
1508
1509         session->nonce_low += 1;
1510         if (session->nonce_low == 0) {
1511                 session->nonce_low += 1;
1512                 session->nonce_high += 1;
1513         }
1514
1515         /*
1516          * CCM and GCM algorithms must never have their
1517          * nonce wrap, or the security of the whole
1518          * communication and the keys is destroyed.
1519          * We must drop the connection once we have
1520          * transfered too much data.
1521          *
1522          * NOTE: We assume nonces greater than 8 bytes.
1523          */
1524         if (session->nonce_high >= session->nonce_high_max) {
1525                 return NT_STATUS_ENCRYPTION_FAILED;
1526         }
1527
1528         nonce_high = session->nonce_high_random;
1529         nonce_high += session->nonce_high;
1530         nonce_low = session->nonce_low;
1531
1532         *new_nonce_high = nonce_high;
1533         *new_nonce_low = nonce_low;
1534         return NT_STATUS_OK;
1535 }
1536
1537 static void smbd_smb2_request_pending_timer(struct tevent_context *ev,
1538                                             struct tevent_timer *te,
1539                                             struct timeval current_time,
1540                                             void *private_data)
1541 {
1542         struct smbd_smb2_request *req =
1543                 talloc_get_type_abort(private_data,
1544                 struct smbd_smb2_request);
1545         struct smbXsrv_connection *xconn = req->xconn;
1546         struct smbd_smb2_request_pending_state *state = NULL;
1547         uint8_t *outhdr = NULL;
1548         const uint8_t *inhdr = NULL;
1549         uint8_t *tf = NULL;
1550         size_t tf_len = 0;
1551         uint8_t *hdr = NULL;
1552         uint8_t *body = NULL;
1553         uint8_t *dyn = NULL;
1554         uint32_t flags = 0;
1555         uint64_t session_id = 0;
1556         uint64_t message_id = 0;
1557         uint64_t nonce_high = 0;
1558         uint64_t nonce_low = 0;
1559         uint64_t async_id = 0;
1560         NTSTATUS status;
1561         bool ok;
1562
1563         TALLOC_FREE(req->async_te);
1564
1565         /* Ensure our final reply matches the interim one. */
1566         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1567         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
1568         flags = IVAL(outhdr, SMB2_HDR_FLAGS);
1569         message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1570         session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
1571
1572         async_id = message_id; /* keep it simple for now... */
1573
1574         SIVAL(outhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1575         SBVAL(outhdr, SMB2_HDR_ASYNC_ID, async_id);
1576
1577         DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
1578                 "going async\n",
1579                 smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1580                 (unsigned long long)async_id ));
1581
1582         /*
1583          * What we send is identical to a smbd_smb2_request_error
1584          * packet with an error status of STATUS_PENDING. Make use
1585          * of this fact sometime when refactoring. JRA.
1586          */
1587
1588         state = talloc_zero(req->xconn, struct smbd_smb2_request_pending_state);
1589         if (state == NULL) {
1590                 smbd_server_connection_terminate(xconn,
1591                                                  nt_errstr(NT_STATUS_NO_MEMORY));
1592                 return;
1593         }
1594
1595         tf = state->buf + NBT_HDR_SIZE;
1596         tf_len = SMB2_TF_HDR_SIZE;
1597
1598         hdr = tf + SMB2_TF_HDR_SIZE;
1599         body = hdr + SMB2_HDR_BODY;
1600         dyn = body + 8;
1601
1602         if (req->do_encryption) {
1603                 status = smb2_get_new_nonce(req->session,
1604                                             &nonce_high,
1605                                             &nonce_low);
1606                 if (!NT_STATUS_IS_OK(status)) {
1607                         smbd_server_connection_terminate(xconn,
1608                                                          nt_errstr(status));
1609                         return;
1610                 }
1611         }
1612
1613         SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
1614         SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
1615         SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
1616         SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
1617
1618         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
1619         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
1620         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
1621         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
1622         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(outhdr, SMB2_HDR_OPCODE));
1623
1624         SIVAL(hdr, SMB2_HDR_FLAGS, flags);
1625         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
1626         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
1627         SBVAL(hdr, SMB2_HDR_PID, async_id);
1628         SBVAL(hdr, SMB2_HDR_SESSION_ID,
1629                 BVAL(outhdr, SMB2_HDR_SESSION_ID));
1630         memcpy(hdr+SMB2_HDR_SIGNATURE,
1631                outhdr+SMB2_HDR_SIGNATURE, 16);
1632
1633         SSVAL(body, 0x00, 0x08 + 1);
1634
1635         SCVAL(body, 0x02, 0);
1636         SCVAL(body, 0x03, 0);
1637         SIVAL(body, 0x04, 0);
1638         /* Match W2K8R2... */
1639         SCVAL(dyn,  0x00, 0x21);
1640
1641         state->vector[0].iov_base = (void *)state->buf;
1642         state->vector[0].iov_len = NBT_HDR_SIZE;
1643
1644         if (req->do_encryption) {
1645                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = tf;
1646                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = tf_len;
1647         } else {
1648                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_base   = NULL;
1649                 state->vector[1+SMBD_SMB2_TF_IOV_OFS].iov_len    = 0;
1650         }
1651
1652         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
1653         state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
1654
1655         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
1656         state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
1657
1658         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
1659         state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len   = 1;
1660
1661         ok = smb2_setup_nbt_length(state->vector,
1662                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
1663         if (!ok) {
1664                 smbd_server_connection_terminate(
1665                         xconn, nt_errstr(NT_STATUS_INTERNAL_ERROR));
1666                 return;
1667         }
1668
1669         /* Ensure we correctly go through crediting. Grant
1670            the credits now, and zero credits on the final
1671            response. */
1672         smb2_set_operation_credit(req->xconn,
1673                         SMBD_SMB2_IN_HDR_IOV(req),
1674                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
1675
1676         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
1677
1678         if (DEBUGLVL(10)) {
1679                 int i;
1680
1681                 for (i = 0; i < ARRAY_SIZE(state->vector); i++) {
1682                         dbgtext("\tstate->vector[%u/%u].iov_len = %u\n",
1683                                 (unsigned int)i,
1684                                 (unsigned int)ARRAY_SIZE(state->vector),
1685                                 (unsigned int)state->vector[i].iov_len);
1686                 }
1687         }
1688
1689         if (req->do_encryption) {
1690                 struct smbXsrv_session *x = req->session;
1691                 DATA_BLOB encryption_key = x->global->encryption_key;
1692
1693                 status = smb2_signing_encrypt_pdu(encryption_key,
1694                                         xconn->smb2.server.cipher,
1695                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
1696                                         SMBD_SMB2_NUM_IOV_PER_REQ);
1697                 if (!NT_STATUS_IS_OK(status)) {
1698                         smbd_server_connection_terminate(xconn,
1699                                                 nt_errstr(status));
1700                         return;
1701                 }
1702         } else if (req->do_signing) {
1703                 struct smbXsrv_session *x = req->session;
1704                 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
1705
1706                 status = smb2_signing_sign_pdu(signing_key,
1707                                         xconn->protocol,
1708                                         &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
1709                                         SMBD_SMB2_NUM_IOV_PER_REQ - 1);
1710                 if (!NT_STATUS_IS_OK(status)) {
1711                         smbd_server_connection_terminate(xconn,
1712                                                 nt_errstr(status));
1713                         return;
1714                 }
1715         }
1716
1717         state->queue_entry.mem_ctx = state;
1718         state->queue_entry.vector = state->vector;
1719         state->queue_entry.count = ARRAY_SIZE(state->vector);
1720         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
1721         xconn->smb2.send_queue_len++;
1722
1723         status = smbd_smb2_flush_send_queue(xconn);
1724         if (!NT_STATUS_IS_OK(status)) {
1725                 smbd_server_connection_terminate(xconn,
1726                                                  nt_errstr(status));
1727                 return;
1728         }
1729 }
1730
1731 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
1732 {
1733         struct smbXsrv_connection *xconn = req->xconn;
1734         struct smbd_smb2_request *cur;
1735         const uint8_t *inhdr;
1736         uint32_t flags;
1737         uint64_t search_message_id;
1738         uint64_t search_async_id;
1739         uint64_t found_id;
1740
1741         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1742
1743         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1744         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
1745         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
1746
1747         /*
1748          * We don't need the request anymore cancel requests never
1749          * have a response.
1750          *
1751          * We defer the TALLOC_FREE(req) to the caller.
1752          */
1753         DLIST_REMOVE(xconn->smb2.requests, req);
1754
1755         for (cur = xconn->smb2.requests; cur; cur = cur->next) {
1756                 const uint8_t *outhdr;
1757                 uint64_t message_id;
1758                 uint64_t async_id;
1759
1760                 if (cur->compound_related) {
1761                         /*
1762                          * Never cancel anything in a compound request.
1763                          * Way too hard to deal with the result.
1764                          */
1765                         continue;
1766                 }
1767
1768                 outhdr = SMBD_SMB2_OUT_HDR_PTR(cur);
1769
1770                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
1771                 async_id = BVAL(outhdr, SMB2_HDR_PID);
1772
1773                 if (flags & SMB2_HDR_FLAG_ASYNC) {
1774                         if (search_async_id == async_id) {
1775                                 found_id = async_id;
1776                                 break;
1777                         }
1778                 } else {
1779                         if (search_message_id == message_id) {
1780                                 found_id = message_id;
1781                                 break;
1782                         }
1783                 }
1784         }
1785
1786         if (cur && cur->subreq) {
1787                 inhdr = SMBD_SMB2_IN_HDR_PTR(cur);
1788                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
1789                         "cancel opcode[%s] mid %llu\n",
1790                         smb2_opcode_name(SVAL(inhdr, SMB2_HDR_OPCODE)),
1791                         (unsigned long long)found_id ));
1792                 tevent_req_cancel(cur->subreq);
1793         }
1794
1795         return NT_STATUS_OK;
1796 }
1797
1798 /*************************************************************
1799  Ensure an incoming tid is a valid one for us to access.
1800  Change to the associated uid credentials and chdir to the
1801  valid tid directory.
1802 *************************************************************/
1803
1804 static NTSTATUS smbd_smb2_request_check_tcon(struct smbd_smb2_request *req)
1805 {
1806         const uint8_t *inhdr;
1807         uint32_t in_flags;
1808         uint32_t in_tid;
1809         struct smbXsrv_tcon *tcon;
1810         NTSTATUS status;
1811         NTTIME now = timeval_to_nttime(&req->request_time);
1812
1813         req->tcon = NULL;
1814
1815         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1816
1817         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1818         in_tid = IVAL(inhdr, SMB2_HDR_TID);
1819
1820         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1821                 in_tid = req->last_tid;
1822         }
1823
1824         req->last_tid = 0;
1825
1826         status = smb2srv_tcon_lookup(req->session,
1827                                      in_tid, now, &tcon);
1828         if (!NT_STATUS_IS_OK(status)) {
1829                 return status;
1830         }
1831
1832         if (!change_to_user(tcon->compat, req->session->compat->vuid)) {
1833                 return NT_STATUS_ACCESS_DENIED;
1834         }
1835
1836         if (!set_current_service(tcon->compat, 0, true)) {
1837                 return NT_STATUS_ACCESS_DENIED;
1838         }
1839
1840         req->tcon = tcon;
1841         req->last_tid = in_tid;
1842
1843         return NT_STATUS_OK;
1844 }
1845
1846 /*************************************************************
1847  Ensure an incoming session_id is a valid one for us to access.
1848 *************************************************************/
1849
1850 static NTSTATUS smbd_smb2_request_check_session(struct smbd_smb2_request *req)
1851 {
1852         const uint8_t *inhdr;
1853         uint32_t in_flags;
1854         uint16_t in_opcode;
1855         uint64_t in_session_id;
1856         struct smbXsrv_session *session = NULL;
1857         struct auth_session_info *session_info;
1858         NTSTATUS status;
1859         NTTIME now = timeval_to_nttime(&req->request_time);
1860
1861         req->session = NULL;
1862         req->tcon = NULL;
1863
1864         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1865
1866         in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
1867         in_opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
1868         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
1869
1870         if (in_flags & SMB2_HDR_FLAG_CHAINED) {
1871                 in_session_id = req->last_session_id;
1872         }
1873
1874         req->last_session_id = 0;
1875
1876         /* look an existing session up */
1877         switch (in_opcode) {
1878         case SMB2_OP_SESSSETUP:
1879                 /*
1880                  * For a session bind request, we don't have the
1881                  * channel set up at this point yet, so we defer
1882                  * the verification that the connection belongs
1883                  * to the session to the session setup code, which
1884                  * can look at the session binding flags.
1885                  */
1886                 status = smb2srv_session_lookup_client(req->xconn->client,
1887                                                        in_session_id, now,
1888                                                        &session);
1889                 break;
1890         default:
1891                 status = smb2srv_session_lookup_conn(req->xconn,
1892                                                      in_session_id, now,
1893                                                      &session);
1894                 break;
1895         }
1896         if (session) {
1897                 req->session = session;
1898                 req->last_session_id = in_session_id;
1899         }
1900         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1901                 switch (in_opcode) {
1902                 case SMB2_OP_SESSSETUP:
1903                         status = NT_STATUS_OK;
1904                         break;
1905                 case SMB2_OP_LOGOFF:
1906                 case SMB2_OP_CLOSE:
1907                 case SMB2_OP_LOCK:
1908                 case SMB2_OP_CANCEL:
1909                 case SMB2_OP_KEEPALIVE:
1910                         /*
1911                          * [MS-SMB2] 3.3.5.2.9 Verifying the Session
1912                          * specifies that LOGOFF, CLOSE and (UN)LOCK
1913                          * should always be processed even on expired sessions.
1914                          *
1915                          * Also see the logic in
1916                          * smbd_smb2_request_process_lock().
1917                          *
1918                          * The smb2.session.expire2 test shows that
1919                          * CANCEL and KEEPALIVE/ECHO should also
1920                          * be processed.
1921                          */
1922                         status = NT_STATUS_OK;
1923                         break;
1924                 default:
1925                         break;
1926                 }
1927         }
1928         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1929                 switch (in_opcode) {
1930                 case SMB2_OP_TCON:
1931                 case SMB2_OP_CREATE:
1932                 case SMB2_OP_GETINFO:
1933                 case SMB2_OP_SETINFO:
1934                         return NT_STATUS_INVALID_HANDLE;
1935                 default:
1936                         /*
1937                          * Notice the check for
1938                          * (session_info == NULL)
1939                          * below.
1940                          */
1941                         status = NT_STATUS_OK;
1942                         break;
1943                 }
1944         }
1945         if (!NT_STATUS_IS_OK(status)) {
1946                 return status;
1947         }
1948
1949         session_info = session->global->auth_session_info;
1950         if (session_info == NULL) {
1951                 return NT_STATUS_INVALID_HANDLE;
1952         }
1953
1954         if (in_session_id != req->xconn->client->last_session_id) {
1955                 req->xconn->client->last_session_id = in_session_id;
1956                 set_current_user_info(session_info->unix_info->sanitized_username,
1957                                       session_info->unix_info->unix_name,
1958                                       session_info->info->domain_name);
1959         }
1960
1961         return NT_STATUS_OK;
1962 }
1963
1964 NTSTATUS smbd_smb2_request_verify_creditcharge(struct smbd_smb2_request *req,
1965                                                 uint32_t data_length)
1966 {
1967         struct smbXsrv_connection *xconn = req->xconn;
1968         uint16_t needed_charge;
1969         uint16_t credit_charge = 1;
1970         const uint8_t *inhdr;
1971
1972         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
1973
1974         if (xconn->smb2.credits.multicredit) {
1975                 credit_charge = SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE);
1976                 credit_charge = MAX(credit_charge, 1);
1977         }
1978
1979         needed_charge = (data_length - 1)/ 65536 + 1;
1980
1981         DEBUG(10, ("mid %llu, CreditCharge: %d, NeededCharge: %d\n",
1982                    (unsigned long long) BVAL(inhdr, SMB2_HDR_MESSAGE_ID),
1983                    credit_charge, needed_charge));
1984
1985         if (needed_charge > credit_charge) {
1986                 DEBUG(2, ("CreditCharge too low, given %d, needed %d\n",
1987                           credit_charge, needed_charge));
1988                 return NT_STATUS_INVALID_PARAMETER;
1989         }
1990
1991         return NT_STATUS_OK;
1992 }
1993
1994 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
1995                                         size_t expected_body_size)
1996 {
1997         struct iovec *inhdr_v;
1998         const uint8_t *inhdr;
1999         uint16_t opcode;
2000         const uint8_t *inbody;
2001         size_t body_size;
2002         size_t min_dyn_size = expected_body_size & 0x00000001;
2003         int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
2004
2005         /*
2006          * The following should be checked already.
2007          */
2008         if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
2009                 return NT_STATUS_INTERNAL_ERROR;
2010         }
2011         if (req->current_idx > max_idx) {
2012                 return NT_STATUS_INTERNAL_ERROR;
2013         }
2014
2015         inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
2016         if (inhdr_v->iov_len != SMB2_HDR_BODY) {
2017                 return NT_STATUS_INTERNAL_ERROR;
2018         }
2019         if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
2020                 return NT_STATUS_INTERNAL_ERROR;
2021         }
2022
2023         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2024         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2025
2026         switch (opcode) {
2027         case SMB2_OP_IOCTL:
2028         case SMB2_OP_GETINFO:
2029                 min_dyn_size = 0;
2030                 break;
2031         case SMB2_OP_WRITE:
2032                 if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
2033                         if (req->smb1req->unread_bytes < min_dyn_size) {
2034                                 return NT_STATUS_INVALID_PARAMETER;
2035                         }
2036
2037                         min_dyn_size = 0;
2038                 }
2039                 break;
2040         }
2041
2042         /*
2043          * Now check the expected body size,
2044          * where the last byte might be in the
2045          * dynamic section..
2046          */
2047         if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
2048                 return NT_STATUS_INVALID_PARAMETER;
2049         }
2050         if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
2051                 return NT_STATUS_INVALID_PARAMETER;
2052         }
2053
2054         inbody = SMBD_SMB2_IN_BODY_PTR(req);
2055
2056         body_size = SVAL(inbody, 0x00);
2057         if (body_size != expected_body_size) {
2058                 return NT_STATUS_INVALID_PARAMETER;
2059         }
2060
2061         return NT_STATUS_OK;
2062 }
2063
2064 bool smbXsrv_is_encrypted(uint8_t encryption_flags)
2065 {
2066         return (!(encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET)
2067                 &&
2068                 (encryption_flags & (SMBXSRV_PROCESSED_ENCRYPTED_PACKET |
2069                                      SMBXSRV_ENCRYPTION_DESIRED |
2070                                      SMBXSRV_ENCRYPTION_REQUIRED)));
2071 }
2072
2073 bool smbXsrv_is_partially_encrypted(uint8_t encryption_flags)
2074 {
2075         return ((encryption_flags & SMBXSRV_PROCESSED_ENCRYPTED_PACKET) &&
2076                 (encryption_flags & SMBXSRV_PROCESSED_UNENCRYPTED_PACKET));
2077 }
2078
2079 /* Set a flag if not already set, return true if set */
2080 bool smbXsrv_set_crypto_flag(uint8_t *flags, uint8_t flag)
2081 {
2082         if ((flag == 0) || (*flags & flag)) {
2083                 return false;
2084         }
2085
2086         *flags |= flag;
2087         return true;
2088 }
2089
2090 /*
2091  * Update encryption state tracking flags, this can be used to
2092  * determine whether whether the session or tcon is "encrypted".
2093  */
2094 static void smb2srv_update_crypto_flags(struct smbd_smb2_request *req,
2095                                         uint16_t opcode,
2096                                         bool *update_session_globalp,
2097                                         bool *update_tcon_globalp)
2098 {
2099         /* Default: assume unecrypted and unsigned */
2100         struct smbXsrv_session *session = req->session;
2101         struct smbXsrv_tcon *tcon = req->tcon;
2102         uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
2103         uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
2104         bool update_session = false;
2105         bool update_tcon = false;
2106
2107         if (req->was_encrypted && req->do_encryption) {
2108                 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
2109                 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2110         } else {
2111                 /* Unencrypted packet, can be signed */
2112                 if (req->do_signing) {
2113                         sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
2114                 } else if (opcode == SMB2_OP_CANCEL) {
2115                         /* Cancel requests are allowed to skip signing */
2116                         sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
2117                 }
2118         }
2119
2120         update_session |= smbXsrv_set_crypto_flag(
2121                 &session->global->encryption_flags, encrypt_flag);
2122         update_session |= smbXsrv_set_crypto_flag(
2123                 &session->global->signing_flags, sign_flag);
2124
2125         if (tcon) {
2126                 update_tcon |= smbXsrv_set_crypto_flag(
2127                         &tcon->global->encryption_flags, encrypt_flag);
2128                 update_tcon |= smbXsrv_set_crypto_flag(
2129                         &tcon->global->signing_flags, sign_flag);
2130         }
2131
2132         *update_session_globalp = update_session;
2133         *update_tcon_globalp = update_tcon;
2134         return;
2135 }
2136
2137 bool smbXsrv_is_signed(uint8_t signing_flags)
2138 {
2139         /*
2140          * Signing is always enabled, so unless we got an unsigned
2141          * packet and at least one signed packet that was not
2142          * encrypted, the session or tcon is "signed".
2143          */
2144         return (!(signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2145                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2146 }
2147
2148 bool smbXsrv_is_partially_signed(uint8_t signing_flags)
2149 {
2150         return ((signing_flags & SMBXSRV_PROCESSED_UNSIGNED_PACKET) &&
2151                 (signing_flags & SMBXSRV_PROCESSED_SIGNED_PACKET));
2152 }
2153
2154 static NTSTATUS smbd_smb2_request_dispatch_update_counts(
2155                                 struct smbd_smb2_request *req,
2156                                 bool modify_call)
2157 {
2158         struct smbXsrv_connection *xconn = req->xconn;
2159         const uint8_t *inhdr;
2160         uint16_t channel_sequence;
2161         uint32_t flags;
2162         int cmp;
2163         struct smbXsrv_open *op;
2164         bool update_open = false;
2165         NTSTATUS status = NT_STATUS_OK;
2166
2167         req->request_counters_updated = false;
2168
2169         if (xconn->protocol < PROTOCOL_SMB2_22) {
2170                 return NT_STATUS_OK;
2171         }
2172
2173         if (req->compat_chain_fsp == NULL) {
2174                 return NT_STATUS_OK;
2175         }
2176
2177         op = req->compat_chain_fsp->op;
2178         if (op == NULL) {
2179                 return NT_STATUS_OK;
2180         }
2181
2182         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2183         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2184         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
2185
2186         cmp = channel_sequence - op->global->channel_sequence;
2187
2188         if (abs(cmp) > INT16_MAX) {
2189                 /*
2190                  * [MS-SMB2] 3.3.5.2.10 - Verifying the Channel Sequence Number:
2191                  *
2192                  * If the channel sequence number of the request and the one
2193                  * known to the server are not equal, the channel sequence
2194                  * number and outstanding request counts are only updated
2195                  * "... if the unsigned difference using 16-bit arithmetic
2196                  * between ChannelSequence and Open.ChannelSequence is less than
2197                  * or equal to 0x7FFF ...".
2198                  * Otherwise, an error is returned for the modifying
2199                  * calls write, set_info, and ioctl.
2200                  *
2201                  * There are currently two issues with the description:
2202                  *
2203                  * * For the other calls, the document seems to imply
2204                  *   that processing continues without adapting the
2205                  *   counters (if the sequence numbers are not equal).
2206                  *
2207                  *   TODO: This needs clarification!
2208                  *
2209                  * * Also, the behaviour if the difference is larger
2210                  *   than 0x7FFF is not clear. The document seems to
2211                  *   imply that if such a difference is reached,
2212                  *   the server starts to ignore the counters or
2213                  *   in the case of the modifying calls, return errors.
2214                  *
2215                  *   TODO: This needs clarification!
2216                  *
2217                  * At this point Samba tries to be a little more
2218                  * clever than the description in the MS-SMB2 document
2219                  * by heuristically detecting and properly treating
2220                  * a 16 bit overflow of the client-submitted sequence
2221                  * number:
2222                  *
2223                  * If the stored channel sequence number is more than
2224                  * 0x7FFF larger than the one from the request, then
2225                  * the client-provided sequence number has likely
2226                  * overflown. We treat this case as valid instead
2227                  * of as failure.
2228                  *
2229                  * The MS-SMB2 behaviour would be setting cmp = -1.
2230                  */
2231                 cmp *= -1;
2232         }
2233
2234         if (flags & SMB2_HDR_FLAG_REPLAY_OPERATION) {
2235                 if (cmp == 0 && op->pre_request_count == 0) {
2236                         op->request_count += 1;
2237                         req->request_counters_updated = true;
2238                 } else if (cmp > 0 && op->pre_request_count == 0) {
2239                         op->pre_request_count += op->request_count;
2240                         op->request_count = 1;
2241                         op->global->channel_sequence = channel_sequence;
2242                         update_open = true;
2243                         req->request_counters_updated = true;
2244                 } else if (modify_call) {
2245                         return NT_STATUS_FILE_NOT_AVAILABLE;
2246                 }
2247         } else {
2248                 if (cmp == 0) {
2249                         op->request_count += 1;
2250                         req->request_counters_updated = true;
2251                 } else if (cmp > 0) {
2252                         op->pre_request_count += op->request_count;
2253                         op->request_count = 1;
2254                         op->global->channel_sequence = channel_sequence;
2255                         update_open = true;
2256                         req->request_counters_updated = true;
2257                 } else if (modify_call) {
2258                         return NT_STATUS_FILE_NOT_AVAILABLE;
2259                 }
2260         }
2261
2262         if (update_open) {
2263                 status = smbXsrv_open_update(op);
2264         }
2265
2266         return status;
2267 }
2268
2269 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
2270 {
2271         struct smbXsrv_connection *xconn = req->xconn;
2272         const struct smbd_smb2_dispatch_table *call = NULL;
2273         const struct iovec *intf_v = SMBD_SMB2_IN_TF_IOV(req);
2274         const uint8_t *inhdr;
2275         uint16_t opcode;
2276         uint32_t flags;
2277         uint64_t mid;
2278         NTSTATUS status;
2279         NTSTATUS session_status;
2280         uint32_t allowed_flags;
2281         NTSTATUS return_value;
2282         struct smbXsrv_session *x = NULL;
2283         bool signing_required = false;
2284         bool encryption_desired = false;
2285         bool encryption_required = false;
2286
2287         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2288
2289         DO_PROFILE_INC(request);
2290
2291         /* TODO: verify more things */
2292
2293         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
2294         opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
2295         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
2296         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
2297                 smb2_opcode_name(opcode),
2298                 (unsigned long long)mid));
2299
2300         if (xconn->protocol >= PROTOCOL_SMB2_02) {
2301                 /*
2302                  * once the protocol is negotiated
2303                  * SMB2_OP_NEGPROT is not allowed anymore
2304                  */
2305                 if (opcode == SMB2_OP_NEGPROT) {
2306                         /* drop the connection */
2307                         return NT_STATUS_INVALID_PARAMETER;
2308                 }
2309         } else {
2310                 /*
2311                  * if the protocol is not negotiated yet
2312                  * only SMB2_OP_NEGPROT is allowed.
2313                  */
2314                 if (opcode != SMB2_OP_NEGPROT) {
2315                         /* drop the connection */
2316                         return NT_STATUS_INVALID_PARAMETER;
2317                 }
2318         }
2319
2320         /*
2321          * Check if the client provided a valid session id,
2322          * if so smbd_smb2_request_check_session() calls
2323          * set_current_user_info().
2324          *
2325          * As some command don't require a valid session id
2326          * we defer the check of the session_status
2327          */
2328         session_status = smbd_smb2_request_check_session(req);
2329         x = req->session;
2330         if (x != NULL) {
2331                 signing_required = x->global->signing_flags & SMBXSRV_SIGNING_REQUIRED;
2332                 encryption_desired = x->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
2333                 encryption_required = x->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED;
2334         }
2335
2336         req->async_internal = false;
2337         req->do_signing = false;
2338         req->do_encryption = false;
2339         req->was_encrypted = false;
2340         if (intf_v->iov_len == SMB2_TF_HDR_SIZE) {
2341                 const uint8_t *intf = SMBD_SMB2_IN_TF_PTR(req);
2342                 uint64_t tf_session_id = BVAL(intf, SMB2_TF_SESSION_ID);
2343
2344                 if (x != NULL && x->global->session_wire_id != tf_session_id) {
2345                         DEBUG(0,("smbd_smb2_request_dispatch: invalid session_id"
2346                                  "in SMB2_HDR[%llu], SMB2_TF[%llu]\n",
2347                                  (unsigned long long)x->global->session_wire_id,
2348                                  (unsigned long long)tf_session_id));
2349                         /*
2350                          * TODO: windows allows this...
2351                          * should we drop the connection?
2352                          *
2353                          * For now we just return ACCESS_DENIED
2354                          * (Windows clients never trigger this)
2355                          * and wait for an update of [MS-SMB2].
2356                          */
2357                         return smbd_smb2_request_error(req,
2358                                         NT_STATUS_ACCESS_DENIED);
2359                 }
2360
2361                 req->was_encrypted = true;
2362         }
2363
2364         if (encryption_required && !req->was_encrypted) {
2365                 return smbd_smb2_request_error(req,
2366                                 NT_STATUS_ACCESS_DENIED);
2367         }
2368
2369         call = smbd_smb2_call(opcode);
2370         if (call == NULL) {
2371                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2372         }
2373
2374         allowed_flags = SMB2_HDR_FLAG_CHAINED |
2375                         SMB2_HDR_FLAG_SIGNED |
2376                         SMB2_HDR_FLAG_DFS;
2377         if (xconn->protocol >= PROTOCOL_SMB3_11) {
2378                 allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
2379         }
2380         if (opcode == SMB2_OP_NEGPROT) {
2381                 if (lp_server_max_protocol() >= PROTOCOL_SMB3_11) {
2382                         allowed_flags |= SMB2_HDR_FLAG_PRIORITY_MASK;
2383                 }
2384         }
2385         if (opcode == SMB2_OP_CANCEL) {
2386                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
2387         }
2388         if (xconn->protocol >= PROTOCOL_SMB2_22) {
2389                 allowed_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
2390         }
2391         if ((flags & ~allowed_flags) != 0) {
2392                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2393         }
2394
2395         if (flags & SMB2_HDR_FLAG_CHAINED) {
2396                 /*
2397                  * This check is mostly for giving the correct error code
2398                  * for compounded requests.
2399                  */
2400                 if (!NT_STATUS_IS_OK(session_status)) {
2401                         return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2402                 }
2403         } else {
2404                 req->compat_chain_fsp = NULL;
2405         }
2406
2407         if (req->was_encrypted) {
2408                 signing_required = false;
2409         } else if (signing_required || (flags & SMB2_HDR_FLAG_SIGNED)) {
2410                 DATA_BLOB signing_key = data_blob_null;
2411
2412                 if (x == NULL) {
2413                         /*
2414                          * MS-SMB2: 3.3.5.2.4 Verifying the Signature.
2415                          * If the SMB2 header of the SMB2 NEGOTIATE
2416                          * request has the SMB2_FLAGS_SIGNED bit set in the
2417                          * Flags field, the server MUST fail the request
2418                          * with STATUS_INVALID_PARAMETER.
2419                          *
2420                          * Microsoft test tool checks this.
2421                          */
2422
2423                         if ((opcode == SMB2_OP_NEGPROT) &&
2424                                         (flags & SMB2_HDR_FLAG_SIGNED)) {
2425                                 status = NT_STATUS_INVALID_PARAMETER;
2426                         } else {
2427                                 status = NT_STATUS_USER_SESSION_DELETED;
2428                         }
2429                         return smbd_smb2_request_error(req, status);
2430                 }
2431
2432                 signing_key = smbd_smb2_signing_key(x, xconn);
2433
2434                 /*
2435                  * If we have a signing key, we should
2436                  * sign the response
2437                  */
2438                 if (signing_key.length > 0) {
2439                         req->do_signing = true;
2440                 }
2441
2442                 status = smb2_signing_check_pdu(signing_key,
2443                                                 xconn->protocol,
2444                                                 SMBD_SMB2_IN_HDR_IOV(req),
2445                                                 SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2446                 if (!NT_STATUS_IS_OK(status)) {
2447                         return smbd_smb2_request_error(req, status);
2448                 }
2449
2450                 /*
2451                  * Now that we know the request was correctly signed
2452                  * we have to sign the response too.
2453                  */
2454                 req->do_signing = true;
2455
2456                 if (!NT_STATUS_IS_OK(session_status)) {
2457                         return smbd_smb2_request_error(req, session_status);
2458                 }
2459         } else if (opcode == SMB2_OP_CANCEL) {
2460                 /* Cancel requests are allowed to skip the signing */
2461         } else if (signing_required) {
2462                 /*
2463                  * If signing is required we try to sign
2464                  * a possible error response
2465                  */
2466                 req->do_signing = true;
2467                 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
2468         }
2469
2470         if (flags & SMB2_HDR_FLAG_CHAINED) {
2471                 req->compound_related = true;
2472         }
2473
2474         if (call->need_session) {
2475                 if (!NT_STATUS_IS_OK(session_status)) {
2476                         return smbd_smb2_request_error(req, session_status);
2477                 }
2478         }
2479
2480         if (call->need_tcon) {
2481                 SMB_ASSERT(call->need_session);
2482
2483                 /*
2484                  * This call needs to be run as user.
2485                  *
2486                  * smbd_smb2_request_check_tcon()
2487                  * calls change_to_user() on success.
2488                  */
2489                 status = smbd_smb2_request_check_tcon(req);
2490                 if (!NT_STATUS_IS_OK(status)) {
2491                         return smbd_smb2_request_error(req, status);
2492                 }
2493                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
2494                         encryption_desired = true;
2495                 }
2496                 if (req->tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_REQUIRED) {
2497                         encryption_required = true;
2498                 }
2499                 if (encryption_required && !req->was_encrypted) {
2500                         return smbd_smb2_request_error(req,
2501                                 NT_STATUS_ACCESS_DENIED);
2502                 }
2503         }
2504
2505         if (req->was_encrypted || encryption_desired) {
2506                 req->do_encryption = true;
2507         }
2508
2509         if (req->session) {
2510                 bool update_session_global = false;
2511                 bool update_tcon_global = false;
2512
2513                 smb2srv_update_crypto_flags(req, opcode,
2514                                             &update_session_global,
2515                                             &update_tcon_global);
2516
2517                 if (update_session_global) {
2518                         status = smbXsrv_session_update(x);
2519                         if (!NT_STATUS_IS_OK(status)) {
2520                                 return smbd_smb2_request_error(req, status);
2521                         }
2522                 }
2523                 if (update_tcon_global) {
2524                         status = smbXsrv_tcon_update(req->tcon);
2525                         if (!NT_STATUS_IS_OK(status)) {
2526                                 return smbd_smb2_request_error(req, status);
2527                         }
2528                 }
2529         }
2530
2531         if (call->fileid_ofs != 0) {
2532                 size_t needed = call->fileid_ofs + 16;
2533                 const uint8_t *body = SMBD_SMB2_IN_BODY_PTR(req);
2534                 size_t body_size = SMBD_SMB2_IN_BODY_LEN(req);
2535                 uint64_t file_id_persistent;
2536                 uint64_t file_id_volatile;
2537                 struct files_struct *fsp;
2538
2539                 SMB_ASSERT(call->need_tcon);
2540
2541                 if (needed > body_size) {
2542                         return smbd_smb2_request_error(req,
2543                                         NT_STATUS_INVALID_PARAMETER);
2544                 }
2545
2546                 file_id_persistent      = BVAL(body, call->fileid_ofs + 0);
2547                 file_id_volatile        = BVAL(body, call->fileid_ofs + 8);
2548
2549                 fsp = file_fsp_smb2(req, file_id_persistent, file_id_volatile);
2550                 if (fsp == NULL) {
2551                         if (!call->allow_invalid_fileid) {
2552                                 return smbd_smb2_request_error(req,
2553                                                 NT_STATUS_FILE_CLOSED);
2554                         }
2555
2556                         if (file_id_persistent != UINT64_MAX) {
2557                                 return smbd_smb2_request_error(req,
2558                                                 NT_STATUS_FILE_CLOSED);
2559                         }
2560                         if (file_id_volatile != UINT64_MAX) {
2561                                 return smbd_smb2_request_error(req,
2562                                                 NT_STATUS_FILE_CLOSED);
2563                         }
2564                 }
2565         }
2566
2567         status = smbd_smb2_request_dispatch_update_counts(req, call->modify);
2568         if (!NT_STATUS_IS_OK(status)) {
2569                 return smbd_smb2_request_error(req, status);
2570         }
2571
2572         if (call->as_root) {
2573                 SMB_ASSERT(call->fileid_ofs == 0);
2574                 /* This call needs to be run as root */
2575                 change_to_root_user();
2576         } else {
2577                 SMB_ASSERT(call->need_tcon);
2578         }
2579
2580 #define _INBYTES(_r) \
2581         iov_buflen(SMBD_SMB2_IN_HDR_IOV(_r), SMBD_SMB2_NUM_IOV_PER_REQ-1)
2582
2583         switch (opcode) {
2584         case SMB2_OP_NEGPROT:
2585                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_negprot, profile_p,
2586                                                req->profile, _INBYTES(req));
2587                 return_value = smbd_smb2_request_process_negprot(req);
2588                 break;
2589
2590         case SMB2_OP_SESSSETUP:
2591                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_sesssetup, profile_p,
2592                                                req->profile, _INBYTES(req));
2593                 return_value = smbd_smb2_request_process_sesssetup(req);
2594                 break;
2595
2596         case SMB2_OP_LOGOFF:
2597                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_logoff, profile_p,
2598                                                req->profile, _INBYTES(req));
2599                 return_value = smbd_smb2_request_process_logoff(req);
2600                 break;
2601
2602         case SMB2_OP_TCON:
2603                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tcon, profile_p,
2604                                                req->profile, _INBYTES(req));
2605                 return_value = smbd_smb2_request_process_tcon(req);
2606                 break;
2607
2608         case SMB2_OP_TDIS:
2609                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_tdis, profile_p,
2610                                                req->profile, _INBYTES(req));
2611                 return_value = smbd_smb2_request_process_tdis(req);
2612                 break;
2613
2614         case SMB2_OP_CREATE:
2615                 if (req->subreq == NULL) {
2616                         SMBPROFILE_IOBYTES_ASYNC_START(smb2_create, profile_p,
2617                                                        req->profile, _INBYTES(req));
2618                 } else {
2619                         SMBPROFILE_IOBYTES_ASYNC_SET_BUSY(req->profile);
2620                 }
2621                 return_value = smbd_smb2_request_process_create(req);
2622                 break;
2623
2624         case SMB2_OP_CLOSE:
2625                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_close, profile_p,
2626                                                req->profile, _INBYTES(req));
2627                 return_value = smbd_smb2_request_process_close(req);
2628                 break;
2629
2630         case SMB2_OP_FLUSH:
2631                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_flush, profile_p,
2632                                                req->profile, _INBYTES(req));
2633                 return_value = smbd_smb2_request_process_flush(req);
2634                 break;
2635
2636         case SMB2_OP_READ:
2637                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_read, profile_p,
2638                                                req->profile, _INBYTES(req));
2639                 return_value = smbd_smb2_request_process_read(req);
2640                 break;
2641
2642         case SMB2_OP_WRITE:
2643                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_write, profile_p,
2644                                                req->profile, _INBYTES(req));
2645                 return_value = smbd_smb2_request_process_write(req);
2646                 break;
2647
2648         case SMB2_OP_LOCK:
2649                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_lock, profile_p,
2650                                                req->profile, _INBYTES(req));
2651                 return_value = smbd_smb2_request_process_lock(req);
2652                 break;
2653
2654         case SMB2_OP_IOCTL:
2655                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_ioctl, profile_p,
2656                                                req->profile, _INBYTES(req));
2657                 return_value = smbd_smb2_request_process_ioctl(req);
2658                 break;
2659
2660         case SMB2_OP_CANCEL:
2661                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_cancel, profile_p,
2662                                                req->profile, _INBYTES(req));
2663                 return_value = smbd_smb2_request_process_cancel(req);
2664                 SMBPROFILE_IOBYTES_ASYNC_END(req->profile, 0);
2665
2666                 /*
2667                  * We don't need the request anymore cancel requests never
2668                  * have a response.
2669                  *
2670                  * smbd_smb2_request_process_cancel() already called
2671                  * DLIST_REMOVE(xconn->smb2.requests, req);
2672                  */
2673                 TALLOC_FREE(req);
2674
2675                 break;
2676
2677         case SMB2_OP_KEEPALIVE:
2678                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_keepalive, profile_p,
2679                                                req->profile, _INBYTES(req));
2680                 return_value = smbd_smb2_request_process_keepalive(req);
2681                 break;
2682
2683         case SMB2_OP_QUERY_DIRECTORY:
2684                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_find, profile_p,
2685                                                req->profile, _INBYTES(req));
2686                 return_value = smbd_smb2_request_process_query_directory(req);
2687                 break;
2688
2689         case SMB2_OP_NOTIFY:
2690                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_notify, profile_p,
2691                                                req->profile, _INBYTES(req));
2692                 return_value = smbd_smb2_request_process_notify(req);
2693                 break;
2694
2695         case SMB2_OP_GETINFO:
2696                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_getinfo, profile_p,
2697                                                req->profile, _INBYTES(req));
2698                 return_value = smbd_smb2_request_process_getinfo(req);
2699                 break;
2700
2701         case SMB2_OP_SETINFO:
2702                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_setinfo, profile_p,
2703                                                req->profile, _INBYTES(req));
2704                 return_value = smbd_smb2_request_process_setinfo(req);
2705                 break;
2706
2707         case SMB2_OP_BREAK:
2708                 SMBPROFILE_IOBYTES_ASYNC_START(smb2_break, profile_p,
2709                                                req->profile, _INBYTES(req));
2710                 return_value = smbd_smb2_request_process_break(req);
2711                 break;
2712
2713         default:
2714                 return_value = smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
2715                 break;
2716         }
2717         return return_value;
2718 }
2719
2720 static void smbd_smb2_request_reply_update_counts(struct smbd_smb2_request *req)
2721 {
2722         struct smbXsrv_connection *xconn = req->xconn;
2723         const uint8_t *inhdr;
2724         uint16_t channel_sequence;
2725         struct smbXsrv_open *op;
2726
2727         if (!req->request_counters_updated) {
2728                 return;
2729         }
2730
2731         if (xconn->protocol < PROTOCOL_SMB2_22) {
2732                 return;
2733         }
2734
2735         if (req->compat_chain_fsp == NULL) {
2736                 return;
2737         }
2738
2739         op = req->compat_chain_fsp->op;
2740         if (op == NULL) {
2741                 return;
2742         }
2743
2744         inhdr = SMBD_SMB2_IN_HDR_PTR(req);
2745         channel_sequence = SVAL(inhdr, SMB2_HDR_CHANNEL_SEQUENCE);
2746
2747         if (op->global->channel_sequence == channel_sequence) {
2748                 SMB_ASSERT(op->request_count > 0);
2749                 op->request_count -= 1;
2750         } else {
2751                 SMB_ASSERT(op->pre_request_count > 0);
2752                 op->pre_request_count -= 1;
2753         }
2754 }
2755
2756 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
2757 {
2758         struct smbXsrv_connection *xconn = req->xconn;
2759         int first_idx = 1;
2760         struct iovec *firsttf = SMBD_SMB2_IDX_TF_IOV(req,out,first_idx);
2761         struct iovec *outhdr = SMBD_SMB2_OUT_HDR_IOV(req);
2762         struct iovec *outdyn = SMBD_SMB2_OUT_DYN_IOV(req);
2763         NTSTATUS status;
2764         bool ok;
2765
2766         req->subreq = NULL;
2767         TALLOC_FREE(req->async_te);
2768
2769         /* MS-SMB2: 3.3.4.1 Sending Any Outgoing Message */
2770         smbd_smb2_request_reply_update_counts(req);
2771
2772         if (req->do_encryption &&
2773             (firsttf->iov_len == 0) &&
2774             (req->first_key.length == 0) &&
2775             (req->session != NULL) &&
2776             (req->session->global->encryption_key.length != 0))
2777         {
2778                 DATA_BLOB encryption_key = req->session->global->encryption_key;
2779                 uint8_t *tf;
2780                 uint64_t session_id = req->session->global->session_wire_id;
2781                 uint64_t nonce_high;
2782                 uint64_t nonce_low;
2783
2784                 status = smb2_get_new_nonce(req->session,
2785                                             &nonce_high,
2786                                             &nonce_low);
2787                 if (!NT_STATUS_IS_OK(status)) {
2788                         return status;
2789                 }
2790
2791                 /*
2792                  * We need to place the SMB2_TRANSFORM header before the
2793                  * first SMB2 header
2794                  */
2795
2796                 /*
2797                  * we need to remember the encryption key
2798                  * and defer the signing/encryption until
2799                  * we are sure that we do not change
2800                  * the header again.
2801                  */
2802                 req->first_key = data_blob_dup_talloc(req, encryption_key);
2803                 if (req->first_key.data == NULL) {
2804                         return NT_STATUS_NO_MEMORY;
2805                 }
2806
2807                 tf = talloc_zero_array(req, uint8_t,
2808                                        SMB2_TF_HDR_SIZE);
2809                 if (tf == NULL) {
2810                         return NT_STATUS_NO_MEMORY;
2811                 }
2812
2813                 SIVAL(tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2814                 SBVAL(tf, SMB2_TF_NONCE+0, nonce_low);
2815                 SBVAL(tf, SMB2_TF_NONCE+8, nonce_high);
2816                 SBVAL(tf, SMB2_TF_SESSION_ID, session_id);
2817
2818                 firsttf->iov_base = (void *)tf;
2819                 firsttf->iov_len = SMB2_TF_HDR_SIZE;
2820         }
2821
2822         if ((req->current_idx > SMBD_SMB2_NUM_IOV_PER_REQ) &&
2823             (req->last_key.length > 0) &&
2824             (firsttf->iov_len == 0))
2825         {
2826                 int last_idx = req->current_idx - SMBD_SMB2_NUM_IOV_PER_REQ;
2827                 struct iovec *lasthdr = SMBD_SMB2_IDX_HDR_IOV(req,out,last_idx);
2828
2829                 /*
2830                  * As we are sure the header of the last request in the
2831                  * compound chain will not change, we can to sign here
2832                  * with the last signing key we remembered.
2833                  */
2834                 status = smb2_signing_sign_pdu(req->last_key,
2835                                                xconn->protocol,
2836                                                lasthdr,
2837                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2838                 if (!NT_STATUS_IS_OK(status)) {
2839                         return status;
2840                 }
2841         }
2842         if (req->last_key.length > 0) {
2843                 data_blob_clear_free(&req->last_key);
2844         }
2845
2846         SMBPROFILE_IOBYTES_ASYNC_END(req->profile,
2847                 iov_buflen(outhdr, SMBD_SMB2_NUM_IOV_PER_REQ-1));
2848
2849         req->current_idx += SMBD_SMB2_NUM_IOV_PER_REQ;
2850
2851         if (req->current_idx < req->out.vector_count) {
2852                 /*
2853                  * We must process the remaining compound
2854                  * SMB2 requests before any new incoming SMB2
2855                  * requests. This is because incoming SMB2
2856                  * requests may include a cancel for a
2857                  * compound request we haven't processed
2858                  * yet.
2859                  */
2860                 struct tevent_immediate *im = tevent_create_immediate(req);
2861                 if (!im) {
2862                         return NT_STATUS_NO_MEMORY;
2863                 }
2864
2865                 if (req->do_signing && firsttf->iov_len == 0) {
2866                         struct smbXsrv_session *x = req->session;
2867                         DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
2868
2869                         /*
2870                          * we need to remember the signing key
2871                          * and defer the signing until
2872                          * we are sure that we do not change
2873                          * the header again.
2874                          */
2875                         req->last_key = data_blob_dup_talloc(req, signing_key);
2876                         if (req->last_key.data == NULL) {
2877                                 return NT_STATUS_NO_MEMORY;
2878                         }
2879                 }
2880
2881                 tevent_schedule_immediate(im,
2882                                         req->sconn->ev_ctx,
2883                                         smbd_smb2_request_dispatch_immediate,
2884                                         req);
2885                 return NT_STATUS_OK;
2886         }
2887
2888         if (req->compound_related) {
2889                 req->compound_related = false;
2890         }
2891
2892         ok = smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
2893         if (!ok) {
2894                 return NT_STATUS_INVALID_PARAMETER_MIX;
2895         }
2896
2897         /* Set credit for these operations (zero credits if this
2898            is a final reply for an async operation). */
2899         smb2_calculate_credits(req, req);
2900
2901         /*
2902          * now check if we need to sign the current response
2903          */
2904         if (firsttf->iov_len == SMB2_TF_HDR_SIZE) {
2905                 status = smb2_signing_encrypt_pdu(req->first_key,
2906                                         xconn->smb2.server.cipher,
2907                                         firsttf,
2908                                         req->out.vector_count - first_idx);
2909                 if (!NT_STATUS_IS_OK(status)) {
2910                         return status;
2911                 }
2912         } else if (req->do_signing) {
2913                 struct smbXsrv_session *x = req->session;
2914                 DATA_BLOB signing_key = smbd_smb2_signing_key(x, xconn);
2915
2916                 status = smb2_signing_sign_pdu(signing_key,
2917                                                xconn->protocol,
2918                                                outhdr,
2919                                                SMBD_SMB2_NUM_IOV_PER_REQ - 1);
2920                 if (!NT_STATUS_IS_OK(status)) {
2921                         return status;
2922                 }
2923         }
2924         if (req->first_key.length > 0) {
2925                 data_blob_clear_free(&req->first_key);
2926         }
2927
2928         if (req->preauth != NULL) {
2929                 struct hc_sha512state sctx;
2930                 int i;
2931
2932                 samba_SHA512_Init(&sctx);
2933                 samba_SHA512_Update(&sctx, req->preauth->sha512_value,
2934                                     sizeof(req->preauth->sha512_value));
2935                 for (i = 1; i < req->in.vector_count; i++) {
2936                         samba_SHA512_Update(&sctx,
2937                                             req->in.vector[i].iov_base,
2938                                             req->in.vector[i].iov_len);
2939                 }
2940                 samba_SHA512_Final(req->preauth->sha512_value, &sctx);
2941
2942                 samba_SHA512_Init(&sctx);
2943                 samba_SHA512_Update(&sctx, req->preauth->sha512_value,
2944                                     sizeof(req->preauth->sha512_value));
2945                 for (i = 1; i < req->out.vector_count; i++) {
2946                         samba_SHA512_Update(&sctx,
2947                                             req->out.vector[i].iov_base,
2948                                             req->out.vector[i].iov_len);
2949                 }
2950                 samba_SHA512_Final(req->preauth->sha512_value, &sctx);
2951
2952                 req->preauth = NULL;
2953         }
2954
2955         /* I am a sick, sick man... :-). Sendfile hack ... JRA. */
2956         if (req->out.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) &&
2957             outdyn->iov_base == NULL && outdyn->iov_len != 0) {
2958                 /* Dynamic part is NULL. Chop it off,
2959                    We're going to send it via sendfile. */
2960                 req->out.vector_count -= 1;
2961         }
2962
2963         /*
2964          * We're done with this request -
2965          * move it off the "being processed" queue.
2966          */
2967         DLIST_REMOVE(xconn->smb2.requests, req);
2968
2969         req->queue_entry.mem_ctx = req;
2970         req->queue_entry.vector = req->out.vector;
2971         req->queue_entry.count = req->out.vector_count;
2972         DLIST_ADD_END(xconn->smb2.send_queue, &req->queue_entry);
2973         xconn->smb2.send_queue_len++;
2974
2975         status = smbd_smb2_flush_send_queue(xconn);
2976         if (!NT_STATUS_IS_OK(status)) {
2977                 return status;
2978         }
2979
2980         return NT_STATUS_OK;
2981 }
2982
2983 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn);
2984
2985 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
2986                                         struct tevent_immediate *im,
2987                                         void *private_data)
2988 {
2989         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
2990                                         struct smbd_smb2_request);
2991         struct smbXsrv_connection *xconn = req->xconn;
2992         NTSTATUS status;
2993
2994         TALLOC_FREE(im);
2995
2996         if (DEBUGLEVEL >= 10) {
2997                 DEBUG(10,("smbd_smb2_request_dispatch_immediate: idx[%d] of %d vectors\n",
2998                         req->current_idx, req->in.vector_count));
2999                 print_req_vectors(req);
3000         }
3001
3002         status = smbd_smb2_request_dispatch(req);
3003         if (!NT_STATUS_IS_OK(status)) {
3004                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3005                 return;
3006         }
3007
3008         status = smbd_smb2_request_next_incoming(xconn);
3009         if (!NT_STATUS_IS_OK(status)) {
3010                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3011                 return;
3012         }
3013 }
3014
3015 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
3016                                    NTSTATUS status,
3017                                    DATA_BLOB body, DATA_BLOB *dyn,
3018                                    const char *location)
3019 {
3020         uint8_t *outhdr;
3021         struct iovec *outbody_v;
3022         struct iovec *outdyn_v;
3023         uint32_t next_command_ofs;
3024
3025         DEBUG(10,("smbd_smb2_request_done_ex: "
3026                   "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
3027                   req->current_idx, nt_errstr(status), (unsigned int)body.length,
3028                   dyn ? "yes": "no",
3029                   (unsigned int)(dyn ? dyn->length : 0),
3030                   location));
3031
3032         if (body.length < 2) {
3033                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3034         }
3035
3036         if ((body.length % 2) != 0) {
3037                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
3038         }
3039
3040         outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3041         outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
3042         outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
3043
3044         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
3045         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
3046
3047         outbody_v->iov_base = (void *)body.data;
3048         outbody_v->iov_len = body.length;
3049
3050         if (dyn) {
3051                 outdyn_v->iov_base = (void *)dyn->data;
3052                 outdyn_v->iov_len = dyn->length;
3053         } else {
3054                 outdyn_v->iov_base = NULL;
3055                 outdyn_v->iov_len = 0;
3056         }
3057
3058         /*
3059          * See if we need to recalculate the offset to the next response
3060          *
3061          * Note that all responses may require padding (including the very last
3062          * one).
3063          */
3064         if (req->out.vector_count >= (2 * SMBD_SMB2_NUM_IOV_PER_REQ)) {
3065                 next_command_ofs  = SMB2_HDR_BODY;
3066                 next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
3067                 next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
3068         }
3069
3070         if ((next_command_ofs % 8) != 0) {
3071                 size_t pad_size = 8 - (next_command_ofs % 8);
3072                 if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
3073                         /*
3074                          * if the dyn buffer is empty
3075                          * we can use it to add padding
3076                          */
3077                         uint8_t *pad;
3078
3079                         pad = talloc_zero_array(req,
3080                                                 uint8_t, pad_size);
3081                         if (pad == NULL) {
3082                                 return smbd_smb2_request_error(req,
3083                                                 NT_STATUS_NO_MEMORY);
3084                         }
3085
3086                         outdyn_v->iov_base = (void *)pad;
3087                         outdyn_v->iov_len = pad_size;
3088                 } else {
3089                         /*
3090                          * For now we copy the dynamic buffer
3091                          * and add the padding to the new buffer
3092                          */
3093                         size_t old_size;
3094                         uint8_t *old_dyn;
3095                         size_t new_size;
3096                         uint8_t *new_dyn;
3097
3098                         old_size = SMBD_SMB2_OUT_DYN_LEN(req);
3099                         old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
3100
3101                         new_size = old_size + pad_size;
3102                         new_dyn = talloc_zero_array(req,
3103                                                uint8_t, new_size);
3104                         if (new_dyn == NULL) {
3105                                 return smbd_smb2_request_error(req,
3106                                                 NT_STATUS_NO_MEMORY);
3107                         }
3108
3109                         memcpy(new_dyn, old_dyn, old_size);
3110                         memset(new_dyn + old_size, 0, pad_size);
3111
3112                         outdyn_v->iov_base = (void *)new_dyn;
3113                         outdyn_v->iov_len = new_size;
3114                 }
3115                 next_command_ofs += pad_size;
3116         }
3117
3118         if ((req->current_idx + SMBD_SMB2_NUM_IOV_PER_REQ) >= req->out.vector_count) {
3119                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
3120         } else {
3121                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
3122         }
3123         return smbd_smb2_request_reply(req);
3124 }
3125
3126 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
3127                                     NTSTATUS status,
3128                                     DATA_BLOB *info,
3129                                     const char *location)
3130 {
3131         struct smbXsrv_connection *xconn = req->xconn;
3132         DATA_BLOB body;
3133         DATA_BLOB _dyn;
3134         uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
3135         size_t unread_bytes = smbd_smb2_unread_bytes(req);
3136
3137         DBG_NOTICE("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| "
3138                    "at %s\n", req->current_idx, nt_errstr(status),
3139                    info ? " +info" : "", location);
3140
3141         if (unread_bytes) {
3142                 /* Recvfile error. Drain incoming socket. */
3143                 size_t ret;
3144
3145                 errno = 0;
3146                 ret = drain_socket(xconn->transport.sock, unread_bytes);
3147                 if (ret != unread_bytes) {
3148                         NTSTATUS error;
3149
3150                         if (errno == 0) {
3151                                 error = NT_STATUS_IO_DEVICE_ERROR;
3152                         } else {
3153                                 error = map_nt_error_from_unix_common(errno);
3154                         }
3155
3156                         DEBUG(2, ("Failed to drain %u bytes from SMB2 socket: "
3157                                   "ret[%u] errno[%d] => %s\n",
3158                                   (unsigned)unread_bytes,
3159                                   (unsigned)ret, errno, nt_errstr(error)));
3160                         return error;
3161                 }
3162         }
3163
3164         body.data = outhdr + SMB2_HDR_BODY;
3165         body.length = 8;
3166         SSVAL(body.data, 0, 9);
3167
3168         if (info) {
3169                 SIVAL(body.data, 0x04, info->length);
3170         } else {
3171                 /* Allocated size of req->out.vector[i].iov_base
3172                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
3173                  * 1 byte without having to do an alloc.
3174                  */
3175                 info = &_dyn;
3176                 info->data = ((uint8_t *)outhdr) +
3177                         OUTVEC_ALLOC_SIZE - 1;
3178                 info->length = 1;
3179                 SCVAL(info->data, 0, 0);
3180         }
3181
3182         /*
3183          * Note: Even if there is an error, continue to process the request.
3184          * per MS-SMB2.
3185          */
3186
3187         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
3188 }
3189
3190
3191 struct smbd_smb2_send_break_state {
3192         struct smbd_smb2_send_queue queue_entry;
3193         uint8_t nbt_hdr[NBT_HDR_SIZE];
3194         uint8_t tf[SMB2_TF_HDR_SIZE];
3195         uint8_t hdr[SMB2_HDR_BODY];
3196         struct iovec vector[1+SMBD_SMB2_NUM_IOV_PER_REQ];
3197         uint8_t body[1];
3198 };
3199
3200 static NTSTATUS smbd_smb2_send_break(struct smbXsrv_connection *xconn,
3201                                      struct smbXsrv_session *session,
3202                                      struct smbXsrv_tcon *tcon,
3203                                      const uint8_t *body,
3204                                      size_t body_len)
3205 {
3206         struct smbd_smb2_send_break_state *state;
3207         bool do_encryption = false;
3208         uint64_t session_wire_id = 0;
3209         uint64_t nonce_high = 0;
3210         uint64_t nonce_low = 0;
3211         NTSTATUS status;
3212         size_t statelen;
3213         bool ok;
3214
3215         if (session != NULL) {
3216                 session_wire_id = session->global->session_wire_id;
3217                 do_encryption = session->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED;
3218                 if (tcon->global->encryption_flags & SMBXSRV_ENCRYPTION_DESIRED) {
3219                         do_encryption = true;
3220                 }
3221         }
3222
3223         statelen = offsetof(struct smbd_smb2_send_break_state, body) +
3224                 body_len;
3225
3226         state = talloc_zero_size(xconn, statelen);
3227         if (state == NULL) {
3228                 return NT_STATUS_NO_MEMORY;
3229         }
3230         talloc_set_name_const(state, "struct smbd_smb2_send_break_state");
3231
3232         if (do_encryption) {
3233                 status = smb2_get_new_nonce(session,
3234                                             &nonce_high,
3235                                             &nonce_low);
3236                 if (!NT_STATUS_IS_OK(status)) {
3237                         return status;
3238                 }
3239         }
3240
3241         SIVAL(state->tf, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3242         SBVAL(state->tf, SMB2_TF_NONCE+0, nonce_low);
3243         SBVAL(state->tf, SMB2_TF_NONCE+8, nonce_high);
3244         SBVAL(state->tf, SMB2_TF_SESSION_ID, session_wire_id);
3245
3246         SIVAL(state->hdr, 0,                            SMB2_MAGIC);
3247         SSVAL(state->hdr, SMB2_HDR_LENGTH,              SMB2_HDR_BODY);
3248         SSVAL(state->hdr, SMB2_HDR_EPOCH,               0);
3249         SIVAL(state->hdr, SMB2_HDR_STATUS,              0);
3250         SSVAL(state->hdr, SMB2_HDR_OPCODE,              SMB2_OP_BREAK);
3251         SSVAL(state->hdr, SMB2_HDR_CREDIT,              0);
3252         SIVAL(state->hdr, SMB2_HDR_FLAGS,               SMB2_HDR_FLAG_REDIRECT);
3253         SIVAL(state->hdr, SMB2_HDR_NEXT_COMMAND,        0);
3254         SBVAL(state->hdr, SMB2_HDR_MESSAGE_ID,          UINT64_MAX);
3255         SIVAL(state->hdr, SMB2_HDR_PID,         0);
3256         SIVAL(state->hdr, SMB2_HDR_TID,         0);
3257         SBVAL(state->hdr, SMB2_HDR_SESSION_ID,          0);
3258         memset(state->hdr+SMB2_HDR_SIGNATURE, 0, 16);
3259
3260         state->vector[0] = (struct iovec) {
3261                 .iov_base = state->nbt_hdr,
3262                 .iov_len  = sizeof(state->nbt_hdr)
3263         };
3264
3265         if (do_encryption) {
3266                 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
3267                         .iov_base = state->tf,
3268                         .iov_len  = sizeof(state->tf)
3269                 };
3270         } else {
3271                 state->vector[1+SMBD_SMB2_TF_IOV_OFS] = (struct iovec) {
3272                         .iov_base = NULL,
3273                         .iov_len  = 0
3274                 };
3275         }
3276
3277         state->vector[1+SMBD_SMB2_HDR_IOV_OFS] = (struct iovec) {
3278                 .iov_base = state->hdr,
3279                 .iov_len  = sizeof(state->hdr)
3280         };
3281
3282         memcpy(state->body, body, body_len);
3283
3284         state->vector[1+SMBD_SMB2_BODY_IOV_OFS] = (struct iovec) {
3285                 .iov_base = state->body,
3286                 .iov_len  = body_len /* no sizeof(state->body) .. :-) */
3287         };
3288
3289         /*
3290          * state->vector[1+SMBD_SMB2_DYN_IOV_OFS] is NULL by talloc_zero above
3291          */
3292
3293         ok = smb2_setup_nbt_length(state->vector,
3294                                    1 + SMBD_SMB2_NUM_IOV_PER_REQ);
3295         if (!ok) {
3296                 return NT_STATUS_INVALID_PARAMETER_MIX;
3297         }
3298
3299         if (do_encryption) {
3300                 DATA_BLOB encryption_key = session->global->encryption_key;
3301
3302                 status = smb2_signing_encrypt_pdu(encryption_key,
3303                                         xconn->smb2.server.cipher,
3304                                         &state->vector[1+SMBD_SMB2_TF_IOV_OFS],
3305                                         SMBD_SMB2_NUM_IOV_PER_REQ);
3306                 if (!NT_STATUS_IS_OK(status)) {
3307                         return status;
3308                 }
3309         }
3310
3311         state->queue_entry.mem_ctx = state;
3312         state->queue_entry.vector = state->vector;
3313         state->queue_entry.count = ARRAY_SIZE(state->vector);
3314         DLIST_ADD_END(xconn->smb2.send_queue, &state->queue_entry);
3315         xconn->smb2.send_queue_len++;
3316
3317         status = smbd_smb2_flush_send_queue(xconn);
3318         if (!NT_STATUS_IS_OK(status)) {
3319                 return status;
3320         }
3321
3322         return NT_STATUS_OK;
3323 }
3324
3325 NTSTATUS smbd_smb2_send_oplock_break(struct smbXsrv_connection *xconn,
3326                                      struct smbXsrv_session *session,
3327                                      struct smbXsrv_tcon *tcon,
3328                                      struct smbXsrv_open *op,
3329                                      uint8_t oplock_level)
3330 {
3331         uint8_t body[0x18];
3332
3333         SSVAL(body, 0x00, sizeof(body));
3334         SCVAL(body, 0x02, oplock_level);
3335         SCVAL(body, 0x03, 0);           /* reserved */
3336         SIVAL(body, 0x04, 0);           /* reserved */
3337         SBVAL(body, 0x08, op->global->open_persistent_id);
3338         SBVAL(body, 0x10, op->global->open_volatile_id);
3339
3340         return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
3341 }
3342
3343 NTSTATUS smbd_smb2_send_lease_break(struct smbXsrv_connection *xconn,
3344                                     uint16_t new_epoch,
3345                                     uint32_t lease_flags,
3346                                     struct smb2_lease_key *lease_key,
3347                                     uint32_t current_lease_state,
3348                                     uint32_t new_lease_state)
3349 {
3350         uint8_t body[0x2c];
3351
3352         SSVAL(body, 0x00, sizeof(body));
3353         SSVAL(body, 0x02, new_epoch);
3354         SIVAL(body, 0x04, lease_flags);
3355         SBVAL(body, 0x08, lease_key->data[0]);
3356         SBVAL(body, 0x10, lease_key->data[1]);
3357         SIVAL(body, 0x18, current_lease_state);
3358         SIVAL(body, 0x1c, new_lease_state);
3359         SIVAL(body, 0x20, 0);           /* BreakReason, MUST be 0 */
3360         SIVAL(body, 0x24, 0);           /* AccessMaskHint, MUST be 0 */
3361         SIVAL(body, 0x28, 0);           /* ShareMaskHint, MUST be 0 */
3362
3363         return smbd_smb2_send_break(xconn, NULL, NULL, body, sizeof(body));
3364 }
3365
3366 static bool is_smb2_recvfile_write(struct smbd_smb2_request_read_state *state)
3367 {
3368         NTSTATUS status;
3369         uint32_t flags;
3370         uint64_t file_id_persistent;
3371         uint64_t file_id_volatile;
3372         struct smbXsrv_open *op = NULL;
3373         struct files_struct *fsp = NULL;
3374         const uint8_t *body = NULL;
3375
3376         /*
3377          * This is only called with a pktbuf
3378          * of at least SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN
3379          * bytes
3380          */
3381
3382         if (IVAL(state->pktbuf, 0) == SMB2_TF_MAGIC) {
3383                 /* Transform header. Cannot recvfile. */
3384                 return false;
3385         }
3386         if (IVAL(state->pktbuf, 0) != SMB2_MAGIC) {
3387                 /* Not SMB2. Normal error path will cope. */
3388                 return false;
3389         }
3390         if (SVAL(state->pktbuf, 4) != SMB2_HDR_BODY) {
3391                 /* Not SMB2. Normal error path will cope. */
3392                 return false;
3393         }
3394         if (SVAL(state->pktbuf, SMB2_HDR_OPCODE) != SMB2_OP_WRITE) {
3395                 /* Needs to be a WRITE. */
3396                 return false;
3397         }
3398         if (IVAL(state->pktbuf, SMB2_HDR_NEXT_COMMAND) != 0) {
3399                 /* Chained. Cannot recvfile. */
3400                 return false;
3401         }
3402         flags = IVAL(state->pktbuf, SMB2_HDR_FLAGS);
3403         if (flags & SMB2_HDR_FLAG_CHAINED) {
3404                 /* Chained. Cannot recvfile. */
3405                 return false;
3406         }
3407         if (flags & SMB2_HDR_FLAG_SIGNED) {
3408                 /* Signed. Cannot recvfile. */
3409                 return false;
3410         }
3411
3412         body = &state->pktbuf[SMB2_HDR_BODY];
3413
3414         file_id_persistent      = BVAL(body, 0x10);
3415         file_id_volatile        = BVAL(body, 0x18);
3416
3417         status = smb2srv_open_lookup(state->req->xconn,
3418                                      file_id_persistent,
3419                                      file_id_volatile,
3420                                      0, /* now */
3421                                      &op);
3422         if (!NT_STATUS_IS_OK(status)) {
3423                 return false;
3424         }
3425
3426         fsp = op->compat;
3427         if (fsp == NULL) {
3428                 return false;
3429         }
3430         if (fsp->conn == NULL) {
3431                 return false;
3432         }
3433
3434         if (IS_IPC(fsp->conn)) {
3435                 return false;
3436         }
3437         if (IS_PRINT(fsp->conn)) {
3438                 return false;
3439         }
3440
3441         DEBUG(10,("Doing recvfile write len = %u\n",
3442                 (unsigned int)(state->pktfull - state->pktlen)));
3443
3444         return true;
3445 }
3446
3447 static NTSTATUS smbd_smb2_request_next_incoming(struct smbXsrv_connection *xconn)
3448 {
3449         struct smbd_server_connection *sconn = xconn->client->sconn;
3450         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3451         size_t max_send_queue_len;
3452         size_t cur_send_queue_len;
3453
3454         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3455                 /*
3456                  * we're not supposed to do any io
3457                  */
3458                 return NT_STATUS_OK;
3459         }
3460
3461         if (state->req != NULL) {
3462                 /*
3463                  * if there is already a tstream_readv_pdu
3464                  * pending, we are done.
3465                  */
3466                 return NT_STATUS_OK;
3467         }
3468
3469         max_send_queue_len = MAX(1, xconn->smb2.credits.max/16);
3470         cur_send_queue_len = xconn->smb2.send_queue_len;
3471
3472         if (cur_send_queue_len > max_send_queue_len) {
3473                 /*
3474                  * if we have a lot of requests to send,
3475                  * we wait until they are on the wire until we
3476                  * ask for the next request.
3477                  */
3478                 return NT_STATUS_OK;
3479         }
3480
3481         /* ask for the next request */
3482         ZERO_STRUCTP(state);
3483         state->req = smbd_smb2_request_allocate(xconn);
3484         if (state->req == NULL) {
3485                 return NT_STATUS_NO_MEMORY;
3486         }
3487         state->req->sconn = sconn;
3488         state->req->xconn = xconn;
3489         state->min_recv_size = lp_min_receive_file_size();
3490
3491         TEVENT_FD_READABLE(xconn->transport.fde);
3492
3493         return NT_STATUS_OK;
3494 }
3495
3496 void smbd_smb2_process_negprot(struct smbXsrv_connection *xconn,
3497                                uint64_t expected_seq_low,
3498                                const uint8_t *inpdu, size_t size)
3499 {
3500         struct smbd_server_connection *sconn = xconn->client->sconn;
3501         NTSTATUS status;
3502         struct smbd_smb2_request *req = NULL;
3503
3504         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
3505                  (unsigned int)size));
3506
3507         status = smbd_initialize_smb2(xconn, expected_seq_low);
3508         if (!NT_STATUS_IS_OK(status)) {
3509                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3510                 return;
3511         }
3512
3513         status = smbd_smb2_request_create(xconn, inpdu, size, &req);
3514         if (!NT_STATUS_IS_OK(status)) {
3515                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3516                 return;
3517         }
3518
3519         status = smbd_smb2_request_validate(req);
3520         if (!NT_STATUS_IS_OK(status)) {
3521                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3522                 return;
3523         }
3524
3525         status = smbd_smb2_request_setup_out(req);
3526         if (!NT_STATUS_IS_OK(status)) {
3527                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3528                 return;
3529         }
3530
3531 #ifdef WITH_PROFILE
3532         /*
3533          * this was already counted at the SMB1 layer =>
3534          * smbd_smb2_request_dispatch() should not count it twice.
3535          */
3536         if (profile_p->values.request_stats.count > 0) {
3537                 profile_p->values.request_stats.count--;
3538         }
3539 #endif
3540         status = smbd_smb2_request_dispatch(req);
3541         if (!NT_STATUS_IS_OK(status)) {
3542                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3543                 return;
3544         }
3545
3546         status = smbd_smb2_request_next_incoming(xconn);
3547         if (!NT_STATUS_IS_OK(status)) {
3548                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3549                 return;
3550         }
3551
3552         sconn->num_requests++;
3553 }
3554
3555 static int socket_error_from_errno(int ret,
3556                                    int sys_errno,
3557                                    bool *retry)
3558 {
3559         *retry = false;
3560
3561         if (ret >= 0) {
3562                 return 0;
3563         }
3564
3565         if (ret != -1) {
3566                 return EIO;
3567         }
3568
3569         if (sys_errno == 0) {
3570                 return EIO;
3571         }
3572
3573         if (sys_errno == EINTR) {
3574                 *retry = true;
3575                 return sys_errno;
3576         }
3577
3578         if (sys_errno == EINPROGRESS) {
3579                 *retry = true;
3580                 return sys_errno;
3581         }
3582
3583         if (sys_errno == EAGAIN) {
3584                 *retry = true;
3585                 return sys_errno;
3586         }
3587
3588         /* ENOMEM is retryable on Solaris/illumos, and possibly other systems. */
3589         if (sys_errno == ENOMEM) {
3590                 *retry = true;
3591                 return sys_errno;
3592         }
3593
3594 #ifdef EWOULDBLOCK
3595 #if EWOULDBLOCK != EAGAIN
3596         if (sys_errno == EWOULDBLOCK) {
3597                 *retry = true;
3598                 return sys_errno;
3599         }
3600 #endif
3601 #endif
3602
3603         return sys_errno;
3604 }
3605
3606 static NTSTATUS smbd_smb2_flush_send_queue(struct smbXsrv_connection *xconn)
3607 {
3608         int ret;
3609         int err;
3610         bool retry;
3611         NTSTATUS status;
3612
3613         if (xconn->smb2.send_queue == NULL) {
3614                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3615                 return NT_STATUS_OK;
3616         }
3617
3618         while (xconn->smb2.send_queue != NULL) {
3619                 struct smbd_smb2_send_queue *e = xconn->smb2.send_queue;
3620                 bool ok;
3621
3622                 if (e->sendfile_header != NULL) {
3623                         size_t size = 0;
3624                         size_t i = 0;
3625                         uint8_t *buf;
3626
3627                         status = NT_STATUS_INTERNAL_ERROR;
3628
3629                         for (i=0; i < e->count; i++) {
3630                                 size += e->vector[i].iov_len;
3631                         }
3632
3633                         if (size <= e->sendfile_header->length) {
3634                                 buf = e->sendfile_header->data;
3635                         } else {
3636                                 buf = talloc_array(e->mem_ctx, uint8_t, size);
3637                                 if (buf == NULL) {
3638                                         return NT_STATUS_NO_MEMORY;
3639                                 }
3640                         }
3641
3642                         size = 0;
3643                         for (i=0; i < e->count; i++) {
3644                                 memcpy(buf+size,
3645                                        e->vector[i].iov_base,
3646                                        e->vector[i].iov_len);
3647                                 size += e->vector[i].iov_len;
3648                         }
3649
3650                         e->sendfile_header->data = buf;
3651                         e->sendfile_header->length = size;
3652                         e->sendfile_status = &status;
3653                         e->count = 0;
3654
3655                         xconn->smb2.send_queue_len--;
3656                         DLIST_REMOVE(xconn->smb2.send_queue, e);
3657                         /*
3658                          * This triggers the sendfile path via
3659                          * the destructor.
3660                          */
3661                         talloc_free(e->mem_ctx);
3662
3663                         if (!NT_STATUS_IS_OK(status)) {
3664                                 return status;
3665                         }
3666                         continue;
3667                 }
3668
3669                 ret = writev(xconn->transport.sock, e->vector, e->count);
3670                 if (ret == 0) {
3671                         /* propagate end of file */
3672                         return NT_STATUS_INTERNAL_ERROR;
3673                 }
3674                 err = socket_error_from_errno(ret, errno, &retry);
3675                 if (retry) {
3676                         /* retry later */
3677                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
3678                         return NT_STATUS_OK;
3679                 }
3680                 if (err != 0) {
3681                         return map_nt_error_from_unix_common(err);
3682                 }
3683
3684                 ok = iov_advance(&e->vector, &e->count, ret);
3685                 if (!ok) {
3686                         return NT_STATUS_INTERNAL_ERROR;
3687                 }
3688
3689                 if (e->count > 0) {
3690                         /* we have more to write */
3691                         TEVENT_FD_WRITEABLE(xconn->transport.fde);
3692                         return NT_STATUS_OK;
3693                 }
3694
3695                 xconn->smb2.send_queue_len--;
3696                 DLIST_REMOVE(xconn->smb2.send_queue, e);
3697                 talloc_free(e->mem_ctx);
3698         }
3699
3700         /*
3701          * Restart reads if we were blocked on
3702          * draining the send queue.
3703          */
3704
3705         status = smbd_smb2_request_next_incoming(xconn);
3706         if (!NT_STATUS_IS_OK(status)) {
3707                 return status;
3708         }
3709
3710         return NT_STATUS_OK;
3711 }
3712
3713 static NTSTATUS smbd_smb2_io_handler(struct smbXsrv_connection *xconn,
3714                                      uint16_t fde_flags)
3715 {
3716         struct smbd_server_connection *sconn = xconn->client->sconn;
3717         struct smbd_smb2_request_read_state *state = &xconn->smb2.request_read_state;
3718         struct smbd_smb2_request *req = NULL;
3719         size_t min_recvfile_size = UINT32_MAX;
3720         int ret;
3721         int err;
3722         bool retry;
3723         NTSTATUS status;
3724         NTTIME now;
3725
3726         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
3727                 /*
3728                  * we're not supposed to do any io
3729                  */
3730                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3731                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
3732                 return NT_STATUS_OK;
3733         }
3734
3735         if (fde_flags & TEVENT_FD_WRITE) {
3736                 status = smbd_smb2_flush_send_queue(xconn);
3737                 if (!NT_STATUS_IS_OK(status)) {
3738                         return status;
3739                 }
3740         }
3741
3742         if (!(fde_flags & TEVENT_FD_READ)) {
3743                 return NT_STATUS_OK;
3744         }
3745
3746         if (state->req == NULL) {
3747                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
3748                 return NT_STATUS_OK;
3749         }
3750
3751 again:
3752         if (!state->hdr.done) {
3753                 state->hdr.done = true;
3754
3755                 state->vector.iov_base = (void *)state->hdr.nbt;
3756                 state->vector.iov_len = NBT_HDR_SIZE;
3757         }
3758
3759         ret = readv(xconn->transport.sock, &state->vector, 1);
3760         if (ret == 0) {
3761                 /* propagate end of file */
3762                 return NT_STATUS_END_OF_FILE;
3763         }
3764         err = socket_error_from_errno(ret, errno, &retry);
3765         if (retry) {
3766                 /* retry later */
3767                 TEVENT_FD_READABLE(xconn->transport.fde);
3768                 return NT_STATUS_OK;
3769         }
3770         if (err != 0) {
3771                 return map_nt_error_from_unix_common(err);
3772         }
3773
3774         if (ret < state->vector.iov_len) {
3775                 uint8_t *base;
3776                 base = (uint8_t *)state->vector.iov_base;
3777                 base += ret;
3778                 state->vector.iov_base = (void *)base;
3779                 state->vector.iov_len -= ret;
3780                 /* we have more to read */
3781                 TEVENT_FD_READABLE(xconn->transport.fde);
3782                 return NT_STATUS_OK;
3783         }
3784
3785         if (state->pktlen > 0) {
3786                 if (state->doing_receivefile && !is_smb2_recvfile_write(state)) {
3787                         /*
3788                          * Not a possible receivefile write.
3789                          * Read the rest of the data.
3790                          */
3791                         state->doing_receivefile = false;
3792
3793                         state->pktbuf = talloc_realloc(state->req,
3794                                                        state->pktbuf,
3795                                                        uint8_t,
3796                                                        state->pktfull);
3797                         if (state->pktbuf == NULL) {
3798                                 return NT_STATUS_NO_MEMORY;
3799                         }
3800
3801                         state->vector.iov_base = (void *)(state->pktbuf +
3802                                 state->pktlen);
3803                         state->vector.iov_len = (state->pktfull -
3804                                 state->pktlen);
3805
3806                         state->pktlen = state->pktfull;
3807                         goto again;
3808                 }
3809
3810                 /*
3811                  * Either this is a receivefile write so we've
3812                  * done a short read, or if not we have all the data.
3813                  */
3814                 goto got_full;
3815         }
3816
3817         /*
3818          * Now we analyze the NBT header
3819          */
3820         if (state->hdr.nbt[0] != 0x00) {
3821                 state->min_recv_size = 0;
3822         }
3823         state->pktfull = smb2_len(state->hdr.nbt);
3824         if (state->pktfull == 0) {
3825                 goto got_full;
3826         }
3827
3828         if (state->min_recv_size != 0) {
3829                 min_recvfile_size = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3830                 min_recvfile_size += state->min_recv_size;
3831         }
3832
3833         if (state->pktfull > min_recvfile_size) {
3834                 /*
3835                  * Might be a receivefile write. Read the SMB2 HEADER +
3836                  * SMB2_WRITE header first. Set 'doing_receivefile'
3837                  * as we're *attempting* receivefile write. If this
3838                  * turns out not to be a SMB2_WRITE request or otherwise
3839                  * not suitable then we'll just read the rest of the data
3840                  * the next time this function is called.
3841                  */
3842                 state->pktlen = SMBD_SMB2_SHORT_RECEIVEFILE_WRITE_LEN;
3843                 state->doing_receivefile = true;
3844         } else {
3845                 state->pktlen = state->pktfull;
3846         }
3847
3848         state->pktbuf = talloc_array(state->req, uint8_t, state->pktlen);
3849         if (state->pktbuf == NULL) {
3850                 return NT_STATUS_NO_MEMORY;
3851         }
3852
3853         state->vector.iov_base = (void *)state->pktbuf;
3854         state->vector.iov_len = state->pktlen;
3855
3856         goto again;
3857
3858 got_full:
3859
3860         if (state->hdr.nbt[0] != 0x00) {
3861                 DEBUG(1,("ignore NBT[0x%02X] msg\n",
3862                          state->hdr.nbt[0]));
3863
3864                 req = state->req;
3865                 ZERO_STRUCTP(state);
3866                 state->req = req;
3867                 state->min_recv_size = lp_min_receive_file_size();
3868                 req = NULL;
3869                 goto again;
3870         }
3871
3872         req = state->req;
3873         state->req = NULL;
3874
3875         req->request_time = timeval_current();
3876         now = timeval_to_nttime(&req->request_time);
3877
3878         status = smbd_smb2_inbuf_parse_compound(xconn,
3879                                                 now,
3880                                                 state->pktbuf,
3881                                                 state->pktlen,
3882                                                 req,
3883                                                 &req->in.vector,
3884                                                 &req->in.vector_count);
3885         if (!NT_STATUS_IS_OK(status)) {
3886                 return status;
3887         }
3888
3889         if (state->doing_receivefile) {
3890                 req->smb1req = talloc_zero(req, struct smb_request);
3891                 if (req->smb1req == NULL) {
3892                         return NT_STATUS_NO_MEMORY;
3893                 }
3894                 req->smb1req->unread_bytes = state->pktfull - state->pktlen;
3895         }
3896
3897         ZERO_STRUCTP(state);
3898
3899         req->current_idx = 1;
3900
3901         DEBUG(10,("smbd_smb2_request idx[%d] of %d vectors\n",
3902                  req->current_idx, req->in.vector_count));
3903
3904         status = smbd_smb2_request_validate(req);
3905         if (!NT_STATUS_IS_OK(status)) {
3906                 return status;
3907         }
3908
3909         status = smbd_smb2_request_setup_out(req);
3910         if (!NT_STATUS_IS_OK(status)) {
3911                 return status;
3912         }
3913
3914         status = smbd_smb2_request_dispatch(req);
3915         if (!NT_STATUS_IS_OK(status)) {
3916                 return status;
3917         }
3918
3919         sconn->num_requests++;
3920
3921         /* The timeout_processing function isn't run nearly
3922            often enough to implement 'max log size' without
3923            overrunning the size of the file by many megabytes.
3924            This is especially true if we are running at debug
3925            level 10.  Checking every 50 SMB2s is a nice
3926            tradeoff of performance vs log file size overrun. */
3927
3928         if ((sconn->num_requests % 50) == 0 &&
3929             need_to_check_log_size()) {
3930                 change_to_root_user();
3931                 check_log_size();
3932         }
3933
3934         status = smbd_smb2_request_next_incoming(xconn);
3935         if (!NT_STATUS_IS_OK(status)) {
3936                 return status;
3937         }
3938
3939         return NT_STATUS_OK;
3940 }
3941
3942 static void smbd_smb2_connection_handler(struct tevent_context *ev,
3943                                          struct tevent_fd *fde,
3944                                          uint16_t flags,
3945                                          void *private_data)
3946 {
3947         struct smbXsrv_connection *xconn =
3948                 talloc_get_type_abort(private_data,
3949                 struct smbXsrv_connection);
3950         NTSTATUS status;
3951
3952         status = smbd_smb2_io_handler(xconn, flags);
3953         if (!NT_STATUS_IS_OK(status)) {
3954                 smbd_server_connection_terminate(xconn, nt_errstr(status));
3955                 return;
3956         }
3957 }