source3/smbd/smb2_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../libcli/smb/smb_common.h"
  24 #include "../lib/tsocket/tsocket.h"
  25
  26 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
  27
  28 static const char *smb2_names[] = {
  29         "SMB2_NEGPROT",
  30         "SMB2_SESSSETUP",
  31         "SMB2_LOGOFF",
  32         "SMB2_TCON",
  33         "SMB2_TDIS",
  34         "SMB2_CREATE",
  35         "SMB2_CLOSE",
  36         "SMB2_FLUSH",
  37         "SMB2_READ",
  38         "SMB2_WRITE",
  39         "SMB2_LOCK",
  40         "SMB2_IOCTL",
  41         "SMB2_CANCEL",
  42         "SMB2_KEEPALIVE",
  43         "SMB2_FIND",
  44         "SMB2_NOTIFY",
  45         "SMB2_GETINFO",
  46         "SMB2_SETINFO",
  47         "SMB2_BREAK"
  48 };
  49
  50 const char *smb2_opcode_name(uint16_t opcode)
  51 {
  52         if (opcode >= 0x12) {
  53                 return "Bad SMB2 opcode";
  54         }
  55         return smb2_names[opcode];
  56 }
  57
  58 static void print_req_vectors(struct smbd_smb2_request *req)
  59 {
  60         int i;
  61
  62         for (i = 0; i < req->in.vector_count; i++) {
  63                 dbgtext("\treq->in.vector[%u].iov_len = %u\n",
  64                         (unsigned int)i,
  65                         (unsigned int)req->in.vector[i].iov_len);
  66         }
  67         for (i = 0; i < req->out.vector_count; i++) {
  68                 dbgtext("\treq->out.vector[%u].iov_len = %u\n",
  69                         (unsigned int)i,
  70                         (unsigned int)req->out.vector[i].iov_len);
  71         }
  72 }
  73
  74 bool smbd_is_smb2_header(const uint8_t *inbuf, size_t size)
  75 {
  76         if (size < (4 + SMB2_HDR_BODY)) {
  77                 return false;
  78         }
  79
  80         if (IVAL(inbuf, 4) != SMB2_MAGIC) {
  81                 return false;
  82         }
  83
  84         return true;
  85 }
  86
  87 static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
  88 {
  89         NTSTATUS status;
  90         int ret;
  91
  92         TALLOC_FREE(sconn->smb1.fde);
  93
  94         sconn->smb2.event_ctx = smbd_event_context();
  95
  96         sconn->smb2.recv_queue = tevent_queue_create(sconn, "smb2 recv queue");
  97         if (sconn->smb2.recv_queue == NULL) {
  98                 return NT_STATUS_NO_MEMORY;
  99         }
 100
 101         sconn->smb2.send_queue = tevent_queue_create(sconn, "smb2 send queue");
 102         if (sconn->smb2.send_queue == NULL) {
 103                 return NT_STATUS_NO_MEMORY;
 104         }
 105
 106         sconn->smb2.sessions.idtree = idr_init(sconn);
 107         if (sconn->smb2.sessions.idtree == NULL) {
 108                 return NT_STATUS_NO_MEMORY;
 109         }
 110         sconn->smb2.sessions.limit = 0x0000FFFE;
 111         sconn->smb2.sessions.list = NULL;
 112
 113         ret = tstream_bsd_existing_socket(sconn, smbd_server_fd(),
 114                                           &sconn->smb2.stream);
 115         if (ret == -1) {
 116                 status = map_nt_error_from_unix(errno);
 117                 return status;
 118         }
 119
 120         /* Ensure child is set to non-blocking mode */
 121         set_blocking(smbd_server_fd(),false);
 122         return NT_STATUS_OK;
 123 }
 124
 125 #define smb2_len(buf) (PVAL(buf,3)|(PVAL(buf,2)<<8)|(PVAL(buf,1)<<16))
 126 #define _smb2_setlen(_buf,len) do { \
 127         uint8_t *buf = (uint8_t *)_buf; \
 128         buf[0] = 0; \
 129         buf[1] = ((len)&0xFF0000)>>16; \
 130         buf[2] = ((len)&0xFF00)>>8; \
 131         buf[3] = (len)&0xFF; \
 132 } while (0)
 133
 134 static void smb2_setup_nbt_length(struct iovec *vector, int count)
 135 {
 136         size_t len = 0;
 137         int i;
 138
 139         for (i=1; i < count; i++) {
 140                 len += vector[i].iov_len;
 141         }
 142
 143         _smb2_setlen(vector[0].iov_base, len);
 144 }
 145
 146 static int smbd_smb2_request_parent_destructor(struct smbd_smb2_request **req)
 147 {
 148         if (*req) {
 149                 (*req)->parent = NULL;
 150                 (*req)->mem_pool = NULL;
 151         }
 152
 153         return 0;
 154 }
 155
 156 static int smbd_smb2_request_destructor(struct smbd_smb2_request *req)
 157 {
 158         if (req->out.vector) {
 159                 DLIST_REMOVE(req->sconn->smb2.requests, req);
 160         }
 161
 162         if (req->parent) {
 163                 *req->parent = NULL;
 164                 talloc_free(req->mem_pool);
 165         }
 166
 167         return 0;
 168 }
 169
 170 static struct smbd_smb2_request *smbd_smb2_request_allocate(TALLOC_CTX *mem_ctx)
 171 {
 172         TALLOC_CTX *mem_pool;
 173         struct smbd_smb2_request **parent;
 174         struct smbd_smb2_request *req;
 175
 176         mem_pool = talloc_pool(mem_ctx, 8192);
 177         if (mem_pool == NULL) {
 178                 return NULL;
 179         }
 180
 181         parent = talloc(mem_pool, struct smbd_smb2_request *);
 182         if (parent == NULL) {
 183                 talloc_free(mem_pool);
 184                 return NULL;
 185         }
 186
 187         req = talloc_zero(parent, struct smbd_smb2_request);
 188         if (req == NULL) {
 189                 talloc_free(mem_pool);
 190                 return NULL;
 191         }
 192         *parent         = req;
 193         req->mem_pool   = mem_pool;
 194         req->parent     = parent;
 195
 196         talloc_set_destructor(parent, smbd_smb2_request_parent_destructor);
 197         talloc_set_destructor(req, smbd_smb2_request_destructor);
 198
 199         return req;
 200 }
 201
 202 static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
 203                                          const uint8_t *inbuf, size_t size,
 204                                          struct smbd_smb2_request **_req)
 205 {
 206         struct smbd_smb2_request *req;
 207         uint32_t protocol_version;
 208         const uint8_t *inhdr = NULL;
 209         off_t ofs = 0;
 210         uint16_t cmd;
 211         uint32_t next_command_ofs;
 212
 213         if (size < (4 + SMB2_HDR_BODY + 2)) {
 214                 DEBUG(0,("Invalid SMB2 packet length count %ld\n", (long)size));
 215                 return NT_STATUS_INVALID_PARAMETER;
 216         }
 217
 218         inhdr = inbuf + 4;
 219
 220         protocol_version = IVAL(inhdr, SMB2_HDR_PROTOCOL_ID);
 221         if (protocol_version != SMB2_MAGIC) {
 222                 DEBUG(0,("Invalid SMB packet: protocol prefix: 0x%08X\n",
 223                          protocol_version));
 224                 return NT_STATUS_INVALID_PARAMETER;
 225         }
 226
 227         cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
 228         if (cmd != SMB2_OP_NEGPROT) {
 229                 DEBUG(0,("Invalid SMB packet: first request: 0x%04X\n",
 230                          cmd));
 231                 return NT_STATUS_INVALID_PARAMETER;
 232         }
 233
 234         next_command_ofs = IVAL(inhdr, SMB2_HDR_NEXT_COMMAND);
 235         if (next_command_ofs != 0) {
 236                 DEBUG(0,("Invalid SMB packet: next_command: 0x%08X\n",
 237                          next_command_ofs));
 238                 return NT_STATUS_INVALID_PARAMETER;
 239         }
 240
 241         req = smbd_smb2_request_allocate(sconn);
 242         if (req == NULL) {
 243                 return NT_STATUS_NO_MEMORY;
 244         }
 245         req->sconn = sconn;
 246
 247         talloc_steal(req, inbuf);
 248
 249         req->in.vector = talloc_array(req, struct iovec, 4);
 250         if (req->in.vector == NULL) {
 251                 TALLOC_FREE(req);
 252                 return NT_STATUS_NO_MEMORY;
 253         }
 254         req->in.vector_count = 4;
 255
 256         memcpy(req->in.nbt_hdr, inbuf, 4);
 257
 258         ofs = 0;
 259         req->in.vector[0].iov_base      = (void *)req->in.nbt_hdr;
 260         req->in.vector[0].iov_len       = 4;
 261         ofs += req->in.vector[0].iov_len;
 262
 263         req->in.vector[1].iov_base      = (void *)(inbuf + ofs);
 264         req->in.vector[1].iov_len       = SMB2_HDR_BODY;
 265         ofs += req->in.vector[1].iov_len;
 266
 267         req->in.vector[2].iov_base      = (void *)(inbuf + ofs);
 268         req->in.vector[2].iov_len       = SVAL(inbuf, ofs) & 0xFFFE;
 269         ofs += req->in.vector[2].iov_len;
 270
 271         if (ofs > size) {
 272                 return NT_STATUS_INVALID_PARAMETER;
 273         }
 274
 275         req->in.vector[3].iov_base      = (void *)(inbuf + ofs);
 276         req->in.vector[3].iov_len       = size - ofs;
 277         ofs += req->in.vector[3].iov_len;
 278
 279         req->current_idx = 1;
 280
 281         *_req = req;
 282         return NT_STATUS_OK;
 283 }
 284
 285 static NTSTATUS smbd_smb2_request_validate(struct smbd_smb2_request *req,
 286                                 uint16_t *p_creds_requested)
 287 {
 288         int count;
 289         int idx;
 290         bool compound_related = false;
 291
 292         *p_creds_requested = 0;
 293         count = req->in.vector_count;
 294
 295         if (count < 4) {
 296                 /* It's not a SMB2 request */
 297                 return NT_STATUS_INVALID_PARAMETER;
 298         }
 299
 300         for (idx=1; idx < count; idx += 3) {
 301                 uint16_t creds_requested = 0;
 302                 const uint8_t *inhdr = NULL;
 303                 uint32_t flags;
 304
 305                 if (req->in.vector[idx].iov_len != SMB2_HDR_BODY) {
 306                         return NT_STATUS_INVALID_PARAMETER;
 307                 }
 308
 309                 if (req->in.vector[idx+1].iov_len < 2) {
 310                         return NT_STATUS_INVALID_PARAMETER;
 311                 }
 312
 313                 inhdr = (const uint8_t *)req->in.vector[idx].iov_base;
 314
 315                 /* setup the SMB2 header */
 316                 if (IVAL(inhdr, SMB2_HDR_PROTOCOL_ID) != SMB2_MAGIC) {
 317                         return NT_STATUS_INVALID_PARAMETER;
 318                 }
 319
 320                 creds_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
 321                 if (*p_creds_requested + creds_requested < creds_requested) {
 322                         *p_creds_requested = 65535;
 323                 } else {
 324                         *p_creds_requested += creds_requested;
 325                 }
 326
 327                 flags = IVAL(inhdr, SMB2_HDR_FLAGS);
 328                 if (idx == 1) {
 329                         /*
 330                          * the 1st request should never have the
 331                          * SMB2_HDR_FLAG_CHAINED flag set
 332                          */
 333                         if (flags & SMB2_HDR_FLAG_CHAINED) {
 334                                 req->next_status = NT_STATUS_INVALID_PARAMETER;
 335                                 return NT_STATUS_OK;
 336                         }
 337                 } else if (idx == 4) {
 338                         /*
 339                          * the 2nd request triggers related vs. unrelated
 340                          * compounded requests
 341                          */
 342                         if (flags & SMB2_HDR_FLAG_CHAINED) {
 343                                 compound_related = true;
 344                         }
 345                 } else if (idx > 4) {
 346 #if 0
 347                         /*
 348                          * It seems the this tests are wrong
 349                          * see the SMB2-COMPOUND test
 350                          */
 351
 352                         /*
 353                          * all other requests should match the 2nd one
 354                          */
 355                         if (flags & SMB2_HDR_FLAG_CHAINED) {
 356                                 if (!compound_related) {
 357                                         req->next_status =
 358                                                 NT_STATUS_INVALID_PARAMETER;
 359                                         return NT_STATUS_OK;
 360                                 }
 361                         } else {
 362                                 if (compound_related) {
 363                                         req->next_status =
 364                                                 NT_STATUS_INVALID_PARAMETER;
 365                                         return NT_STATUS_OK;
 366                                 }
 367                         }
 368 #endif
 369                 }
 370         }
 371
 372         return NT_STATUS_OK;
 373 }
 374
 375 static NTSTATUS smbd_smb2_request_setup_out(struct smbd_smb2_request *req, uint16_t creds)
 376 {
 377         struct iovec *vector;
 378         int count;
 379         int idx;
 380
 381         count = req->in.vector_count;
 382         vector = talloc_zero_array(req, struct iovec, count);
 383         if (vector == NULL) {
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386
 387         vector[0].iov_base      = req->out.nbt_hdr;
 388         vector[0].iov_len       = 4;
 389         SIVAL(req->out.nbt_hdr, 0, 0);
 390
 391         for (idx=1; idx < count; idx += 3) {
 392                 const uint8_t *inhdr = NULL;
 393                 uint32_t in_flags;
 394                 uint8_t *outhdr = NULL;
 395                 uint8_t *outbody = NULL;
 396                 uint32_t next_command_ofs = 0;
 397                 struct iovec *current = &vector[idx];
 398
 399                 if ((idx + 3) < count) {
 400                         /* we have a next command -
 401                          * setup for the error case. */
 402                         next_command_ofs = SMB2_HDR_BODY + 9;
 403                 }
 404
 405                 inhdr = (const uint8_t *)req->in.vector[idx].iov_base;
 406                 in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
 407
 408                 outhdr = talloc_zero_array(vector, uint8_t,
 409                                       OUTVEC_ALLOC_SIZE);
 410                 if (outhdr == NULL) {
 411                         return NT_STATUS_NO_MEMORY;
 412                 }
 413
 414                 outbody = outhdr + SMB2_HDR_BODY;
 415
 416                 current[0].iov_base     = (void *)outhdr;
 417                 current[0].iov_len      = SMB2_HDR_BODY;
 418
 419                 current[1].iov_base     = (void *)outbody;
 420                 current[1].iov_len      = 8;
 421
 422                 current[2].iov_base     = NULL;
 423                 current[2].iov_len      = 0;
 424
 425                 /* setup the SMB2 header */
 426                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
 427                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
 428                 SSVAL(outhdr, SMB2_HDR_EPOCH,           0);
 429                 SIVAL(outhdr, SMB2_HDR_STATUS,
 430                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
 431                 SSVAL(outhdr, SMB2_HDR_OPCODE,
 432                       SVAL(inhdr, SMB2_HDR_OPCODE));
 433                 SSVAL(outhdr, SMB2_HDR_CREDIT,          creds);
 434                 SIVAL(outhdr, SMB2_HDR_FLAGS,
 435                       IVAL(inhdr, SMB2_HDR_FLAGS) | SMB2_HDR_FLAG_REDIRECT);
 436                 SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND,    next_command_ofs);
 437                 SBVAL(outhdr, SMB2_HDR_MESSAGE_ID,
 438                       BVAL(inhdr, SMB2_HDR_MESSAGE_ID));
 439                 SIVAL(outhdr, SMB2_HDR_PID,
 440                       IVAL(inhdr, SMB2_HDR_PID));
 441                 SIVAL(outhdr, SMB2_HDR_TID,
 442                       IVAL(inhdr, SMB2_HDR_TID));
 443                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
 444                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
 445                 memset(outhdr + SMB2_HDR_SIGNATURE, 0, 16);
 446
 447                 /* setup error body header */
 448                 SSVAL(outbody, 0x00, 0x08 + 1);
 449                 SSVAL(outbody, 0x02, 0);
 450                 SIVAL(outbody, 0x04, 0);
 451         }
 452
 453         req->out.vector = vector;
 454         req->out.vector_count = count;
 455
 456         /* setup the length of the NBT packet */
 457         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
 458
 459         DLIST_ADD_END(req->sconn->smb2.requests, req, struct smbd_smb2_request *);
 460
 461         return NT_STATUS_OK;
 462 }
 463
 464 void smbd_server_connection_terminate_ex(struct smbd_server_connection *sconn,
 465                                          const char *reason,
 466                                          const char *location)
 467 {
 468         DEBUG(10,("smbd_server_connection_terminate_ex: reason[%s] at %s\n",
 469                   reason, location));
 470         exit_server_cleanly(reason);
 471 }
 472
 473 static bool dup_smb2_vec(struct iovec *dstvec,
 474                         const struct iovec *srcvec,
 475                         int offset)
 476 {
 477
 478         if (srcvec[offset].iov_len &&
 479                         srcvec[offset].iov_base) {
 480                 dstvec[offset].iov_base = talloc_memdup(dstvec,
 481                                         srcvec[offset].iov_base,
 482                                         srcvec[offset].iov_len);
 483                 if (!dstvec[offset].iov_base) {
 484                         return false;
 485                 }
 486                 dstvec[offset].iov_len = srcvec[offset].iov_len;
 487         } else {
 488                 dstvec[offset].iov_base = NULL;
 489                 dstvec[offset].iov_len = 0;
 490         }
 491         return true;
 492 }
 493
 494 static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *req)
 495 {
 496         struct smbd_smb2_request *newreq = NULL;
 497         struct iovec *outvec = NULL;
 498         int count = req->out.vector_count;
 499         int i;
 500
 501         newreq = smbd_smb2_request_allocate(req->sconn);
 502         if (!newreq) {
 503                 return NULL;
 504         }
 505
 506         newreq->sconn = req->sconn;
 507         newreq->do_signing = req->do_signing;
 508         newreq->current_idx = req->current_idx;
 509         newreq->async = false;
 510         newreq->cancelled = false;
 511
 512         outvec = talloc_zero_array(newreq, struct iovec, count);
 513         if (!outvec) {
 514                 TALLOC_FREE(newreq);
 515                 return NULL;
 516         }
 517         newreq->out.vector = outvec;
 518         newreq->out.vector_count = count;
 519
 520         /* Setup the outvec's identically to req. */
 521         outvec[0].iov_base = newreq->out.nbt_hdr;
 522         outvec[0].iov_len = 4;
 523         memcpy(newreq->out.nbt_hdr, req->out.nbt_hdr, 4);
 524
 525         for (i = 1; i < count; i += 3) {
 526                 /* i + 0 and i + 1 are always
 527                  * boilerplate. */
 528                 outvec[i].iov_base = talloc_memdup(outvec,
 529                                                 req->out.vector[i].iov_base,
 530                                                 OUTVEC_ALLOC_SIZE);
 531                 if (!outvec[i].iov_base) {
 532                         break;
 533                 }
 534                 outvec[i].iov_len = SMB2_HDR_BODY;
 535
 536                 outvec[i+1].iov_base = ((uint8_t *)outvec[i].iov_base) +
 537                                                 SMB2_HDR_BODY;
 538                 outvec[i+1].iov_len = 8;
 539
 540                 if (req->out.vector[i+2].iov_base ==
 541                                 ((uint8_t *)req->out.vector[i].iov_base) +
 542                                         (OUTVEC_ALLOC_SIZE - 1) &&
 543                                 req->out.vector[i+2].iov_len == 1) {
 544                         /* Common SMB2 error packet case. */
 545                         outvec[i+2].iov_base = ((uint8_t *)outvec[i].iov_base) +
 546                                 (OUTVEC_ALLOC_SIZE - 1);
 547                         outvec[i+2].iov_len = 1;
 548                 } else if (!dup_smb2_vec(outvec,
 549                                 req->out.vector,
 550                                 i)) {
 551                         break;
 552                 }
 553         }
 554
 555         if (i < count) {
 556                 /* Alloc failed. */
 557                 TALLOC_FREE(newreq);
 558                 return NULL;
 559         }
 560
 561         smb2_setup_nbt_length(newreq->out.vector,
 562                 newreq->out.vector_count);
 563
 564         return newreq;
 565 }
 566
 567 static void smbd_smb2_request_writev_done(struct tevent_req *subreq);
 568
 569 static NTSTATUS smb2_send_async_interim_response(const struct smbd_smb2_request *req)
 570 {
 571         int i = 0;
 572         uint8_t *outhdr = NULL;
 573         struct smbd_smb2_request *nreq = NULL;
 574
 575         /* Create a new smb2 request we'll use
 576            for the interim return. */
 577         nreq = dup_smb2_req(req);
 578         if (!nreq) {
 579                 return NT_STATUS_NO_MEMORY;
 580         }
 581
 582         /* Lose the last 3 out vectors. They're the
 583            ones we'll be using for the async reply. */
 584         nreq->out.vector_count -= 3;
 585
 586         smb2_setup_nbt_length(nreq->out.vector,
 587                 nreq->out.vector_count);
 588
 589         /* Step back to the previous reply. */
 590         i = nreq->current_idx - 3;
 591         outhdr = (uint8_t *)nreq->out.vector[i].iov_base;
 592         /* And end the chain. */
 593         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, 0);
 594
 595         /* Re-sign if needed. */
 596         if (nreq->do_signing) {
 597                 NTSTATUS status;
 598                 status = smb2_signing_sign_pdu(nreq->session->session_key,
 599                                         &nreq->out.vector[i], 3);
 600                 if (!NT_STATUS_IS_OK(status)) {
 601                         return status;
 602                 }
 603         }
 604         if (DEBUGLEVEL >= 10) {
 605                 dbgtext("smb2_send_async_interim_response: nreq->current_idx = %u\n",
 606                         (unsigned int)nreq->current_idx );
 607                 dbgtext("smb2_send_async_interim_response: returning %u vectors\n",
 608                         (unsigned int)nreq->out.vector_count );
 609                 print_req_vectors(nreq);
 610         }
 611         nreq->subreq = tstream_writev_queue_send(nreq,
 612                                         nreq->sconn->smb2.event_ctx,
 613                                         nreq->sconn->smb2.stream,
 614                                         nreq->sconn->smb2.send_queue,
 615                                         nreq->out.vector,
 616                                         nreq->out.vector_count);
 617
 618         if (nreq->subreq == NULL) {
 619                 return NT_STATUS_NO_MEMORY;
 620         }
 621
 622         tevent_req_set_callback(nreq->subreq,
 623                         smbd_smb2_request_writev_done,
 624                         nreq);
 625
 626         return NT_STATUS_OK;
 627 }
 628
 629 struct smbd_smb2_request_pending_state {
 630         struct smbd_server_connection *sconn;
 631         uint8_t buf[4 + SMB2_HDR_BODY + 0x08 + 1];
 632         struct iovec vector[3];
 633 };
 634
 635 static void smbd_smb2_request_pending_writev_done(struct tevent_req *subreq)
 636 {
 637         struct smbd_smb2_request_pending_state *state =
 638                 tevent_req_callback_data(subreq,
 639                         struct smbd_smb2_request_pending_state);
 640         struct smbd_server_connection *sconn = state->sconn;
 641         int ret;
 642         int sys_errno;
 643
 644         ret = tstream_writev_queue_recv(subreq, &sys_errno);
 645         TALLOC_FREE(subreq);
 646         if (ret == -1) {
 647                 NTSTATUS status = map_nt_error_from_unix(sys_errno);
 648                 smbd_server_connection_terminate(sconn, nt_errstr(status));
 649                 return;
 650         }
 651
 652         TALLOC_FREE(state);
 653 }
 654
 655 NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
 656                                          struct tevent_req *subreq)
 657 {
 658         NTSTATUS status;
 659         struct smbd_smb2_request_pending_state *state = NULL;
 660         int i = req->current_idx;
 661         uint8_t *reqhdr = NULL;
 662         uint8_t *hdr = NULL;
 663         uint8_t *body = NULL;
 664         uint32_t flags = 0;
 665         uint64_t message_id = 0;
 666         uint64_t async_id = 0;
 667         struct iovec *outvec = NULL;
 668
 669         if (!tevent_req_is_in_progress(subreq)) {
 670                 return NT_STATUS_OK;
 671         }
 672
 673         if (req->async) {
 674                 /* We're already async. */
 675                 return NT_STATUS_OK;
 676         }
 677
 678         if (req->in.vector_count > i + 3) {
 679                 /*
 680                  * We're trying to go async in a compound
 681                  * request chain. This is not allowed.
 682                  * Cancel the outstanding request.
 683                  */
 684                 tevent_req_cancel(subreq);
 685                 return smbd_smb2_request_error(req,
 686                         NT_STATUS_INSUFFICIENT_RESOURCES);
 687         }
 688
 689         req->subreq = subreq;
 690         subreq = NULL;
 691
 692         if (DEBUGLEVEL >= 10) {
 693                 dbgtext("smbd_smb2_request_pending_queue: req->current_idx = %u\n",
 694                         (unsigned int)req->current_idx );
 695                 print_req_vectors(req);
 696         }
 697
 698         if (req->out.vector_count > 4) {
 699                 /* This is a compound reply. We
 700                  * must do an interim response
 701                  * followed by the async response
 702                  * to match W2K8R2.
 703                  */
 704                 status = smb2_send_async_interim_response(req);
 705                 if (!NT_STATUS_IS_OK(status)) {
 706                         return status;
 707                 }
 708         }
 709
 710         reqhdr = (uint8_t *)req->out.vector[i].iov_base;
 711         flags = IVAL(reqhdr, SMB2_HDR_FLAGS);
 712         message_id = BVAL(reqhdr, SMB2_HDR_MESSAGE_ID);
 713         async_id = message_id; /* keep it simple for now... */
 714
 715         /*
 716          * What we send is identical to a smbd_smb2_request_error
 717          * packet with an error status of STATUS_PENDING. Make use
 718          * of this fact sometime when refactoring. JRA.
 719          */
 720
 721         state = talloc_zero(req->sconn, struct smbd_smb2_request_pending_state);
 722         if (state == NULL) {
 723                 return NT_STATUS_NO_MEMORY;
 724         }
 725         state->sconn = req->sconn;
 726
 727         state->vector[0].iov_base = (void *)state->buf;
 728         state->vector[0].iov_len = 4;
 729
 730         state->vector[1].iov_base = state->buf + 4;
 731         state->vector[1].iov_len = SMB2_HDR_BODY;
 732
 733         state->vector[2].iov_base = state->buf + 4 + SMB2_HDR_BODY;
 734         state->vector[2].iov_len = 9;
 735
 736         smb2_setup_nbt_length(state->vector, 3);
 737
 738         hdr = (uint8_t *)state->vector[1].iov_base;
 739         body = (uint8_t *)state->vector[2].iov_base;
 740
 741         SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
 742         SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
 743         SSVAL(hdr, SMB2_HDR_EPOCH, 0);
 744         SIVAL(hdr, SMB2_HDR_STATUS, NT_STATUS_V(STATUS_PENDING));
 745         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(reqhdr, SMB2_HDR_OPCODE));
 746         SSVAL(hdr, SMB2_HDR_CREDIT, 5);
 747         SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
 748         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
 749         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
 750         SBVAL(hdr, SMB2_HDR_PID, async_id);
 751         SBVAL(hdr, SMB2_HDR_SESSION_ID,
 752                 BVAL(reqhdr, SMB2_HDR_SESSION_ID));
 753         memset(hdr+SMB2_HDR_SIGNATURE, 0, 16);
 754
 755         SSVAL(body, 0x00, 0x08 + 1);
 756
 757         SCVAL(body, 0x02, 0);
 758         SCVAL(body, 0x03, 0);
 759         SIVAL(body, 0x04, 0);
 760         /* Match W2K8R2... */
 761         SCVAL(body, 0x08, 0x21);
 762
 763         if (req->do_signing) {
 764                 status = smb2_signing_sign_pdu(req->session->session_key,
 765                                         state->vector, 3);
 766                 if (!NT_STATUS_IS_OK(status)) {
 767                         return status;
 768                 }
 769         }
 770
 771         subreq = tstream_writev_queue_send(state,
 772                                         req->sconn->smb2.event_ctx,
 773                                         req->sconn->smb2.stream,
 774                                         req->sconn->smb2.send_queue,
 775                                         state->vector,
 776                                         3);
 777
 778         if (subreq == NULL) {
 779                 return NT_STATUS_NO_MEMORY;
 780         }
 781
 782         tevent_req_set_callback(subreq,
 783                         smbd_smb2_request_pending_writev_done,
 784                         state);
 785
 786         /* Note we're going async with this request. */
 787         req->async = true;
 788
 789         /*
 790          * Now manipulate req so that the outstanding async request
 791          * is the only one left in the struct smbd_smb2_request.
 792          */
 793
 794         if (req->current_idx == 1) {
 795                 /* There was only one. */
 796                 goto out;
 797         }
 798
 799         /* Re-arrange the in.vectors. */
 800         req->in.vector[1] = req->in.vector[i];
 801         req->in.vector[2] = req->in.vector[i+1];
 802         req->in.vector[3] = req->in.vector[i+2];
 803         req->in.vector_count = 4;
 804         /* Reset the new in size. */
 805         smb2_setup_nbt_length(req->in.vector, 4);
 806
 807         /* Now recreate the out.vectors. */
 808         outvec = talloc_zero_array(req, struct iovec, 4);
 809         if (!outvec) {
 810                 return NT_STATUS_NO_MEMORY;
 811         }
 812         outvec[0].iov_base = req->out.nbt_hdr;
 813         outvec[0].iov_len = 4;
 814         SIVAL(req->out.nbt_hdr, 0, 0);
 815
 816         outvec[1].iov_base = talloc_memdup(outvec,
 817                                 req->out.vector[i].iov_base,
 818                                 OUTVEC_ALLOC_SIZE);
 819         if (!outvec[1].iov_base) {
 820                 return NT_STATUS_NO_MEMORY;
 821         }
 822         outvec[1].iov_len = SMB2_HDR_BODY;
 823
 824         outvec[2].iov_base = ((uint8_t *)outvec[1].iov_base) +
 825                                 SMB2_HDR_BODY;
 826         outvec[2].iov_len = 8;
 827
 828         if (req->out.vector[i+2].iov_base &&
 829                         req->out.vector[i+2].iov_len) {
 830                 if (req->out.vector[i+2].iov_base ==
 831                                 ((uint8_t *)req->out.vector[i].iov_base) +
 832                                         (OUTVEC_ALLOC_SIZE - 1) &&
 833                                 req->out.vector[i].iov_len == 1) {
 834                         /* Common SMB2 error packet case. */
 835                         outvec[3].iov_base = ((uint8_t *)outvec[1].iov_base) +
 836                                 (OUTVEC_ALLOC_SIZE - 1);
 837                 } else {
 838                         outvec[3].iov_base = talloc_memdup(outvec,
 839                                         req->out.vector[i+2].iov_base,
 840                                         req->out.vector[i+2].iov_len);
 841                         if (!outvec[3].iov_base) {
 842                                 return NT_STATUS_NO_MEMORY;
 843                         }
 844                 }
 845                 outvec[3].iov_len = req->out.vector[i+2].iov_len;
 846         } else {
 847                 outvec[3].iov_base = NULL;
 848                 outvec[3].iov_len = 0;
 849         }
 850
 851         TALLOC_FREE(req->out.vector);
 852
 853         req->out.vector = outvec;
 854
 855         req->current_idx = 1;
 856         req->out.vector_count = 4;
 857
 858   out:
 859
 860         smb2_setup_nbt_length(req->out.vector,
 861                 req->out.vector_count);
 862
 863         /* Ensure our final reply matches the interim one. */
 864         reqhdr = (uint8_t *)req->out.vector[1].iov_base;
 865         SIVAL(reqhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
 866         SBVAL(reqhdr, SMB2_HDR_PID, async_id);
 867
 868         {
 869                 const uint8_t *inhdr =
 870                         (const uint8_t *)req->in.vector[1].iov_base;
 871                 DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
 872                         "going async\n",
 873                         smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
 874                         (unsigned long long)async_id ));
 875         }
 876         return NT_STATUS_OK;
 877 }
 878
 879 static NTSTATUS smbd_smb2_request_process_cancel(struct smbd_smb2_request *req)
 880 {
 881         struct smbd_server_connection *sconn = req->sconn;
 882         struct smbd_smb2_request *cur;
 883         const uint8_t *inhdr;
 884         int i = req->current_idx;
 885         uint32_t flags;
 886         uint64_t search_message_id;
 887         uint64_t search_async_id;
 888         uint64_t found_id;
 889
 890         inhdr = (const uint8_t *)req->in.vector[i].iov_base;
 891
 892         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
 893         search_message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 894         search_async_id = BVAL(inhdr, SMB2_HDR_PID);
 895
 896         /*
 897          * we don't need the request anymore
 898          * cancel requests never have a response
 899          */
 900         TALLOC_FREE(req);
 901
 902         for (cur = sconn->smb2.requests; cur; cur = cur->next) {
 903                 const uint8_t *outhdr;
 904                 uint64_t message_id;
 905                 uint64_t async_id;
 906
 907                 i = cur->current_idx;
 908
 909                 outhdr = (const uint8_t *)cur->out.vector[i].iov_base;
 910
 911                 message_id = BVAL(outhdr, SMB2_HDR_MESSAGE_ID);
 912                 async_id = BVAL(outhdr, SMB2_HDR_PID);
 913
 914                 if (flags & SMB2_HDR_FLAG_ASYNC) {
 915                         if (search_async_id == async_id) {
 916                                 found_id = async_id;
 917                                 break;
 918                         }
 919                 } else {
 920                         if (search_message_id == message_id) {
 921                                 found_id = message_id;
 922                                 break;
 923                         }
 924                 }
 925         }
 926
 927         if (cur && cur->subreq) {
 928                 inhdr = (const uint8_t *)cur->in.vector[i].iov_base;
 929                 DEBUG(10,("smbd_smb2_request_process_cancel: attempting to "
 930                         "cancel opcode[%s] mid %llu\n",
 931                         smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
 932                         (unsigned long long)found_id ));
 933                 tevent_req_cancel(cur->subreq);
 934         }
 935
 936         return NT_STATUS_OK;
 937 }
 938
 939 static NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
 940 {
 941         const uint8_t *inhdr;
 942         int i = req->current_idx;
 943         uint16_t opcode;
 944         uint32_t flags;
 945         uint64_t mid;
 946         NTSTATUS status;
 947         NTSTATUS session_status;
 948         uint32_t allowed_flags;
 949
 950         inhdr = (const uint8_t *)req->in.vector[i].iov_base;
 951
 952         /* TODO: verify more things */
 953
 954         flags = IVAL(inhdr, SMB2_HDR_FLAGS);
 955         opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
 956         mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
 957         DEBUG(10,("smbd_smb2_request_dispatch: opcode[%s] mid = %llu\n",
 958                 smb2_opcode_name(opcode),
 959                 (unsigned long long)mid));
 960
 961         allowed_flags = SMB2_HDR_FLAG_CHAINED |
 962                         SMB2_HDR_FLAG_SIGNED |
 963                         SMB2_HDR_FLAG_DFS;
 964         if (opcode == SMB2_OP_CANCEL) {
 965                 allowed_flags |= SMB2_HDR_FLAG_ASYNC;
 966         }
 967         if ((flags & ~allowed_flags) != 0) {
 968                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 969         }
 970
 971         session_status = smbd_smb2_request_check_session(req);
 972
 973         req->do_signing = false;
 974         if (flags & SMB2_HDR_FLAG_SIGNED) {
 975                 if (!NT_STATUS_IS_OK(session_status)) {
 976                         return smbd_smb2_request_error(req, session_status);
 977                 }
 978
 979                 req->do_signing = true;
 980                 status = smb2_signing_check_pdu(req->session->session_key,
 981                                                 &req->in.vector[i], 3);
 982                 if (!NT_STATUS_IS_OK(status)) {
 983                         return smbd_smb2_request_error(req, status);
 984                 }
 985         } else if (req->session && req->session->do_signing) {
 986                 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
 987         }
 988
 989         if (flags & SMB2_HDR_FLAG_CHAINED) {
 990                 /*
 991                  * This check is mostly for giving the correct error code
 992                  * for compounded requests.
 993                  *
 994                  * TODO: we may need to move this after the session
 995                  *       and tcon checks.
 996                  */
 997                 if (!NT_STATUS_IS_OK(req->next_status)) {
 998                         return smbd_smb2_request_error(req, req->next_status);
 999                 }
1000         } else {
1001                 req->compat_chain_fsp = NULL;
1002         }
1003
1004         switch (opcode) {
1005         case SMB2_OP_NEGPROT:
1006                 return smbd_smb2_request_process_negprot(req);
1007
1008         case SMB2_OP_SESSSETUP:
1009                 return smbd_smb2_request_process_sesssetup(req);
1010
1011         case SMB2_OP_LOGOFF:
1012                 if (!NT_STATUS_IS_OK(session_status)) {
1013                         return smbd_smb2_request_error(req, session_status);
1014                 }
1015                 return smbd_smb2_request_process_logoff(req);
1016
1017         case SMB2_OP_TCON:
1018                 if (!NT_STATUS_IS_OK(session_status)) {
1019                         return smbd_smb2_request_error(req, session_status);
1020                 }
1021                 status = smbd_smb2_request_check_session(req);
1022                 if (!NT_STATUS_IS_OK(status)) {
1023                         return smbd_smb2_request_error(req, status);
1024                 }
1025                 return smbd_smb2_request_process_tcon(req);
1026
1027         case SMB2_OP_TDIS:
1028                 if (!NT_STATUS_IS_OK(session_status)) {
1029                         return smbd_smb2_request_error(req, session_status);
1030                 }
1031                 status = smbd_smb2_request_check_tcon(req);
1032                 if (!NT_STATUS_IS_OK(status)) {
1033                         return smbd_smb2_request_error(req, status);
1034                 }
1035                 return smbd_smb2_request_process_tdis(req);
1036
1037         case SMB2_OP_CREATE:
1038                 if (!NT_STATUS_IS_OK(session_status)) {
1039                         return smbd_smb2_request_error(req, session_status);
1040                 }
1041                 status = smbd_smb2_request_check_tcon(req);
1042                 if (!NT_STATUS_IS_OK(status)) {
1043                         return smbd_smb2_request_error(req, status);
1044                 }
1045                 return smbd_smb2_request_process_create(req);
1046
1047         case SMB2_OP_CLOSE:
1048                 if (!NT_STATUS_IS_OK(session_status)) {
1049                         return smbd_smb2_request_error(req, session_status);
1050                 }
1051                 status = smbd_smb2_request_check_tcon(req);
1052                 if (!NT_STATUS_IS_OK(status)) {
1053                         return smbd_smb2_request_error(req, status);
1054                 }
1055                 return smbd_smb2_request_process_close(req);
1056
1057         case SMB2_OP_FLUSH:
1058                 if (!NT_STATUS_IS_OK(session_status)) {
1059                         return smbd_smb2_request_error(req, session_status);
1060                 }
1061                 status = smbd_smb2_request_check_tcon(req);
1062                 if (!NT_STATUS_IS_OK(status)) {
1063                         return smbd_smb2_request_error(req, status);
1064                 }
1065                 return smbd_smb2_request_process_flush(req);
1066
1067         case SMB2_OP_READ:
1068                 if (!NT_STATUS_IS_OK(session_status)) {
1069                         return smbd_smb2_request_error(req, session_status);
1070                 }
1071                 status = smbd_smb2_request_check_tcon(req);
1072                 if (!NT_STATUS_IS_OK(status)) {
1073                         return smbd_smb2_request_error(req, status);
1074                 }
1075                 return smbd_smb2_request_process_read(req);
1076
1077         case SMB2_OP_WRITE:
1078                 if (!NT_STATUS_IS_OK(session_status)) {
1079                         return smbd_smb2_request_error(req, session_status);
1080                 }
1081                 status = smbd_smb2_request_check_tcon(req);
1082                 if (!NT_STATUS_IS_OK(status)) {
1083                         return smbd_smb2_request_error(req, status);
1084                 }
1085                 return smbd_smb2_request_process_write(req);
1086
1087         case SMB2_OP_LOCK:
1088                 if (!NT_STATUS_IS_OK(session_status)) {
1089                         return smbd_smb2_request_error(req, session_status);
1090                 }
1091                 status = smbd_smb2_request_check_tcon(req);
1092                 if (!NT_STATUS_IS_OK(status)) {
1093                         return smbd_smb2_request_error(req, status);
1094                 }
1095                 return smbd_smb2_request_process_lock(req);
1096
1097         case SMB2_OP_IOCTL:
1098                 if (!NT_STATUS_IS_OK(session_status)) {
1099                         return smbd_smb2_request_error(req, session_status);
1100                 }
1101                 status = smbd_smb2_request_check_tcon(req);
1102                 if (!NT_STATUS_IS_OK(status)) {
1103                         return smbd_smb2_request_error(req, status);
1104                 }
1105                 return smbd_smb2_request_process_ioctl(req);
1106
1107         case SMB2_OP_CANCEL:
1108                 return smbd_smb2_request_process_cancel(req);
1109
1110         case SMB2_OP_KEEPALIVE:
1111                 return smbd_smb2_request_process_keepalive(req);
1112
1113         case SMB2_OP_FIND:
1114                 if (!NT_STATUS_IS_OK(session_status)) {
1115                         return smbd_smb2_request_error(req, session_status);
1116                 }
1117                 status = smbd_smb2_request_check_tcon(req);
1118                 if (!NT_STATUS_IS_OK(status)) {
1119                         return smbd_smb2_request_error(req, status);
1120                 }
1121                 return smbd_smb2_request_process_find(req);
1122
1123         case SMB2_OP_NOTIFY:
1124                 if (!NT_STATUS_IS_OK(session_status)) {
1125                         return smbd_smb2_request_error(req, session_status);
1126                 }
1127                 status = smbd_smb2_request_check_tcon(req);
1128                 if (!NT_STATUS_IS_OK(status)) {
1129                         return smbd_smb2_request_error(req, status);
1130                 }
1131                 return smbd_smb2_request_process_notify(req);
1132
1133         case SMB2_OP_GETINFO:
1134                 if (!NT_STATUS_IS_OK(session_status)) {
1135                         return smbd_smb2_request_error(req, session_status);
1136                 }
1137                 status = smbd_smb2_request_check_tcon(req);
1138                 if (!NT_STATUS_IS_OK(status)) {
1139                         return smbd_smb2_request_error(req, status);
1140                 }
1141                 return smbd_smb2_request_process_getinfo(req);
1142
1143         case SMB2_OP_SETINFO:
1144                 if (!NT_STATUS_IS_OK(session_status)) {
1145                         return smbd_smb2_request_error(req, session_status);
1146                 }
1147                 status = smbd_smb2_request_check_tcon(req);
1148                 if (!NT_STATUS_IS_OK(status)) {
1149                         return smbd_smb2_request_error(req, status);
1150                 }
1151                 return smbd_smb2_request_process_setinfo(req);
1152
1153         case SMB2_OP_BREAK:
1154                 if (!NT_STATUS_IS_OK(session_status)) {
1155                         return smbd_smb2_request_error(req, session_status);
1156                 }
1157                 status = smbd_smb2_request_check_tcon(req);
1158                 if (!NT_STATUS_IS_OK(status)) {
1159                         return smbd_smb2_request_error(req, status);
1160                 }
1161                 return smbd_smb2_request_process_break(req);
1162         }
1163
1164         return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
1165 }
1166
1167 static void smbd_smb2_request_dispatch_compound(struct tevent_context *ctx,
1168                                         struct tevent_immediate *im,
1169                                         void *private_data);
1170
1171 static NTSTATUS smbd_smb2_request_reply(struct smbd_smb2_request *req)
1172 {
1173         struct tevent_req *subreq;
1174
1175         req->subreq = NULL;
1176
1177         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
1178
1179         if (req->do_signing) {
1180                 int i = req->current_idx;
1181                 NTSTATUS status;
1182                 status = smb2_signing_sign_pdu(req->session->session_key,
1183                                                &req->out.vector[i], 3);
1184                 if (!NT_STATUS_IS_OK(status)) {
1185                         return status;
1186                 }
1187         }
1188
1189         req->current_idx += 3;
1190
1191         if (req->current_idx < req->out.vector_count) {
1192                 /*
1193                  * We must process the remaining compound
1194                  * SMB2 requests before any new incoming SMB2
1195                  * requests. This is because incoming SMB2
1196                  * requests may include a cancel for a
1197                  * compound request we haven't processed
1198                  * yet.
1199                  */
1200                 struct tevent_immediate *im = tevent_create_immediate(req);
1201                 if (!im) {
1202                         return NT_STATUS_NO_MEMORY;
1203                 }
1204                 tevent_schedule_immediate(im,
1205                                         req->sconn->smb2.event_ctx,
1206                                         smbd_smb2_request_dispatch_compound,
1207                                         req);
1208                 return NT_STATUS_OK;
1209         }
1210
1211         if (DEBUGLEVEL >= 10) {
1212                 dbgtext("smbd_smb2_request_reply: sending...\n");
1213                 print_req_vectors(req);
1214         }
1215
1216         subreq = tstream_writev_queue_send(req,
1217                                            req->sconn->smb2.event_ctx,
1218                                            req->sconn->smb2.stream,
1219                                            req->sconn->smb2.send_queue,
1220                                            req->out.vector,
1221                                            req->out.vector_count);
1222         if (subreq == NULL) {
1223                 return NT_STATUS_NO_MEMORY;
1224         }
1225         tevent_req_set_callback(subreq, smbd_smb2_request_writev_done, req);
1226
1227         return NT_STATUS_OK;
1228 }
1229
1230 static void smbd_smb2_request_dispatch_compound(struct tevent_context *ctx,
1231                                         struct tevent_immediate *im,
1232                                         void *private_data)
1233 {
1234         struct smbd_smb2_request *req = talloc_get_type_abort(private_data,
1235                                         struct smbd_smb2_request);
1236         struct smbd_server_connection *sconn = req->sconn;
1237         NTSTATUS status;
1238
1239         TALLOC_FREE(im);
1240
1241         if (DEBUGLEVEL >= 10) {
1242                 DEBUG(10,("smbd_smb2_request_dispatch_compound: idx[%d] of %d vectors\n",
1243                         req->current_idx, req->in.vector_count));
1244                 print_req_vectors(req);
1245         }
1246
1247         status = smbd_smb2_request_dispatch(req);
1248         if (!NT_STATUS_IS_OK(status)) {
1249                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1250                 return;
1251         }
1252 }
1253
1254 static void smbd_smb2_request_writev_done(struct tevent_req *subreq)
1255 {
1256         struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
1257                                         struct smbd_smb2_request);
1258         struct smbd_server_connection *sconn = req->sconn;
1259         int ret;
1260         int sys_errno;
1261
1262         ret = tstream_writev_queue_recv(subreq, &sys_errno);
1263         TALLOC_FREE(subreq);
1264         TALLOC_FREE(req);
1265         if (ret == -1) {
1266                 NTSTATUS status = map_nt_error_from_unix(sys_errno);
1267                 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
1268                         nt_errstr(status)));
1269                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1270                 return;
1271         }
1272 }
1273
1274 NTSTATUS smbd_smb2_request_done_ex(struct smbd_smb2_request *req,
1275                                    NTSTATUS status,
1276                                    DATA_BLOB body, DATA_BLOB *dyn,
1277                                    const char *location)
1278 {
1279         uint8_t *outhdr;
1280         int i = req->current_idx;
1281         uint32_t next_command_ofs;
1282
1283         DEBUG(10,("smbd_smb2_request_done_ex: "
1284                   "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
1285                   i, nt_errstr(status), (unsigned int)body.length,
1286                   dyn ? "yes": "no",
1287                   (unsigned int)(dyn ? dyn->length : 0),
1288                   location));
1289
1290         if (body.length < 2) {
1291                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
1292         }
1293
1294         if ((body.length % 2) != 0) {
1295                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
1296         }
1297
1298         outhdr = (uint8_t *)req->out.vector[i].iov_base;
1299
1300         next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
1301         SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
1302
1303         req->out.vector[i+1].iov_base = (void *)body.data;
1304         req->out.vector[i+1].iov_len = body.length;
1305
1306         if (dyn) {
1307                 req->out.vector[i+2].iov_base   = (void *)dyn->data;
1308                 req->out.vector[i+2].iov_len    = dyn->length;
1309         } else {
1310                 req->out.vector[i+2].iov_base = NULL;
1311                 req->out.vector[i+2].iov_len = 0;
1312         }
1313
1314         /* see if we need to recalculate the offset to the next response */
1315         if (next_command_ofs > 0) {
1316                 next_command_ofs  = SMB2_HDR_BODY;
1317                 next_command_ofs += req->out.vector[i+1].iov_len;
1318                 next_command_ofs += req->out.vector[i+2].iov_len;
1319         }
1320
1321         if ((next_command_ofs % 8) != 0) {
1322                 size_t pad_size = 8 - (next_command_ofs % 8);
1323                 if (req->out.vector[i+2].iov_len == 0) {
1324                         /*
1325                          * if the dyn buffer is empty
1326                          * we can use it to add padding
1327                          */
1328                         uint8_t *pad;
1329
1330                         pad = talloc_zero_array(req->out.vector,
1331                                                 uint8_t, pad_size);
1332                         if (pad == NULL) {
1333                                 return smbd_smb2_request_error(req,
1334                                                 NT_STATUS_NO_MEMORY);
1335                         }
1336
1337                         req->out.vector[i+2].iov_base = (void *)pad;
1338                         req->out.vector[i+2].iov_len = pad_size;
1339                 } else {
1340                         /*
1341                          * For now we copy the dynamic buffer
1342                          * and add the padding to the new buffer
1343                          */
1344                         size_t old_size;
1345                         uint8_t *old_dyn;
1346                         size_t new_size;
1347                         uint8_t *new_dyn;
1348
1349                         old_size = req->out.vector[i+2].iov_len;
1350                         old_dyn = (uint8_t *)req->out.vector[i+2].iov_base;
1351
1352                         new_size = old_size + pad_size;
1353                         new_dyn = talloc_zero_array(req->out.vector,
1354                                                uint8_t, new_size);
1355                         if (new_dyn == NULL) {
1356                                 return smbd_smb2_request_error(req,
1357                                                 NT_STATUS_NO_MEMORY);
1358                         }
1359
1360                         memcpy(new_dyn, old_dyn, old_size);
1361                         memset(new_dyn + old_size, 0, pad_size);
1362
1363                         req->out.vector[i+2].iov_base = (void *)new_dyn;
1364                         req->out.vector[i+2].iov_len = new_size;
1365                 }
1366                 next_command_ofs += pad_size;
1367         }
1368
1369         SIVAL(outhdr, SMB2_HDR_NEXT_COMMAND, next_command_ofs);
1370
1371         return smbd_smb2_request_reply(req);
1372 }
1373
1374 NTSTATUS smbd_smb2_request_error_ex(struct smbd_smb2_request *req,
1375                                     NTSTATUS status,
1376                                     DATA_BLOB *info,
1377                                     const char *location)
1378 {
1379         DATA_BLOB body;
1380         int i = req->current_idx;
1381         uint8_t *outhdr = (uint8_t *)req->out.vector[i].iov_base;
1382
1383         DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
1384                   i, nt_errstr(status), info ? " +info" : "",
1385                   location));
1386
1387         body.data = outhdr + SMB2_HDR_BODY;
1388         body.length = 8;
1389         SSVAL(body.data, 0, 9);
1390
1391         if (info) {
1392                 SIVAL(body.data, 0x04, info->length);
1393         } else {
1394                 /* Allocated size of req->out.vector[i].iov_base
1395                  * *MUST BE* OUTVEC_ALLOC_SIZE. So we have room for
1396                  * 1 byte without having to do an alloc.
1397                  */
1398                 info = talloc_zero_array(req->out.vector,
1399                                         DATA_BLOB,
1400                                         1);
1401                 if (!info) {
1402                         return NT_STATUS_NO_MEMORY;
1403                 }
1404                 info->data = ((uint8_t *)outhdr) +
1405                         OUTVEC_ALLOC_SIZE - 1;
1406                 info->length = 1;
1407                 SCVAL(info->data, 0, 0);
1408         }
1409
1410         /*
1411          * if a request fails, all other remaining
1412          * compounded requests should fail too
1413          */
1414         req->next_status = NT_STATUS_INVALID_PARAMETER;
1415
1416         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
1417 }
1418
1419
1420 struct smbd_smb2_send_oplock_break_state {
1421         struct smbd_server_connection *sconn;
1422         uint8_t buf[4 + SMB2_HDR_BODY + 0x18];
1423         struct iovec vector;
1424 };
1425
1426 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq);
1427
1428 NTSTATUS smbd_smb2_send_oplock_break(struct smbd_server_connection *sconn,
1429                                      uint64_t file_id_persistent,
1430                                      uint64_t file_id_volatile,
1431                                      uint8_t oplock_level)
1432 {
1433         struct smbd_smb2_send_oplock_break_state *state;
1434         struct tevent_req *subreq;
1435         uint8_t *hdr;
1436         uint8_t *body;
1437
1438         state = talloc(sconn, struct smbd_smb2_send_oplock_break_state);
1439         if (state == NULL) {
1440                 return NT_STATUS_NO_MEMORY;
1441         }
1442         state->sconn = sconn;
1443
1444         state->vector.iov_base = (void *)state->buf;
1445         state->vector.iov_len = sizeof(state->buf);
1446
1447         _smb2_setlen(state->buf, sizeof(state->buf) - 4);
1448         hdr = state->buf + 4;
1449         body = hdr + SMB2_HDR_BODY;
1450
1451         SIVAL(hdr, 0,                           SMB2_MAGIC);
1452         SSVAL(hdr, SMB2_HDR_LENGTH,             SMB2_HDR_BODY);
1453         SSVAL(hdr, SMB2_HDR_EPOCH,              0);
1454         SIVAL(hdr, SMB2_HDR_STATUS,             0);
1455         SSVAL(hdr, SMB2_HDR_OPCODE,             SMB2_OP_BREAK);
1456         SSVAL(hdr, SMB2_HDR_CREDIT,             0);
1457         SIVAL(hdr, SMB2_HDR_FLAGS,              SMB2_HDR_FLAG_REDIRECT);
1458         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND,       0);
1459         SBVAL(hdr, SMB2_HDR_MESSAGE_ID,         UINT64_MAX);
1460         SIVAL(hdr, SMB2_HDR_PID,                0);
1461         SIVAL(hdr, SMB2_HDR_TID,                0);
1462         SBVAL(hdr, SMB2_HDR_SESSION_ID,         0);
1463         memset(hdr+SMB2_HDR_SIGNATURE, 0, 16);
1464
1465         SSVAL(body, 0x00, 0x18);
1466
1467         SCVAL(body, 0x02, oplock_level);
1468         SCVAL(body, 0x03, 0);           /* reserved */
1469         SIVAL(body, 0x04, 0);           /* reserved */
1470         SBVAL(body, 0x08, file_id_persistent);
1471         SBVAL(body, 0x10, file_id_volatile);
1472
1473         subreq = tstream_writev_queue_send(state,
1474                                            sconn->smb2.event_ctx,
1475                                            sconn->smb2.stream,
1476                                            sconn->smb2.send_queue,
1477                                            &state->vector, 1);
1478         if (subreq == NULL) {
1479                 return NT_STATUS_NO_MEMORY;
1480         }
1481         tevent_req_set_callback(subreq,
1482                                 smbd_smb2_oplock_break_writev_done,
1483                                 state);
1484
1485         return NT_STATUS_OK;
1486 }
1487
1488 static void smbd_smb2_oplock_break_writev_done(struct tevent_req *subreq)
1489 {
1490         struct smbd_smb2_send_oplock_break_state *state =
1491                 tevent_req_callback_data(subreq,
1492                 struct smbd_smb2_send_oplock_break_state);
1493         struct smbd_server_connection *sconn = state->sconn;
1494         int ret;
1495         int sys_errno;
1496
1497         ret = tstream_writev_queue_recv(subreq, &sys_errno);
1498         TALLOC_FREE(subreq);
1499         if (ret == -1) {
1500                 NTSTATUS status = map_nt_error_from_unix(sys_errno);
1501                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1502                 return;
1503         }
1504
1505         TALLOC_FREE(state);
1506 }
1507
1508 struct smbd_smb2_request_read_state {
1509         size_t missing;
1510         bool asked_for_header;
1511         struct smbd_smb2_request *smb2_req;
1512 };
1513
1514 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
1515                                          void *private_data,
1516                                          TALLOC_CTX *mem_ctx,
1517                                          struct iovec **_vector,
1518                                          size_t *_count);
1519 static void smbd_smb2_request_read_done(struct tevent_req *subreq);
1520
1521 static struct tevent_req *smbd_smb2_request_read_send(TALLOC_CTX *mem_ctx,
1522                                         struct tevent_context *ev,
1523                                         struct smbd_server_connection *sconn)
1524 {
1525         struct tevent_req *req;
1526         struct smbd_smb2_request_read_state *state;
1527         struct tevent_req *subreq;
1528
1529         req = tevent_req_create(mem_ctx, &state,
1530                                 struct smbd_smb2_request_read_state);
1531         if (req == NULL) {
1532                 return NULL;
1533         }
1534         state->missing = 0;
1535         state->asked_for_header = false;
1536
1537         state->smb2_req = smbd_smb2_request_allocate(state);
1538         if (tevent_req_nomem(state->smb2_req, req)) {
1539                 return tevent_req_post(req, ev);
1540         }
1541         state->smb2_req->sconn = sconn;
1542
1543         subreq = tstream_readv_pdu_queue_send(state, ev, sconn->smb2.stream,
1544                                               sconn->smb2.recv_queue,
1545                                               smbd_smb2_request_next_vector,
1546                                               state);
1547         if (tevent_req_nomem(subreq, req)) {
1548                 return tevent_req_post(req, ev);
1549         }
1550         tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
1551
1552         return req;
1553 }
1554
1555 static int smbd_smb2_request_next_vector(struct tstream_context *stream,
1556                                          void *private_data,
1557                                          TALLOC_CTX *mem_ctx,
1558                                          struct iovec **_vector,
1559                                          size_t *_count)
1560 {
1561         struct smbd_smb2_request_read_state *state =
1562                 talloc_get_type_abort(private_data,
1563                 struct smbd_smb2_request_read_state);
1564         struct smbd_smb2_request *req = state->smb2_req;
1565         struct iovec *vector;
1566         int idx = req->in.vector_count;
1567         size_t len = 0;
1568         uint8_t *buf = NULL;
1569
1570         if (req->in.vector_count == 0) {
1571                 /*
1572                  * first we need to get the NBT header
1573                  */
1574                 req->in.vector = talloc_array(req, struct iovec,
1575                                               req->in.vector_count + 1);
1576                 if (req->in.vector == NULL) {
1577                         return -1;
1578                 }
1579                 req->in.vector_count += 1;
1580
1581                 req->in.vector[idx].iov_base    = (void *)req->in.nbt_hdr;
1582                 req->in.vector[idx].iov_len     = 4;
1583
1584                 vector = talloc_array(mem_ctx, struct iovec, 1);
1585                 if (vector == NULL) {
1586                         return -1;
1587                 }
1588
1589                 vector[0] = req->in.vector[idx];
1590
1591                 *_vector = vector;
1592                 *_count = 1;
1593                 return 0;
1594         }
1595
1596         if (req->in.vector_count == 1) {
1597                 /*
1598                  * Now we analyze the NBT header
1599                  */
1600                 state->missing = smb2_len(req->in.vector[0].iov_base);
1601
1602                 if (state->missing == 0) {
1603                         /* if there're no remaining bytes, we're done */
1604                         *_vector = NULL;
1605                         *_count = 0;
1606                         return 0;
1607                 }
1608
1609                 req->in.vector = talloc_realloc(req, req->in.vector,
1610                                                 struct iovec,
1611                                                 req->in.vector_count + 1);
1612                 if (req->in.vector == NULL) {
1613                         return -1;
1614                 }
1615                 req->in.vector_count += 1;
1616
1617                 if (CVAL(req->in.vector[0].iov_base, 0) != 0) {
1618                         /*
1619                          * it's a special NBT message,
1620                          * so get all remaining bytes
1621                          */
1622                         len = state->missing;
1623                 } else if (state->missing < (SMB2_HDR_BODY + 2)) {
1624                         /*
1625                          * it's an invalid message, just read what we can get
1626                          * and let the caller handle the error
1627                          */
1628                         len = state->missing;
1629                 } else {
1630                         /*
1631                          * We assume it's a SMB2 request,
1632                          * and we first get the header and the
1633                          * first 2 bytes (the struct size) of the body
1634                          */
1635                         len = SMB2_HDR_BODY + 2;
1636
1637                         state->asked_for_header = true;
1638                 }
1639
1640                 state->missing -= len;
1641
1642                 buf = talloc_array(req->in.vector, uint8_t, len);
1643                 if (buf == NULL) {
1644                         return -1;
1645                 }
1646
1647                 req->in.vector[idx].iov_base    = (void *)buf;
1648                 req->in.vector[idx].iov_len     = len;
1649
1650                 vector = talloc_array(mem_ctx, struct iovec, 1);
1651                 if (vector == NULL) {
1652                         return -1;
1653                 }
1654
1655                 vector[0] = req->in.vector[idx];
1656
1657                 *_vector = vector;
1658                 *_count = 1;
1659                 return 0;
1660         }
1661
1662         if (state->missing == 0) {
1663                 /* if there're no remaining bytes, we're done */
1664                 *_vector = NULL;
1665                 *_count = 0;
1666                 return 0;
1667         }
1668
1669         if (state->asked_for_header) {
1670                 const uint8_t *hdr;
1671                 size_t full_size;
1672                 size_t next_command_ofs;
1673                 size_t body_size;
1674                 uint8_t *body;
1675                 size_t dyn_size;
1676                 uint8_t *dyn;
1677                 bool invalid = false;
1678
1679                 state->asked_for_header = false;
1680
1681                 /*
1682                  * We got the SMB2 header and the first 2 bytes
1683                  * of the body. We fix the size to just the header
1684                  * and manually copy the 2 first bytes to the body section
1685                  */
1686                 req->in.vector[idx-1].iov_len = SMB2_HDR_BODY;
1687                 hdr = (const uint8_t *)req->in.vector[idx-1].iov_base;
1688
1689                 /* allocate vectors for body and dynamic areas */
1690                 req->in.vector = talloc_realloc(req, req->in.vector,
1691                                                 struct iovec,
1692                                                 req->in.vector_count + 2);
1693                 if (req->in.vector == NULL) {
1694                         return -1;
1695                 }
1696                 req->in.vector_count += 2;
1697
1698                 full_size = state->missing + SMB2_HDR_BODY + 2;
1699                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
1700                 body_size = SVAL(hdr, SMB2_HDR_BODY);
1701
1702                 if (next_command_ofs != 0) {
1703                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
1704                                 /*
1705                                  * this is invalid, just return a zero
1706                                  * body and let the caller deal with the error
1707                                  */
1708                                 invalid = true;
1709                         } else if (next_command_ofs > full_size) {
1710                                 /*
1711                                  * this is invalid, just return a zero
1712                                  * body and let the caller deal with the error
1713                                  */
1714                                 invalid = true;
1715                         } else {
1716                                 full_size = next_command_ofs;
1717                         }
1718                 }
1719
1720                 if (!invalid) {
1721                         if (body_size < 2) {
1722                                 /*
1723                                  * this is invalid, just return a zero
1724                                  * body and let the caller deal with the error
1725                                  */
1726                                 invalid = true;
1727                         }
1728
1729                         if ((body_size % 2) != 0) {
1730                                 body_size -= 1;
1731                         }
1732
1733                         if (body_size > (full_size - SMB2_HDR_BODY)) {
1734                                 /*
1735                                  * this is invalid, just return a zero
1736                                  * body and let the caller deal with the error
1737                                  */
1738                                 invalid = true;
1739                         }
1740                 }
1741
1742                 if (invalid) {
1743                         /* the caller should check this */
1744                         body_size = 2;
1745                 }
1746
1747                 dyn_size = full_size - (SMB2_HDR_BODY + body_size);
1748
1749                 state->missing -= (body_size - 2) + dyn_size;
1750
1751                 body = talloc_array(req->in.vector, uint8_t, body_size);
1752                 if (body == NULL) {
1753                         return -1;
1754                 }
1755
1756                 dyn = talloc_array(req->in.vector, uint8_t, dyn_size);
1757                 if (dyn == NULL) {
1758                         return -1;
1759                 }
1760
1761                 req->in.vector[idx].iov_base    = (void *)body;
1762                 req->in.vector[idx].iov_len     = body_size;
1763                 req->in.vector[idx+1].iov_base  = (void *)dyn;
1764                 req->in.vector[idx+1].iov_len   = dyn_size;
1765
1766                 vector = talloc_array(mem_ctx, struct iovec, 2);
1767                 if (vector == NULL) {
1768                         return -1;
1769                 }
1770
1771                 /*
1772                  * the first 2 bytes of the body were already fetched
1773                  * together with the header
1774                  */
1775                 memcpy(body, hdr + SMB2_HDR_BODY, 2);
1776                 vector[0].iov_base = body + 2;
1777                 vector[0].iov_len = body_size - 2;
1778
1779                 vector[1] = req->in.vector[idx+1];
1780
1781                 *_vector = vector;
1782                 *_count = 2;
1783                 return 0;
1784         }
1785
1786         /*
1787          * when we endup here, we're looking for a new SMB2 request
1788          * next. And we ask for its header and the first 2 bytes of
1789          * the body (like we did for the first SMB2 request).
1790          */
1791
1792         req->in.vector = talloc_realloc(req, req->in.vector,
1793                                         struct iovec,
1794                                         req->in.vector_count + 1);
1795         if (req->in.vector == NULL) {
1796                 return -1;
1797         }
1798         req->in.vector_count += 1;
1799
1800         /*
1801          * We assume it's a SMB2 request,
1802          * and we first get the header and the
1803          * first 2 bytes (the struct size) of the body
1804          */
1805         len = SMB2_HDR_BODY + 2;
1806
1807         if (len > state->missing) {
1808                 /* let the caller handle the error */
1809                 len = state->missing;
1810         }
1811
1812         state->missing -= len;
1813         state->asked_for_header = true;
1814
1815         buf = talloc_array(req->in.vector, uint8_t, len);
1816         if (buf == NULL) {
1817                 return -1;
1818         }
1819
1820         req->in.vector[idx].iov_base    = (void *)buf;
1821         req->in.vector[idx].iov_len     = len;
1822
1823         vector = talloc_array(mem_ctx, struct iovec, 1);
1824         if (vector == NULL) {
1825                 return -1;
1826         }
1827
1828         vector[0] = req->in.vector[idx];
1829
1830         *_vector = vector;
1831         *_count = 1;
1832         return 0;
1833 }
1834
1835 static void smbd_smb2_request_read_done(struct tevent_req *subreq)
1836 {
1837         struct tevent_req *req =
1838                 tevent_req_callback_data(subreq,
1839                 struct tevent_req);
1840         int ret;
1841         int sys_errno;
1842         NTSTATUS status;
1843
1844         ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
1845         if (ret == -1) {
1846                 status = map_nt_error_from_unix(sys_errno);
1847                 tevent_req_nterror(req, status);
1848                 return;
1849         }
1850
1851         tevent_req_done(req);
1852 }
1853
1854 static NTSTATUS smbd_smb2_request_read_recv(struct tevent_req *req,
1855                                             TALLOC_CTX *mem_ctx,
1856                                             struct smbd_smb2_request **_smb2_req)
1857 {
1858         struct smbd_smb2_request_read_state *state =
1859                 tevent_req_data(req,
1860                 struct smbd_smb2_request_read_state);
1861         NTSTATUS status;
1862
1863         if (tevent_req_is_nterror(req, &status)) {
1864                 tevent_req_received(req);
1865                 return status;
1866         }
1867
1868         talloc_steal(mem_ctx, state->smb2_req->mem_pool);
1869         *_smb2_req = state->smb2_req;
1870         tevent_req_received(req);
1871         return NT_STATUS_OK;
1872 }
1873
1874 static void smbd_smb2_request_incoming(struct tevent_req *subreq);
1875
1876 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
1877                              const uint8_t *inbuf, size_t size)
1878 {
1879         NTSTATUS status;
1880         struct smbd_smb2_request *req;
1881         struct tevent_req *subreq;
1882
1883         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
1884                  (unsigned int)size));
1885
1886         status = smbd_initialize_smb2(sconn);
1887         if (!NT_STATUS_IS_OK(status)) {
1888                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1889                 return;
1890         }
1891
1892         status = smbd_smb2_request_create(sconn, inbuf, size, &req);
1893         if (!NT_STATUS_IS_OK(status)) {
1894                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1895                 return;
1896         }
1897
1898         status = smbd_smb2_request_setup_out(req, (uint16_t)lp_maxmux());
1899         if (!NT_STATUS_IS_OK(status)) {
1900                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1901                 return;
1902         }
1903
1904         status = smbd_smb2_request_dispatch(req);
1905         if (!NT_STATUS_IS_OK(status)) {
1906                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1907                 return;
1908         }
1909
1910         /* ask for the next request */
1911         subreq = smbd_smb2_request_read_send(sconn, sconn->smb2.event_ctx, sconn);
1912         if (subreq == NULL) {
1913                 smbd_server_connection_terminate(sconn, "no memory for reading");
1914                 return;
1915         }
1916         tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
1917 }
1918
1919 static void smbd_smb2_request_incoming(struct tevent_req *subreq)
1920 {
1921         uint16_t creds_requested = 0;
1922         struct smbd_server_connection *sconn = tevent_req_callback_data(subreq,
1923                                                struct smbd_server_connection);
1924         NTSTATUS status;
1925         struct smbd_smb2_request *req = NULL;
1926
1927         status = smbd_smb2_request_read_recv(subreq, sconn, &req);
1928         TALLOC_FREE(subreq);
1929         if (!NT_STATUS_IS_OK(status)) {
1930                 DEBUG(2,("smbd_smb2_request_incoming: client read error %s\n",
1931                         nt_errstr(status)));
1932                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1933                 return;
1934         }
1935
1936         if (req->in.nbt_hdr[0] != 0x00) {
1937                 DEBUG(1,("smbd_smb2_request_incoming: ignore NBT[0x%02X] msg\n",
1938                          req->in.nbt_hdr[0]));
1939                 TALLOC_FREE(req);
1940                 goto next;
1941         }
1942
1943         req->current_idx = 1;
1944
1945         DEBUG(10,("smbd_smb2_request_incoming: idx[%d] of %d vectors\n",
1946                  req->current_idx, req->in.vector_count));
1947
1948         status = smbd_smb2_request_validate(req, &creds_requested);
1949         if (!NT_STATUS_IS_OK(status)) {
1950                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1951                 return;
1952         }
1953
1954         status = smbd_smb2_request_setup_out(req, 5);
1955         if (!NT_STATUS_IS_OK(status)) {
1956                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1957                 return;
1958         }
1959
1960         status = smbd_smb2_request_dispatch(req);
1961         if (!NT_STATUS_IS_OK(status)) {
1962                 smbd_server_connection_terminate(sconn, nt_errstr(status));
1963                 return;
1964         }
1965
1966 next:
1967         /* ask for the next request (this constructs the main loop) */
1968         subreq = smbd_smb2_request_read_send(sconn, sconn->smb2.event_ctx, sconn);
1969         if (subreq == NULL) {
1970                 smbd_server_connection_terminate(sconn, "no memory for reading");
1971                 return;
1972         }
1973         tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
1974 }