s3:smb2_server: call change_to_root_user() or smbd_smb2_request_check_tcon()

[metze/samba/wip.git] / source3 / smbd / smb2_server.c

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index 50505e773028e3592e31267a6796111facb9dd77..90f476720311f7f3ff29efb58210cb13cd524e73 100644 (file)
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -24,6 +24,8 @@
 #include "smbd/globals.h"
 #include "../libcli/smb/smb_common.h"
 #include "../lib/tsocket/tsocket.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "smbprofile.h"
 
 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)
 
@@ -93,7 +95,7 @@ static NTSTATUS smbd_initialize_smb2(struct smbd_server_connection *sconn)
 
        TALLOC_FREE(sconn->smb1.fde);
 
-       sconn->smb2.event_ctx = smbd_event_context();
+       sconn->smb2.event_ctx = server_event_context();
 
        sconn->smb2.recv_queue = tevent_queue_create(sconn, "smb2 recv queue");
        if (sconn->smb2.recv_queue == NULL) {
@@ -267,15 +269,15 @@ static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
        memcpy(req->in.nbt_hdr, inbuf, 4);
 
        ofs = 0;
-       req->in.vector[0].iov_base      = (void *)req->in.nbt_hdr;
+       req->in.vector[0].iov_base      = discard_const_p(void, req->in.nbt_hdr);
        req->in.vector[0].iov_len       = 4;
        ofs += req->in.vector[0].iov_len;
 
-       req->in.vector[1].iov_base      = (void *)(inbuf + ofs);
+       req->in.vector[1].iov_base      = discard_const_p(void, (inbuf + ofs));
        req->in.vector[1].iov_len       = SMB2_HDR_BODY;
        ofs += req->in.vector[1].iov_len;
 
-       req->in.vector[2].iov_base      = (void *)(inbuf + ofs);
+       req->in.vector[2].iov_base      = discard_const_p(void, (inbuf + ofs));
        req->in.vector[2].iov_len       = SVAL(inbuf, ofs) & 0xFFFE;
        ofs += req->in.vector[2].iov_len;
 
@@ -283,7 +285,7 @@ static NTSTATUS smbd_smb2_request_create(struct smbd_server_connection *sconn,
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       req->in.vector[3].iov_base      = (void *)(inbuf + ofs);
+       req->in.vector[3].iov_base      = discard_const_p(void, (inbuf + ofs));
        req->in.vector[3].iov_len       = size - ofs;
        ofs += req->in.vector[3].iov_len;
 
@@ -606,7 +608,7 @@ static bool dup_smb2_vec3(TALLOC_CTX *ctx,
                        srcvec[1].iov_base ==
                                ((uint8_t *)srcvec[0].iov_base) +
                                        SMB2_HDR_BODY) {
-               outvec[1].iov_base = ((uint8_t *)outvec[1].iov_base) +
+               outvec[1].iov_base = ((uint8_t *)outvec[0].iov_base) +
                                        SMB2_HDR_BODY;
                outvec[1].iov_len = 8;
        } else {
@@ -663,10 +665,18 @@ static struct smbd_smb2_request *dup_smb2_req(const struct smbd_smb2_request *re
        }
 
        newreq->sconn = req->sconn;
+       newreq->session = req->session;
        newreq->do_signing = req->do_signing;
        newreq->current_idx = req->current_idx;
        newreq->async = false;
        newreq->cancelled = false;
+       /* Note we are leaving:
+               ->tcon
+               ->smb1req
+               ->compat_chain_fsp
+          uninitialized as NULL here as
+          they're not used in the interim
+          response code. JRA. */
 
        outvec = talloc_zero_array(newreq, struct iovec, count);
        if (!outvec) {
@@ -913,7 +923,7 @@ NTSTATUS smbd_smb2_request_pending_queue(struct smbd_smb2_request *req,
 
        if (req->do_signing) {
                status = smb2_signing_sign_pdu(req->session->session_key,
-                                       state->vector, 3);
+                                       &state->vector[1], 2);
                if (!NT_STATUS_IS_OK(status)) {
                        return status;
                }
@@ -1129,6 +1139,9 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
 
        switch (opcode) {
        case SMB2_OP_NEGPROT:
+               /* This call needs to be run as root */
+               change_to_root_user();
+
                {
                        START_PROFILE(smb2_negprot);
                        return_value = smbd_smb2_request_process_negprot(req);
@@ -1137,6 +1150,9 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                break;
 
        case SMB2_OP_SESSSETUP:
+               /* This call needs to be run as root */
+               change_to_root_user();
+
                {
                        START_PROFILE(smb2_sesssetup);
                        return_value = smbd_smb2_request_process_sesssetup(req);
@@ -1150,6 +1166,9 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                        break;
                }
 
+               /* This call needs to be run as root */
+               change_to_root_user();
+
                {
                        START_PROFILE(smb2_logoff);
                        return_value = smbd_smb2_request_process_logoff(req);
@@ -1162,11 +1181,9 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                        return_value = smbd_smb2_request_error(req, session_status);
                        break;
                }
-               status = smbd_smb2_request_check_session(req);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return_value = smbd_smb2_request_error(req, status);
-                       break;
-               }
+
+               /* This call needs to be run as root */
+               change_to_root_user();
 
                {
                        START_PROFILE(smb2_tcon);
@@ -1185,6 +1202,9 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                        return_value = smbd_smb2_request_error(req, status);
                        break;
                }
+               /* This call needs to be run as root */
+               change_to_root_user();
+
 
                {
                        START_PROFILE(smb2_tdis);
@@ -1328,6 +1348,9 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                break;
 
        case SMB2_OP_CANCEL:
+               /* This call needs to be run as root */
+               change_to_root_user();
+
                {
                        START_PROFILE(smb2_cancel);
                        return_value = smbd_smb2_request_process_cancel(req);
@@ -1336,9 +1359,14 @@ NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
                break;
 
        case SMB2_OP_KEEPALIVE:
-               {START_PROFILE(smb2_keepalive);
-               return_value = smbd_smb2_request_process_keepalive(req);
-               END_PROFILE(smb2_keepalive);}
+               /* This call needs to be run as root */
+               change_to_root_user();
+
+               {
+                       START_PROFILE(smb2_keepalive);
+                       return_value = smbd_smb2_request_process_keepalive(req);
+                       END_PROFILE(smb2_keepalive);
+               }
                break;
 
        case SMB2_OP_FIND:
@@ -2016,9 +2044,11 @@ static int smbd_smb2_request_next_vector(struct tstream_context *stream,
                                invalid = true;
                        }
 
-                       if ((body_size % 2) != 0) {
-                               body_size -= 1;
-                       }
+                       /*
+                        * Mask out the lowest bit, the "dynamic" part
+                        * of body_size.
+                        */
+                       body_size &= ~1;
 
                        if (body_size > (full_size - SMB2_HDR_BODY)) {
                                /*