source3/smbd/smbXsrv_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2011-2012
   5    Copyright (C) Michael Adam 2012
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "dbwrap/dbwrap.h"
  26 #include "dbwrap/dbwrap_rbt.h"
  27 #include "dbwrap/dbwrap_open.h"
  28 #include "session.h"
  29 #include "auth.h"
  30 #include "auth/gensec/gensec.h"
  31 #include "../lib/tsocket/tsocket.h"
  32 #include "../libcli/security/security.h"
  33 #include "messages.h"
  34 #include "lib/util/util_tdb.h"
  35 #include "librpc/gen_ndr/ndr_smbXsrv.h"
  36 #include "serverid.h"
  37
  38 struct smbXsrv_session_table {
  39         struct {
  40                 struct db_context *db_ctx;
  41                 uint32_t lowest_id;
  42                 uint32_t highest_id;
  43                 uint32_t num_sessions;
  44         } local;
  45         struct {
  46                 struct db_context *db_ctx;
  47         } global;
  48 };
  49
  50 static struct db_context *smbXsrv_session_global_db_ctx = NULL;
  51
  52 NTSTATUS smbXsrv_session_global_init(void)
  53 {
  54         const char *global_path = NULL;
  55         struct db_context *db_ctx = NULL;
  56
  57         if (smbXsrv_session_global_db_ctx != NULL) {
  58                 return NT_STATUS_OK;
  59         }
  60
  61         /*
  62          * This contains secret information like session keys!
  63          */
  64         global_path = lock_path("smbXsrv_session_global.tdb");
  65
  66         db_ctx = db_open(NULL, global_path,
  67                          0, /* hash_size */
  68                          TDB_DEFAULT |
  69                          TDB_CLEAR_IF_FIRST |
  70                          TDB_INCOMPATIBLE_HASH,
  71                          O_RDWR | O_CREAT, 0600,
  72                          DBWRAP_LOCK_ORDER_1);
  73         if (db_ctx == NULL) {
  74                 NTSTATUS status;
  75
  76                 status = map_nt_error_from_unix_common(errno);
  77
  78                 return status;
  79         }
  80
  81         smbXsrv_session_global_db_ctx = db_ctx;
  82
  83         return NT_STATUS_OK;
  84 }
  85
  86 /*
  87  * NOTE:
  88  * We need to store the keys in big endian so that dbwrap_rbt's memcmp
  89  * has the same result as integer comparison between the uint32_t
  90  * values.
  91  *
  92  * TODO: implement string based key
  93  */
  94
  95 #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
  96
  97 static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
  98                                                  uint8_t *key_buf)
  99 {
 100         TDB_DATA key;
 101
 102         RSIVAL(key_buf, 0, id);
 103
 104         key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
 105
 106         return key;
 107 }
 108
 109 #if 0
 110 static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
 111 {
 112         if (id == NULL) {
 113                 return NT_STATUS_INVALID_PARAMETER;
 114         }
 115
 116         if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
 117                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 118         }
 119
 120         *id = RIVAL(key.dptr, 0);
 121
 122         return NT_STATUS_OK;
 123 }
 124 #endif
 125
 126 #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
 127
 128 static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
 129                                                 uint8_t *key_buf)
 130 {
 131         TDB_DATA key;
 132
 133         RSIVAL(key_buf, 0, id);
 134
 135         key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
 136
 137         return key;
 138 }
 139
 140 static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
 141 {
 142         if (id == NULL) {
 143                 return NT_STATUS_INVALID_PARAMETER;
 144         }
 145
 146         if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
 147                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 148         }
 149
 150         *id = RIVAL(key.dptr, 0);
 151
 152         return NT_STATUS_OK;
 153 }
 154
 155 static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
 156                                            uint32_t lowest_id,
 157                                            uint32_t highest_id)
 158 {
 159         struct smbXsrv_session_table *table;
 160         NTSTATUS status;
 161
 162         table = talloc_zero(conn, struct smbXsrv_session_table);
 163         if (table == NULL) {
 164                 return NT_STATUS_NO_MEMORY;
 165         }
 166
 167         table->local.db_ctx = db_open_rbt(table);
 168         if (table->local.db_ctx == NULL) {
 169                 TALLOC_FREE(table);
 170                 return NT_STATUS_NO_MEMORY;
 171         }
 172         table->local.lowest_id = lowest_id;
 173         table->local.highest_id = highest_id;
 174
 175         status = smbXsrv_session_global_init();
 176         if (!NT_STATUS_IS_OK(status)) {
 177                 TALLOC_FREE(table);
 178                 return status;
 179         }
 180
 181         table->global.db_ctx = smbXsrv_session_global_db_ctx;
 182
 183         conn->session_table = table;
 184         return NT_STATUS_OK;
 185 }
 186
 187 struct smb1srv_session_local_allocate_state {
 188         const uint32_t lowest_id;
 189         const uint32_t highest_id;
 190         uint32_t last_id;
 191         uint32_t useable_id;
 192         NTSTATUS status;
 193 };
 194
 195 static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
 196                                                    void *private_data)
 197 {
 198         struct smb1srv_session_local_allocate_state *state =
 199                 (struct smb1srv_session_local_allocate_state *)private_data;
 200         TDB_DATA key = dbwrap_record_get_key(rec);
 201         uint32_t id = 0;
 202         NTSTATUS status;
 203
 204         status = smbXsrv_session_local_key_to_id(key, &id);
 205         if (!NT_STATUS_IS_OK(status)) {
 206                 state->status = status;
 207                 return -1;
 208         }
 209
 210         if (id <= state->last_id) {
 211                 state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 212                 return -1;
 213         }
 214         state->last_id = id;
 215
 216         if (id > state->useable_id) {
 217                 state->status = NT_STATUS_OK;
 218                 return -1;
 219         }
 220
 221         if (state->useable_id == state->highest_id) {
 222                 state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
 223                 return -1;
 224         }
 225
 226         state->useable_id +=1;
 227         return 0;
 228 }
 229
 230 static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
 231                                                   uint32_t lowest_id,
 232                                                   uint32_t highest_id,
 233                                                   TALLOC_CTX *mem_ctx,
 234                                                   struct db_record **_rec,
 235                                                   uint32_t *_id)
 236 {
 237         struct smb1srv_session_local_allocate_state state = {
 238                 .lowest_id = lowest_id,
 239                 .highest_id = highest_id,
 240                 .last_id = 0,
 241                 .useable_id = lowest_id,
 242                 .status = NT_STATUS_INTERNAL_ERROR,
 243         };
 244         uint32_t i;
 245         uint32_t range;
 246         NTSTATUS status;
 247         int count = 0;
 248
 249         *_rec = NULL;
 250         *_id = 0;
 251
 252         if (lowest_id > highest_id) {
 253                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 254         }
 255
 256         /*
 257          * first we try randomly
 258          */
 259         range = (highest_id - lowest_id) + 1;
 260
 261         for (i = 0; i < (range / 2); i++) {
 262                 uint32_t id;
 263                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 264                 TDB_DATA key;
 265                 TDB_DATA val;
 266                 struct db_record *rec = NULL;
 267
 268                 id = generate_random() % range;
 269                 id += lowest_id;
 270
 271                 if (id < lowest_id) {
 272                         id = lowest_id;
 273                 }
 274                 if (id > highest_id) {
 275                         id = highest_id;
 276                 }
 277
 278                 key = smbXsrv_session_local_id_to_key(id, key_buf);
 279
 280                 rec = dbwrap_fetch_locked(db, mem_ctx, key);
 281                 if (rec == NULL) {
 282                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 283                 }
 284
 285                 val = dbwrap_record_get_value(rec);
 286                 if (val.dsize != 0) {
 287                         TALLOC_FREE(rec);
 288                         continue;
 289                 }
 290
 291                 *_rec = rec;
 292                 *_id = id;
 293                 return NT_STATUS_OK;
 294         }
 295
 296         /*
 297          * if the range is almost full,
 298          * we traverse the whole table
 299          * (this relies on sorted behavior of dbwrap_rbt)
 300          */
 301         status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
 302                                       &state, &count);
 303         if (NT_STATUS_IS_OK(status)) {
 304                 if (NT_STATUS_IS_OK(state.status)) {
 305                         return NT_STATUS_INTERNAL_ERROR;
 306                 }
 307
 308                 if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
 309                         return state.status;
 310                 }
 311
 312                 if (state.useable_id <= state.highest_id) {
 313                         state.status = NT_STATUS_OK;
 314                 } else {
 315                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 316                 }
 317         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
 318                 /*
 319                  * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
 320                  *
 321                  * If we get anything else it is an error, because it
 322                  * means we did not manage to find a free slot in
 323                  * the db.
 324                  */
 325                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 326         }
 327
 328         if (NT_STATUS_IS_OK(state.status)) {
 329                 uint32_t id;
 330                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 331                 TDB_DATA key;
 332                 TDB_DATA val;
 333                 struct db_record *rec = NULL;
 334
 335                 id = state.useable_id;
 336
 337                 key = smbXsrv_session_local_id_to_key(id, key_buf);
 338
 339                 rec = dbwrap_fetch_locked(db, mem_ctx, key);
 340                 if (rec == NULL) {
 341                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 342                 }
 343
 344                 val = dbwrap_record_get_value(rec);
 345                 if (val.dsize != 0) {
 346                         TALLOC_FREE(rec);
 347                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 348                 }
 349
 350                 *_rec = rec;
 351                 *_id = id;
 352                 return NT_STATUS_OK;
 353         }
 354
 355         return state.status;
 356 }
 357
 358 struct smbXsrv_session_local_fetch_state {
 359         struct smbXsrv_session *session;
 360         NTSTATUS status;
 361 };
 362
 363 static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
 364                                                void *private_data)
 365 {
 366         struct smbXsrv_session_local_fetch_state *state =
 367                 (struct smbXsrv_session_local_fetch_state *)private_data;
 368         void *ptr;
 369
 370         if (data.dsize != sizeof(ptr)) {
 371                 state->status = NT_STATUS_INTERNAL_DB_ERROR;
 372                 return;
 373         }
 374
 375         memcpy(&ptr, data.dptr, data.dsize);
 376         state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
 377         state->status = NT_STATUS_OK;
 378 }
 379
 380 static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
 381                                              uint32_t session_local_id,
 382                                              NTTIME now,
 383                                              struct smbXsrv_session **_session)
 384 {
 385         struct smbXsrv_session_local_fetch_state state = {
 386                 .session = NULL,
 387                 .status = NT_STATUS_INTERNAL_ERROR,
 388         };
 389         uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 390         TDB_DATA key;
 391         NTSTATUS status;
 392
 393         *_session = NULL;
 394
 395         if (session_local_id == 0) {
 396                 return NT_STATUS_USER_SESSION_DELETED;
 397         }
 398
 399         if (table == NULL) {
 400                 /* this might happen before the end of negprot */
 401                 return NT_STATUS_USER_SESSION_DELETED;
 402         }
 403
 404         if (table->local.db_ctx == NULL) {
 405                 return NT_STATUS_INTERNAL_ERROR;
 406         }
 407
 408         key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
 409
 410         status = dbwrap_parse_record(table->local.db_ctx, key,
 411                                      smbXsrv_session_local_fetch_parser,
 412                                      &state);
 413         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
 414                 return NT_STATUS_USER_SESSION_DELETED;
 415         } else if (!NT_STATUS_IS_OK(status)) {
 416                 return status;
 417         }
 418         if (!NT_STATUS_IS_OK(state.status)) {
 419                 return state.status;
 420         }
 421
 422         if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
 423                 return NT_STATUS_USER_SESSION_DELETED;
 424         }
 425
 426         state.session->idle_time = now;
 427
 428         if (!NT_STATUS_IS_OK(state.session->status)) {
 429                 *_session = state.session;
 430                 return state.session->status;
 431         }
 432
 433         if (now > state.session->global->expiration_time) {
 434                 state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
 435         }
 436
 437         *_session = state.session;
 438         return state.session->status;
 439 }
 440
 441 static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
 442 {
 443         return 0;
 444 }
 445
 446 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 447                                         bool *is_free,
 448                                         bool *was_free,
 449                                         TALLOC_CTX *mem_ctx,
 450                                         struct smbXsrv_session_global0 **_g);
 451
 452 static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
 453                                         TALLOC_CTX *mem_ctx,
 454                                         struct smbXsrv_session_global0 **_global)
 455 {
 456         uint32_t i;
 457         struct smbXsrv_session_global0 *global = NULL;
 458         uint32_t last_free = 0;
 459         const uint32_t min_tries = 3;
 460
 461         *_global = NULL;
 462
 463         global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
 464         if (global == NULL) {
 465                 return NT_STATUS_NO_MEMORY;
 466         }
 467         talloc_set_destructor(global, smbXsrv_session_global_destructor);
 468
 469         /*
 470          * Here we just randomly try the whole 32-bit space
 471          *
 472          * We use just 32-bit, because we want to reuse the
 473          * ID for SRVSVC.
 474          */
 475         for (i = 0; i < UINT32_MAX; i++) {
 476                 bool is_free = false;
 477                 bool was_free = false;
 478                 uint32_t id;
 479                 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 480                 TDB_DATA key;
 481
 482                 if (i >= min_tries && last_free != 0) {
 483                         id = last_free;
 484                 } else {
 485                         id = generate_random();
 486                 }
 487                 if (id == 0) {
 488                         id++;
 489                 }
 490                 if (id == UINT32_MAX) {
 491                         id--;
 492                 }
 493
 494                 key = smbXsrv_session_global_id_to_key(id, key_buf);
 495
 496                 global->db_rec = dbwrap_fetch_locked(db, mem_ctx, key);
 497                 if (global->db_rec == NULL) {
 498                         talloc_free(global);
 499                         return NT_STATUS_INSUFFICIENT_RESOURCES;
 500                 }
 501
 502                 smbXsrv_session_global_verify_record(global->db_rec,
 503                                                      &is_free,
 504                                                      &was_free,
 505                                                      NULL, NULL);
 506
 507                 if (!is_free) {
 508                         TALLOC_FREE(global->db_rec);
 509                         continue;
 510                 }
 511
 512                 if (!was_free && i < min_tries) {
 513                         /*
 514                          * The session_id is free now,
 515                          * but was not free before.
 516                          *
 517                          * This happens if a smbd crashed
 518                          * and did not cleanup the record.
 519                          *
 520                          * If this is one of our first tries,
 521                          * then we try to find a real free one.
 522                          */
 523                         if (last_free == 0) {
 524                                 last_free = id;
 525                         }
 526                         TALLOC_FREE(global->db_rec);
 527                         continue;
 528                 }
 529
 530                 global->session_global_id = id;
 531
 532                 *_global = global;
 533                 return NT_STATUS_OK;
 534         }
 535
 536         /* should not be reached */
 537         talloc_free(global);
 538         return NT_STATUS_INTERNAL_ERROR;
 539 }
 540
 541 static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
 542                                         bool *is_free,
 543                                         bool *was_free,
 544                                         TALLOC_CTX *mem_ctx,
 545                                         struct smbXsrv_session_global0 **_g)
 546 {
 547         TDB_DATA key;
 548         TDB_DATA val;
 549         DATA_BLOB blob;
 550         struct smbXsrv_session_globalB global_blob;
 551         enum ndr_err_code ndr_err;
 552         struct smbXsrv_session_global0 *global = NULL;
 553         bool exists;
 554         TALLOC_CTX *frame = talloc_stackframe();
 555
 556         *is_free = false;
 557
 558         if (was_free) {
 559                 *was_free = false;
 560         }
 561         if (_g) {
 562                 *_g = NULL;
 563         }
 564
 565         key = dbwrap_record_get_key(db_rec);
 566
 567         val = dbwrap_record_get_value(db_rec);
 568         if (val.dsize == 0) {
 569                 TALLOC_FREE(frame);
 570                 *is_free = true;
 571                 if (was_free) {
 572                         *was_free = true;
 573                 }
 574                 return;
 575         }
 576
 577         blob = data_blob_const(val.dptr, val.dsize);
 578
 579         ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
 580                         (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
 581         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 582                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 583                 DEBUG(1,("smbXsrv_session_global_verify_record: "
 584                          "key '%s' ndr_pull_struct_blob - %s\n",
 585                          hex_encode_talloc(frame, key.dptr, key.dsize),
 586                          nt_errstr(status)));
 587                 TALLOC_FREE(frame);
 588                 return;
 589         }
 590
 591         DEBUG(10,("smbXsrv_session_global_verify_record\n"));
 592         if (DEBUGLVL(10)) {
 593                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 594         }
 595
 596         if (global_blob.version != SMBXSRV_VERSION_0) {
 597                 DEBUG(0,("smbXsrv_session_global_verify_record: "
 598                          "key '%s' use unsupported version %u\n",
 599                          hex_encode_talloc(frame, key.dptr, key.dsize),
 600                          global_blob.version));
 601                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 602                 TALLOC_FREE(frame);
 603                 return;
 604         }
 605
 606         global = global_blob.info.info0;
 607
 608         exists = serverid_exists(&global->channels[0].server_id);
 609         if (!exists) {
 610                 DEBUG(2,("smbXsrv_session_global_verify_record: "
 611                          "key '%s' server_id %s does not exist.\n",
 612                          hex_encode_talloc(frame, key.dptr, key.dsize),
 613                          server_id_str(frame, &global->channels[0].server_id)));
 614                 if (DEBUGLVL(2)) {
 615                         NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 616                 }
 617                 TALLOC_FREE(frame);
 618                 dbwrap_record_delete(db_rec);
 619                 *is_free = true;
 620                 return;
 621         }
 622
 623         if (_g) {
 624                 *_g = talloc_move(mem_ctx, &global);
 625         }
 626         TALLOC_FREE(frame);
 627 }
 628
 629 static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_connection *sconn,
 630                                              struct smbXsrv_session_global0 *global)
 631 {
 632         struct smbXsrv_session_globalB global_blob;
 633         DATA_BLOB blob = data_blob_null;
 634         TDB_DATA key;
 635         TDB_DATA val;
 636         NTSTATUS status;
 637         enum ndr_err_code ndr_err;
 638
 639         /*
 640          * TODO: if we use other versions than '0'
 641          * we would add glue code here, that would be able to
 642          * store the information in the old format.
 643          */
 644
 645         if (global->db_rec == NULL) {
 646                 return NT_STATUS_INTERNAL_ERROR;
 647         }
 648
 649         key = dbwrap_record_get_key(global->db_rec);
 650         val = dbwrap_record_get_value(global->db_rec);
 651
 652         ZERO_STRUCT(global_blob);
 653         global_blob.version = smbXsrv_version_global_current();
 654         if (val.dsize >= 8) {
 655                 global_blob.seqnum = IVAL(val.dptr, 4);
 656         }
 657         global_blob.seqnum += 1;
 658         global_blob.info.info0 = global;
 659
 660         ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
 661                         (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
 662         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 663                 status = ndr_map_error2ntstatus(ndr_err);
 664                 DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
 665                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 666                          nt_errstr(status)));
 667                 TALLOC_FREE(global->db_rec);
 668                 return status;
 669         }
 670
 671         val = make_tdb_data(blob.data, blob.length);
 672         status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
 673         if (!NT_STATUS_IS_OK(status)) {
 674                 DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
 675                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
 676                          nt_errstr(status)));
 677                 TALLOC_FREE(global->db_rec);
 678                 return status;
 679         }
 680
 681         if (DEBUGLVL(10)) {
 682                 DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
 683                          hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
 684                 NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
 685         }
 686
 687         TALLOC_FREE(global->db_rec);
 688
 689         return NT_STATUS_OK;
 690 }
 691
 692 static int smbXsrv_session_destructor(struct smbXsrv_session *session)
 693 {
 694         NTSTATUS status;
 695
 696         status = smbXsrv_session_logoff(session);
 697         if (!NT_STATUS_IS_OK(status)) {
 698                 DEBUG(0, ("smbXsrv_session_destructor: "
 699                           "smbXsrv_session_logoff() failed: %s\n",
 700                           nt_errstr(status)));
 701         }
 702
 703         TALLOC_FREE(session->global);
 704
 705         return 0;
 706 }
 707
 708 NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
 709                                 NTTIME now,
 710                                 struct smbXsrv_session **_session)
 711 {
 712         struct smbXsrv_session_table *table = conn->session_table;
 713         uint32_t max_sessions = table->local.highest_id - table->local.lowest_id;
 714         struct db_record *local_rec = NULL;
 715         struct smbXsrv_session *session = NULL;
 716         void *ptr = NULL;
 717         TDB_DATA val;
 718         struct smbXsrv_session_global0 *global = NULL;
 719         struct smbXsrv_channel_global0 *channels = NULL;
 720         NTSTATUS status;
 721
 722         if (table->local.num_sessions >= max_sessions) {
 723                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 724         }
 725
 726         session = talloc_zero(table, struct smbXsrv_session);
 727         if (session == NULL) {
 728                 return NT_STATUS_NO_MEMORY;
 729         }
 730         session->table = table;
 731         session->idle_time = now;
 732         session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 733         session->connection = conn;
 734
 735         status = smbXsrv_session_global_allocate(table->global.db_ctx,
 736                                                  session,
 737                                                  &global);
 738         if (!NT_STATUS_IS_OK(status)) {
 739                 TALLOC_FREE(session);
 740                 return status;
 741         }
 742         session->global = global;
 743
 744         if (conn->protocol >= PROTOCOL_SMB2_02) {
 745                 uint64_t id = global->session_global_id;
 746                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 747                 TDB_DATA key;
 748
 749                 global->connection_dialect = conn->smb2.server.dialect;
 750
 751                 global->session_wire_id = id;
 752
 753                 session->local_id = global->session_global_id;
 754
 755                 key = smbXsrv_session_local_id_to_key(session->local_id, key_buf);
 756
 757                 local_rec = dbwrap_fetch_locked(table->local.db_ctx,
 758                                                 session, key);
 759                 if (local_rec == NULL) {
 760                         TALLOC_FREE(session);
 761                         return NT_STATUS_NO_MEMORY;
 762                 }
 763
 764                 val = dbwrap_record_get_value(local_rec);
 765                 if (val.dsize != 0) {
 766                         TALLOC_FREE(session);
 767                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 768                 }
 769         } else {
 770
 771                 status = smb1srv_session_local_allocate_id(table->local.db_ctx,
 772                                                         table->local.lowest_id,
 773                                                         table->local.highest_id,
 774                                                         session,
 775                                                         &local_rec,
 776                                                         &session->local_id);
 777                 if (!NT_STATUS_IS_OK(status)) {
 778                         TALLOC_FREE(session);
 779                         return status;
 780                 }
 781
 782                 global->session_wire_id = session->local_id;
 783         }
 784
 785         global->creation_time = now;
 786         global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
 787
 788         global->num_channels = 1;
 789         channels = talloc_zero_array(global,
 790                                      struct smbXsrv_channel_global0,
 791                                      global->num_channels);
 792         if (channels == NULL) {
 793                 TALLOC_FREE(session);
 794                 return NT_STATUS_NO_MEMORY;
 795         }
 796         global->channels = channels;
 797
 798         channels[0].server_id = messaging_server_id(conn->msg_ctx);
 799         channels[0].local_address = tsocket_address_string(conn->local_address,
 800                                                            channels);
 801         if (channels[0].local_address == NULL) {
 802                 TALLOC_FREE(session);
 803                 return NT_STATUS_NO_MEMORY;
 804         }
 805         channels[0].remote_address = tsocket_address_string(conn->remote_address,
 806                                                             channels);
 807         if (channels[0].remote_address == NULL) {
 808                 TALLOC_FREE(session);
 809                 return NT_STATUS_NO_MEMORY;
 810         }
 811         channels[0].remote_name = talloc_strdup(channels, conn->remote_hostname);
 812         if (channels[0].remote_name == NULL) {
 813                 TALLOC_FREE(session);
 814                 return NT_STATUS_NO_MEMORY;
 815         }
 816         channels[0].signing_key = data_blob_null;
 817
 818         ptr = session;
 819         val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
 820         status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
 821         TALLOC_FREE(local_rec);
 822         if (!NT_STATUS_IS_OK(status)) {
 823                 TALLOC_FREE(session);
 824                 return status;
 825         }
 826         table->local.num_sessions += 1;
 827
 828         talloc_set_destructor(session, smbXsrv_session_destructor);
 829
 830         status = smbXsrv_session_global_store(conn,
 831                                               global);
 832         if (!NT_STATUS_IS_OK(status)) {
 833                 DEBUG(0,("smbXsrv_session_create: "
 834                          "global_id (0x%08x) store failed - %s\n",
 835                          session->global->session_global_id,
 836                          nt_errstr(status)));
 837                 TALLOC_FREE(session);
 838                 return status;
 839         }
 840
 841         if (DEBUGLVL(10)) {
 842                 struct smbXsrv_sessionB session_blob;
 843
 844                 ZERO_STRUCT(session_blob);
 845                 session_blob.version = SMBXSRV_VERSION_0;
 846                 session_blob.info.info0 = session;
 847
 848                 DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
 849                          session->global->session_global_id));
 850                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
 851         }
 852
 853         *_session = session;
 854         return NT_STATUS_OK;
 855 }
 856
 857 NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
 858 {
 859         struct smbXsrv_session_table *table = session->table;
 860         NTSTATUS status;
 861         uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 862         TDB_DATA key;
 863
 864         if (session->global->db_rec != NULL) {
 865                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
 866                           "Called with db_rec != NULL'\n",
 867                           session->global->session_global_id));
 868                 return NT_STATUS_INTERNAL_ERROR;
 869         }
 870
 871         key = smbXsrv_session_global_id_to_key(
 872                                         session->global->session_global_id,
 873                                         key_buf);
 874
 875         session->global->db_rec = dbwrap_fetch_locked(table->global.db_ctx,
 876                                                       session->global, key);
 877         if (session->global->db_rec == NULL) {
 878                 DEBUG(0, ("smbXsrv_session_update(0x%08x): "
 879                           "Failed to lock global key '%s'\n",
 880                           session->global->session_global_id,
 881                           hex_encode_talloc(talloc_tos(), key.dptr,
 882                                             key.dsize)));
 883                 return NT_STATUS_INTERNAL_DB_ERROR;
 884         }
 885
 886         status = smbXsrv_session_global_store(session->connection,
 887                                               session->global);
 888         if (!NT_STATUS_IS_OK(status)) {
 889                 DEBUG(0,("smbXsrv_session_update: "
 890                          "global_id (0x%08x) store failed - %s\n",
 891                          session->global->session_global_id,
 892                          nt_errstr(status)));
 893                 return status;
 894         }
 895
 896         if (DEBUGLVL(10)) {
 897                 struct smbXsrv_sessionB session_blob;
 898
 899                 ZERO_STRUCT(session_blob);
 900                 session_blob.version = SMBXSRV_VERSION_0;
 901                 session_blob.info.info0 = session;
 902
 903                 DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
 904                           session->global->session_global_id));
 905                 NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
 906         }
 907
 908         return NT_STATUS_OK;
 909 }
 910
 911 NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
 912 {
 913         struct smbXsrv_session_table *table;
 914         struct db_record *local_rec = NULL;
 915         struct db_record *global_rec = NULL;
 916         struct smbXsrv_connection *conn;
 917         NTSTATUS status;
 918         NTSTATUS error = NT_STATUS_OK;
 919
 920         if (session->table == NULL) {
 921                 return NT_STATUS_OK;
 922         }
 923
 924         table = session->table;
 925         session->table = NULL;
 926
 927         conn = session->connection;
 928         session->connection = NULL;
 929         session->status = NT_STATUS_USER_SESSION_DELETED;
 930
 931         global_rec = session->global->db_rec;
 932         session->global->db_rec = NULL;
 933         if (global_rec == NULL) {
 934                 uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
 935                 TDB_DATA key;
 936
 937                 key = smbXsrv_session_global_id_to_key(
 938                                         session->global->session_global_id,
 939                                         key_buf);
 940
 941                 global_rec = dbwrap_fetch_locked(table->global.db_ctx,
 942                                                  session->global, key);
 943                 if (global_rec == NULL) {
 944                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
 945                                   "Failed to lock global key '%s'\n",
 946                                   session->global->session_global_id,
 947                                   hex_encode_talloc(global_rec, key.dptr,
 948                                                     key.dsize)));
 949                         error = NT_STATUS_INTERNAL_ERROR;
 950                 }
 951         }
 952
 953         if (global_rec != NULL) {
 954                 status = dbwrap_record_delete(global_rec);
 955                 if (!NT_STATUS_IS_OK(status)) {
 956                         TDB_DATA key = dbwrap_record_get_key(global_rec);
 957
 958                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
 959                                   "failed to delete global key '%s': %s\n",
 960                                   session->global->session_global_id,
 961                                   hex_encode_talloc(global_rec, key.dptr,
 962                                                     key.dsize),
 963                                   nt_errstr(status)));
 964                         error = status;
 965                 }
 966         }
 967         TALLOC_FREE(global_rec);
 968
 969         local_rec = session->db_rec;
 970         if (local_rec == NULL) {
 971                 uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
 972                 TDB_DATA key;
 973
 974                 key = smbXsrv_session_local_id_to_key(session->local_id,
 975                                                       key_buf);
 976
 977                 local_rec = dbwrap_fetch_locked(table->local.db_ctx,
 978                                                 session, key);
 979                 if (local_rec == NULL) {
 980                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
 981                                   "Failed to lock local key '%s'\n",
 982                                   session->global->session_global_id,
 983                                   hex_encode_talloc(local_rec, key.dptr,
 984                                                     key.dsize)));
 985                         error = NT_STATUS_INTERNAL_ERROR;
 986                 }
 987         }
 988
 989         if (local_rec != NULL) {
 990                 status = dbwrap_record_delete(local_rec);
 991                 if (!NT_STATUS_IS_OK(status)) {
 992                         TDB_DATA key = dbwrap_record_get_key(local_rec);
 993
 994                         DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
 995                                   "failed to delete local key '%s': %s\n",
 996                                   session->global->session_global_id,
 997                                   hex_encode_talloc(local_rec, key.dptr,
 998                                                     key.dsize),
 999                                   nt_errstr(status)));
1000                         error = status;
1001                 }
1002                 table->local.num_sessions -= 1;
1003         }
1004         if (session->db_rec == NULL) {
1005                 TALLOC_FREE(local_rec);
1006         }
1007         session->db_rec = NULL;
1008
1009         if (session->compat) {
1010                 file_close_user(conn->sconn, session->compat->vuid);
1011                 invalidate_vuid(conn->sconn, session->compat->vuid);
1012                 session->compat = NULL;
1013         }
1014
1015         return error;
1016 }
1017
1018 struct smbXsrv_session_logoff_all_state {
1019         NTSTATUS first_status;
1020         int errors;
1021 };
1022
1023 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1024                                                void *private_data);
1025
1026 NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_connection *conn)
1027 {
1028         struct smbXsrv_session_table *table = conn->session_table;
1029         struct smbXsrv_session_logoff_all_state state;
1030         NTSTATUS status;
1031         int count = 0;
1032
1033         if (table == NULL) {
1034                 DEBUG(10, ("smbXsrv_session_logoff_all: "
1035                            "empty session_table, nothing to do.\n"));
1036                 return NT_STATUS_OK;
1037         }
1038
1039         ZERO_STRUCT(state);
1040
1041         status = dbwrap_traverse(table->local.db_ctx,
1042                                  smbXsrv_session_logoff_all_callback,
1043                                  &state, &count);
1044         if (!NT_STATUS_IS_OK(status)) {
1045                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1046                           "dbwrap_traverse() failed: %s\n",
1047                           nt_errstr(status)));
1048                 return status;
1049         }
1050
1051         if (!NT_STATUS_IS_OK(state.first_status)) {
1052                 DEBUG(0, ("smbXsrv_session_logoff_all: "
1053                           "count[%d] errors[%d] first[%s]\n",
1054                           count, state.errors,
1055                           nt_errstr(state.first_status)));
1056                 return state.first_status;
1057         }
1058
1059         return NT_STATUS_OK;
1060 }
1061
1062 static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1063                                                void *private_data)
1064 {
1065         struct smbXsrv_session_logoff_all_state *state =
1066                 (struct smbXsrv_session_logoff_all_state *)private_data;
1067         TDB_DATA val;
1068         void *ptr = NULL;
1069         struct smbXsrv_session *session = NULL;
1070         NTSTATUS status;
1071
1072         val = dbwrap_record_get_value(local_rec);
1073         if (val.dsize != sizeof(ptr)) {
1074                 status = NT_STATUS_INTERNAL_ERROR;
1075                 if (NT_STATUS_IS_OK(state->first_status)) {
1076                         state->first_status = status;
1077                 }
1078                 state->errors++;
1079                 return 0;
1080         }
1081
1082         memcpy(&ptr, val.dptr, val.dsize);
1083         session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1084
1085         session->db_rec = local_rec;
1086         status = smbXsrv_session_logoff(session);
1087         if (!NT_STATUS_IS_OK(status)) {
1088                 if (NT_STATUS_IS_OK(state->first_status)) {
1089                         state->first_status = status;
1090                 }
1091                 state->errors++;
1092                 return 0;
1093         }
1094
1095         return 0;
1096 }
1097
1098 NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
1099 {
1100         /*
1101          * Allow a range from 1..65534.
1102          */
1103         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1);
1104 }
1105
1106 NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
1107                                 uint16_t vuid, NTTIME now,
1108                                 struct smbXsrv_session **session)
1109 {
1110         struct smbXsrv_session_table *table = conn->session_table;
1111         uint32_t local_id = vuid;
1112
1113         return smbXsrv_session_local_lookup(table, local_id, now, session);
1114 }
1115
1116 NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
1117 {
1118         /*
1119          * For now use the same range as SMB1.
1120          *
1121          * Allow a range from 1..65534.
1122          */
1123         return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1);
1124 }
1125
1126 NTSTATUS smb2srv_session_lookup(struct smbXsrv_connection *conn,
1127                                 uint64_t session_id, NTTIME now,
1128                                 struct smbXsrv_session **session)
1129 {
1130         struct smbXsrv_session_table *table = conn->session_table;
1131         uint32_t local_id = session_id & UINT32_MAX;
1132         uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
1133
1134         if (local_zeros != 0) {
1135                 return NT_STATUS_USER_SESSION_DELETED;
1136         }
1137
1138         return smbXsrv_session_local_lookup(table, local_id, now, session);
1139 }