Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : Copyright (C) Stefan Metzmacher 2011-2012
5 : Copyright (C) Michael Adam 2012
6 :
7 : This program is free software; you can redistribute it and/or modify
8 : it under the terms of the GNU General Public License as published by
9 : the Free Software Foundation; either version 3 of the License, or
10 : (at your option) any later version.
11 :
12 : This program is distributed in the hope that it will be useful,
13 : but WITHOUT ANY WARRANTY; without even the implied warranty of
14 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 : GNU General Public License for more details.
16 :
17 : You should have received a copy of the GNU General Public License
18 : along with this program. If not, see <http://www.gnu.org/licenses/>.
19 : */
20 :
21 : #include "includes.h"
22 : #include "system/filesys.h"
23 : #include <tevent.h>
24 : #include "lib/util/server_id.h"
25 : #include "smbd/smbd.h"
26 : #include "smbd/globals.h"
27 : #include "dbwrap/dbwrap.h"
28 : #include "dbwrap/dbwrap_rbt.h"
29 : #include "dbwrap/dbwrap_open.h"
30 : #include "dbwrap/dbwrap_watch.h"
31 : #include "session.h"
32 : #include "auth.h"
33 : #include "auth/gensec/gensec.h"
34 : #include "../lib/tsocket/tsocket.h"
35 : #include "../libcli/security/security.h"
36 : #include "messages.h"
37 : #include "lib/util/util_tdb.h"
38 : #include "librpc/gen_ndr/ndr_smbXsrv.h"
39 : #include "serverid.h"
40 : #include "lib/util/tevent_ntstatus.h"
41 : #include "lib/global_contexts.h"
42 :
43 : struct smbXsrv_session_table {
44 : struct {
45 : struct db_context *db_ctx;
46 : uint32_t lowest_id;
47 : uint32_t highest_id;
48 : uint32_t max_sessions;
49 : uint32_t num_sessions;
50 : } local;
51 : struct {
52 : struct db_context *db_ctx;
53 : } global;
54 : };
55 :
56 : static struct db_context *smbXsrv_session_global_db_ctx = NULL;
57 :
58 26784 : NTSTATUS smbXsrv_session_global_init(struct messaging_context *msg_ctx)
59 : {
60 26784 : char *global_path = NULL;
61 26784 : struct db_context *backend = NULL;
62 26784 : struct db_context *db_ctx = NULL;
63 :
64 26784 : if (smbXsrv_session_global_db_ctx != NULL) {
65 26717 : return NT_STATUS_OK;
66 : }
67 :
68 : /*
69 : * This contains secret information like session keys!
70 : */
71 67 : global_path = lock_path(talloc_tos(), "smbXsrv_session_global.tdb");
72 67 : if (global_path == NULL) {
73 0 : return NT_STATUS_NO_MEMORY;
74 : }
75 :
76 67 : backend = db_open(NULL, global_path,
77 : 0, /* hash_size */
78 : TDB_DEFAULT |
79 : TDB_CLEAR_IF_FIRST |
80 : TDB_INCOMPATIBLE_HASH,
81 : O_RDWR | O_CREAT, 0600,
82 : DBWRAP_LOCK_ORDER_1,
83 : DBWRAP_FLAG_NONE);
84 67 : TALLOC_FREE(global_path);
85 67 : if (backend == NULL) {
86 : NTSTATUS status;
87 :
88 0 : status = map_nt_error_from_unix_common(errno);
89 :
90 0 : return status;
91 : }
92 :
93 67 : db_ctx = db_open_watched(NULL, &backend, global_messaging_context());
94 67 : if (db_ctx == NULL) {
95 0 : TALLOC_FREE(backend);
96 0 : return NT_STATUS_NO_MEMORY;
97 : }
98 :
99 67 : smbXsrv_session_global_db_ctx = db_ctx;
100 :
101 67 : return NT_STATUS_OK;
102 : }
103 :
104 : /*
105 : * NOTE:
106 : * We need to store the keys in big endian so that dbwrap_rbt's memcmp
107 : * has the same result as integer comparison between the uint32_t
108 : * values.
109 : *
110 : * TODO: implement string based key
111 : */
112 :
113 : #define SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE sizeof(uint32_t)
114 :
115 165703 : static TDB_DATA smbXsrv_session_global_id_to_key(uint32_t id,
116 : uint8_t *key_buf)
117 : {
118 : TDB_DATA key;
119 :
120 168185 : RSIVAL(key_buf, 0, id);
121 :
122 168185 : key = make_tdb_data(key_buf, SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE);
123 :
124 168185 : return key;
125 : }
126 :
127 : #if 0
128 : static NTSTATUS smbXsrv_session_global_key_to_id(TDB_DATA key, uint32_t *id)
129 : {
130 : if (id == NULL) {
131 : return NT_STATUS_INVALID_PARAMETER;
132 : }
133 :
134 : if (key.dsize != SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE) {
135 : return NT_STATUS_INTERNAL_DB_CORRUPTION;
136 : }
137 :
138 : *id = RIVAL(key.dptr, 0);
139 :
140 : return NT_STATUS_OK;
141 : }
142 : #endif
143 :
144 : #define SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE sizeof(uint32_t)
145 :
146 3857480 : static TDB_DATA smbXsrv_session_local_id_to_key(uint32_t id,
147 : uint8_t *key_buf)
148 : {
149 : TDB_DATA key;
150 :
151 3890154 : RSIVAL(key_buf, 0, id);
152 :
153 3890154 : key = make_tdb_data(key_buf, SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE);
154 :
155 3890154 : return key;
156 : }
157 :
158 0 : static NTSTATUS smbXsrv_session_local_key_to_id(TDB_DATA key, uint32_t *id)
159 : {
160 0 : if (id == NULL) {
161 0 : return NT_STATUS_INVALID_PARAMETER;
162 : }
163 :
164 0 : if (key.dsize != SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE) {
165 0 : return NT_STATUS_INTERNAL_DB_CORRUPTION;
166 : }
167 :
168 0 : *id = RIVAL(key.dptr, 0);
169 :
170 0 : return NT_STATUS_OK;
171 : }
172 :
173 168185 : static struct db_record *smbXsrv_session_global_fetch_locked(
174 : struct db_context *db,
175 : uint32_t id,
176 : TALLOC_CTX *mem_ctx)
177 : {
178 : TDB_DATA key;
179 : uint8_t key_buf[SMBXSRV_SESSION_GLOBAL_TDB_KEY_SIZE];
180 168185 : struct db_record *rec = NULL;
181 :
182 168185 : key = smbXsrv_session_global_id_to_key(id, key_buf);
183 :
184 168185 : rec = dbwrap_fetch_locked(db, mem_ctx, key);
185 :
186 168185 : if (rec == NULL) {
187 0 : DBG_DEBUG("Failed to lock global id 0x%08x, key '%s'\n", id,
188 : hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
189 : }
190 :
191 168185 : return rec;
192 : }
193 :
194 29760 : static struct db_record *smbXsrv_session_local_fetch_locked(
195 : struct db_context *db,
196 : uint32_t id,
197 : TALLOC_CTX *mem_ctx)
198 : {
199 : TDB_DATA key;
200 : uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
201 29760 : struct db_record *rec = NULL;
202 :
203 29760 : key = smbXsrv_session_local_id_to_key(id, key_buf);
204 :
205 29760 : rec = dbwrap_fetch_locked(db, mem_ctx, key);
206 :
207 29760 : if (rec == NULL) {
208 0 : DBG_DEBUG("Failed to lock local id 0x%08x, key '%s'\n", id,
209 : hex_encode_talloc(talloc_tos(), key.dptr, key.dsize));
210 : }
211 :
212 29760 : return rec;
213 : }
214 :
215 : static void smbXsrv_session_close_loop(struct tevent_req *subreq);
216 :
217 26693 : static NTSTATUS smbXsrv_session_table_init(struct smbXsrv_connection *conn,
218 : uint32_t lowest_id,
219 : uint32_t highest_id,
220 : uint32_t max_sessions)
221 : {
222 26693 : struct smbXsrv_client *client = conn->client;
223 : struct smbXsrv_session_table *table;
224 : NTSTATUS status;
225 : struct tevent_req *subreq;
226 : uint64_t max_range;
227 :
228 26693 : if (lowest_id > highest_id) {
229 0 : return NT_STATUS_INTERNAL_ERROR;
230 : }
231 :
232 26693 : max_range = highest_id;
233 26693 : max_range -= lowest_id;
234 26693 : max_range += 1;
235 :
236 26693 : if (max_sessions > max_range) {
237 0 : return NT_STATUS_INTERNAL_ERROR;
238 : }
239 :
240 26693 : table = talloc_zero(client, struct smbXsrv_session_table);
241 26693 : if (table == NULL) {
242 0 : return NT_STATUS_NO_MEMORY;
243 : }
244 :
245 26693 : table->local.db_ctx = db_open_rbt(table);
246 26693 : if (table->local.db_ctx == NULL) {
247 0 : TALLOC_FREE(table);
248 0 : return NT_STATUS_NO_MEMORY;
249 : }
250 26693 : table->local.lowest_id = lowest_id;
251 26693 : table->local.highest_id = highest_id;
252 26693 : table->local.max_sessions = max_sessions;
253 :
254 26693 : status = smbXsrv_session_global_init(client->msg_ctx);
255 26693 : if (!NT_STATUS_IS_OK(status)) {
256 0 : TALLOC_FREE(table);
257 0 : return status;
258 : }
259 :
260 26693 : table->global.db_ctx = smbXsrv_session_global_db_ctx;
261 :
262 26693 : subreq = messaging_read_send(table,
263 : client->raw_ev_ctx,
264 : client->msg_ctx,
265 : MSG_SMBXSRV_SESSION_CLOSE);
266 26693 : if (subreq == NULL) {
267 0 : TALLOC_FREE(table);
268 0 : return NT_STATUS_NO_MEMORY;
269 : }
270 26693 : tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
271 :
272 26693 : client->session_table = table;
273 26693 : return NT_STATUS_OK;
274 : }
275 :
276 : static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq);
277 :
278 50 : static void smbXsrv_session_close_loop(struct tevent_req *subreq)
279 : {
280 38 : struct smbXsrv_client *client =
281 50 : tevent_req_callback_data(subreq,
282 : struct smbXsrv_client);
283 50 : struct smbXsrv_session_table *table = client->session_table;
284 : int ret;
285 50 : struct messaging_rec *rec = NULL;
286 : struct smbXsrv_session_closeB close_blob;
287 : enum ndr_err_code ndr_err;
288 50 : struct smbXsrv_session_close0 *close_info0 = NULL;
289 50 : struct smbXsrv_session *session = NULL;
290 : NTSTATUS status;
291 50 : struct timeval tv = timeval_current();
292 50 : NTTIME now = timeval_to_nttime(&tv);
293 :
294 50 : ret = messaging_read_recv(subreq, talloc_tos(), &rec);
295 50 : TALLOC_FREE(subreq);
296 50 : if (ret != 0) {
297 0 : goto next;
298 : }
299 :
300 50 : ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
301 : (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
302 50 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
303 0 : status = ndr_map_error2ntstatus(ndr_err);
304 0 : DEBUG(1,("smbXsrv_session_close_loop: "
305 : "ndr_pull_struct_blob - %s\n",
306 : nt_errstr(status)));
307 0 : goto next;
308 : }
309 :
310 50 : DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
311 50 : if (DEBUGLVL(10)) {
312 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
313 : }
314 :
315 50 : if (close_blob.version != SMBXSRV_VERSION_0) {
316 0 : DEBUG(0,("smbXsrv_session_close_loop: "
317 : "ignore invalid version %u\n", close_blob.version));
318 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
319 0 : goto next;
320 : }
321 :
322 50 : close_info0 = close_blob.info.info0;
323 50 : if (close_info0 == NULL) {
324 0 : DEBUG(0,("smbXsrv_session_close_loop: "
325 : "ignore NULL info %u\n", close_blob.version));
326 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
327 0 : goto next;
328 : }
329 :
330 50 : status = smb2srv_session_lookup_client(client,
331 : close_info0->old_session_wire_id,
332 : now, &session);
333 50 : if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
334 0 : DEBUG(4,("smbXsrv_session_close_loop: "
335 : "old_session_wire_id %llu not found\n",
336 : (unsigned long long)close_info0->old_session_wire_id));
337 0 : if (DEBUGLVL(4)) {
338 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
339 : }
340 0 : goto next;
341 : }
342 50 : if (!NT_STATUS_IS_OK(status) &&
343 0 : !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
344 0 : !NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
345 0 : DEBUG(1,("smbXsrv_session_close_loop: "
346 : "old_session_wire_id %llu - %s\n",
347 : (unsigned long long)close_info0->old_session_wire_id,
348 : nt_errstr(status)));
349 0 : if (DEBUGLVL(1)) {
350 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
351 : }
352 0 : goto next;
353 : }
354 :
355 50 : if (session->global->session_global_id != close_info0->old_session_global_id) {
356 0 : DEBUG(1,("smbXsrv_session_close_loop: "
357 : "old_session_wire_id %llu - global %u != %u\n",
358 : (unsigned long long)close_info0->old_session_wire_id,
359 : session->global->session_global_id,
360 : close_info0->old_session_global_id));
361 0 : if (DEBUGLVL(1)) {
362 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
363 : }
364 0 : goto next;
365 : }
366 :
367 50 : if (session->global->creation_time != close_info0->old_creation_time) {
368 0 : DEBUG(1,("smbXsrv_session_close_loop: "
369 : "old_session_wire_id %llu - "
370 : "creation %s (%llu) != %s (%llu)\n",
371 : (unsigned long long)close_info0->old_session_wire_id,
372 : nt_time_string(rec, session->global->creation_time),
373 : (unsigned long long)session->global->creation_time,
374 : nt_time_string(rec, close_info0->old_creation_time),
375 : (unsigned long long)close_info0->old_creation_time));
376 0 : if (DEBUGLVL(1)) {
377 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
378 : }
379 0 : goto next;
380 : }
381 :
382 50 : subreq = smb2srv_session_shutdown_send(session, client->raw_ev_ctx,
383 : session, NULL);
384 50 : if (subreq == NULL) {
385 0 : status = NT_STATUS_NO_MEMORY;
386 0 : DEBUG(0, ("smbXsrv_session_close_loop: "
387 : "smb2srv_session_shutdown_send(%llu) failed: %s\n",
388 : (unsigned long long)session->global->session_wire_id,
389 : nt_errstr(status)));
390 0 : if (DEBUGLVL(1)) {
391 0 : NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
392 : }
393 0 : goto next;
394 : }
395 50 : tevent_req_set_callback(subreq,
396 : smbXsrv_session_close_shutdown_done,
397 : session);
398 :
399 50 : next:
400 50 : TALLOC_FREE(rec);
401 :
402 50 : subreq = messaging_read_send(table,
403 : client->raw_ev_ctx,
404 : client->msg_ctx,
405 : MSG_SMBXSRV_SESSION_CLOSE);
406 50 : if (subreq == NULL) {
407 : const char *r;
408 0 : r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
409 0 : exit_server_cleanly(r);
410 : return;
411 : }
412 50 : tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
413 38 : }
414 :
415 50 : static void smbXsrv_session_close_shutdown_done(struct tevent_req *subreq)
416 : {
417 38 : struct smbXsrv_session *session =
418 50 : tevent_req_callback_data(subreq,
419 : struct smbXsrv_session);
420 : NTSTATUS status;
421 :
422 50 : status = smb2srv_session_shutdown_recv(subreq);
423 50 : TALLOC_FREE(subreq);
424 50 : if (!NT_STATUS_IS_OK(status)) {
425 0 : DEBUG(0, ("smbXsrv_session_close_loop: "
426 : "smb2srv_session_shutdown_recv(%llu) failed: %s\n",
427 : (unsigned long long)session->global->session_wire_id,
428 : nt_errstr(status)));
429 : }
430 :
431 50 : status = smbXsrv_session_logoff(session);
432 50 : if (!NT_STATUS_IS_OK(status)) {
433 0 : DEBUG(0, ("smbXsrv_session_close_loop: "
434 : "smbXsrv_session_logoff(%llu) failed: %s\n",
435 : (unsigned long long)session->global->session_wire_id,
436 : nt_errstr(status)));
437 : }
438 :
439 50 : TALLOC_FREE(session);
440 50 : }
441 :
442 : struct smb1srv_session_local_allocate_state {
443 : const uint32_t lowest_id;
444 : const uint32_t highest_id;
445 : uint32_t last_id;
446 : uint32_t useable_id;
447 : NTSTATUS status;
448 : };
449 :
450 0 : static int smb1srv_session_local_allocate_traverse(struct db_record *rec,
451 : void *private_data)
452 : {
453 0 : struct smb1srv_session_local_allocate_state *state =
454 : (struct smb1srv_session_local_allocate_state *)private_data;
455 0 : TDB_DATA key = dbwrap_record_get_key(rec);
456 0 : uint32_t id = 0;
457 : NTSTATUS status;
458 :
459 0 : status = smbXsrv_session_local_key_to_id(key, &id);
460 0 : if (!NT_STATUS_IS_OK(status)) {
461 0 : state->status = status;
462 0 : return -1;
463 : }
464 :
465 0 : if (id <= state->last_id) {
466 0 : state->status = NT_STATUS_INTERNAL_DB_CORRUPTION;
467 0 : return -1;
468 : }
469 0 : state->last_id = id;
470 :
471 0 : if (id > state->useable_id) {
472 0 : state->status = NT_STATUS_OK;
473 0 : return -1;
474 : }
475 :
476 0 : if (state->useable_id == state->highest_id) {
477 0 : state->status = NT_STATUS_INSUFFICIENT_RESOURCES;
478 0 : return -1;
479 : }
480 :
481 0 : state->useable_id +=1;
482 0 : return 0;
483 : }
484 :
485 5662 : static NTSTATUS smb1srv_session_local_allocate_id(struct db_context *db,
486 : uint32_t lowest_id,
487 : uint32_t highest_id,
488 : TALLOC_CTX *mem_ctx,
489 : struct db_record **_rec,
490 : uint32_t *_id)
491 : {
492 5662 : struct smb1srv_session_local_allocate_state state = {
493 : .lowest_id = lowest_id,
494 : .highest_id = highest_id,
495 : .last_id = 0,
496 : .useable_id = lowest_id,
497 : .status = NT_STATUS_INTERNAL_ERROR,
498 : };
499 : uint32_t i;
500 : uint32_t range;
501 : NTSTATUS status;
502 5662 : int count = 0;
503 :
504 5662 : *_rec = NULL;
505 5662 : *_id = 0;
506 :
507 5662 : if (lowest_id > highest_id) {
508 0 : return NT_STATUS_INSUFFICIENT_RESOURCES;
509 : }
510 :
511 : /*
512 : * first we try randomly
513 : */
514 5662 : range = (highest_id - lowest_id) + 1;
515 :
516 10964 : for (i = 0; i < (range / 2); i++) {
517 : uint32_t id;
518 : TDB_DATA val;
519 5662 : struct db_record *rec = NULL;
520 :
521 5662 : id = generate_random() % range;
522 5662 : id += lowest_id;
523 :
524 5662 : if (id < lowest_id) {
525 0 : id = lowest_id;
526 : }
527 5662 : if (id > highest_id) {
528 0 : id = highest_id;
529 : }
530 :
531 5662 : rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
532 5662 : if (rec == NULL) {
533 5302 : return NT_STATUS_INSUFFICIENT_RESOURCES;
534 : }
535 :
536 5662 : val = dbwrap_record_get_value(rec);
537 5662 : if (val.dsize != 0) {
538 0 : TALLOC_FREE(rec);
539 0 : continue;
540 : }
541 :
542 5662 : *_rec = rec;
543 5662 : *_id = id;
544 5662 : return NT_STATUS_OK;
545 : }
546 :
547 : /*
548 : * if the range is almost full,
549 : * we traverse the whole table
550 : * (this relies on sorted behavior of dbwrap_rbt)
551 : */
552 0 : status = dbwrap_traverse_read(db, smb1srv_session_local_allocate_traverse,
553 : &state, &count);
554 0 : if (NT_STATUS_IS_OK(status)) {
555 0 : if (NT_STATUS_IS_OK(state.status)) {
556 0 : return NT_STATUS_INTERNAL_ERROR;
557 : }
558 :
559 0 : if (!NT_STATUS_EQUAL(state.status, NT_STATUS_INTERNAL_ERROR)) {
560 0 : return state.status;
561 : }
562 :
563 0 : if (state.useable_id <= state.highest_id) {
564 0 : state.status = NT_STATUS_OK;
565 : } else {
566 0 : return NT_STATUS_INSUFFICIENT_RESOURCES;
567 : }
568 0 : } else if (!NT_STATUS_EQUAL(status, NT_STATUS_INTERNAL_DB_CORRUPTION)) {
569 : /*
570 : * Here we really expect NT_STATUS_INTERNAL_DB_CORRUPTION!
571 : *
572 : * If we get anything else it is an error, because it
573 : * means we did not manage to find a free slot in
574 : * the db.
575 : */
576 0 : return NT_STATUS_INSUFFICIENT_RESOURCES;
577 : }
578 :
579 0 : if (NT_STATUS_IS_OK(state.status)) {
580 : uint32_t id;
581 : TDB_DATA val;
582 0 : struct db_record *rec = NULL;
583 :
584 0 : id = state.useable_id;
585 :
586 0 : rec = smbXsrv_session_local_fetch_locked(db, id, mem_ctx);
587 0 : if (rec == NULL) {
588 0 : return NT_STATUS_INSUFFICIENT_RESOURCES;
589 : }
590 :
591 0 : val = dbwrap_record_get_value(rec);
592 0 : if (val.dsize != 0) {
593 0 : TALLOC_FREE(rec);
594 0 : return NT_STATUS_INTERNAL_DB_CORRUPTION;
595 : }
596 :
597 0 : *_rec = rec;
598 0 : *_id = id;
599 0 : return NT_STATUS_OK;
600 : }
601 :
602 0 : return state.status;
603 : }
604 :
605 : struct smbXsrv_session_local_fetch_state {
606 : struct smbXsrv_session *session;
607 : NTSTATUS status;
608 : };
609 :
610 3859482 : static void smbXsrv_session_local_fetch_parser(TDB_DATA key, TDB_DATA data,
611 : void *private_data)
612 : {
613 3859482 : struct smbXsrv_session_local_fetch_state *state =
614 : (struct smbXsrv_session_local_fetch_state *)private_data;
615 : void *ptr;
616 :
617 3859482 : if (data.dsize != sizeof(ptr)) {
618 0 : state->status = NT_STATUS_INTERNAL_DB_ERROR;
619 0 : return;
620 : }
621 :
622 3859482 : memcpy(&ptr, data.dptr, data.dsize);
623 3859482 : state->session = talloc_get_type_abort(ptr, struct smbXsrv_session);
624 3859482 : state->status = NT_STATUS_OK;
625 : }
626 :
627 2069042 : static NTSTATUS smbXsrv_session_local_lookup(struct smbXsrv_session_table *table,
628 : /* conn: optional */
629 : struct smbXsrv_connection *conn,
630 : uint32_t session_local_id,
631 : NTTIME now,
632 : struct smbXsrv_session **_session)
633 : {
634 2069042 : struct smbXsrv_session_local_fetch_state state = {
635 : .session = NULL,
636 : .status = NT_STATUS_INTERNAL_ERROR,
637 : };
638 : uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
639 : TDB_DATA key;
640 : NTSTATUS status;
641 :
642 2069042 : *_session = NULL;
643 :
644 2069042 : if (session_local_id == 0) {
645 85967 : return NT_STATUS_USER_SESSION_DELETED;
646 : }
647 :
648 1983075 : if (table == NULL) {
649 : /* this might happen before the end of negprot */
650 0 : return NT_STATUS_USER_SESSION_DELETED;
651 : }
652 :
653 1983075 : if (table->local.db_ctx == NULL) {
654 0 : return NT_STATUS_INTERNAL_ERROR;
655 : }
656 :
657 1983075 : key = smbXsrv_session_local_id_to_key(session_local_id, key_buf);
658 :
659 1983075 : status = dbwrap_parse_record(table->local.db_ctx, key,
660 : smbXsrv_session_local_fetch_parser,
661 : &state);
662 1983075 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_FOUND)) {
663 895 : return NT_STATUS_USER_SESSION_DELETED;
664 1982180 : } else if (!NT_STATUS_IS_OK(status)) {
665 0 : return status;
666 : }
667 1982180 : if (!NT_STATUS_IS_OK(state.status)) {
668 0 : return state.status;
669 : }
670 :
671 1982180 : if (NT_STATUS_EQUAL(state.session->status, NT_STATUS_USER_SESSION_DELETED)) {
672 0 : return NT_STATUS_USER_SESSION_DELETED;
673 : }
674 :
675 : /*
676 : * If a connection is specified check if the session is
677 : * valid on the channel.
678 : */
679 1982180 : if (conn != NULL) {
680 1964401 : struct smbXsrv_channel_global0 *c = NULL;
681 :
682 1964401 : status = smbXsrv_session_find_channel(state.session, conn, &c);
683 1964401 : if (!NT_STATUS_IS_OK(status)) {
684 120 : return status;
685 : }
686 : }
687 :
688 1982060 : state.session->idle_time = now;
689 :
690 1982060 : if (!NT_STATUS_IS_OK(state.session->status)) {
691 25725 : *_session = state.session;
692 25725 : return state.session->status;
693 : }
694 :
695 1956335 : if (now > state.session->global->expiration_time) {
696 40 : state.session->status = NT_STATUS_NETWORK_SESSION_EXPIRED;
697 : }
698 :
699 1956335 : *_session = state.session;
700 1956335 : return state.session->status;
701 : }
702 :
703 27381 : static int smbXsrv_session_global_destructor(struct smbXsrv_session_global0 *global)
704 : {
705 27381 : return 0;
706 : }
707 :
708 : static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
709 : bool *is_free,
710 : bool *was_free,
711 : TALLOC_CTX *mem_ctx,
712 : struct smbXsrv_session_global0 **_g);
713 :
714 27395 : static NTSTATUS smbXsrv_session_global_allocate(struct db_context *db,
715 : TALLOC_CTX *mem_ctx,
716 : struct smbXsrv_session_global0 **_global)
717 : {
718 : uint32_t i;
719 27395 : struct smbXsrv_session_global0 *global = NULL;
720 27395 : uint32_t last_free = 0;
721 27395 : const uint32_t min_tries = 3;
722 :
723 27395 : *_global = NULL;
724 :
725 27395 : global = talloc_zero(mem_ctx, struct smbXsrv_session_global0);
726 27395 : if (global == NULL) {
727 0 : return NT_STATUS_NO_MEMORY;
728 : }
729 27395 : talloc_set_destructor(global, smbXsrv_session_global_destructor);
730 :
731 : /*
732 : * Here we just randomly try the whole 32-bit space
733 : *
734 : * We use just 32-bit, because we want to reuse the
735 : * ID for SRVSVC.
736 : */
737 27395 : for (i = 0; i < UINT32_MAX; i++) {
738 27395 : bool is_free = false;
739 27395 : bool was_free = false;
740 : uint32_t id;
741 :
742 27395 : if (i >= min_tries && last_free != 0) {
743 0 : id = last_free;
744 : } else {
745 27395 : id = generate_random();
746 : }
747 27395 : if (id == 0) {
748 0 : id++;
749 : }
750 27395 : if (id == UINT32_MAX) {
751 0 : id--;
752 : }
753 :
754 27395 : global->db_rec = smbXsrv_session_global_fetch_locked(db, id,
755 : mem_ctx);
756 27395 : if (global->db_rec == NULL) {
757 0 : talloc_free(global);
758 24004 : return NT_STATUS_INSUFFICIENT_RESOURCES;
759 : }
760 :
761 27395 : smbXsrv_session_global_verify_record(global->db_rec,
762 : &is_free,
763 : &was_free,
764 : NULL, NULL);
765 :
766 27395 : if (!is_free) {
767 0 : TALLOC_FREE(global->db_rec);
768 0 : continue;
769 : }
770 :
771 27395 : if (!was_free && i < min_tries) {
772 : /*
773 : * The session_id is free now,
774 : * but was not free before.
775 : *
776 : * This happens if a smbd crashed
777 : * and did not cleanup the record.
778 : *
779 : * If this is one of our first tries,
780 : * then we try to find a real free one.
781 : */
782 0 : if (last_free == 0) {
783 0 : last_free = id;
784 : }
785 0 : TALLOC_FREE(global->db_rec);
786 0 : continue;
787 : }
788 :
789 27395 : global->session_global_id = id;
790 :
791 27395 : *_global = global;
792 27395 : return NT_STATUS_OK;
793 : }
794 :
795 : /* should not be reached */
796 0 : talloc_free(global);
797 0 : return NT_STATUS_INTERNAL_ERROR;
798 : }
799 :
800 28405 : static void smbXsrv_session_global_verify_record(struct db_record *db_rec,
801 : bool *is_free,
802 : bool *was_free,
803 : TALLOC_CTX *mem_ctx,
804 : struct smbXsrv_session_global0 **_g)
805 : {
806 : TDB_DATA key;
807 : TDB_DATA val;
808 : DATA_BLOB blob;
809 : struct smbXsrv_session_globalB global_blob;
810 : enum ndr_err_code ndr_err;
811 28405 : struct smbXsrv_session_global0 *global = NULL;
812 : bool exists;
813 28405 : TALLOC_CTX *frame = talloc_stackframe();
814 :
815 28405 : *is_free = false;
816 :
817 28405 : if (was_free) {
818 27395 : *was_free = false;
819 : }
820 28405 : if (_g) {
821 1010 : *_g = NULL;
822 : }
823 :
824 28405 : key = dbwrap_record_get_key(db_rec);
825 :
826 28405 : val = dbwrap_record_get_value(db_rec);
827 28405 : if (val.dsize == 0) {
828 27503 : TALLOC_FREE(frame);
829 27503 : *is_free = true;
830 27503 : if (was_free) {
831 27395 : *was_free = true;
832 : }
833 51070 : return;
834 : }
835 :
836 902 : blob = data_blob_const(val.dptr, val.dsize);
837 :
838 902 : ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
839 : (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
840 902 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
841 0 : NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
842 0 : DEBUG(1,("smbXsrv_session_global_verify_record: "
843 : "key '%s' ndr_pull_struct_blob - %s\n",
844 : hex_encode_talloc(frame, key.dptr, key.dsize),
845 : nt_errstr(status)));
846 0 : TALLOC_FREE(frame);
847 0 : *is_free = true;
848 0 : if (was_free) {
849 0 : *was_free = true;
850 : }
851 0 : return;
852 : }
853 :
854 902 : DEBUG(10,("smbXsrv_session_global_verify_record\n"));
855 902 : if (DEBUGLVL(10)) {
856 0 : NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
857 : }
858 :
859 902 : if (global_blob.version != SMBXSRV_VERSION_0) {
860 0 : DEBUG(0,("smbXsrv_session_global_verify_record: "
861 : "key '%s' use unsupported version %u\n",
862 : hex_encode_talloc(frame, key.dptr, key.dsize),
863 : global_blob.version));
864 0 : NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
865 0 : TALLOC_FREE(frame);
866 0 : *is_free = true;
867 0 : if (was_free) {
868 0 : *was_free = true;
869 : }
870 0 : return;
871 : }
872 :
873 902 : global = global_blob.info.info0;
874 :
875 : #define __BLOB_KEEP_SECRET(__blob) do { \
876 : if ((__blob).length != 0) { \
877 : talloc_keep_secret((__blob).data); \
878 : } \
879 : } while(0)
880 : {
881 : uint32_t i;
882 902 : __BLOB_KEEP_SECRET(global->application_key_blob);
883 902 : __BLOB_KEEP_SECRET(global->signing_key_blob);
884 902 : __BLOB_KEEP_SECRET(global->encryption_key_blob);
885 902 : __BLOB_KEEP_SECRET(global->decryption_key_blob);
886 1812 : for (i = 0; i < global->num_channels; i++) {
887 910 : __BLOB_KEEP_SECRET(global->channels[i].signing_key_blob);
888 : }
889 : }
890 : #undef __BLOB_KEEP_SECRET
891 :
892 902 : exists = serverid_exists(&global->channels[0].server_id);
893 902 : if (!exists) {
894 : struct server_id_buf idbuf;
895 0 : DEBUG(2,("smbXsrv_session_global_verify_record: "
896 : "key '%s' server_id %s does not exist.\n",
897 : hex_encode_talloc(frame, key.dptr, key.dsize),
898 : server_id_str_buf(global->channels[0].server_id,
899 : &idbuf)));
900 0 : if (DEBUGLVL(2)) {
901 0 : NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
902 : }
903 0 : TALLOC_FREE(frame);
904 0 : dbwrap_record_delete(db_rec);
905 0 : *is_free = true;
906 0 : return;
907 : }
908 :
909 902 : if (_g) {
910 902 : *_g = talloc_move(mem_ctx, &global);
911 : }
912 902 : TALLOC_FREE(frame);
913 : }
914 :
915 139794 : static NTSTATUS smbXsrv_session_global_store(struct smbXsrv_session_global0 *global)
916 : {
917 : struct smbXsrv_session_globalB global_blob;
918 139794 : DATA_BLOB blob = data_blob_null;
919 : TDB_DATA key;
920 : TDB_DATA val;
921 : NTSTATUS status;
922 : enum ndr_err_code ndr_err;
923 :
924 : /*
925 : * TODO: if we use other versions than '0'
926 : * we would add glue code here, that would be able to
927 : * store the information in the old format.
928 : */
929 :
930 139794 : if (global->db_rec == NULL) {
931 0 : return NT_STATUS_INTERNAL_ERROR;
932 : }
933 :
934 139794 : key = dbwrap_record_get_key(global->db_rec);
935 139794 : val = dbwrap_record_get_value(global->db_rec);
936 :
937 139794 : ZERO_STRUCT(global_blob);
938 139794 : global_blob.version = smbXsrv_version_global_current();
939 139794 : if (val.dsize >= 8) {
940 112399 : global_blob.seqnum = IVAL(val.dptr, 4);
941 : }
942 139794 : global_blob.seqnum += 1;
943 139794 : global_blob.info.info0 = global;
944 :
945 139794 : ndr_err = ndr_push_struct_blob(&blob, global->db_rec, &global_blob,
946 : (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_globalB);
947 139794 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
948 0 : status = ndr_map_error2ntstatus(ndr_err);
949 0 : DEBUG(1,("smbXsrv_session_global_store: key '%s' ndr_push - %s\n",
950 : hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
951 : nt_errstr(status)));
952 0 : TALLOC_FREE(global->db_rec);
953 0 : return status;
954 : }
955 :
956 139794 : val = make_tdb_data(blob.data, blob.length);
957 139794 : status = dbwrap_record_store(global->db_rec, val, TDB_REPLACE);
958 139794 : if (!NT_STATUS_IS_OK(status)) {
959 0 : DEBUG(1,("smbXsrv_session_global_store: key '%s' store - %s\n",
960 : hex_encode_talloc(global->db_rec, key.dptr, key.dsize),
961 : nt_errstr(status)));
962 0 : TALLOC_FREE(global->db_rec);
963 0 : return status;
964 : }
965 :
966 139794 : if (DEBUGLVL(10)) {
967 0 : DEBUG(10,("smbXsrv_session_global_store: key '%s' stored\n",
968 : hex_encode_talloc(global->db_rec, key.dptr, key.dsize)));
969 0 : NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob);
970 : }
971 :
972 139794 : TALLOC_FREE(global->db_rec);
973 :
974 139794 : return NT_STATUS_OK;
975 : }
976 :
977 : struct smb2srv_session_close_previous_state {
978 : struct tevent_context *ev;
979 : struct smbXsrv_connection *connection;
980 : struct dom_sid *current_sid;
981 : uint64_t previous_session_id;
982 : uint64_t current_session_id;
983 : struct db_record *db_rec;
984 : };
985 :
986 : static void smb2srv_session_close_previous_check(struct tevent_req *req);
987 : static void smb2srv_session_close_previous_modified(struct tevent_req *subreq);
988 :
989 98 : struct tevent_req *smb2srv_session_close_previous_send(TALLOC_CTX *mem_ctx,
990 : struct tevent_context *ev,
991 : struct smbXsrv_connection *conn,
992 : struct auth_session_info *session_info,
993 : uint64_t previous_session_id,
994 : uint64_t current_session_id)
995 : {
996 : struct tevent_req *req;
997 : struct smb2srv_session_close_previous_state *state;
998 98 : uint32_t global_id = previous_session_id & UINT32_MAX;
999 98 : uint64_t global_zeros = previous_session_id & 0xFFFFFFFF00000000LLU;
1000 98 : struct smbXsrv_session_table *table = conn->client->session_table;
1001 98 : struct security_token *current_token = NULL;
1002 :
1003 98 : req = tevent_req_create(mem_ctx, &state,
1004 : struct smb2srv_session_close_previous_state);
1005 98 : if (req == NULL) {
1006 0 : return NULL;
1007 : }
1008 98 : state->ev = ev;
1009 98 : state->connection = conn;
1010 98 : state->previous_session_id = previous_session_id;
1011 98 : state->current_session_id = current_session_id;
1012 :
1013 98 : if (global_zeros != 0) {
1014 0 : tevent_req_done(req);
1015 0 : return tevent_req_post(req, ev);
1016 : }
1017 :
1018 98 : if (session_info == NULL) {
1019 0 : tevent_req_done(req);
1020 0 : return tevent_req_post(req, ev);
1021 : }
1022 98 : current_token = session_info->security_token;
1023 :
1024 98 : if (current_token->num_sids > PRIMARY_USER_SID_INDEX) {
1025 98 : state->current_sid = ¤t_token->sids[PRIMARY_USER_SID_INDEX];
1026 : }
1027 :
1028 98 : if (state->current_sid == NULL) {
1029 0 : tevent_req_done(req);
1030 0 : return tevent_req_post(req, ev);
1031 : }
1032 :
1033 98 : if (!security_token_has_nt_authenticated_users(current_token)) {
1034 : /* TODO */
1035 0 : tevent_req_done(req);
1036 0 : return tevent_req_post(req, ev);
1037 : }
1038 :
1039 98 : state->db_rec = smbXsrv_session_global_fetch_locked(
1040 : table->global.db_ctx,
1041 : global_id,
1042 : state /* TALLOC_CTX */);
1043 98 : if (state->db_rec == NULL) {
1044 0 : tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1045 0 : return tevent_req_post(req, ev);
1046 : }
1047 :
1048 98 : smb2srv_session_close_previous_check(req);
1049 98 : if (!tevent_req_is_in_progress(req)) {
1050 46 : return tevent_req_post(req, ev);
1051 : }
1052 :
1053 52 : return req;
1054 : }
1055 :
1056 150 : static void smb2srv_session_close_previous_check(struct tevent_req *req)
1057 : {
1058 115 : struct smb2srv_session_close_previous_state *state =
1059 150 : tevent_req_data(req,
1060 : struct smb2srv_session_close_previous_state);
1061 150 : struct smbXsrv_connection *conn = state->connection;
1062 : DATA_BLOB blob;
1063 150 : struct security_token *previous_token = NULL;
1064 150 : struct smbXsrv_session_global0 *global = NULL;
1065 : enum ndr_err_code ndr_err;
1066 : struct smbXsrv_session_close0 close_info0;
1067 : struct smbXsrv_session_closeB close_blob;
1068 150 : struct tevent_req *subreq = NULL;
1069 : NTSTATUS status;
1070 150 : bool is_free = false;
1071 :
1072 150 : smbXsrv_session_global_verify_record(state->db_rec,
1073 : &is_free,
1074 : NULL,
1075 : state,
1076 : &global);
1077 :
1078 150 : if (is_free) {
1079 98 : TALLOC_FREE(state->db_rec);
1080 98 : tevent_req_done(req);
1081 98 : return;
1082 : }
1083 :
1084 52 : if (global->auth_session_info == NULL) {
1085 0 : TALLOC_FREE(state->db_rec);
1086 0 : tevent_req_done(req);
1087 0 : return;
1088 : }
1089 :
1090 52 : previous_token = global->auth_session_info->security_token;
1091 :
1092 52 : if (!security_token_is_sid(previous_token, state->current_sid)) {
1093 0 : TALLOC_FREE(state->db_rec);
1094 0 : tevent_req_done(req);
1095 0 : return;
1096 : }
1097 :
1098 52 : subreq = dbwrap_watched_watch_send(state, state->ev, state->db_rec,
1099 52 : (struct server_id){0});
1100 52 : if (tevent_req_nomem(subreq, req)) {
1101 0 : TALLOC_FREE(state->db_rec);
1102 0 : return;
1103 : }
1104 52 : tevent_req_set_callback(subreq,
1105 : smb2srv_session_close_previous_modified,
1106 : req);
1107 :
1108 52 : close_info0.old_session_global_id = global->session_global_id;
1109 52 : close_info0.old_session_wire_id = global->session_wire_id;
1110 52 : close_info0.old_creation_time = global->creation_time;
1111 52 : close_info0.new_session_wire_id = state->current_session_id;
1112 :
1113 52 : ZERO_STRUCT(close_blob);
1114 52 : close_blob.version = smbXsrv_version_global_current();
1115 52 : close_blob.info.info0 = &close_info0;
1116 :
1117 52 : ndr_err = ndr_push_struct_blob(&blob, state, &close_blob,
1118 : (ndr_push_flags_fn_t)ndr_push_smbXsrv_session_closeB);
1119 52 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1120 0 : TALLOC_FREE(state->db_rec);
1121 0 : status = ndr_map_error2ntstatus(ndr_err);
1122 0 : DEBUG(1,("smb2srv_session_close_previous_check: "
1123 : "old_session[%llu] new_session[%llu] ndr_push - %s\n",
1124 : (unsigned long long)close_info0.old_session_wire_id,
1125 : (unsigned long long)close_info0.new_session_wire_id,
1126 : nt_errstr(status)));
1127 0 : tevent_req_nterror(req, status);
1128 0 : return;
1129 : }
1130 :
1131 52 : status = messaging_send(conn->client->msg_ctx,
1132 52 : global->channels[0].server_id,
1133 : MSG_SMBXSRV_SESSION_CLOSE, &blob);
1134 52 : TALLOC_FREE(state->db_rec);
1135 52 : if (tevent_req_nterror(req, status)) {
1136 0 : return;
1137 : }
1138 :
1139 52 : TALLOC_FREE(global);
1140 52 : return;
1141 : }
1142 :
1143 52 : static void smb2srv_session_close_previous_modified(struct tevent_req *subreq)
1144 : {
1145 40 : struct tevent_req *req =
1146 52 : tevent_req_callback_data(subreq,
1147 : struct tevent_req);
1148 40 : struct smb2srv_session_close_previous_state *state =
1149 52 : tevent_req_data(req,
1150 : struct smb2srv_session_close_previous_state);
1151 : uint32_t global_id;
1152 : NTSTATUS status;
1153 :
1154 52 : status = dbwrap_watched_watch_recv(subreq, NULL, NULL);
1155 52 : TALLOC_FREE(subreq);
1156 52 : if (tevent_req_nterror(req, status)) {
1157 0 : return;
1158 : }
1159 :
1160 52 : global_id = state->previous_session_id & UINT32_MAX;
1161 :
1162 64 : state->db_rec = smbXsrv_session_global_fetch_locked(
1163 52 : state->connection->client->session_table->global.db_ctx,
1164 : global_id, state /* TALLOC_CTX */);
1165 52 : if (state->db_rec == NULL) {
1166 0 : tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1167 0 : return;
1168 : }
1169 :
1170 52 : smb2srv_session_close_previous_check(req);
1171 : }
1172 :
1173 98 : NTSTATUS smb2srv_session_close_previous_recv(struct tevent_req *req)
1174 : {
1175 : NTSTATUS status;
1176 :
1177 98 : if (tevent_req_is_nterror(req, &status)) {
1178 0 : tevent_req_received(req);
1179 0 : return status;
1180 : }
1181 :
1182 98 : tevent_req_received(req);
1183 98 : return NT_STATUS_OK;
1184 : }
1185 :
1186 52397 : static NTSTATUS smbXsrv_session_clear_and_logoff(struct smbXsrv_session *session)
1187 : {
1188 : NTSTATUS status;
1189 52397 : struct smbXsrv_connection *xconn = NULL;
1190 :
1191 52397 : if (session->client != NULL) {
1192 27130 : xconn = session->client->connections;
1193 : }
1194 :
1195 78531 : for (; xconn != NULL; xconn = xconn->next) {
1196 : struct smbd_smb2_request *preq;
1197 :
1198 27234 : for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1199 56 : if (preq->session != session) {
1200 0 : continue;
1201 : }
1202 :
1203 56 : preq->session = NULL;
1204 : /*
1205 : * If we no longer have a session we can't
1206 : * sign or encrypt replies.
1207 : */
1208 56 : preq->do_signing = false;
1209 56 : preq->do_encryption = false;
1210 56 : preq->preauth = NULL;
1211 : }
1212 : }
1213 :
1214 52397 : status = smbXsrv_session_logoff(session);
1215 52397 : return status;
1216 : }
1217 :
1218 27381 : static int smbXsrv_session_destructor(struct smbXsrv_session *session)
1219 : {
1220 : NTSTATUS status;
1221 :
1222 27381 : DBG_DEBUG("destructing session(%llu)\n",
1223 : (unsigned long long)session->global->session_wire_id);
1224 :
1225 27381 : status = smbXsrv_session_clear_and_logoff(session);
1226 27381 : if (!NT_STATUS_IS_OK(status)) {
1227 0 : DEBUG(0, ("smbXsrv_session_destructor: "
1228 : "smbXsrv_session_logoff() failed: %s\n",
1229 : nt_errstr(status)));
1230 : }
1231 :
1232 27381 : TALLOC_FREE(session->global);
1233 :
1234 27381 : return 0;
1235 : }
1236 :
1237 27395 : NTSTATUS smbXsrv_session_create(struct smbXsrv_connection *conn,
1238 : NTTIME now,
1239 : struct smbXsrv_session **_session)
1240 : {
1241 27395 : struct smbXsrv_session_table *table = conn->client->session_table;
1242 27395 : struct db_record *local_rec = NULL;
1243 27395 : struct smbXsrv_session *session = NULL;
1244 27395 : void *ptr = NULL;
1245 : TDB_DATA val;
1246 27395 : struct smbXsrv_session_global0 *global = NULL;
1247 27395 : struct smbXsrv_channel_global0 *channel = NULL;
1248 : NTSTATUS status;
1249 :
1250 27395 : if (table->local.num_sessions >= table->local.max_sessions) {
1251 0 : return NT_STATUS_INSUFFICIENT_RESOURCES;
1252 : }
1253 :
1254 27395 : session = talloc_zero(table, struct smbXsrv_session);
1255 27395 : if (session == NULL) {
1256 0 : return NT_STATUS_NO_MEMORY;
1257 : }
1258 27395 : session->table = table;
1259 27395 : session->idle_time = now;
1260 27395 : session->status = NT_STATUS_MORE_PROCESSING_REQUIRED;
1261 27395 : session->client = conn->client;
1262 27395 : session->homes_snum = -1;
1263 :
1264 27395 : status = smbXsrv_session_global_allocate(table->global.db_ctx,
1265 : session,
1266 : &global);
1267 27395 : if (!NT_STATUS_IS_OK(status)) {
1268 0 : TALLOC_FREE(session);
1269 0 : return status;
1270 : }
1271 27395 : session->global = global;
1272 :
1273 27395 : if (conn->protocol >= PROTOCOL_SMB2_02) {
1274 21733 : uint64_t id = global->session_global_id;
1275 :
1276 21733 : global->connection_dialect = conn->smb2.server.dialect;
1277 :
1278 21733 : global->session_wire_id = id;
1279 :
1280 21733 : status = smb2srv_tcon_table_init(session);
1281 21733 : if (!NT_STATUS_IS_OK(status)) {
1282 0 : TALLOC_FREE(session);
1283 0 : return status;
1284 : }
1285 :
1286 21733 : session->local_id = global->session_global_id;
1287 :
1288 21733 : local_rec = smbXsrv_session_local_fetch_locked(
1289 : table->local.db_ctx,
1290 : session->local_id,
1291 : session /* TALLOC_CTX */);
1292 21733 : if (local_rec == NULL) {
1293 0 : TALLOC_FREE(session);
1294 0 : return NT_STATUS_NO_MEMORY;
1295 : }
1296 :
1297 21733 : val = dbwrap_record_get_value(local_rec);
1298 21733 : if (val.dsize != 0) {
1299 0 : TALLOC_FREE(session);
1300 0 : return NT_STATUS_INTERNAL_DB_CORRUPTION;
1301 : }
1302 : } else {
1303 :
1304 5662 : status = smb1srv_session_local_allocate_id(table->local.db_ctx,
1305 : table->local.lowest_id,
1306 : table->local.highest_id,
1307 : session,
1308 : &local_rec,
1309 : &session->local_id);
1310 5662 : if (!NT_STATUS_IS_OK(status)) {
1311 0 : TALLOC_FREE(session);
1312 0 : return status;
1313 : }
1314 :
1315 5662 : global->session_wire_id = session->local_id;
1316 : }
1317 :
1318 27395 : global->creation_time = now;
1319 27395 : global->expiration_time = GENSEC_EXPIRE_TIME_INFINITY;
1320 :
1321 27395 : status = smbXsrv_session_add_channel(session, conn, now, &channel);
1322 27395 : if (!NT_STATUS_IS_OK(status)) {
1323 0 : TALLOC_FREE(session);
1324 0 : return status;
1325 : }
1326 :
1327 27395 : ptr = session;
1328 27395 : val = make_tdb_data((uint8_t const *)&ptr, sizeof(ptr));
1329 27395 : status = dbwrap_record_store(local_rec, val, TDB_REPLACE);
1330 27395 : TALLOC_FREE(local_rec);
1331 27395 : if (!NT_STATUS_IS_OK(status)) {
1332 0 : TALLOC_FREE(session);
1333 0 : return status;
1334 : }
1335 27395 : table->local.num_sessions += 1;
1336 :
1337 27395 : talloc_set_destructor(session, smbXsrv_session_destructor);
1338 :
1339 27395 : status = smbXsrv_session_global_store(global);
1340 27395 : if (!NT_STATUS_IS_OK(status)) {
1341 0 : DEBUG(0,("smbXsrv_session_create: "
1342 : "global_id (0x%08x) store failed - %s\n",
1343 : session->global->session_global_id,
1344 : nt_errstr(status)));
1345 0 : TALLOC_FREE(session);
1346 0 : return status;
1347 : }
1348 :
1349 27395 : if (DEBUGLVL(10)) {
1350 0 : struct smbXsrv_sessionB session_blob = {
1351 : .version = SMBXSRV_VERSION_0,
1352 : .info.info0 = session,
1353 : };
1354 :
1355 0 : DEBUG(10,("smbXsrv_session_create: global_id (0x%08x) stored\n",
1356 : session->global->session_global_id));
1357 0 : NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1358 : }
1359 :
1360 27395 : *_session = session;
1361 27395 : return NT_STATUS_OK;
1362 : }
1363 :
1364 28159 : NTSTATUS smbXsrv_session_add_channel(struct smbXsrv_session *session,
1365 : struct smbXsrv_connection *conn,
1366 : NTTIME now,
1367 : struct smbXsrv_channel_global0 **_c)
1368 : {
1369 28159 : struct smbXsrv_session_global0 *global = session->global;
1370 28159 : struct smbXsrv_channel_global0 *c = NULL;
1371 :
1372 28159 : if (global->num_channels > 31) {
1373 : /*
1374 : * Windows allow up to 32 channels
1375 : */
1376 4 : return NT_STATUS_INSUFFICIENT_RESOURCES;
1377 : }
1378 :
1379 28155 : c = talloc_realloc(global,
1380 : global->channels,
1381 : struct smbXsrv_channel_global0,
1382 : global->num_channels + 1);
1383 28155 : if (c == NULL) {
1384 0 : return NT_STATUS_NO_MEMORY;
1385 : }
1386 28155 : global->channels = c;
1387 :
1388 28155 : c = &global->channels[global->num_channels];
1389 28155 : ZERO_STRUCTP(c);
1390 :
1391 28155 : c->server_id = messaging_server_id(conn->client->msg_ctx);
1392 28155 : c->channel_id = conn->channel_id;
1393 28155 : c->creation_time = now;
1394 31735 : c->local_address = tsocket_address_string(conn->local_address,
1395 28155 : global->channels);
1396 28155 : if (c->local_address == NULL) {
1397 0 : return NT_STATUS_NO_MEMORY;
1398 : }
1399 31735 : c->remote_address = tsocket_address_string(conn->remote_address,
1400 28155 : global->channels);
1401 28155 : if (c->remote_address == NULL) {
1402 0 : return NT_STATUS_NO_MEMORY;
1403 : }
1404 28155 : c->remote_name = talloc_strdup(global->channels,
1405 : conn->remote_hostname);
1406 28155 : if (c->remote_name == NULL) {
1407 0 : return NT_STATUS_NO_MEMORY;
1408 : }
1409 28155 : c->connection = conn;
1410 :
1411 28155 : global->num_channels += 1;
1412 :
1413 28155 : *_c = c;
1414 28155 : return NT_STATUS_OK;
1415 : }
1416 :
1417 112399 : NTSTATUS smbXsrv_session_update(struct smbXsrv_session *session)
1418 : {
1419 112399 : struct smbXsrv_session_table *table = session->table;
1420 : NTSTATUS status;
1421 :
1422 112399 : if (session->global->db_rec != NULL) {
1423 0 : DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1424 : "Called with db_rec != NULL'\n",
1425 : session->global->session_global_id));
1426 0 : return NT_STATUS_INTERNAL_ERROR;
1427 : }
1428 :
1429 112399 : if (table == NULL) {
1430 0 : DEBUG(0, ("smbXsrv_session_update(0x%08x): "
1431 : "Called with table == NULL'\n",
1432 : session->global->session_global_id));
1433 0 : return NT_STATUS_INTERNAL_ERROR;
1434 : }
1435 :
1436 124549 : session->global->db_rec = smbXsrv_session_global_fetch_locked(
1437 : table->global.db_ctx,
1438 110961 : session->global->session_global_id,
1439 110961 : session->global /* TALLOC_CTX */);
1440 112399 : if (session->global->db_rec == NULL) {
1441 0 : return NT_STATUS_INTERNAL_DB_ERROR;
1442 : }
1443 :
1444 112399 : status = smbXsrv_session_global_store(session->global);
1445 112399 : if (!NT_STATUS_IS_OK(status)) {
1446 0 : DEBUG(0,("smbXsrv_session_update: "
1447 : "global_id (0x%08x) store failed - %s\n",
1448 : session->global->session_global_id,
1449 : nt_errstr(status)));
1450 0 : return status;
1451 : }
1452 :
1453 112399 : if (DEBUGLVL(10)) {
1454 0 : struct smbXsrv_sessionB session_blob = {
1455 : .version = SMBXSRV_VERSION_0,
1456 : .info.info0 = session,
1457 : };
1458 :
1459 0 : DEBUG(10,("smbXsrv_session_update: global_id (0x%08x) stored\n",
1460 : session->global->session_global_id));
1461 0 : NDR_PRINT_DEBUG(smbXsrv_sessionB, &session_blob);
1462 : }
1463 :
1464 112399 : return NT_STATUS_OK;
1465 : }
1466 :
1467 3307827 : NTSTATUS smbXsrv_session_find_channel(const struct smbXsrv_session *session,
1468 : const struct smbXsrv_connection *conn,
1469 : struct smbXsrv_channel_global0 **_c)
1470 : {
1471 : uint32_t i;
1472 :
1473 3366663 : for (i=0; i < session->global->num_channels; i++) {
1474 3361627 : struct smbXsrv_channel_global0 *c = &session->global->channels[i];
1475 :
1476 3361627 : if (c->channel_id != conn->channel_id) {
1477 58836 : continue;
1478 : }
1479 :
1480 3302791 : if (c->connection != conn) {
1481 0 : continue;
1482 : }
1483 :
1484 3302791 : *_c = c;
1485 3302791 : return NT_STATUS_OK;
1486 : }
1487 :
1488 5036 : return NT_STATUS_USER_SESSION_DELETED;
1489 : }
1490 :
1491 79169 : NTSTATUS smbXsrv_session_find_auth(const struct smbXsrv_session *session,
1492 : const struct smbXsrv_connection *conn,
1493 : NTTIME now,
1494 : struct smbXsrv_session_auth0 **_a)
1495 : {
1496 : struct smbXsrv_session_auth0 *a;
1497 :
1498 79169 : for (a = session->pending_auth; a != NULL; a = a->next) {
1499 21019 : if (a->channel_id != conn->channel_id) {
1500 0 : continue;
1501 : }
1502 :
1503 21019 : if (a->connection == conn) {
1504 21019 : if (now != 0) {
1505 21005 : a->idle_time = now;
1506 : }
1507 21019 : *_a = a;
1508 21019 : return NT_STATUS_OK;
1509 : }
1510 : }
1511 :
1512 58150 : return NT_STATUS_USER_SESSION_DELETED;
1513 : }
1514 :
1515 28238 : static int smbXsrv_session_auth0_destructor(struct smbXsrv_session_auth0 *a)
1516 : {
1517 28238 : if (a->session == NULL) {
1518 14 : return 0;
1519 : }
1520 :
1521 28224 : DLIST_REMOVE(a->session->pending_auth, a);
1522 28224 : a->session = NULL;
1523 28224 : return 0;
1524 : }
1525 :
1526 28236 : NTSTATUS smbXsrv_session_create_auth(struct smbXsrv_session *session,
1527 : struct smbXsrv_connection *conn,
1528 : NTTIME now,
1529 : uint8_t in_flags,
1530 : uint8_t in_security_mode,
1531 : struct smbXsrv_session_auth0 **_a)
1532 : {
1533 : struct smbXsrv_session_auth0 *a;
1534 : NTSTATUS status;
1535 :
1536 28236 : status = smbXsrv_session_find_auth(session, conn, 0, &a);
1537 28236 : if (NT_STATUS_IS_OK(status)) {
1538 0 : return NT_STATUS_INTERNAL_ERROR;
1539 : }
1540 :
1541 28236 : a = talloc_zero(session, struct smbXsrv_session_auth0);
1542 28236 : if (a == NULL) {
1543 0 : return NT_STATUS_NO_MEMORY;
1544 : }
1545 28236 : a->session = session;
1546 28236 : a->connection = conn;
1547 28236 : a->in_flags = in_flags;
1548 28236 : a->in_security_mode = in_security_mode;
1549 28236 : a->creation_time = now;
1550 28236 : a->idle_time = now;
1551 28236 : a->channel_id = conn->channel_id;
1552 :
1553 28236 : if (conn->protocol >= PROTOCOL_SMB3_11) {
1554 20263 : a->preauth = talloc(a, struct smbXsrv_preauth);
1555 20263 : if (a->preauth == NULL) {
1556 0 : TALLOC_FREE(session);
1557 0 : return NT_STATUS_NO_MEMORY;
1558 : }
1559 20263 : *a->preauth = conn->smb2.preauth;
1560 : }
1561 :
1562 28236 : talloc_set_destructor(a, smbXsrv_session_auth0_destructor);
1563 28236 : DLIST_ADD_END(session->pending_auth, a);
1564 :
1565 28236 : *_a = a;
1566 28236 : return NT_STATUS_OK;
1567 : }
1568 :
1569 : static void smbXsrv_session_remove_channel_done(struct tevent_req *subreq);
1570 :
1571 1692 : NTSTATUS smbXsrv_session_remove_channel(struct smbXsrv_session *session,
1572 : struct smbXsrv_connection *xconn)
1573 : {
1574 1692 : struct smbXsrv_session_auth0 *a = NULL;
1575 1692 : struct smbXsrv_channel_global0 *c = NULL;
1576 : NTSTATUS status;
1577 1692 : bool need_update = false;
1578 :
1579 1692 : status = smbXsrv_session_find_auth(session, xconn, 0, &a);
1580 1692 : if (!NT_STATUS_IS_OK(status)) {
1581 1678 : a = NULL;
1582 : }
1583 1692 : status = smbXsrv_session_find_channel(session, xconn, &c);
1584 1692 : if (!NT_STATUS_IS_OK(status)) {
1585 900 : c = NULL;
1586 : }
1587 :
1588 1692 : if (a != NULL) {
1589 14 : smbXsrv_session_auth0_destructor(a);
1590 14 : a->connection = NULL;
1591 14 : need_update = true;
1592 : }
1593 :
1594 1692 : if (c != NULL) {
1595 792 : struct smbXsrv_session_global0 *global = session->global;
1596 : ptrdiff_t n;
1597 :
1598 792 : n = (c - global->channels);
1599 792 : if (n >= global->num_channels || n < 0) {
1600 0 : return NT_STATUS_INTERNAL_ERROR;
1601 : }
1602 792 : ARRAY_DEL_ELEMENT(global->channels, n, global->num_channels);
1603 792 : global->num_channels--;
1604 792 : if (global->num_channels == 0) {
1605 40 : struct smbXsrv_client *client = session->client;
1606 40 : struct tevent_queue *xconn_wait_queue =
1607 : xconn->transport.shutdown_wait_queue;
1608 40 : struct tevent_req *subreq = NULL;
1609 :
1610 : /*
1611 : * Let the connection wait until the session is
1612 : * destroyed.
1613 : *
1614 : * We don't set a callback, as we just want to block the
1615 : * wait queue and the talloc_free() of the session will
1616 : * remove the item from the wait queue in order
1617 : * to remove allow the connection to disapear.
1618 : */
1619 40 : if (xconn_wait_queue != NULL) {
1620 40 : subreq = tevent_queue_wait_send(session,
1621 : client->raw_ev_ctx,
1622 : xconn_wait_queue);
1623 40 : if (subreq == NULL) {
1624 0 : status = NT_STATUS_NO_MEMORY;
1625 0 : DBG_ERR("tevent_queue_wait_send() session(%llu) failed: %s\n",
1626 : (unsigned long long)session->global->session_wire_id,
1627 : nt_errstr(status));
1628 0 : return status;
1629 : }
1630 : }
1631 :
1632 : /*
1633 : * This is garanteed to set
1634 : * session->status = NT_STATUS_USER_SESSION_DELETED
1635 : * even if NULL is returned.
1636 : */
1637 40 : subreq = smb2srv_session_shutdown_send(session,
1638 : client->raw_ev_ctx,
1639 : session,
1640 : NULL);
1641 40 : if (subreq == NULL) {
1642 0 : status = NT_STATUS_NO_MEMORY;
1643 0 : DBG_ERR("smb2srv_session_shutdown_send(%llu) failed: %s\n",
1644 : (unsigned long long)session->global->session_wire_id,
1645 : nt_errstr(status));
1646 0 : return status;
1647 : }
1648 40 : tevent_req_set_callback(subreq,
1649 : smbXsrv_session_remove_channel_done,
1650 : session);
1651 : }
1652 792 : need_update = true;
1653 : }
1654 :
1655 1692 : if (!need_update) {
1656 900 : return NT_STATUS_OK;
1657 : }
1658 :
1659 792 : return smbXsrv_session_update(session);
1660 : }
1661 :
1662 40 : static void smbXsrv_session_remove_channel_done(struct tevent_req *subreq)
1663 : {
1664 33 : struct smbXsrv_session *session =
1665 40 : tevent_req_callback_data(subreq,
1666 : struct smbXsrv_session);
1667 : NTSTATUS status;
1668 :
1669 40 : status = smb2srv_session_shutdown_recv(subreq);
1670 40 : TALLOC_FREE(subreq);
1671 40 : if (!NT_STATUS_IS_OK(status)) {
1672 0 : DBG_ERR("smb2srv_session_shutdown_recv(%llu) failed: %s\n",
1673 : (unsigned long long)session->global->session_wire_id,
1674 : nt_errstr(status));
1675 : }
1676 :
1677 40 : status = smbXsrv_session_logoff(session);
1678 40 : if (!NT_STATUS_IS_OK(status)) {
1679 0 : DBG_ERR("smbXsrv_session_logoff(%llu) failed: %s\n",
1680 : (unsigned long long)session->global->session_wire_id,
1681 : nt_errstr(status));
1682 : }
1683 :
1684 40 : TALLOC_FREE(session);
1685 40 : }
1686 :
1687 : struct smb2srv_session_shutdown_state {
1688 : struct tevent_queue *wait_queue;
1689 : };
1690 :
1691 : static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq);
1692 :
1693 1558 : struct tevent_req *smb2srv_session_shutdown_send(TALLOC_CTX *mem_ctx,
1694 : struct tevent_context *ev,
1695 : struct smbXsrv_session *session,
1696 : struct smbd_smb2_request *current_req)
1697 : {
1698 : struct tevent_req *req;
1699 : struct smb2srv_session_shutdown_state *state;
1700 : struct tevent_req *subreq;
1701 1558 : struct smbXsrv_connection *xconn = NULL;
1702 1558 : size_t len = 0;
1703 :
1704 : /*
1705 : * Make sure that no new request will be able to use this session.
1706 : */
1707 1558 : session->status = NT_STATUS_USER_SESSION_DELETED;
1708 :
1709 1558 : req = tevent_req_create(mem_ctx, &state,
1710 : struct smb2srv_session_shutdown_state);
1711 1558 : if (req == NULL) {
1712 0 : return NULL;
1713 : }
1714 :
1715 1558 : state->wait_queue = tevent_queue_create(state, "smb2srv_session_shutdown_queue");
1716 1558 : if (tevent_req_nomem(state->wait_queue, req)) {
1717 0 : return tevent_req_post(req, ev);
1718 : }
1719 :
1720 3194 : for (xconn = session->client->connections; xconn != NULL; xconn = xconn->next) {
1721 : struct smbd_smb2_request *preq;
1722 :
1723 3138 : for (preq = xconn->smb2.requests; preq != NULL; preq = preq->next) {
1724 1502 : if (preq == current_req) {
1725 : /* Can't cancel current request. */
1726 1468 : continue;
1727 : }
1728 34 : if (preq->session != session) {
1729 : /* Request on different session. */
1730 22 : continue;
1731 : }
1732 :
1733 12 : if (preq->subreq != NULL) {
1734 12 : tevent_req_cancel(preq->subreq);
1735 : }
1736 :
1737 : /*
1738 : * Now wait until the request is finished.
1739 : *
1740 : * We don't set a callback, as we just want to block the
1741 : * wait queue and the talloc_free() of the request will
1742 : * remove the item from the wait queue.
1743 : */
1744 12 : subreq = tevent_queue_wait_send(preq, ev, state->wait_queue);
1745 12 : if (tevent_req_nomem(subreq, req)) {
1746 0 : return tevent_req_post(req, ev);
1747 : }
1748 : }
1749 : }
1750 :
1751 1558 : len = tevent_queue_length(state->wait_queue);
1752 1558 : if (len == 0) {
1753 1546 : tevent_req_done(req);
1754 1546 : return tevent_req_post(req, ev);
1755 : }
1756 :
1757 : /*
1758 : * Now we add our own waiter to the end of the queue,
1759 : * this way we get notified when all pending requests are finished
1760 : * and send to the socket.
1761 : */
1762 12 : subreq = tevent_queue_wait_send(state, ev, state->wait_queue);
1763 12 : if (tevent_req_nomem(subreq, req)) {
1764 0 : return tevent_req_post(req, ev);
1765 : }
1766 12 : tevent_req_set_callback(subreq, smb2srv_session_shutdown_wait_done, req);
1767 :
1768 12 : return req;
1769 : }
1770 :
1771 12 : static void smb2srv_session_shutdown_wait_done(struct tevent_req *subreq)
1772 : {
1773 12 : struct tevent_req *req =
1774 12 : tevent_req_callback_data(subreq,
1775 : struct tevent_req);
1776 :
1777 12 : tevent_queue_wait_recv(subreq);
1778 12 : TALLOC_FREE(subreq);
1779 :
1780 12 : tevent_req_done(req);
1781 12 : }
1782 :
1783 1558 : NTSTATUS smb2srv_session_shutdown_recv(struct tevent_req *req)
1784 : {
1785 1558 : return tevent_req_simple_recv_ntstatus(req);
1786 : }
1787 :
1788 52648 : NTSTATUS smbXsrv_session_logoff(struct smbXsrv_session *session)
1789 : {
1790 : struct smbXsrv_session_table *table;
1791 52648 : struct db_record *local_rec = NULL;
1792 52648 : struct db_record *global_rec = NULL;
1793 52648 : struct smbd_server_connection *sconn = NULL;
1794 : NTSTATUS status;
1795 52648 : NTSTATUS error = NT_STATUS_OK;
1796 :
1797 52648 : if (session->table == NULL) {
1798 25267 : return NT_STATUS_OK;
1799 : }
1800 :
1801 27381 : table = session->table;
1802 27381 : session->table = NULL;
1803 :
1804 27381 : sconn = session->client->sconn;
1805 27381 : session->client = NULL;
1806 27381 : session->status = NT_STATUS_USER_SESSION_DELETED;
1807 :
1808 : /*
1809 : * For SMB2 this is a bit redundant as files are also close
1810 : * below via smb2srv_tcon_disconnect_all() -> ... ->
1811 : * smbXsrv_tcon_disconnect() -> close_cnum() ->
1812 : * file_close_conn().
1813 : */
1814 27381 : file_close_user(sconn, session->global->session_wire_id);
1815 :
1816 27381 : if (session->tcon_table != NULL) {
1817 : /*
1818 : * Note: We only have a tcon_table for SMB2.
1819 : */
1820 21731 : status = smb2srv_tcon_disconnect_all(session);
1821 21731 : if (!NT_STATUS_IS_OK(status)) {
1822 36 : DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1823 : "smb2srv_tcon_disconnect_all() failed: %s\n",
1824 : session->global->session_global_id,
1825 : nt_errstr(status)));
1826 36 : error = status;
1827 : }
1828 : }
1829 :
1830 27381 : invalidate_vuid(sconn, session->global->session_wire_id);
1831 :
1832 27381 : global_rec = session->global->db_rec;
1833 27381 : session->global->db_rec = NULL;
1834 27381 : if (global_rec == NULL) {
1835 27381 : global_rec = smbXsrv_session_global_fetch_locked(
1836 : table->global.db_ctx,
1837 26859 : session->global->session_global_id,
1838 26859 : session->global /* TALLOC_CTX */);
1839 27381 : if (global_rec == NULL) {
1840 0 : error = NT_STATUS_INTERNAL_ERROR;
1841 : }
1842 : }
1843 :
1844 27381 : if (global_rec != NULL) {
1845 27381 : status = dbwrap_record_delete(global_rec);
1846 27381 : if (!NT_STATUS_IS_OK(status)) {
1847 0 : TDB_DATA key = dbwrap_record_get_key(global_rec);
1848 :
1849 0 : DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1850 : "failed to delete global key '%s': %s\n",
1851 : session->global->session_global_id,
1852 : hex_encode_talloc(global_rec, key.dptr,
1853 : key.dsize),
1854 : nt_errstr(status)));
1855 0 : error = status;
1856 : }
1857 : }
1858 27381 : TALLOC_FREE(global_rec);
1859 :
1860 27381 : local_rec = session->db_rec;
1861 27381 : if (local_rec == NULL) {
1862 2365 : local_rec = smbXsrv_session_local_fetch_locked(
1863 : table->local.db_ctx,
1864 : session->local_id,
1865 : session /* TALLOC_CTX */);
1866 2365 : if (local_rec == NULL) {
1867 0 : error = NT_STATUS_INTERNAL_ERROR;
1868 : }
1869 : }
1870 :
1871 27381 : if (local_rec != NULL) {
1872 27381 : status = dbwrap_record_delete(local_rec);
1873 27381 : if (!NT_STATUS_IS_OK(status)) {
1874 0 : TDB_DATA key = dbwrap_record_get_key(local_rec);
1875 :
1876 0 : DEBUG(0, ("smbXsrv_session_logoff(0x%08x): "
1877 : "failed to delete local key '%s': %s\n",
1878 : session->global->session_global_id,
1879 : hex_encode_talloc(local_rec, key.dptr,
1880 : key.dsize),
1881 : nt_errstr(status)));
1882 0 : error = status;
1883 : }
1884 27381 : table->local.num_sessions -= 1;
1885 : }
1886 27381 : if (session->db_rec == NULL) {
1887 2365 : TALLOC_FREE(local_rec);
1888 : }
1889 27381 : session->db_rec = NULL;
1890 :
1891 27381 : return error;
1892 : }
1893 :
1894 : struct smbXsrv_session_logoff_all_state {
1895 : NTSTATUS first_status;
1896 : int errors;
1897 : };
1898 :
1899 : static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1900 : void *private_data);
1901 :
1902 27249 : NTSTATUS smbXsrv_session_logoff_all(struct smbXsrv_client *client)
1903 : {
1904 27249 : struct smbXsrv_session_table *table = client->session_table;
1905 : struct smbXsrv_session_logoff_all_state state;
1906 : NTSTATUS status;
1907 27249 : int count = 0;
1908 :
1909 27249 : if (table == NULL) {
1910 570 : DEBUG(10, ("smbXsrv_session_logoff_all: "
1911 : "empty session_table, nothing to do.\n"));
1912 570 : return NT_STATUS_OK;
1913 : }
1914 :
1915 26679 : ZERO_STRUCT(state);
1916 :
1917 26679 : status = dbwrap_traverse(table->local.db_ctx,
1918 : smbXsrv_session_logoff_all_callback,
1919 : &state, &count);
1920 26679 : if (!NT_STATUS_IS_OK(status)) {
1921 0 : DEBUG(0, ("smbXsrv_session_logoff_all: "
1922 : "dbwrap_traverse() failed: %s\n",
1923 : nt_errstr(status)));
1924 0 : return status;
1925 : }
1926 :
1927 26679 : if (!NT_STATUS_IS_OK(state.first_status)) {
1928 36 : DEBUG(0, ("smbXsrv_session_logoff_all: "
1929 : "count[%d] errors[%d] first[%s]\n",
1930 : count, state.errors,
1931 : nt_errstr(state.first_status)));
1932 36 : return state.first_status;
1933 : }
1934 :
1935 26643 : return NT_STATUS_OK;
1936 : }
1937 :
1938 25016 : static int smbXsrv_session_logoff_all_callback(struct db_record *local_rec,
1939 : void *private_data)
1940 : {
1941 25016 : struct smbXsrv_session_logoff_all_state *state =
1942 : (struct smbXsrv_session_logoff_all_state *)private_data;
1943 : TDB_DATA val;
1944 25016 : void *ptr = NULL;
1945 25016 : struct smbXsrv_session *session = NULL;
1946 : NTSTATUS status;
1947 :
1948 25016 : val = dbwrap_record_get_value(local_rec);
1949 25016 : if (val.dsize != sizeof(ptr)) {
1950 0 : status = NT_STATUS_INTERNAL_ERROR;
1951 0 : if (NT_STATUS_IS_OK(state->first_status)) {
1952 0 : state->first_status = status;
1953 : }
1954 0 : state->errors++;
1955 0 : return 0;
1956 : }
1957 :
1958 25016 : memcpy(&ptr, val.dptr, val.dsize);
1959 25016 : session = talloc_get_type_abort(ptr, struct smbXsrv_session);
1960 :
1961 25016 : session->db_rec = local_rec;
1962 25016 : status = smbXsrv_session_clear_and_logoff(session);
1963 25016 : session->db_rec = NULL;
1964 25016 : if (!NT_STATUS_IS_OK(status)) {
1965 36 : if (NT_STATUS_IS_OK(state->first_status)) {
1966 36 : state->first_status = status;
1967 : }
1968 36 : state->errors++;
1969 36 : return 0;
1970 : }
1971 :
1972 24458 : return 0;
1973 : }
1974 :
1975 : struct smbXsrv_session_local_trav_state {
1976 : NTSTATUS status;
1977 : int (*caller_cb)(struct smbXsrv_session *session,
1978 : void *caller_data);
1979 : void *caller_data;
1980 : };
1981 :
1982 : static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
1983 : void *private_data);
1984 :
1985 0 : NTSTATUS smbXsrv_session_local_traverse(
1986 : struct smbXsrv_client *client,
1987 : int (*caller_cb)(struct smbXsrv_session *session,
1988 : void *caller_data),
1989 : void *caller_data)
1990 : {
1991 0 : struct smbXsrv_session_table *table = client->session_table;
1992 : struct smbXsrv_session_local_trav_state state;
1993 : NTSTATUS status;
1994 0 : int count = 0;
1995 :
1996 0 : state = (struct smbXsrv_session_local_trav_state) {
1997 : .status = NT_STATUS_OK,
1998 : .caller_cb = caller_cb,
1999 : .caller_data = caller_data,
2000 : };
2001 :
2002 0 : if (table == NULL) {
2003 0 : DBG_DEBUG("empty session_table, nothing to do.\n");
2004 0 : return NT_STATUS_OK;
2005 : }
2006 :
2007 0 : status = dbwrap_traverse(table->local.db_ctx,
2008 : smbXsrv_session_local_traverse_cb,
2009 : &state,
2010 : &count);
2011 0 : if (!NT_STATUS_IS_OK(status)) {
2012 0 : DBG_ERR("dbwrap_traverse() failed: %s\n", nt_errstr(status));
2013 0 : return status;
2014 : }
2015 0 : if (!NT_STATUS_IS_OK(state.status)) {
2016 0 : DBG_ERR("count[%d] status[%s]\n",
2017 : count, nt_errstr(state.status));
2018 0 : return state.status;
2019 : }
2020 :
2021 0 : return NT_STATUS_OK;
2022 : }
2023 :
2024 0 : static int smbXsrv_session_local_traverse_cb(struct db_record *local_rec,
2025 : void *private_data)
2026 : {
2027 0 : struct smbXsrv_session_local_trav_state *state =
2028 : (struct smbXsrv_session_local_trav_state *)private_data;
2029 : TDB_DATA val;
2030 0 : void *ptr = NULL;
2031 0 : struct smbXsrv_session *session = NULL;
2032 : int ret;
2033 :
2034 0 : val = dbwrap_record_get_value(local_rec);
2035 0 : if (val.dsize != sizeof(ptr)) {
2036 0 : state->status = NT_STATUS_INTERNAL_ERROR;
2037 0 : return -1;
2038 : }
2039 :
2040 0 : memcpy(&ptr, val.dptr, val.dsize);
2041 0 : session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2042 :
2043 0 : session->db_rec = local_rec;
2044 0 : ret = state->caller_cb(session, state->caller_data);
2045 0 : session->db_rec = NULL;
2046 :
2047 0 : return ret;
2048 : }
2049 :
2050 : struct smbXsrv_session_disconnect_xconn_state {
2051 : struct smbXsrv_connection *xconn;
2052 : NTSTATUS first_status;
2053 : int errors;
2054 : };
2055 :
2056 : static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
2057 : void *private_data);
2058 :
2059 930 : NTSTATUS smbXsrv_session_disconnect_xconn(struct smbXsrv_connection *xconn)
2060 : {
2061 930 : struct smbXsrv_client *client = xconn->client;
2062 930 : struct smbXsrv_session_table *table = client->session_table;
2063 : struct smbXsrv_session_disconnect_xconn_state state;
2064 : NTSTATUS status;
2065 930 : int count = 0;
2066 :
2067 930 : if (table == NULL) {
2068 0 : DBG_ERR("empty session_table, nothing to do.\n");
2069 0 : return NT_STATUS_OK;
2070 : }
2071 :
2072 930 : ZERO_STRUCT(state);
2073 930 : state.xconn = xconn;
2074 :
2075 930 : status = dbwrap_traverse(table->local.db_ctx,
2076 : smbXsrv_session_disconnect_xconn_callback,
2077 : &state, &count);
2078 930 : if (!NT_STATUS_IS_OK(status)) {
2079 0 : DBG_ERR("dbwrap_traverse() failed: %s\n",
2080 : nt_errstr(status));
2081 0 : return status;
2082 : }
2083 :
2084 930 : if (!NT_STATUS_IS_OK(state.first_status)) {
2085 0 : DBG_ERR("count[%d] errors[%d] first[%s]\n",
2086 : count, state.errors,
2087 : nt_errstr(state.first_status));
2088 0 : return state.first_status;
2089 : }
2090 :
2091 930 : return NT_STATUS_OK;
2092 : }
2093 :
2094 998 : static int smbXsrv_session_disconnect_xconn_callback(struct db_record *local_rec,
2095 : void *private_data)
2096 : {
2097 998 : struct smbXsrv_session_disconnect_xconn_state *state =
2098 : (struct smbXsrv_session_disconnect_xconn_state *)private_data;
2099 : TDB_DATA val;
2100 998 : void *ptr = NULL;
2101 998 : struct smbXsrv_session *session = NULL;
2102 : NTSTATUS status;
2103 :
2104 998 : val = dbwrap_record_get_value(local_rec);
2105 998 : if (val.dsize != sizeof(ptr)) {
2106 0 : status = NT_STATUS_INTERNAL_ERROR;
2107 0 : if (NT_STATUS_IS_OK(state->first_status)) {
2108 0 : state->first_status = status;
2109 : }
2110 0 : state->errors++;
2111 0 : return 0;
2112 : }
2113 :
2114 998 : memcpy(&ptr, val.dptr, val.dsize);
2115 998 : session = talloc_get_type_abort(ptr, struct smbXsrv_session);
2116 :
2117 998 : session->db_rec = local_rec;
2118 998 : status = smbXsrv_session_remove_channel(session, state->xconn);
2119 998 : session->db_rec = NULL;
2120 998 : if (!NT_STATUS_IS_OK(status)) {
2121 0 : if (NT_STATUS_IS_OK(state->first_status)) {
2122 0 : state->first_status = status;
2123 : }
2124 0 : state->errors++;
2125 : }
2126 :
2127 998 : return 0;
2128 : }
2129 :
2130 4877 : NTSTATUS smb1srv_session_table_init(struct smbXsrv_connection *conn)
2131 : {
2132 : /*
2133 : * Allow a range from 1..65534 with 65534 values.
2134 : */
2135 4877 : return smbXsrv_session_table_init(conn, 1, UINT16_MAX - 1,
2136 : UINT16_MAX - 1);
2137 : }
2138 :
2139 661286 : NTSTATUS smb1srv_session_lookup(struct smbXsrv_connection *conn,
2140 : uint16_t vuid, NTTIME now,
2141 : struct smbXsrv_session **session)
2142 : {
2143 661286 : struct smbXsrv_session_table *table = conn->client->session_table;
2144 661286 : uint32_t local_id = vuid;
2145 :
2146 661286 : return smbXsrv_session_local_lookup(table, conn, local_id, now,
2147 : session);
2148 : }
2149 :
2150 1849623 : NTSTATUS smbXsrv_session_info_lookup(struct smbXsrv_client *client,
2151 : uint64_t session_wire_id,
2152 : struct auth_session_info **si)
2153 : {
2154 1849623 : struct smbXsrv_session_table *table = client->session_table;
2155 : uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2156 1849623 : struct smbXsrv_session_local_fetch_state state = {
2157 : .session = NULL,
2158 : .status = NT_STATUS_INTERNAL_ERROR,
2159 : };
2160 : TDB_DATA key;
2161 : NTSTATUS status;
2162 :
2163 1849623 : if (session_wire_id == 0) {
2164 0 : return NT_STATUS_USER_SESSION_DELETED;
2165 : }
2166 :
2167 1849623 : if (table == NULL) {
2168 : /* this might happen before the end of negprot */
2169 0 : return NT_STATUS_USER_SESSION_DELETED;
2170 : }
2171 :
2172 1849623 : if (table->local.db_ctx == NULL) {
2173 0 : return NT_STATUS_INTERNAL_ERROR;
2174 : }
2175 :
2176 1865228 : key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2177 :
2178 1849623 : status = dbwrap_parse_record(table->local.db_ctx, key,
2179 : smbXsrv_session_local_fetch_parser,
2180 : &state);
2181 1849623 : if (!NT_STATUS_IS_OK(status)) {
2182 17 : return status;
2183 : }
2184 1849606 : if (!NT_STATUS_IS_OK(state.status)) {
2185 0 : return state.status;
2186 : }
2187 1849606 : if (state.session->global->auth_session_info == NULL) {
2188 0 : return NT_STATUS_USER_SESSION_DELETED;
2189 : }
2190 :
2191 1849606 : *si = state.session->global->auth_session_info;
2192 1849606 : return NT_STATUS_OK;
2193 : }
2194 :
2195 : /*
2196 : * In memory of get_valid_user_struct()
2197 : *
2198 : * This function is similar to smbXsrv_session_local_lookup() and it's wrappers,
2199 : * but it doesn't implement the state checks of
2200 : * those. get_valid_smbXsrv_session() is NOT meant to be called to validate the
2201 : * session wire-id of incoming SMB requests, it MUST only be used in later
2202 : * internal processing where the session wire-id has already been validated.
2203 : */
2204 27696 : NTSTATUS get_valid_smbXsrv_session(struct smbXsrv_client *client,
2205 : uint64_t session_wire_id,
2206 : struct smbXsrv_session **session)
2207 : {
2208 27696 : struct smbXsrv_session_table *table = client->session_table;
2209 : uint8_t key_buf[SMBXSRV_SESSION_LOCAL_TDB_KEY_SIZE];
2210 27696 : struct smbXsrv_session_local_fetch_state state = {
2211 : .session = NULL,
2212 : .status = NT_STATUS_INTERNAL_ERROR,
2213 : };
2214 : TDB_DATA key;
2215 : NTSTATUS status;
2216 :
2217 27696 : if (session_wire_id == 0) {
2218 0 : return NT_STATUS_USER_SESSION_DELETED;
2219 : }
2220 :
2221 27696 : if (table == NULL) {
2222 : /* this might happen before the end of negprot */
2223 0 : return NT_STATUS_USER_SESSION_DELETED;
2224 : }
2225 :
2226 27696 : if (table->local.db_ctx == NULL) {
2227 0 : return NT_STATUS_INTERNAL_ERROR;
2228 : }
2229 :
2230 28218 : key = smbXsrv_session_local_id_to_key(session_wire_id, key_buf);
2231 :
2232 27696 : status = dbwrap_parse_record(table->local.db_ctx, key,
2233 : smbXsrv_session_local_fetch_parser,
2234 : &state);
2235 27696 : if (!NT_STATUS_IS_OK(status)) {
2236 0 : return status;
2237 : }
2238 27696 : if (!NT_STATUS_IS_OK(state.status)) {
2239 0 : return state.status;
2240 : }
2241 27696 : if (state.session->global->auth_session_info == NULL) {
2242 2102 : return NT_STATUS_USER_SESSION_DELETED;
2243 : }
2244 :
2245 25594 : *session = state.session;
2246 25594 : return NT_STATUS_OK;
2247 : }
2248 :
2249 22593 : NTSTATUS smb2srv_session_lookup_global(struct smbXsrv_client *client,
2250 : uint64_t session_wire_id,
2251 : TALLOC_CTX *mem_ctx,
2252 : struct smbXsrv_session **_session)
2253 : {
2254 22593 : TALLOC_CTX *frame = talloc_stackframe();
2255 22593 : struct smbXsrv_session_table *table = client->session_table;
2256 22593 : uint32_t global_id = session_wire_id & UINT32_MAX;
2257 22593 : uint64_t global_zeros = session_wire_id & 0xFFFFFFFF00000000LLU;
2258 22593 : struct smbXsrv_session *session = NULL;
2259 22593 : struct db_record *global_rec = NULL;
2260 22593 : bool is_free = false;
2261 : NTSTATUS status;
2262 :
2263 22593 : if (global_id == 0) {
2264 21733 : TALLOC_FREE(frame);
2265 21733 : return NT_STATUS_USER_SESSION_DELETED;
2266 : }
2267 860 : if (global_zeros != 0) {
2268 0 : TALLOC_FREE(frame);
2269 0 : return NT_STATUS_USER_SESSION_DELETED;
2270 : }
2271 :
2272 860 : if (table == NULL) {
2273 : /* this might happen before the end of negprot */
2274 0 : TALLOC_FREE(frame);
2275 0 : return NT_STATUS_USER_SESSION_DELETED;
2276 : }
2277 :
2278 860 : if (table->global.db_ctx == NULL) {
2279 0 : TALLOC_FREE(frame);
2280 0 : return NT_STATUS_INTERNAL_ERROR;
2281 : }
2282 :
2283 860 : session = talloc_zero(mem_ctx, struct smbXsrv_session);
2284 860 : if (session == NULL) {
2285 0 : TALLOC_FREE(frame);
2286 0 : return NT_STATUS_NO_MEMORY;
2287 : }
2288 860 : talloc_steal(frame, session);
2289 :
2290 860 : session->client = client;
2291 860 : session->status = NT_STATUS_BAD_LOGON_SESSION_STATE;
2292 860 : session->local_id = global_id;
2293 :
2294 : /*
2295 : * This means smb2_get_new_nonce() will return
2296 : * NT_STATUS_ENCRYPTION_FAILED.
2297 : *
2298 : * But we intialize some random parts just in case...
2299 : */
2300 860 : session->nonce_high_max = session->nonce_high = 0;
2301 860 : generate_nonce_buffer((uint8_t *)&session->nonce_high_random,
2302 : sizeof(session->nonce_high_random));
2303 860 : generate_nonce_buffer((uint8_t *)&session->nonce_low,
2304 : sizeof(session->nonce_low));
2305 :
2306 860 : global_rec = smbXsrv_session_global_fetch_locked(table->global.db_ctx,
2307 : global_id,
2308 : frame);
2309 860 : if (global_rec == NULL) {
2310 0 : TALLOC_FREE(frame);
2311 0 : return NT_STATUS_INTERNAL_DB_ERROR;
2312 : }
2313 :
2314 860 : smbXsrv_session_global_verify_record(global_rec,
2315 : &is_free,
2316 : NULL,
2317 : session,
2318 860 : &session->global);
2319 860 : if (is_free) {
2320 10 : TALLOC_FREE(frame);
2321 10 : return NT_STATUS_USER_SESSION_DELETED;
2322 : }
2323 :
2324 : /*
2325 : * We don't have channels on this session
2326 : * and only the main signing key
2327 : */
2328 850 : session->global->num_channels = 0;
2329 1431 : status = smb2_signing_key_sign_create(session->global,
2330 850 : session->global->signing_algo,
2331 : NULL, /* no master key */
2332 : NULL, /* derivations */
2333 850 : &session->global->signing_key);
2334 850 : if (!NT_STATUS_IS_OK(status)) {
2335 0 : TALLOC_FREE(frame);
2336 0 : return NT_STATUS_NO_MEMORY;
2337 : }
2338 850 : session->global->signing_key->blob = session->global->signing_key_blob;
2339 850 : session->global->signing_flags = 0;
2340 :
2341 1431 : status = smb2_signing_key_cipher_create(session->global,
2342 850 : session->global->encryption_cipher,
2343 : NULL, /* no master key */
2344 : NULL, /* derivations */
2345 850 : &session->global->decryption_key);
2346 850 : if (!NT_STATUS_IS_OK(status)) {
2347 0 : TALLOC_FREE(frame);
2348 0 : return NT_STATUS_NO_MEMORY;
2349 : }
2350 850 : session->global->decryption_key->blob = session->global->decryption_key_blob;
2351 850 : session->global->encryption_flags = 0;
2352 :
2353 850 : *_session = talloc_move(mem_ctx, &session);
2354 850 : TALLOC_FREE(frame);
2355 850 : return NT_STATUS_OK;
2356 : }
2357 :
2358 21816 : NTSTATUS smb2srv_session_table_init(struct smbXsrv_connection *conn)
2359 : {
2360 : /*
2361 : * Allow a range from 1..4294967294 with 65534 (same as SMB1) values.
2362 : */
2363 21816 : return smbXsrv_session_table_init(conn, 1, UINT32_MAX - 1,
2364 : UINT16_MAX - 1);
2365 : }
2366 :
2367 1398420 : static NTSTATUS smb2srv_session_lookup_raw(struct smbXsrv_session_table *table,
2368 : /* conn: optional */
2369 : struct smbXsrv_connection *conn,
2370 : uint64_t session_id, NTTIME now,
2371 : struct smbXsrv_session **session)
2372 : {
2373 1407780 : uint32_t local_id = session_id & UINT32_MAX;
2374 1407780 : uint64_t local_zeros = session_id & 0xFFFFFFFF00000000LLU;
2375 :
2376 1407780 : if (local_zeros != 0) {
2377 24 : return NT_STATUS_USER_SESSION_DELETED;
2378 : }
2379 :
2380 1407756 : return smbXsrv_session_local_lookup(table, conn, local_id, now,
2381 : session);
2382 : }
2383 :
2384 1367576 : NTSTATUS smb2srv_session_lookup_conn(struct smbXsrv_connection *conn,
2385 : uint64_t session_id, NTTIME now,
2386 : struct smbXsrv_session **session)
2387 : {
2388 1367576 : struct smbXsrv_session_table *table = conn->client->session_table;
2389 1367576 : return smb2srv_session_lookup_raw(table, conn, session_id, now,
2390 : session);
2391 : }
2392 :
2393 40204 : NTSTATUS smb2srv_session_lookup_client(struct smbXsrv_client *client,
2394 : uint64_t session_id, NTTIME now,
2395 : struct smbXsrv_session **session)
2396 : {
2397 40204 : struct smbXsrv_session_table *table = client->session_table;
2398 40204 : return smb2srv_session_lookup_raw(table, NULL, session_id, now,
2399 : session);
2400 : }
2401 :
2402 : struct smbXsrv_session_global_traverse_state {
2403 : int (*fn)(struct smbXsrv_session_global0 *, void *);
2404 : void *private_data;
2405 : };
2406 :
2407 28 : static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
2408 : {
2409 28 : int ret = -1;
2410 28 : struct smbXsrv_session_global_traverse_state *state =
2411 : (struct smbXsrv_session_global_traverse_state*)data;
2412 28 : TDB_DATA key = dbwrap_record_get_key(rec);
2413 28 : TDB_DATA val = dbwrap_record_get_value(rec);
2414 28 : DATA_BLOB blob = data_blob_const(val.dptr, val.dsize);
2415 : struct smbXsrv_session_globalB global_blob;
2416 : enum ndr_err_code ndr_err;
2417 28 : TALLOC_CTX *frame = talloc_stackframe();
2418 :
2419 28 : ndr_err = ndr_pull_struct_blob(&blob, frame, &global_blob,
2420 : (ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_globalB);
2421 28 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2422 0 : DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2423 : "key '%s' ndr_pull_struct_blob - %s\n",
2424 : hex_encode_talloc(frame, key.dptr, key.dsize),
2425 : ndr_errstr(ndr_err)));
2426 0 : goto done;
2427 : }
2428 :
2429 28 : if (global_blob.version != SMBXSRV_VERSION_0) {
2430 0 : DEBUG(1,("Invalid record in smbXsrv_session_global.tdb:"
2431 : "key '%s' unsupported version - %d\n",
2432 : hex_encode_talloc(frame, key.dptr, key.dsize),
2433 : (int)global_blob.version));
2434 0 : goto done;
2435 : }
2436 :
2437 28 : if (global_blob.info.info0 == NULL) {
2438 0 : DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
2439 : "key '%s' info0 NULL pointer\n",
2440 : hex_encode_talloc(frame, key.dptr, key.dsize)));
2441 0 : goto done;
2442 : }
2443 :
2444 28 : global_blob.info.info0->db_rec = rec;
2445 28 : ret = state->fn(global_blob.info.info0, state->private_data);
2446 28 : done:
2447 28 : TALLOC_FREE(frame);
2448 28 : return ret;
2449 : }
2450 :
2451 28 : NTSTATUS smbXsrv_session_global_traverse(
2452 : int (*fn)(struct smbXsrv_session_global0 *, void *),
2453 : void *private_data)
2454 : {
2455 :
2456 : NTSTATUS status;
2457 28 : int count = 0;
2458 28 : struct smbXsrv_session_global_traverse_state state = {
2459 : .fn = fn,
2460 : .private_data = private_data,
2461 : };
2462 :
2463 28 : become_root();
2464 28 : status = smbXsrv_session_global_init(NULL);
2465 28 : if (!NT_STATUS_IS_OK(status)) {
2466 0 : unbecome_root();
2467 0 : DEBUG(0, ("Failed to initialize session_global: %s\n",
2468 : nt_errstr(status)));
2469 0 : return status;
2470 : }
2471 :
2472 28 : status = dbwrap_traverse_read(smbXsrv_session_global_db_ctx,
2473 : smbXsrv_session_global_traverse_fn,
2474 : &state,
2475 : &count);
2476 28 : unbecome_root();
2477 :
2478 28 : return status;
2479 : }
|
