?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smbd: Remove unused "pcd" arg from smb1_srv_send()
[Samba.git] / source3 / smbd / smb1_process.c
blob0d2724fcff05f0abca99f0251b05300c6f59c79d
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "smbd/smbXsrv_open.h"
27 #include "librpc/gen_ndr/netlogon.h"
28 #include "../lib/async_req/async_sock.h"
29 #include "ctdbd_conn.h"
30 #include "../lib/util/select.h"
31 #include "printing/queue_process.h"
32 #include "system/select.h"
33 #include "passdb.h"
34 #include "auth.h"
35 #include "messages.h"
36 #include "lib/messages_ctdb.h"
37 #include "smbprofile.h"
38 #include "rpc_server/spoolss/srv_spoolss_nt.h"
39 #include "../lib/util/tevent_ntstatus.h"
40 #include "../libcli/security/dom_sid.h"
41 #include "../libcli/security/security_token.h"
42 #include "lib/id_cache.h"
43 #include "lib/util/sys_rw_data.h"
44 #include "system/threads.h"
45 #include "lib/pthreadpool/pthreadpool_tevent.h"
46 #include "util_event.h"
47 #include "libcli/smb/smbXcli_base.h"
48 #include "lib/util/time_basic.h"
49 #include "source3/lib/substitute.h"
50 #include "lib/util/util_process.h"
51
52 /* Internal message queue for deferred opens. */
53 struct pending_message_list {
54 struct pending_message_list *next, *prev;
55 struct timeval request_time; /* When was this first issued? */
56 struct smbd_server_connection *sconn;
57 struct smbXsrv_connection *xconn;
58 struct tevent_timer *te;
59 struct smb_perfcount_data pcd;
60 uint32_t seqnum;
61 bool encrypted;
62 bool processed;
63 DATA_BLOB buf;
64 struct deferred_open_record *open_rec;
65 };
66
67 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
68
69 void smbd_echo_init(struct smbXsrv_connection *xconn)
70 {
71 xconn->smb1.echo_handler.trusted_fd = -1;
72 xconn->smb1.echo_handler.socket_lock_fd = -1;
73 #ifdef HAVE_ROBUST_MUTEXES
74 xconn->smb1.echo_handler.socket_mutex = NULL;
75 #endif
76 }
77
78 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
79 {
80 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
81 return true;
82 }
83
84 #ifdef HAVE_ROBUST_MUTEXES
85 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
86 return true;
87 }
88 #endif
89
90 return false;
91 }
92
93 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
94 {
95 if (!smbd_echo_active(xconn)) {
96 return true;
97 }
98
99 xconn->smb1.echo_handler.ref_count++;
100
101 if (xconn->smb1.echo_handler.ref_count > 1) {
102 return true;
103 }
104
105 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
106
107 #ifdef HAVE_ROBUST_MUTEXES
108 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
109 int ret = EINTR;
110
111 while (ret == EINTR) {
112 ret = pthread_mutex_lock(
113 xconn->smb1.echo_handler.socket_mutex);
114 if (ret == 0) {
115 break;
116 }
117 }
118 if (ret != 0) {
119 DEBUG(1, ("pthread_mutex_lock failed: %s\n",
120 strerror(ret)));
121 return false;
122 }
123 }
124 #endif
125
126 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
127 bool ok;
128
129 do {
130 ok = fcntl_lock(
131 xconn->smb1.echo_handler.socket_lock_fd,
132 F_SETLKW, 0, 0, F_WRLCK);
133 } while (!ok && (errno == EINTR));
134
135 if (!ok) {
136 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
137 return false;
138 }
139 }
140
141 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
142
143 return true;
144 }
145
146 void smbd_lock_socket(struct smbXsrv_connection *xconn)
147 {
148 if (!smbd_lock_socket_internal(xconn)) {
149 exit_server_cleanly("failed to lock socket");
150 }
151 }
152
153 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
154 {
155 if (!smbd_echo_active(xconn)) {
156 return true;
157 }
158
159 xconn->smb1.echo_handler.ref_count--;
160
161 if (xconn->smb1.echo_handler.ref_count > 0) {
162 return true;
163 }
164
165 #ifdef HAVE_ROBUST_MUTEXES
166 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
167 int ret;
168 ret = pthread_mutex_unlock(
169 xconn->smb1.echo_handler.socket_mutex);
170 if (ret != 0) {
171 DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
172 strerror(ret)));
173 return false;
174 }
175 }
176 #endif
177
178 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
179 bool ok;
180
181 do {
182 ok = fcntl_lock(
183 xconn->smb1.echo_handler.socket_lock_fd,
184 F_SETLKW, 0, 0, F_UNLCK);
185 } while (!ok && (errno == EINTR));
186
187 if (!ok) {
188 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
189 return false;
190 }
191 }
192
193 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
194
195 return true;
196 }
197
198 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
199 {
200 if (!smbd_unlock_socket_internal(xconn)) {
201 exit_server_cleanly("failed to unlock socket");
202 }
203 }
204
205 /* Accessor function for smb_read_error for smbd functions. */
206
207 /****************************************************************************
208 Send an smb to a fd.
209 ****************************************************************************/
210
211 bool smb1_srv_send(struct smbXsrv_connection *xconn,
212 char *buffer,
213 bool do_signing,
214 uint32_t seqnum,
215 bool do_encrypt)
216 {
217 size_t len = 0;
218 ssize_t ret;
219 char *buf_out = buffer;
220
221 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
222 /*
223 * we're not supposed to do any io
224 */
225 return true;
226 }
227
228 smbd_lock_socket(xconn);
229
230 if (do_signing) {
231 NTSTATUS status;
232
233 /* Sign the outgoing packet if required. */
234 status = smb1_srv_calculate_sign_mac(xconn, buf_out, seqnum);
235 if (!NT_STATUS_IS_OK(status)) {
236 DBG_ERR("Failed to calculate signing mac: %s\n",
237 nt_errstr(status));
238 return false;
239 }
240 }
241
242 if (do_encrypt) {
243 char *enc = NULL;
244 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &enc);
245 if (!NT_STATUS_IS_OK(status)) {
246 DEBUG(0, ("send_smb: SMB encryption failed "
247 "on outgoing packet! Error %s\n",
248 nt_errstr(status) ));
249 SAFE_FREE(enc);
250 ret = -1;
251 goto out;
252 }
253 buf_out = enc;
254 }
255
256 len = smb_len_large(buf_out) + 4;
257
258 ret = write_data(xconn->transport.sock, buf_out, len);
259 if (ret <= 0) {
260 int saved_errno = errno;
261 /*
262 * Try and give an error message saying what
263 * client failed.
264 */
265 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
266 (int)getpid(), (int)len,
267 smbXsrv_connection_dbg(xconn),
268 (int)ret, strerror(saved_errno)));
269 errno = saved_errno;
270
271 srv_free_enc_buffer(xconn, buf_out);
272 goto out;
273 }
274
275 srv_free_enc_buffer(xconn, buf_out);
276 out:
277 smbd_unlock_socket(xconn);
278 return (ret > 0);
279 }
280
281 /* Socket functions for smbd packet processing. */
282
283 static bool valid_packet_size(size_t len)
284 {
285 /*
286 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
287 * of header. Don't print the error if this fits.... JRA.
288 */
289
290 if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
291 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
292 (unsigned long)len));
293 return false;
294 }
295 return true;
296 }
297
298 /****************************************************************************
299 Attempt a zerocopy writeX read. We know here that len > smb_size-4
300 ****************************************************************************/
301
302 /*
303 * Unfortunately, earlier versions of smbclient/libsmbclient
304 * don't send this "standard" writeX header. I've fixed this
305 * for 3.2 but we'll use the old method with earlier versions.
306 * Windows and CIFSFS at least use this standard size. Not
307 * sure about MacOSX.
308 */
309
310 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
311 (2*14) + /* word count (including bcc) */ \
312 1 /* pad byte */)
313
314 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
315 const char lenbuf[4],
316 struct smbXsrv_connection *xconn,
317 int sock,
318 char **buffer,
319 unsigned int timeout,
320 size_t *p_unread,
321 size_t *len_ret)
322 {
323 /* Size of a WRITEX call (+4 byte len). */
324 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
325 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
326 ssize_t toread;
327 NTSTATUS status;
328
329 memcpy(writeX_header, lenbuf, 4);
330
331 status = read_fd_with_timeout(
332 sock, writeX_header + 4,
333 STANDARD_WRITE_AND_X_HEADER_SIZE,
334 STANDARD_WRITE_AND_X_HEADER_SIZE,
335 timeout, NULL);
336
337 if (!NT_STATUS_IS_OK(status)) {
338 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
339 "error = %s.\n",
340 smbXsrv_connection_dbg(xconn),
341 nt_errstr(status)));
342 return status;
343 }
344
345 /*
346 * Ok - now try and see if this is a possible
347 * valid writeX call.
348 */
349
350 if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
351 /*
352 * If the data offset is beyond what
353 * we've read, drain the extra bytes.
354 */
355 uint16_t doff = SVAL(writeX_header,smb_vwv11);
356 ssize_t newlen;
357
358 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
359 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
360 if (drain_socket(sock, drain) != drain) {
361 smb_panic("receive_smb_raw_talloc_partial_read:"
362 " failed to drain pending bytes");
363 }
364 } else {
365 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
366 }
367
368 /* Spoof down the length and null out the bcc. */
369 set_message_bcc(writeX_header, 0);
370 newlen = smb_len(writeX_header);
371
372 /* Copy the header we've written. */
373
374 *buffer = (char *)talloc_memdup(mem_ctx,
375 writeX_header,
376 sizeof(writeX_header));
377
378 if (*buffer == NULL) {
379 DEBUG(0, ("Could not allocate inbuf of length %d\n",
380 (int)sizeof(writeX_header)));
381 return NT_STATUS_NO_MEMORY;
382 }
383
384 /* Work out the remaining bytes. */
385 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
386 *len_ret = newlen + 4;
387 return NT_STATUS_OK;
388 }
389
390 if (!valid_packet_size(len)) {
391 return NT_STATUS_INVALID_PARAMETER;
392 }
393
394 /*
395 * Not a valid writeX call. Just do the standard
396 * talloc and return.
397 */
398
399 *buffer = talloc_array(mem_ctx, char, len+4);
400
401 if (*buffer == NULL) {
402 DEBUG(0, ("Could not allocate inbuf of length %d\n",
403 (int)len+4));
404 return NT_STATUS_NO_MEMORY;
405 }
406
407 /* Copy in what we already read. */
408 memcpy(*buffer,
409 writeX_header,
410 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
411 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
412
413 if(toread > 0) {
414 status = read_packet_remainder(
415 sock,
416 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
417 timeout, toread);
418
419 if (!NT_STATUS_IS_OK(status)) {
420 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
421 nt_errstr(status)));
422 return status;
423 }
424 }
425
426 *len_ret = len + 4;
427 return NT_STATUS_OK;
428 }
429
430 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
431 struct smbXsrv_connection *xconn,
432 int sock,
433 char **buffer, unsigned int timeout,
434 size_t *p_unread, size_t *plen)
435 {
436 char lenbuf[4];
437 size_t len;
438 int min_recv_size = lp_min_receive_file_size();
439 NTSTATUS status;
440
441 *p_unread = 0;
442
443 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
444 &len);
445 if (!NT_STATUS_IS_OK(status)) {
446 return status;
447 }
448
449 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
450 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
451 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
452 !smb1_srv_is_signing_active(xconn) &&
453 xconn->smb1.echo_handler.trusted_fde == NULL) {
454
455 return receive_smb_raw_talloc_partial_read(
456 mem_ctx, lenbuf, xconn, sock, buffer, timeout,
457 p_unread, plen);
458 }
459
460 if (!valid_packet_size(len)) {
461 return NT_STATUS_INVALID_PARAMETER;
462 }
463
464 /*
465 * The +4 here can't wrap, we've checked the length above already.
466 */
467
468 *buffer = talloc_array(mem_ctx, char, len+4);
469
470 if (*buffer == NULL) {
471 DEBUG(0, ("Could not allocate inbuf of length %d\n",
472 (int)len+4));
473 return NT_STATUS_NO_MEMORY;
474 }
475
476 memcpy(*buffer, lenbuf, sizeof(lenbuf));
477
478 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
479 if (!NT_STATUS_IS_OK(status)) {
480 return status;
481 }
482
483 *plen = len + 4;
484 return NT_STATUS_OK;
485 }
486
487 NTSTATUS smb1_receive_talloc(TALLOC_CTX *mem_ctx,
488 struct smbXsrv_connection *xconn,
489 int sock,
490 char **buffer, unsigned int timeout,
491 size_t *p_unread, bool *p_encrypted,
492 size_t *p_len,
493 uint32_t *seqnum,
494 bool trusted_channel)
495 {
496 size_t len = 0;
497 NTSTATUS status;
498
499 *p_encrypted = false;
500
501 status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
502 p_unread, &len);
503 if (!NT_STATUS_IS_OK(status)) {
504 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
505 ("receive_smb_raw_talloc failed for client %s "
506 "read error = %s.\n",
507 smbXsrv_connection_dbg(xconn),
508 nt_errstr(status)) );
509 return status;
510 }
511
512 if (is_encrypted_packet((uint8_t *)*buffer)) {
513 status = srv_decrypt_buffer(xconn, *buffer);
514 if (!NT_STATUS_IS_OK(status)) {
515 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
516 "incoming packet! Error %s\n",
517 nt_errstr(status) ));
518 return status;
519 }
520 *p_encrypted = true;
521 }
522
523 /* Check the incoming SMB signature. */
524 if (!smb1_srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
525 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
526 "incoming packet!\n"));
527 return NT_STATUS_INVALID_NETWORK_RESPONSE;
528 }
529
530 *p_len = len;
531 return NT_STATUS_OK;
532 }
533
534 /****************************************************************************
535 Function to push a message onto the tail of a linked list of smb messages ready
536 for processing.
537 ****************************************************************************/
538
539 static bool push_queued_message(struct smb_request *req,
540 struct timeval request_time,
541 struct timeval end_time,
542 struct deferred_open_record *open_rec)
543 {
544 int msg_len = smb_len(req->inbuf) + 4;
545 struct pending_message_list *msg;
546
547 msg = talloc_zero(NULL, struct pending_message_list);
548
549 if(msg == NULL) {
550 DEBUG(0,("push_message: malloc fail (1)\n"));
551 return False;
552 }
553 msg->sconn = req->sconn;
554 msg->xconn = req->xconn;
555
556 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
557 if(msg->buf.data == NULL) {
558 DEBUG(0,("push_message: malloc fail (2)\n"));
559 TALLOC_FREE(msg);
560 return False;
561 }
562
563 msg->request_time = request_time;
564 msg->seqnum = req->seqnum;
565 msg->encrypted = req->encrypted;
566 msg->processed = false;
567
568 if (open_rec) {
569 msg->open_rec = talloc_move(msg, &open_rec);
570 }
571
572 #if 0
573 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
574 msg,
575 end_time,
576 smbd_deferred_open_timer,
577 msg);
578 if (!msg->te) {
579 DEBUG(0,("push_message: event_add_timed failed\n"));
580 TALLOC_FREE(msg);
581 return false;
582 }
583 #endif
584
585 DLIST_ADD_END(req->sconn->deferred_open_queue, msg);
586
587 DEBUG(10,("push_message: pushed message length %u on "
588 "deferred_open_queue\n", (unsigned int)msg_len));
589
590 return True;
591 }
592
593 /****************************************************************************
594 Function to push a deferred open smb message onto a linked list of local smb
595 messages ready for processing.
596 ****************************************************************************/
597
598 bool push_deferred_open_message_smb1(struct smb_request *req,
599 struct timeval timeout,
600 struct file_id id,
601 struct deferred_open_record *open_rec)
602 {
603 struct timeval_buf tvbuf;
604 struct timeval end_time;
605
606 if (req->unread_bytes) {
607 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
608 "unread_bytes = %u\n",
609 (unsigned int)req->unread_bytes ));
610 smb_panic("push_deferred_open_message_smb: "
611 "logic error unread_bytes != 0" );
612 }
613
614 end_time = timeval_sum(&req->request_time, &timeout);
615
616 DBG_DEBUG("pushing message len %u mid %"PRIu64" timeout time [%s]\n",
617 (unsigned int) smb_len(req->inbuf)+4,
618 req->mid,
619 timeval_str_buf(&end_time, false, true, &tvbuf));
620
621 return push_queued_message(req, req->request_time, end_time, open_rec);
622 }
623
624 /*
625 * Only allow 5 outstanding trans requests. We're allocating memory, so
626 * prevent a DoS.
627 */
628
629 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
630 {
631 int count = 0;
632 for (; list != NULL; list = list->next) {
633
634 if (list->mid == mid) {
635 return NT_STATUS_INVALID_PARAMETER;
636 }
637
638 count += 1;
639 }
640 if (count > 5) {
641 return NT_STATUS_INSUFFICIENT_RESOURCES;
642 }
643
644 return NT_STATUS_OK;
645 }
646
647 /*
648 These flags determine some of the permissions required to do an operation
649
650 Note that I don't set NEED_WRITE on some write operations because they
651 are used by some brain-dead clients when printing, and I don't want to
652 force write permissions on print services.
653 */
654 #define AS_USER (1<<0)
655 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
656 #define TIME_INIT (1<<2)
657 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
658 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
659 #define DO_CHDIR (1<<6)
660
661 /*
662 define a list of possible SMB messages and their corresponding
663 functions. Any message that has a NULL function is unimplemented -
664 please feel free to contribute implementations!
665 */
666 static const struct smb_message_struct {
667 const char *name;
668 void (*fn)(struct smb_request *req);
669 int flags;
670 } smb_messages[256] = {
671
672 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
673 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
674 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
675 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
676 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
677 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
678 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
679 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
680 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
681 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
682 /* 0x0a */ { "SMBread",reply_read,AS_USER},
683 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
684 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
685 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
686 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
687 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
688 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
689 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
690 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
691 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
692 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
693 /* 0x15 */ { NULL, NULL, 0 },
694 /* 0x16 */ { NULL, NULL, 0 },
695 /* 0x17 */ { NULL, NULL, 0 },
696 /* 0x18 */ { NULL, NULL, 0 },
697 /* 0x19 */ { NULL, NULL, 0 },
698 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
699 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
700 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
701 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
702 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
703 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
704 /* 0x20 */ { "SMBwritec", NULL,0},
705 /* 0x21 */ { NULL, NULL, 0 },
706 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
707 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
708 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
709 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
710 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
711 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
712 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
713 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
714 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
715 /* 0x2b */ { "SMBecho",reply_echo,0},
716 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
717 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
718 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
719 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
720 /* 0x30 */ { NULL, NULL, 0 },
721 /* 0x31 */ { NULL, NULL, 0 },
722 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
723 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
724 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
725 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
726 /* 0x36 */ { NULL, NULL, 0 },
727 /* 0x37 */ { NULL, NULL, 0 },
728 /* 0x38 */ { NULL, NULL, 0 },
729 /* 0x39 */ { NULL, NULL, 0 },
730 /* 0x3a */ { NULL, NULL, 0 },
731 /* 0x3b */ { NULL, NULL, 0 },
732 /* 0x3c */ { NULL, NULL, 0 },
733 /* 0x3d */ { NULL, NULL, 0 },
734 /* 0x3e */ { NULL, NULL, 0 },
735 /* 0x3f */ { NULL, NULL, 0 },
736 /* 0x40 */ { NULL, NULL, 0 },
737 /* 0x41 */ { NULL, NULL, 0 },
738 /* 0x42 */ { NULL, NULL, 0 },
739 /* 0x43 */ { NULL, NULL, 0 },
740 /* 0x44 */ { NULL, NULL, 0 },
741 /* 0x45 */ { NULL, NULL, 0 },
742 /* 0x46 */ { NULL, NULL, 0 },
743 /* 0x47 */ { NULL, NULL, 0 },
744 /* 0x48 */ { NULL, NULL, 0 },
745 /* 0x49 */ { NULL, NULL, 0 },
746 /* 0x4a */ { NULL, NULL, 0 },
747 /* 0x4b */ { NULL, NULL, 0 },
748 /* 0x4c */ { NULL, NULL, 0 },
749 /* 0x4d */ { NULL, NULL, 0 },
750 /* 0x4e */ { NULL, NULL, 0 },
751 /* 0x4f */ { NULL, NULL, 0 },
752 /* 0x50 */ { NULL, NULL, 0 },
753 /* 0x51 */ { NULL, NULL, 0 },
754 /* 0x52 */ { NULL, NULL, 0 },
755 /* 0x53 */ { NULL, NULL, 0 },
756 /* 0x54 */ { NULL, NULL, 0 },
757 /* 0x55 */ { NULL, NULL, 0 },
758 /* 0x56 */ { NULL, NULL, 0 },
759 /* 0x57 */ { NULL, NULL, 0 },
760 /* 0x58 */ { NULL, NULL, 0 },
761 /* 0x59 */ { NULL, NULL, 0 },
762 /* 0x5a */ { NULL, NULL, 0 },
763 /* 0x5b */ { NULL, NULL, 0 },
764 /* 0x5c */ { NULL, NULL, 0 },
765 /* 0x5d */ { NULL, NULL, 0 },
766 /* 0x5e */ { NULL, NULL, 0 },
767 /* 0x5f */ { NULL, NULL, 0 },
768 /* 0x60 */ { NULL, NULL, 0 },
769 /* 0x61 */ { NULL, NULL, 0 },
770 /* 0x62 */ { NULL, NULL, 0 },
771 /* 0x63 */ { NULL, NULL, 0 },
772 /* 0x64 */ { NULL, NULL, 0 },
773 /* 0x65 */ { NULL, NULL, 0 },
774 /* 0x66 */ { NULL, NULL, 0 },
775 /* 0x67 */ { NULL, NULL, 0 },
776 /* 0x68 */ { NULL, NULL, 0 },
777 /* 0x69 */ { NULL, NULL, 0 },
778 /* 0x6a */ { NULL, NULL, 0 },
779 /* 0x6b */ { NULL, NULL, 0 },
780 /* 0x6c */ { NULL, NULL, 0 },
781 /* 0x6d */ { NULL, NULL, 0 },
782 /* 0x6e */ { NULL, NULL, 0 },
783 /* 0x6f */ { NULL, NULL, 0 },
784 /* 0x70 */ { "SMBtcon",reply_tcon,0},
785 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
786 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
787 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
788 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
789 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
790 /* 0x76 */ { NULL, NULL, 0 },
791 /* 0x77 */ { NULL, NULL, 0 },
792 /* 0x78 */ { NULL, NULL, 0 },
793 /* 0x79 */ { NULL, NULL, 0 },
794 /* 0x7a */ { NULL, NULL, 0 },
795 /* 0x7b */ { NULL, NULL, 0 },
796 /* 0x7c */ { NULL, NULL, 0 },
797 /* 0x7d */ { NULL, NULL, 0 },
798 /* 0x7e */ { NULL, NULL, 0 },
799 /* 0x7f */ { NULL, NULL, 0 },
800 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
801 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
802 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
803 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
804 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
805 /* 0x85 */ { NULL, NULL, 0 },
806 /* 0x86 */ { NULL, NULL, 0 },
807 /* 0x87 */ { NULL, NULL, 0 },
808 /* 0x88 */ { NULL, NULL, 0 },
809 /* 0x89 */ { NULL, NULL, 0 },
810 /* 0x8a */ { NULL, NULL, 0 },
811 /* 0x8b */ { NULL, NULL, 0 },
812 /* 0x8c */ { NULL, NULL, 0 },
813 /* 0x8d */ { NULL, NULL, 0 },
814 /* 0x8e */ { NULL, NULL, 0 },
815 /* 0x8f */ { NULL, NULL, 0 },
816 /* 0x90 */ { NULL, NULL, 0 },
817 /* 0x91 */ { NULL, NULL, 0 },
818 /* 0x92 */ { NULL, NULL, 0 },
819 /* 0x93 */ { NULL, NULL, 0 },
820 /* 0x94 */ { NULL, NULL, 0 },
821 /* 0x95 */ { NULL, NULL, 0 },
822 /* 0x96 */ { NULL, NULL, 0 },
823 /* 0x97 */ { NULL, NULL, 0 },
824 /* 0x98 */ { NULL, NULL, 0 },
825 /* 0x99 */ { NULL, NULL, 0 },
826 /* 0x9a */ { NULL, NULL, 0 },
827 /* 0x9b */ { NULL, NULL, 0 },
828 /* 0x9c */ { NULL, NULL, 0 },
829 /* 0x9d */ { NULL, NULL, 0 },
830 /* 0x9e */ { NULL, NULL, 0 },
831 /* 0x9f */ { NULL, NULL, 0 },
832 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
833 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
834 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
835 /* 0xa3 */ { NULL, NULL, 0 },
836 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
837 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
838 /* 0xa6 */ { NULL, NULL, 0 },
839 /* 0xa7 */ { NULL, NULL, 0 },
840 /* 0xa8 */ { NULL, NULL, 0 },
841 /* 0xa9 */ { NULL, NULL, 0 },
842 /* 0xaa */ { NULL, NULL, 0 },
843 /* 0xab */ { NULL, NULL, 0 },
844 /* 0xac */ { NULL, NULL, 0 },
845 /* 0xad */ { NULL, NULL, 0 },
846 /* 0xae */ { NULL, NULL, 0 },
847 /* 0xaf */ { NULL, NULL, 0 },
848 /* 0xb0 */ { NULL, NULL, 0 },
849 /* 0xb1 */ { NULL, NULL, 0 },
850 /* 0xb2 */ { NULL, NULL, 0 },
851 /* 0xb3 */ { NULL, NULL, 0 },
852 /* 0xb4 */ { NULL, NULL, 0 },
853 /* 0xb5 */ { NULL, NULL, 0 },
854 /* 0xb6 */ { NULL, NULL, 0 },
855 /* 0xb7 */ { NULL, NULL, 0 },
856 /* 0xb8 */ { NULL, NULL, 0 },
857 /* 0xb9 */ { NULL, NULL, 0 },
858 /* 0xba */ { NULL, NULL, 0 },
859 /* 0xbb */ { NULL, NULL, 0 },
860 /* 0xbc */ { NULL, NULL, 0 },
861 /* 0xbd */ { NULL, NULL, 0 },
862 /* 0xbe */ { NULL, NULL, 0 },
863 /* 0xbf */ { NULL, NULL, 0 },
864 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
865 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
866 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
867 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
868 /* 0xc4 */ { NULL, NULL, 0 },
869 /* 0xc5 */ { NULL, NULL, 0 },
870 /* 0xc6 */ { NULL, NULL, 0 },
871 /* 0xc7 */ { NULL, NULL, 0 },
872 /* 0xc8 */ { NULL, NULL, 0 },
873 /* 0xc9 */ { NULL, NULL, 0 },
874 /* 0xca */ { NULL, NULL, 0 },
875 /* 0xcb */ { NULL, NULL, 0 },
876 /* 0xcc */ { NULL, NULL, 0 },
877 /* 0xcd */ { NULL, NULL, 0 },
878 /* 0xce */ { NULL, NULL, 0 },
879 /* 0xcf */ { NULL, NULL, 0 },
880 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
881 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
882 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
883 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
884 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
885 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
886 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
887 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
888 /* 0xd8 */ { NULL, NULL, 0 },
889 /* 0xd9 */ { NULL, NULL, 0 },
890 /* 0xda */ { NULL, NULL, 0 },
891 /* 0xdb */ { NULL, NULL, 0 },
892 /* 0xdc */ { NULL, NULL, 0 },
893 /* 0xdd */ { NULL, NULL, 0 },
894 /* 0xde */ { NULL, NULL, 0 },
895 /* 0xdf */ { NULL, NULL, 0 },
896 /* 0xe0 */ { NULL, NULL, 0 },
897 /* 0xe1 */ { NULL, NULL, 0 },
898 /* 0xe2 */ { NULL, NULL, 0 },
899 /* 0xe3 */ { NULL, NULL, 0 },
900 /* 0xe4 */ { NULL, NULL, 0 },
901 /* 0xe5 */ { NULL, NULL, 0 },
902 /* 0xe6 */ { NULL, NULL, 0 },
903 /* 0xe7 */ { NULL, NULL, 0 },
904 /* 0xe8 */ { NULL, NULL, 0 },
905 /* 0xe9 */ { NULL, NULL, 0 },
906 /* 0xea */ { NULL, NULL, 0 },
907 /* 0xeb */ { NULL, NULL, 0 },
908 /* 0xec */ { NULL, NULL, 0 },
909 /* 0xed */ { NULL, NULL, 0 },
910 /* 0xee */ { NULL, NULL, 0 },
911 /* 0xef */ { NULL, NULL, 0 },
912 /* 0xf0 */ { NULL, NULL, 0 },
913 /* 0xf1 */ { NULL, NULL, 0 },
914 /* 0xf2 */ { NULL, NULL, 0 },
915 /* 0xf3 */ { NULL, NULL, 0 },
916 /* 0xf4 */ { NULL, NULL, 0 },
917 /* 0xf5 */ { NULL, NULL, 0 },
918 /* 0xf6 */ { NULL, NULL, 0 },
919 /* 0xf7 */ { NULL, NULL, 0 },
920 /* 0xf8 */ { NULL, NULL, 0 },
921 /* 0xf9 */ { NULL, NULL, 0 },
922 /* 0xfa */ { NULL, NULL, 0 },
923 /* 0xfb */ { NULL, NULL, 0 },
924 /* 0xfc */ { NULL, NULL, 0 },
925 /* 0xfd */ { NULL, NULL, 0 },
926 /* 0xfe */ { NULL, NULL, 0 },
927 /* 0xff */ { NULL, NULL, 0 }
928
929 };
930
931
932 /*******************************************************************
933 Dump a packet to a file.
934 ********************************************************************/
935
936 static void smb_dump(const char *name, int type, const char *data)
937 {
938 size_t len;
939 int fd, i;
940 char *fname = NULL;
941 if (DEBUGLEVEL < 50) {
942 return;
943 }
944
945 len = smb_len_tcp(data)+4;
946 for (i=1;i<100;i++) {
947 fname = talloc_asprintf(talloc_tos(),
948 "/tmp/%s.%d.%s",
949 name,
950 i,
951 type ? "req" : "resp");
952 if (fname == NULL) {
953 return;
954 }
955 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
956 if (fd != -1 || errno != EEXIST) break;
957 TALLOC_FREE(fname);
958 }
959 if (fd != -1) {
960 ssize_t ret = write(fd, data, len);
961 if (ret != len)
962 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
963 close(fd);
964 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
965 }
966 TALLOC_FREE(fname);
967 }
968
969 static void smb1srv_update_crypto_flags(struct smbXsrv_session *session,
970 struct smb_request *req,
971 uint8_t type,
972 bool *update_session_globalp,
973 bool *update_tcon_globalp)
974 {
975 connection_struct *conn = req->conn;
976 struct smbXsrv_tcon *tcon = conn ? conn->tcon : NULL;
977 uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
978 uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
979 bool update_session = false;
980 bool update_tcon = false;
981
982 if (req->encrypted) {
983 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
984 }
985
986 if (smb1_srv_is_signing_active(req->xconn)) {
987 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
988 } else if ((type == SMBecho) || (type == SMBsesssetupX)) {
989 /*
990 * echo can be unsigned. Sesssion setup except final
991 * session setup response too
992 */
993 sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
994 }
995
996 update_session |= smbXsrv_set_crypto_flag(
997 &session->global->encryption_flags, encrypt_flag);
998 update_session |= smbXsrv_set_crypto_flag(
999 &session->global->signing_flags, sign_flag);
1000
1001 if (tcon) {
1002 update_tcon |= smbXsrv_set_crypto_flag(
1003 &tcon->global->encryption_flags, encrypt_flag);
1004 update_tcon |= smbXsrv_set_crypto_flag(
1005 &tcon->global->signing_flags, sign_flag);
1006 }
1007
1008 if (update_session) {
1009 session->global->channels[0].encryption_cipher = SMB_ENCRYPTION_GSSAPI;
1010 }
1011
1012 *update_session_globalp = update_session;
1013 *update_tcon_globalp = update_tcon;
1014 return;
1015 }
1016
1017 static void set_current_case_sensitive(connection_struct *conn, uint16_t flags)
1018 {
1019 int snum;
1020 enum remote_arch_types ra_type;
1021
1022 SMB_ASSERT(conn != NULL);
1023 SMB_ASSERT(!conn->sconn->using_smb2);
1024
1025 snum = SNUM(conn);
1026
1027 /*
1028 * Obey the client case sensitivity requests - only for clients that
1029 * support it. */
1030 switch (lp_case_sensitive(snum)) {
1031 case Auto:
1032 /*
1033 * We need this uglyness due to DOS/Win9x clients that lie
1034 * about case insensitivity. */
1035 ra_type = get_remote_arch();
1036 if ((ra_type != RA_SAMBA) && (ra_type != RA_CIFSFS)) {
1037 /*
1038 * Client can't support per-packet case sensitive
1039 * pathnames. */
1040 conn->case_sensitive = false;
1041 } else {
1042 conn->case_sensitive =
1043 !(flags & FLAG_CASELESS_PATHNAMES);
1044 }
1045 break;
1046 case True:
1047 conn->case_sensitive = true;
1048 break;
1049 default:
1050 conn->case_sensitive = false;
1051 break;
1052 }
1053 }
1054
1055 /****************************************************************************
1056 Prepare everything for calling the actual request function, and potentially
1057 call the request function via the "new" interface.
1058
1059 Return False if the "legacy" function needs to be called, everything is
1060 prepared.
1061
1062 Return True if we're done.
1063
1064 I know this API sucks, but it is the one with the least code change I could
1065 find.
1066 ****************************************************************************/
1067
1068 static connection_struct *switch_message(uint8_t type, struct smb_request *req)
1069 {
1070 const struct loadparm_substitution *lp_sub =
1071 loadparm_s3_global_substitution();
1072 int flags;
1073 uint64_t session_tag;
1074 connection_struct *conn = NULL;
1075 struct smbXsrv_connection *xconn = req->xconn;
1076 NTTIME now = timeval_to_nttime(&req->request_time);
1077 struct smbXsrv_session *session = NULL;
1078 NTSTATUS status;
1079
1080 errno = 0;
1081
1082 if (!xconn->smb1.negprot.done) {
1083 switch (type) {
1084 /*
1085 * Without a negprot the request must
1086 * either be a negprot, or one of the
1087 * evil old SMB mailslot messaging types.
1088 */
1089 case SMBnegprot:
1090 case SMBsendstrt:
1091 case SMBsendend:
1092 case SMBsendtxt:
1093 break;
1094 default:
1095 exit_server_cleanly("The first request "
1096 "should be a negprot");
1097 }
1098 }
1099
1100 if (smb_messages[type].fn == NULL) {
1101 DEBUG(0,("Unknown message type %d!\n",type));
1102 smb_dump("Unknown", 1, (const char *)req->inbuf);
1103 reply_unknown_new(req, type);
1104 return NULL;
1105 }
1106
1107 flags = smb_messages[type].flags;
1108
1109 /* In share mode security we must ignore the vuid. */
1110 session_tag = req->vuid;
1111 conn = req->conn;
1112
1113 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1114 (int)getpid(), (unsigned long)conn));
1115
1116 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1117
1118 /* Ensure this value is replaced in the incoming packet. */
1119 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1120
1121 /*
1122 * Ensure the correct username is in current_user_info. This is a
1123 * really ugly bugfix for problems with multiple session_setup_and_X's
1124 * being done and allowing %U and %G substitutions to work correctly.
1125 * There is a reason this code is done here, don't move it unless you
1126 * know what you're doing... :-).
1127 * JRA.
1128 */
1129
1130 /*
1131 * lookup an existing session
1132 *
1133 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1134 * here, the main check is still in change_to_user()
1135 */
1136 status = smb1srv_session_lookup(xconn,
1137 session_tag,
1138 now,
1139 &session);
1140 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1141 switch (type) {
1142 case SMBsesssetupX:
1143 status = NT_STATUS_OK;
1144 break;
1145 default:
1146 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1147 (unsigned long long)session_tag,
1148 (unsigned long long)req->mid));
1149 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1150 return conn;
1151 }
1152 }
1153
1154 if (session != NULL &&
1155 session->global->auth_session_info != NULL &&
1156 !(flags & AS_USER))
1157 {
1158 /*
1159 * change_to_user() implies set_current_user_info()
1160 * and chdir_connect_service().
1161 *
1162 * So we only call set_current_user_info if
1163 * we don't have AS_USER specified.
1164 */
1165 set_current_user_info(
1166 session->global->auth_session_info->unix_info->sanitized_username,
1167 session->global->auth_session_info->unix_info->unix_name,
1168 session->global->auth_session_info->info->domain_name);
1169 }
1170
1171 /* Does this call need to be run as the connected user? */
1172 if (flags & AS_USER) {
1173
1174 /* Does this call need a valid tree connection? */
1175 if (!conn) {
1176 /*
1177 * Amazingly, the error code depends on the command
1178 * (from Samba4).
1179 */
1180 if (type == SMBntcreateX) {
1181 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1182 } else {
1183 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1184 }
1185 return NULL;
1186 }
1187
1188 set_current_case_sensitive(conn, SVAL(req->inbuf,smb_flg));
1189
1190 /*
1191 * change_to_user() implies set_current_user_info()
1192 * and chdir_connect_service().
1193 */
1194 if (!change_to_user_and_service(conn,session_tag)) {
1195 DEBUG(0, ("Error: Could not change to user. Removing "
1196 "deferred open, mid=%llu.\n",
1197 (unsigned long long)req->mid));
1198 reply_force_doserror(req, ERRSRV, ERRbaduid);
1199 return conn;
1200 }
1201
1202 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1203
1204 /* Does it need write permission? */
1205 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1206 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1207 return conn;
1208 }
1209
1210 /* IPC services are limited */
1211 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1212 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1213 return conn;
1214 }
1215 } else if (flags & AS_GUEST) {
1216 /*
1217 * Does this protocol need to be run as guest? (Only archane
1218 * messenger service requests have this...)
1219 */
1220 if (!change_to_guest()) {
1221 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1222 return conn;
1223 }
1224 } else {
1225 /* This call needs to be run as root */
1226 change_to_root_user();
1227 }
1228
1229 /* load service specific parameters */
1230 if (conn) {
1231 if (req->encrypted) {
1232 conn->encrypted_tid = true;
1233 /* encrypted required from now on. */
1234 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1235 } else if (ENCRYPTION_REQUIRED(conn)) {
1236 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1237 DEBUG(1,("service[%s] requires encryption"
1238 "%s ACCESS_DENIED. mid=%llu\n",
1239 lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
1240 smb_fn_name(type),
1241 (unsigned long long)req->mid));
1242 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1243 return conn;
1244 }
1245 }
1246
1247 if (flags & DO_CHDIR) {
1248 bool ok;
1249
1250 ok = chdir_current_service(conn);
1251 if (!ok) {
1252 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1253 return conn;
1254 }
1255 }
1256 conn->num_smb_operations++;
1257 }
1258
1259 /*
1260 * Update encryption and signing state tracking flags that are
1261 * used by smbstatus to display signing and encryption status.
1262 */
1263 if (session != NULL) {
1264 bool update_session_global = false;
1265 bool update_tcon_global = false;
1266
1267 req->session = session;
1268
1269 smb1srv_update_crypto_flags(session, req, type,
1270 &update_session_global,
1271 &update_tcon_global);
1272
1273 if (update_session_global) {
1274 status = smbXsrv_session_update(session);
1275 if (!NT_STATUS_IS_OK(status)) {
1276 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1277 return conn;
1278 }
1279 }
1280
1281 if (update_tcon_global) {
1282 status = smbXsrv_tcon_update(req->conn->tcon);
1283 if (!NT_STATUS_IS_OK(status)) {
1284 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1285 return conn;
1286 }
1287 }
1288 }
1289
1290 smb_messages[type].fn(req);
1291 return req->conn;
1292 }
1293
1294 /****************************************************************************
1295 Construct a reply to the incoming packet.
1296 ****************************************************************************/
1297
1298 void construct_reply(struct smbXsrv_connection *xconn,
1299 char *inbuf, int size, size_t unread_bytes,
1300 uint32_t seqnum, bool encrypted,
1301 struct smb_perfcount_data *deferred_pcd)
1302 {
1303 struct smbd_server_connection *sconn = xconn->client->sconn;
1304 struct smb_request *req;
1305
1306 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1307 smb_panic("could not allocate smb_request");
1308 }
1309
1310 if (!init_smb1_request(req, sconn, xconn, (uint8_t *)inbuf, unread_bytes,
1311 encrypted, seqnum)) {
1312 exit_server_cleanly("Invalid SMB request");
1313 }
1314
1315 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1316
1317 /* we popped this message off the queue - keep original perf data */
1318 if (deferred_pcd) {
1319 req->pcd = *deferred_pcd;
1320 }
1321
1322 req->conn = switch_message(req->cmd, req);
1323
1324 if (req->outbuf == NULL) {
1325 /*
1326 * Request has suspended itself, will come
1327 * back here.
1328 */
1329 return;
1330 }
1331 if (CVAL(req->outbuf,0) == 0) {
1332 show_msg((char *)req->outbuf);
1333 }
1334 smb_request_done(req);
1335 }
1336
1337 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1338 char *inbuf, int size, uint32_t seqnum,
1339 bool encrypted,
1340 struct smb_perfcount_data *deferred_pcd)
1341 {
1342 struct smb_request **reqs = NULL;
1343 struct smb_request *req;
1344 unsigned num_reqs;
1345 bool ok;
1346
1347 ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted,
1348 seqnum, &reqs, &num_reqs);
1349 if (!ok) {
1350 char errbuf[smb_size];
1351 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1352 __LINE__, __FILE__);
1353 if (!smb1_srv_send(xconn, errbuf, true, seqnum, encrypted)) {
1354 exit_server_cleanly("construct_reply_chain: "
1355 "smb1_srv_send failed.");
1356 }
1357 return;
1358 }
1359
1360 req = reqs[0];
1361 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1362
1363 req->conn = switch_message(req->cmd, req);
1364
1365 if (req->outbuf == NULL) {
1366 /*
1367 * Request has suspended itself, will come
1368 * back here.
1369 */
1370 return;
1371 }
1372 smb_request_done(req);
1373 }
1374
1375 /*
1376 * To be called from an async SMB handler that is potentially chained
1377 * when it is finished for shipping.
1378 */
1379
1380 void smb_request_done(struct smb_request *req)
1381 {
1382 struct smb_request **reqs = NULL;
1383 struct smb_request *first_req;
1384 size_t i, num_reqs, next_index;
1385 NTSTATUS status;
1386
1387 if (req->chain == NULL) {
1388 first_req = req;
1389 goto shipit;
1390 }
1391
1392 reqs = req->chain;
1393 num_reqs = talloc_array_length(reqs);
1394
1395 for (i=0; i<num_reqs; i++) {
1396 if (reqs[i] == req) {
1397 break;
1398 }
1399 }
1400 if (i == num_reqs) {
1401 /*
1402 * Invalid chain, should not happen
1403 */
1404 status = NT_STATUS_INTERNAL_ERROR;
1405 goto error;
1406 }
1407 next_index = i+1;
1408
1409 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1410 struct smb_request *next = reqs[next_index];
1411 struct smbXsrv_tcon *tcon;
1412 NTTIME now = timeval_to_nttime(&req->request_time);
1413
1414 next->vuid = SVAL(req->outbuf, smb_uid);
1415 next->tid = SVAL(req->outbuf, smb_tid);
1416 status = smb1srv_tcon_lookup(req->xconn, next->tid,
1417 now, &tcon);
1418
1419 if (NT_STATUS_IS_OK(status)) {
1420 next->conn = tcon->compat;
1421 } else {
1422 next->conn = NULL;
1423 }
1424 next->chain_fsp = req->chain_fsp;
1425 next->inbuf = req->inbuf;
1426
1427 req = next;
1428 req->conn = switch_message(req->cmd, req);
1429
1430 if (req->outbuf == NULL) {
1431 /*
1432 * Request has suspended itself, will come
1433 * back here.
1434 */
1435 return;
1436 }
1437 next_index += 1;
1438 }
1439
1440 first_req = reqs[0];
1441
1442 for (i=1; i<next_index; i++) {
1443 bool ok;
1444
1445 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1446 if (!ok) {
1447 status = NT_STATUS_INTERNAL_ERROR;
1448 goto error;
1449 }
1450 }
1451
1452 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1453 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1454
1455 /*
1456 * This scary statement intends to set the
1457 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1458 * to the value last_req->outbuf carries
1459 */
1460 SSVAL(first_req->outbuf, smb_flg2,
1461 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1462 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1463
1464 /*
1465 * Transfer the error codes from the subrequest to the main one
1466 */
1467 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1468 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1469
1470 _smb_setlen_large(
1471 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1472
1473 shipit:
1474 if (!smb1_srv_send(first_req->xconn,
1475 (char *)first_req->outbuf,
1476 true,
1477 first_req->seqnum + 1,
1478 IS_CONN_ENCRYPTED(req->conn) ||
1479 first_req->encrypted)) {
1480 exit_server_cleanly("construct_reply_chain: smb1_srv_send "
1481 "failed.");
1482 }
1483 TALLOC_FREE(req); /* non-chained case */
1484 TALLOC_FREE(reqs); /* chained case */
1485 return;
1486
1487 error:
1488 {
1489 char errbuf[smb_size];
1490 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1491 if (!smb1_srv_send(req->xconn,
1492 errbuf,
1493 true,
1494 req->seqnum + 1,
1495 req->encrypted)) {
1496 exit_server_cleanly("construct_reply_chain: "
1497 "smb1_srv_send failed.");
1498 }
1499 }
1500 TALLOC_FREE(req); /* non-chained case */
1501 TALLOC_FREE(reqs); /* chained case */
1502 }
1503
1504 /****************************************************************************
1505 Process an smb from the client
1506 ****************************************************************************/
1507
1508 void process_smb1(struct smbXsrv_connection *xconn,
1509 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1510 uint32_t seqnum, bool encrypted,
1511 struct smb_perfcount_data *deferred_pcd)
1512 {
1513 struct smbd_server_connection *sconn = xconn->client->sconn;
1514
1515 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1516 * so subtract 4 from it. */
1517 if ((nread < (smb_size - 4)) || !valid_smb1_header(inbuf)) {
1518 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1519 smb_len(inbuf)));
1520
1521 /* special magic for immediate exit */
1522 if ((nread == 9) &&
1523 (IVAL(inbuf, 4) == SMB_SUICIDE_PACKET) &&
1524 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1525 uint8_t exitcode = CVAL(inbuf, 8);
1526 DBG_WARNING("SUICIDE: Exiting immediately with code %d\n",
1527 (int)exitcode);
1528 exit(exitcode);
1529 }
1530
1531 exit_server_cleanly("Non-SMB packet");
1532 }
1533
1534 show_msg((char *)inbuf);
1535
1536 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1537 construct_reply_chain(xconn, (char *)inbuf, nread,
1538 seqnum, encrypted, deferred_pcd);
1539 } else {
1540 construct_reply(xconn, (char *)inbuf, nread, unread_bytes,
1541 seqnum, encrypted, deferred_pcd);
1542 }
1543
1544 sconn->trans_num++;
1545 }
1546
1547 /****************************************************************************
1548 Return a string containing the function name of a SMB command.
1549 ****************************************************************************/
1550
1551 const char *smb_fn_name(int type)
1552 {
1553 const char *unknown_name = "SMBunknown";
1554
1555 if (smb_messages[type].name == NULL)
1556 return(unknown_name);
1557
1558 return(smb_messages[type].name);
1559 }
1560
1561 /****************************************************************************
1562 Helper functions for contruct_reply.
1563 ****************************************************************************/
1564
1565 void add_to_common_flags2(uint32_t v)
1566 {
1567 common_flags2 |= v;
1568 }
1569
1570 void remove_from_common_flags2(uint32_t v)
1571 {
1572 common_flags2 &= ~v;
1573 }
1574
1575 /**
1576 * @brief Find the smb_cmd offset of the last command pushed
1577 * @param[in] buf The buffer we're building up
1578 * @retval Where can we put our next andx cmd?
1579 *
1580 * While chaining requests, the "next" request we're looking at needs to put
1581 * its SMB_Command before the data the previous request already built up added
1582 * to the chain. Find the offset to the place where we have to put our cmd.
1583 */
1584
1585 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1586 {
1587 uint8_t cmd;
1588 size_t ofs;
1589
1590 cmd = CVAL(buf, smb_com);
1591
1592 if (!smb1cli_is_andx_req(cmd)) {
1593 return false;
1594 }
1595
1596 ofs = smb_vwv0;
1597
1598 while (CVAL(buf, ofs) != 0xff) {
1599
1600 if (!smb1cli_is_andx_req(CVAL(buf, ofs))) {
1601 return false;
1602 }
1603
1604 /*
1605 * ofs is from start of smb header, so add the 4 length
1606 * bytes. The next cmd is right after the wct field.
1607 */
1608 ofs = SVAL(buf, ofs+2) + 4 + 1;
1609
1610 if (ofs+4 >= talloc_get_size(buf)) {
1611 return false;
1612 }
1613 }
1614
1615 *pofs = ofs;
1616 return true;
1617 }
1618
1619 /**
1620 * @brief Do the smb chaining at a buffer level
1621 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1622 * @param[in] andx_buf Buffer to be appended
1623 */
1624
1625 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1626 {
1627 uint8_t smb_command = CVAL(andx_buf, smb_com);
1628 uint8_t wct = CVAL(andx_buf, smb_wct);
1629 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1630 uint32_t num_bytes = smb_buflen(andx_buf);
1631 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1632
1633 uint8_t *outbuf;
1634 size_t old_size, new_size;
1635 size_t ofs;
1636 size_t chain_padding = 0;
1637 size_t andx_cmd_ofs;
1638
1639
1640 old_size = talloc_get_size(*poutbuf);
1641
1642 if ((old_size % 4) != 0) {
1643 /*
1644 * Align the wct field of subsequent requests to a 4-byte
1645 * boundary
1646 */
1647 chain_padding = 4 - (old_size % 4);
1648 }
1649
1650 /*
1651 * After the old request comes the new wct field (1 byte), the vwv's
1652 * and the num_bytes field.
1653 */
1654
1655 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1656 new_size += num_bytes;
1657
1658 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1659 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
1660 (unsigned)new_size));
1661 return false;
1662 }
1663
1664 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1665 if (outbuf == NULL) {
1666 DEBUG(0, ("talloc failed\n"));
1667 return false;
1668 }
1669 *poutbuf = outbuf;
1670
1671 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1672 DEBUG(1, ("invalid command chain\n"));
1673 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
1674 return false;
1675 }
1676
1677 if (chain_padding != 0) {
1678 memset(outbuf + old_size, 0, chain_padding);
1679 old_size += chain_padding;
1680 }
1681
1682 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1683 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1684
1685 ofs = old_size;
1686
1687 /*
1688 * Push the chained request:
1689 *
1690 * wct field
1691 */
1692
1693 SCVAL(outbuf, ofs, wct);
1694 ofs += 1;
1695
1696 /*
1697 * vwv array
1698 */
1699
1700 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1701
1702 /*
1703 * HACK ALERT
1704 *
1705 * Read&X has an offset into its data buffer at
1706 * vwv[6]. reply_read_andx has no idea anymore that it's
1707 * running from within a chain, so we have to fix up the
1708 * offset here.
1709 *
1710 * Although it looks disgusting at this place, I want to keep
1711 * it here. The alternative would be to push knowledge about
1712 * the andx chain down into read&x again.
1713 */
1714
1715 if (smb_command == SMBreadX) {
1716 uint8_t *bytes_addr;
1717
1718 if (wct < 7) {
1719 /*
1720 * Invalid read&x response
1721 */
1722 return false;
1723 }
1724
1725 bytes_addr = outbuf + ofs /* vwv start */
1726 + sizeof(uint16_t) * wct /* vwv array */
1727 + sizeof(uint16_t) /* bcc */
1728 + 1; /* padding byte */
1729
1730 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
1731 bytes_addr - outbuf - 4);
1732 }
1733
1734 ofs += sizeof(uint16_t) * wct;
1735
1736 /*
1737 * bcc (byte count)
1738 */
1739
1740 SSVAL(outbuf, ofs, num_bytes);
1741 ofs += sizeof(uint16_t);
1742
1743 /*
1744 * The bytes field
1745 */
1746
1747 memcpy(outbuf + ofs, bytes, num_bytes);
1748
1749 return true;
1750 }
1751
1752 bool smb1_is_chain(const uint8_t *buf)
1753 {
1754 uint8_t cmd, wct, andx_cmd;
1755
1756 cmd = CVAL(buf, smb_com);
1757 if (!smb1cli_is_andx_req(cmd)) {
1758 return false;
1759 }
1760 wct = CVAL(buf, smb_wct);
1761 if (wct < 2) {
1762 return false;
1763 }
1764 andx_cmd = CVAL(buf, smb_vwv);
1765 return (andx_cmd != 0xFF);
1766 }
1767
1768 bool smb1_walk_chain(const uint8_t *buf,
1769 bool (*fn)(uint8_t cmd,
1770 uint8_t wct, const uint16_t *vwv,
1771 uint16_t num_bytes, const uint8_t *bytes,
1772 void *private_data),
1773 void *private_data)
1774 {
1775 size_t smblen = smb_len(buf);
1776 const char *smb_buf = smb_base(buf);
1777 uint8_t cmd, chain_cmd;
1778 uint8_t wct;
1779 const uint16_t *vwv;
1780 uint16_t num_bytes;
1781 const uint8_t *bytes;
1782
1783 cmd = CVAL(buf, smb_com);
1784 wct = CVAL(buf, smb_wct);
1785 vwv = (const uint16_t *)(buf + smb_vwv);
1786 num_bytes = smb_buflen(buf);
1787 bytes = (const uint8_t *)smb_buf_const(buf);
1788
1789 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
1790 return false;
1791 }
1792
1793 if (!smb1cli_is_andx_req(cmd)) {
1794 return true;
1795 }
1796 if (wct < 2) {
1797 return false;
1798 }
1799
1800 chain_cmd = CVAL(vwv, 0);
1801
1802 while (chain_cmd != 0xff) {
1803 uint32_t chain_offset; /* uint32_t to avoid overflow */
1804 size_t length_needed;
1805 ptrdiff_t vwv_offset;
1806
1807 chain_offset = SVAL(vwv+1, 0);
1808
1809 /*
1810 * Check if the client tries to fool us. The chain
1811 * offset needs to point beyond the current request in
1812 * the chain, it needs to strictly grow. Otherwise we
1813 * might be tricked into an endless loop always
1814 * processing the same request over and over again. We
1815 * used to assume that vwv and the byte buffer array
1816 * in a chain are always attached, but OS/2 the
1817 * Write&X/Read&X chain puts the Read&X vwv array
1818 * right behind the Write&X vwv chain. The Write&X bcc
1819 * array is put behind the Read&X vwv array. So now we
1820 * check whether the chain offset points strictly
1821 * behind the previous vwv array. req->buf points
1822 * right after the vwv array of the previous
1823 * request. See
1824 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
1825 * more information.
1826 */
1827
1828 vwv_offset = ((const char *)vwv - smb_buf);
1829 if (chain_offset <= vwv_offset) {
1830 return false;
1831 }
1832
1833 /*
1834 * Next check: Make sure the chain offset does not
1835 * point beyond the overall smb request length.
1836 */
1837
1838 length_needed = chain_offset+1; /* wct */
1839 if (length_needed > smblen) {
1840 return false;
1841 }
1842
1843 /*
1844 * Now comes the pointer magic. Goal here is to set up
1845 * vwv and buf correctly again. The chain offset (the
1846 * former vwv[1]) points at the new wct field.
1847 */
1848
1849 wct = CVAL(smb_buf, chain_offset);
1850
1851 if (smb1cli_is_andx_req(chain_cmd) && (wct < 2)) {
1852 return false;
1853 }
1854
1855 /*
1856 * Next consistency check: Make the new vwv array fits
1857 * in the overall smb request.
1858 */
1859
1860 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1861 if (length_needed > smblen) {
1862 return false;
1863 }
1864 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
1865
1866 /*
1867 * Now grab the new byte buffer....
1868 */
1869
1870 num_bytes = SVAL(vwv+wct, 0);
1871
1872 /*
1873 * .. and check that it fits.
1874 */
1875
1876 length_needed += num_bytes;
1877 if (length_needed > smblen) {
1878 return false;
1879 }
1880 bytes = (const uint8_t *)(vwv+wct+1);
1881
1882 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
1883 return false;
1884 }
1885
1886 if (!smb1cli_is_andx_req(chain_cmd)) {
1887 return true;
1888 }
1889 chain_cmd = CVAL(vwv, 0);
1890 }
1891 return true;
1892 }
1893
1894 static bool smb1_chain_length_cb(uint8_t cmd,
1895 uint8_t wct, const uint16_t *vwv,
1896 uint16_t num_bytes, const uint8_t *bytes,
1897 void *private_data)
1898 {
1899 unsigned *count = (unsigned *)private_data;
1900 *count += 1;
1901 return true;
1902 }
1903
1904 unsigned smb1_chain_length(const uint8_t *buf)
1905 {
1906 unsigned count = 0;
1907
1908 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
1909 return 0;
1910 }
1911 return count;
1912 }
1913
1914 struct smb1_parse_chain_state {
1915 TALLOC_CTX *mem_ctx;
1916 const uint8_t *buf;
1917 struct smbd_server_connection *sconn;
1918 struct smbXsrv_connection *xconn;
1919 bool encrypted;
1920 uint32_t seqnum;
1921
1922 struct smb_request **reqs;
1923 unsigned num_reqs;
1924 };
1925
1926 static bool smb1_parse_chain_cb(uint8_t cmd,
1927 uint8_t wct, const uint16_t *vwv,
1928 uint16_t num_bytes, const uint8_t *bytes,
1929 void *private_data)
1930 {
1931 struct smb1_parse_chain_state *state =
1932 (struct smb1_parse_chain_state *)private_data;
1933 struct smb_request **reqs;
1934 struct smb_request *req;
1935 bool ok;
1936
1937 reqs = talloc_realloc(state->mem_ctx, state->reqs,
1938 struct smb_request *, state->num_reqs+1);
1939 if (reqs == NULL) {
1940 return false;
1941 }
1942 state->reqs = reqs;
1943
1944 req = talloc(reqs, struct smb_request);
1945 if (req == NULL) {
1946 return false;
1947 }
1948
1949 ok = init_smb1_request(req, state->sconn, state->xconn, state->buf, 0,
1950 state->encrypted, state->seqnum);
1951 if (!ok) {
1952 return false;
1953 }
1954 req->cmd = cmd;
1955 req->wct = wct;
1956 req->vwv = vwv;
1957 req->buflen = num_bytes;
1958 req->buf = bytes;
1959
1960 reqs[state->num_reqs] = req;
1961 state->num_reqs += 1;
1962 return true;
1963 }
1964
1965 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
1966 struct smbXsrv_connection *xconn,
1967 bool encrypted, uint32_t seqnum,
1968 struct smb_request ***reqs, unsigned *num_reqs)
1969 {
1970 struct smbd_server_connection *sconn = NULL;
1971 struct smb1_parse_chain_state state;
1972 unsigned i;
1973
1974 if (xconn != NULL) {
1975 sconn = xconn->client->sconn;
1976 }
1977
1978 state.mem_ctx = mem_ctx;
1979 state.buf = buf;
1980 state.sconn = sconn;
1981 state.xconn = xconn;
1982 state.encrypted = encrypted;
1983 state.seqnum = seqnum;
1984 state.reqs = NULL;
1985 state.num_reqs = 0;
1986
1987 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
1988 TALLOC_FREE(state.reqs);
1989 return false;
1990 }
1991 for (i=0; i<state.num_reqs; i++) {
1992 state.reqs[i]->chain = state.reqs;
1993 }
1994 *reqs = state.reqs;
1995 *num_reqs = state.num_reqs;
1996 return true;
1997 }
1998
1999 static bool fd_is_readable(int fd)
2000 {
2001 int ret, revents;
2002
2003 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2004
2005 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2006
2007 }
2008
2009 static void smbd_server_connection_write_handler(
2010 struct smbXsrv_connection *xconn)
2011 {
2012 /* TODO: make write nonblocking */
2013 }
2014
2015 void smbd_smb1_server_connection_read_handler(struct smbXsrv_connection *xconn,
2016 int fd)
2017 {
2018 uint8_t *inbuf = NULL;
2019 size_t inbuf_len = 0;
2020 size_t unread_bytes = 0;
2021 bool encrypted = false;
2022 TALLOC_CTX *mem_ctx = talloc_tos();
2023 NTSTATUS status;
2024 uint32_t seqnum;
2025
2026 bool async_echo = lp_async_smb_echo_handler();
2027 bool from_client = false;
2028
2029 if (async_echo) {
2030 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2031 /*
2032 * This is the super-ugly hack to prefer the packets
2033 * forwarded by the echo handler over the ones by the
2034 * client directly
2035 */
2036 fd = xconn->smb1.echo_handler.trusted_fd;
2037 }
2038 }
2039
2040 from_client = (xconn->transport.sock == fd);
2041
2042 if (async_echo && from_client) {
2043 smbd_lock_socket(xconn);
2044
2045 if (!fd_is_readable(fd)) {
2046 DEBUG(10,("the echo listener was faster\n"));
2047 smbd_unlock_socket(xconn);
2048 return;
2049 }
2050 }
2051
2052 /* TODO: make this completely nonblocking */
2053 status = receive_smb_talloc(mem_ctx, xconn, fd,
2054 (char **)(void *)&inbuf,
2055 0, /* timeout */
2056 &unread_bytes,
2057 &encrypted,
2058 &inbuf_len, &seqnum,
2059 !from_client /* trusted channel */);
2060
2061 if (async_echo && from_client) {
2062 smbd_unlock_socket(xconn);
2063 }
2064
2065 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2066 goto process;
2067 }
2068 if (NT_STATUS_IS_ERR(status)) {
2069 exit_server_cleanly("failed to receive smb request");
2070 }
2071 if (!NT_STATUS_IS_OK(status)) {
2072 return;
2073 }
2074
2075 process:
2076 process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2077 seqnum, encrypted, NULL);
2078 }
2079
2080 static void smbd_server_echo_handler(struct tevent_context *ev,
2081 struct tevent_fd *fde,
2082 uint16_t flags,
2083 void *private_data)
2084 {
2085 struct smbXsrv_connection *xconn =
2086 talloc_get_type_abort(private_data,
2087 struct smbXsrv_connection);
2088
2089 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2090 /*
2091 * we're not supposed to do any io
2092 */
2093 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2094 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2095 return;
2096 }
2097
2098 if (flags & TEVENT_FD_WRITE) {
2099 smbd_server_connection_write_handler(xconn);
2100 return;
2101 }
2102 if (flags & TEVENT_FD_READ) {
2103 smbd_smb1_server_connection_read_handler(
2104 xconn, xconn->smb1.echo_handler.trusted_fd);
2105 return;
2106 }
2107 }
2108
2109 /*
2110 * Send keepalive packets to our client
2111 */
2112 bool keepalive_fn(const struct timeval *now, void *private_data)
2113 {
2114 struct smbd_server_connection *sconn = talloc_get_type_abort(
2115 private_data, struct smbd_server_connection);
2116 struct smbXsrv_connection *xconn = NULL;
2117 bool ret;
2118
2119 if (sconn->using_smb2) {
2120 /* Don't do keepalives on an SMB2 connection. */
2121 return false;
2122 }
2123
2124 /*
2125 * With SMB1 we only have 1 connection
2126 */
2127 xconn = sconn->client->connections;
2128 smbd_lock_socket(xconn);
2129 ret = send_keepalive(xconn->transport.sock);
2130 smbd_unlock_socket(xconn);
2131
2132 if (!ret) {
2133 int saved_errno = errno;
2134 /*
2135 * Try and give an error message saying what
2136 * client failed.
2137 */
2138 DEBUG(0, ("send_keepalive failed for client %s. "
2139 "Error %s - exiting\n",
2140 smbXsrv_connection_dbg(xconn),
2141 strerror(saved_errno)));
2142 errno = saved_errno;
2143 return False;
2144 }
2145 return True;
2146 }
2147
2148 /*
2149 * Read an smb packet in the echo handler child, giving the parent
2150 * smbd one second to react once the socket becomes readable.
2151 */
2152
2153 struct smbd_echo_read_state {
2154 struct tevent_context *ev;
2155 struct smbXsrv_connection *xconn;
2156
2157 char *buf;
2158 size_t buflen;
2159 uint32_t seqnum;
2160 };
2161
2162 static void smbd_echo_read_readable(struct tevent_req *subreq);
2163 static void smbd_echo_read_waited(struct tevent_req *subreq);
2164
2165 static struct tevent_req *smbd_echo_read_send(
2166 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2167 struct smbXsrv_connection *xconn)
2168 {
2169 struct tevent_req *req, *subreq;
2170 struct smbd_echo_read_state *state;
2171
2172 req = tevent_req_create(mem_ctx, &state,
2173 struct smbd_echo_read_state);
2174 if (req == NULL) {
2175 return NULL;
2176 }
2177 state->ev = ev;
2178 state->xconn = xconn;
2179
2180 subreq = wait_for_read_send(state, ev, xconn->transport.sock, false);
2181 if (tevent_req_nomem(subreq, req)) {
2182 return tevent_req_post(req, ev);
2183 }
2184 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2185 return req;
2186 }
2187
2188 static void smbd_echo_read_readable(struct tevent_req *subreq)
2189 {
2190 struct tevent_req *req = tevent_req_callback_data(
2191 subreq, struct tevent_req);
2192 struct smbd_echo_read_state *state = tevent_req_data(
2193 req, struct smbd_echo_read_state);
2194 bool ok;
2195 int err;
2196
2197 ok = wait_for_read_recv(subreq, &err);
2198 TALLOC_FREE(subreq);
2199 if (!ok) {
2200 tevent_req_nterror(req, map_nt_error_from_unix(err));
2201 return;
2202 }
2203
2204 /*
2205 * Give the parent smbd one second to step in
2206 */
2207
2208 subreq = tevent_wakeup_send(
2209 state, state->ev, timeval_current_ofs(1, 0));
2210 if (tevent_req_nomem(subreq, req)) {
2211 return;
2212 }
2213 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2214 }
2215
2216 static void smbd_echo_read_waited(struct tevent_req *subreq)
2217 {
2218 struct tevent_req *req = tevent_req_callback_data(
2219 subreq, struct tevent_req);
2220 struct smbd_echo_read_state *state = tevent_req_data(
2221 req, struct smbd_echo_read_state);
2222 struct smbXsrv_connection *xconn = state->xconn;
2223 bool ok;
2224 NTSTATUS status;
2225 size_t unread = 0;
2226 bool encrypted;
2227
2228 ok = tevent_wakeup_recv(subreq);
2229 TALLOC_FREE(subreq);
2230 if (!ok) {
2231 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2232 return;
2233 }
2234
2235 ok = smbd_lock_socket_internal(xconn);
2236 if (!ok) {
2237 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2238 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2239 return;
2240 }
2241
2242 if (!fd_is_readable(xconn->transport.sock)) {
2243 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2244 (int)getpid()));
2245
2246 ok = smbd_unlock_socket_internal(xconn);
2247 if (!ok) {
2248 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2249 DEBUG(1, ("%s: failed to unlock socket\n",
2250 __location__));
2251 return;
2252 }
2253
2254 subreq = wait_for_read_send(state, state->ev,
2255 xconn->transport.sock, false);
2256 if (tevent_req_nomem(subreq, req)) {
2257 return;
2258 }
2259 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2260 return;
2261 }
2262
2263 status = receive_smb_talloc(state, xconn,
2264 xconn->transport.sock,
2265 &state->buf,
2266 0 /* timeout */,
2267 &unread,
2268 &encrypted,
2269 &state->buflen,
2270 &state->seqnum,
2271 false /* trusted_channel*/);
2272
2273 if (tevent_req_nterror(req, status)) {
2274 tevent_req_nterror(req, status);
2275 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2276 (int)getpid(), nt_errstr(status)));
2277 return;
2278 }
2279
2280 ok = smbd_unlock_socket_internal(xconn);
2281 if (!ok) {
2282 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2283 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2284 return;
2285 }
2286 tevent_req_done(req);
2287 }
2288
2289 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2290 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2291 {
2292 struct smbd_echo_read_state *state = tevent_req_data(
2293 req, struct smbd_echo_read_state);
2294 NTSTATUS status;
2295
2296 if (tevent_req_is_nterror(req, &status)) {
2297 return status;
2298 }
2299 *pbuf = talloc_move(mem_ctx, &state->buf);
2300 *pbuflen = state->buflen;
2301 *pseqnum = state->seqnum;
2302 return NT_STATUS_OK;
2303 }
2304
2305 struct smbd_echo_state {
2306 struct tevent_context *ev;
2307 struct iovec *pending;
2308 struct smbd_server_connection *sconn;
2309 struct smbXsrv_connection *xconn;
2310 int parent_pipe;
2311
2312 struct tevent_fd *parent_fde;
2313
2314 struct tevent_req *write_req;
2315 };
2316
2317 static void smbd_echo_writer_done(struct tevent_req *req);
2318
2319 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2320 {
2321 int num_pending;
2322
2323 if (state->write_req != NULL) {
2324 return;
2325 }
2326
2327 num_pending = talloc_array_length(state->pending);
2328 if (num_pending == 0) {
2329 return;
2330 }
2331
2332 state->write_req = writev_send(state, state->ev, NULL,
2333 state->parent_pipe, false,
2334 state->pending, num_pending);
2335 if (state->write_req == NULL) {
2336 DEBUG(1, ("writev_send failed\n"));
2337 exit(1);
2338 }
2339
2340 talloc_steal(state->write_req, state->pending);
2341 state->pending = NULL;
2342
2343 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2344 state);
2345 }
2346
2347 static void smbd_echo_writer_done(struct tevent_req *req)
2348 {
2349 struct smbd_echo_state *state = tevent_req_callback_data(
2350 req, struct smbd_echo_state);
2351 ssize_t written;
2352 int err;
2353
2354 written = writev_recv(req, &err);
2355 TALLOC_FREE(req);
2356 state->write_req = NULL;
2357 if (written == -1) {
2358 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2359 exit(1);
2360 }
2361 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2362 smbd_echo_activate_writer(state);
2363 }
2364
2365 static bool smbd_echo_reply(struct smbd_echo_state *state,
2366 uint8_t *inbuf, size_t inbuf_len,
2367 uint32_t seqnum)
2368 {
2369 struct smb_request req;
2370 uint16_t num_replies;
2371 char *outbuf;
2372 bool ok;
2373
2374 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2375 DEBUG(10, ("Got netbios keepalive\n"));
2376 /*
2377 * Just swallow it
2378 */
2379 return true;
2380 }
2381
2382 if (inbuf_len < smb_size) {
2383 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2384 return false;
2385 }
2386 if (!valid_smb1_header(inbuf)) {
2387 DEBUG(10, ("Got invalid SMB header\n"));
2388 return false;
2389 }
2390
2391 if (!init_smb1_request(&req, state->sconn, state->xconn, inbuf, 0, false,
2392 seqnum)) {
2393 return false;
2394 }
2395 req.inbuf = inbuf;
2396
2397 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2398 smb_messages[req.cmd].name
2399 ? smb_messages[req.cmd].name : "unknown"));
2400
2401 if (req.cmd != SMBecho) {
2402 return false;
2403 }
2404 if (req.wct < 1) {
2405 return false;
2406 }
2407
2408 num_replies = SVAL(req.vwv+0, 0);
2409 if (num_replies != 1) {
2410 /* Not a Windows "Hey, you're still there?" request */
2411 return false;
2412 }
2413
2414 if (!create_smb1_outbuf(talloc_tos(), &req, req.inbuf, &outbuf,
2415 1, req.buflen)) {
2416 DEBUG(10, ("create_smb1_outbuf failed\n"));
2417 return false;
2418 }
2419 req.outbuf = (uint8_t *)outbuf;
2420
2421 SSVAL(req.outbuf, smb_vwv0, num_replies);
2422
2423 if (req.buflen > 0) {
2424 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2425 }
2426
2427 ok = smb1_srv_send(req.xconn, (char *)outbuf, true, seqnum + 1, false);
2428 TALLOC_FREE(outbuf);
2429 if (!ok) {
2430 exit(1);
2431 }
2432
2433 return true;
2434 }
2435
2436 static void smbd_echo_exit(struct tevent_context *ev,
2437 struct tevent_fd *fde, uint16_t flags,
2438 void *private_data)
2439 {
2440 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2441 exit(0);
2442 }
2443
2444 static void smbd_echo_got_packet(struct tevent_req *req);
2445
2446 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
2447 int parent_pipe)
2448 {
2449 struct smbd_echo_state *state;
2450 struct tevent_req *read_req;
2451
2452 state = talloc_zero(xconn, struct smbd_echo_state);
2453 if (state == NULL) {
2454 DEBUG(1, ("talloc failed\n"));
2455 return;
2456 }
2457 state->xconn = xconn;
2458 state->parent_pipe = parent_pipe;
2459 state->ev = samba_tevent_context_init(state);
2460 if (state->ev == NULL) {
2461 DEBUG(1, ("samba_tevent_context_init failed\n"));
2462 TALLOC_FREE(state);
2463 return;
2464 }
2465 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2466 TEVENT_FD_READ, smbd_echo_exit,
2467 state);
2468 if (state->parent_fde == NULL) {
2469 DEBUG(1, ("tevent_add_fd failed\n"));
2470 TALLOC_FREE(state);
2471 return;
2472 }
2473
2474 read_req = smbd_echo_read_send(state, state->ev, xconn);
2475 if (read_req == NULL) {
2476 DEBUG(1, ("smbd_echo_read_send failed\n"));
2477 TALLOC_FREE(state);
2478 return;
2479 }
2480 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2481
2482 while (true) {
2483 if (tevent_loop_once(state->ev) == -1) {
2484 DEBUG(1, ("tevent_loop_once failed: %s\n",
2485 strerror(errno)));
2486 break;
2487 }
2488 }
2489 TALLOC_FREE(state);
2490 }
2491
2492 static void smbd_echo_got_packet(struct tevent_req *req)
2493 {
2494 struct smbd_echo_state *state = tevent_req_callback_data(
2495 req, struct smbd_echo_state);
2496 NTSTATUS status;
2497 char *buf = NULL;
2498 size_t buflen = 0;
2499 uint32_t seqnum = 0;
2500 bool reply;
2501
2502 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2503 TALLOC_FREE(req);
2504 if (!NT_STATUS_IS_OK(status)) {
2505 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2506 nt_errstr(status)));
2507 exit(1);
2508 }
2509
2510 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2511 if (!reply) {
2512 size_t num_pending;
2513 struct iovec *tmp;
2514 struct iovec *iov;
2515
2516 num_pending = talloc_array_length(state->pending);
2517 tmp = talloc_realloc(state, state->pending, struct iovec,
2518 num_pending+1);
2519 if (tmp == NULL) {
2520 DEBUG(1, ("talloc_realloc failed\n"));
2521 exit(1);
2522 }
2523 state->pending = tmp;
2524
2525 if (buflen >= smb_size) {
2526 /*
2527 * place the seqnum in the packet so that the main process
2528 * can reply with signing
2529 */
2530 SIVAL(buf, smb_ss_field, seqnum);
2531 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2532 }
2533
2534 iov = &state->pending[num_pending];
2535 iov->iov_base = talloc_move(state->pending, &buf);
2536 iov->iov_len = buflen;
2537
2538 DEBUG(10,("echo_handler[%d]: forward to main\n",
2539 (int)getpid()));
2540 smbd_echo_activate_writer(state);
2541 }
2542
2543 req = smbd_echo_read_send(state, state->ev, state->xconn);
2544 if (req == NULL) {
2545 DEBUG(1, ("smbd_echo_read_send failed\n"));
2546 exit(1);
2547 }
2548 tevent_req_set_callback(req, smbd_echo_got_packet, state);
2549 }
2550
2551
2552 /*
2553 * Handle SMBecho requests in a forked child process
2554 */
2555 bool fork_echo_handler(struct smbXsrv_connection *xconn)
2556 {
2557 int listener_pipe[2];
2558 int res;
2559 pid_t child;
2560 bool use_mutex = false;
2561
2562 res = pipe(listener_pipe);
2563 if (res == -1) {
2564 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2565 return false;
2566 }
2567
2568 #ifdef HAVE_ROBUST_MUTEXES
2569 use_mutex = tdb_runtime_check_for_robust_mutexes();
2570
2571 if (use_mutex) {
2572 pthread_mutexattr_t a;
2573
2574 xconn->smb1.echo_handler.socket_mutex =
2575 anonymous_shared_allocate(sizeof(pthread_mutex_t));
2576 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
2577 DEBUG(1, ("Could not create mutex shared memory: %s\n",
2578 strerror(errno)));
2579 goto fail;
2580 }
2581
2582 res = pthread_mutexattr_init(&a);
2583 if (res != 0) {
2584 DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
2585 strerror(res)));
2586 goto fail;
2587 }
2588 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
2589 if (res != 0) {
2590 DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
2591 strerror(res)));
2592 pthread_mutexattr_destroy(&a);
2593 goto fail;
2594 }
2595 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
2596 if (res != 0) {
2597 DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
2598 strerror(res)));
2599 pthread_mutexattr_destroy(&a);
2600 goto fail;
2601 }
2602 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
2603 if (res != 0) {
2604 DEBUG(1, ("pthread_mutexattr_setrobust failed: "
2605 "%s\n", strerror(res)));
2606 pthread_mutexattr_destroy(&a);
2607 goto fail;
2608 }
2609 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
2610 &a);
2611 pthread_mutexattr_destroy(&a);
2612 if (res != 0) {
2613 DEBUG(1, ("pthread_mutex_init failed: %s\n",
2614 strerror(res)));
2615 goto fail;
2616 }
2617 }
2618 #endif
2619
2620 if (!use_mutex) {
2621 xconn->smb1.echo_handler.socket_lock_fd =
2622 create_unlink_tmp(lp_lock_directory());
2623 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
2624 DEBUG(1, ("Could not create lock fd: %s\n",
2625 strerror(errno)));
2626 goto fail;
2627 }
2628 }
2629
2630 child = fork();
2631 if (child == 0) {
2632 NTSTATUS status;
2633
2634 close(listener_pipe[0]);
2635 set_blocking(listener_pipe[1], false);
2636
2637 status = smbd_reinit_after_fork(xconn->client->msg_ctx,
2638 xconn->client->raw_ev_ctx,
2639 true);
2640 if (!NT_STATUS_IS_OK(status)) {
2641 DEBUG(1, ("reinit_after_fork failed: %s\n",
2642 nt_errstr(status)));
2643 exit(1);
2644 }
2645 process_set_title("smbd-echo", "echo handler");
2646 initialize_password_db(true, xconn->client->raw_ev_ctx);
2647 smbd_echo_loop(xconn, listener_pipe[1]);
2648 exit(0);
2649 }
2650 close(listener_pipe[1]);
2651 listener_pipe[1] = -1;
2652 xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2653
2654 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
2655
2656 /*
2657 * Without smb signing this is the same as the normal smbd
2658 * listener. This needs to change once signing comes in.
2659 */
2660 xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(
2661 xconn->client->raw_ev_ctx,
2662 xconn,
2663 xconn->smb1.echo_handler.trusted_fd,
2664 TEVENT_FD_READ,
2665 smbd_server_echo_handler,
2666 xconn);
2667 if (xconn->smb1.echo_handler.trusted_fde == NULL) {
2668 DEBUG(1, ("event_add_fd failed\n"));
2669 goto fail;
2670 }
2671
2672 return true;
2673
2674 fail:
2675 if (listener_pipe[0] != -1) {
2676 close(listener_pipe[0]);
2677 }
2678 if (listener_pipe[1] != -1) {
2679 close(listener_pipe[1]);
2680 }
2681 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
2682 close(xconn->smb1.echo_handler.socket_lock_fd);
2683 }
2684 #ifdef HAVE_ROBUST_MUTEXES
2685 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
2686 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
2687 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
2688 }
2689 #endif
2690 smbd_echo_init(xconn);
2691
2692 return false;
2693 }
2694
2695 bool req_is_in_chain(const struct smb_request *req)
2696 {
2697 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
2698 /*
2699 * We're right now handling a subsequent request, so we must
2700 * be in a chain
2701 */
2702 return true;
2703 }
2704
2705 if (!smb1cli_is_andx_req(req->cmd)) {
2706 return false;
2707 }
2708
2709 if (req->wct < 2) {
2710 /*
2711 * Okay, an illegal request, but definitely not chained :-)
2712 */
2713 return false;
2714 }
2715
2716 return (CVAL(req->vwv+0, 0) != 0xFF);
2717 }
Samba GIT mirror