?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
charset/tests: add more str[n]casecmp_m() tests to demonstrate the bug
[Samba.git] / source3 / smbd / process.c
blobb65ae2c1b1c0e505813e01173a1e9d48ecadde71
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "lib/messages_ctdb.h"
36 #include "smbprofile.h"
37 #include "rpc_server/spoolss/srv_spoolss_nt.h"
38 #include "libsmb/libsmb.h"
39 #include "../lib/util/tevent_ntstatus.h"
40 #include "../libcli/security/dom_sid.h"
41 #include "../libcli/security/security_token.h"
42 #include "lib/id_cache.h"
43 #include "lib/util/sys_rw_data.h"
44 #include "serverid.h"
45 #include "system/threads.h"
46
47 /* Internal message queue for deferred opens. */
48 struct pending_message_list {
49 struct pending_message_list *next, *prev;
50 struct timeval request_time; /* When was this first issued? */
51 struct smbd_server_connection *sconn;
52 struct smbXsrv_connection *xconn;
53 struct tevent_timer *te;
54 struct smb_perfcount_data pcd;
55 uint32_t seqnum;
56 bool encrypted;
57 bool processed;
58 DATA_BLOB buf;
59 struct deferred_open_record *open_rec;
60 };
61
62 static void construct_reply_common(uint8_t cmd, const uint8_t *inbuf,
63 char *outbuf);
64 static struct pending_message_list *get_deferred_open_message_smb(
65 struct smbd_server_connection *sconn, uint64_t mid);
66 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
67
68 static void smbd_echo_init(struct smbXsrv_connection *xconn)
69 {
70 xconn->smb1.echo_handler.trusted_fd = -1;
71 xconn->smb1.echo_handler.socket_lock_fd = -1;
72 #ifdef HAVE_ROBUST_MUTEXES
73 xconn->smb1.echo_handler.socket_mutex = NULL;
74 #endif
75 }
76
77 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
78 {
79 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
80 return true;
81 }
82
83 #ifdef HAVE_ROBUST_MUTEXES
84 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
85 return true;
86 }
87 #endif
88
89 return false;
90 }
91
92 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
93 {
94 if (!smbd_echo_active(xconn)) {
95 return true;
96 }
97
98 xconn->smb1.echo_handler.ref_count++;
99
100 if (xconn->smb1.echo_handler.ref_count > 1) {
101 return true;
102 }
103
104 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
105
106 #ifdef HAVE_ROBUST_MUTEXES
107 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
108 int ret = EINTR;
109
110 while (ret == EINTR) {
111 ret = pthread_mutex_lock(
112 xconn->smb1.echo_handler.socket_mutex);
113 if (ret == 0) {
114 break;
115 }
116 }
117 if (ret != 0) {
118 DEBUG(1, ("pthread_mutex_lock failed: %s\n",
119 strerror(ret)));
120 return false;
121 }
122 }
123 #endif
124
125 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
126 bool ok;
127
128 do {
129 ok = fcntl_lock(
130 xconn->smb1.echo_handler.socket_lock_fd,
131 F_SETLKW, 0, 0, F_WRLCK);
132 } while (!ok && (errno == EINTR));
133
134 if (!ok) {
135 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
136 return false;
137 }
138 }
139
140 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
141
142 return true;
143 }
144
145 void smbd_lock_socket(struct smbXsrv_connection *xconn)
146 {
147 if (!smbd_lock_socket_internal(xconn)) {
148 exit_server_cleanly("failed to lock socket");
149 }
150 }
151
152 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
153 {
154 if (!smbd_echo_active(xconn)) {
155 return true;
156 }
157
158 xconn->smb1.echo_handler.ref_count--;
159
160 if (xconn->smb1.echo_handler.ref_count > 0) {
161 return true;
162 }
163
164 #ifdef HAVE_ROBUST_MUTEXES
165 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
166 int ret = EINTR;
167
168 while (ret == EINTR) {
169 ret = pthread_mutex_unlock(
170 xconn->smb1.echo_handler.socket_mutex);
171 if (ret == 0) {
172 break;
173 }
174 }
175 if (ret != 0) {
176 DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
177 strerror(ret)));
178 return false;
179 }
180 }
181 #endif
182
183 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
184 bool ok;
185
186 do {
187 ok = fcntl_lock(
188 xconn->smb1.echo_handler.socket_lock_fd,
189 F_SETLKW, 0, 0, F_UNLCK);
190 } while (!ok && (errno == EINTR));
191
192 if (!ok) {
193 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
194 return false;
195 }
196 }
197
198 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
199
200 return true;
201 }
202
203 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
204 {
205 if (!smbd_unlock_socket_internal(xconn)) {
206 exit_server_cleanly("failed to unlock socket");
207 }
208 }
209
210 /* Accessor function for smb_read_error for smbd functions. */
211
212 /****************************************************************************
213 Send an smb to a fd.
214 ****************************************************************************/
215
216 bool srv_send_smb(struct smbXsrv_connection *xconn, char *buffer,
217 bool do_signing, uint32_t seqnum,
218 bool do_encrypt,
219 struct smb_perfcount_data *pcd)
220 {
221 size_t len = 0;
222 ssize_t ret;
223 char *buf_out = buffer;
224
225 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
226 /*
227 * we're not supposed to do any io
228 */
229 return true;
230 }
231
232 smbd_lock_socket(xconn);
233
234 if (do_signing) {
235 /* Sign the outgoing packet if required. */
236 srv_calculate_sign_mac(xconn, buf_out, seqnum);
237 }
238
239 if (do_encrypt) {
240 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
241 if (!NT_STATUS_IS_OK(status)) {
242 DEBUG(0, ("send_smb: SMB encryption failed "
243 "on outgoing packet! Error %s\n",
244 nt_errstr(status) ));
245 ret = -1;
246 goto out;
247 }
248 }
249
250 len = smb_len_large(buf_out) + 4;
251
252 ret = write_data(xconn->transport.sock, buf_out, len);
253 if (ret <= 0) {
254 int saved_errno = errno;
255 /*
256 * Try and give an error message saying what
257 * client failed.
258 */
259 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
260 (int)getpid(), (int)len,
261 smbXsrv_connection_dbg(xconn),
262 (int)ret, strerror(saved_errno)));
263 errno = saved_errno;
264
265 srv_free_enc_buffer(xconn, buf_out);
266 goto out;
267 }
268
269 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
270 srv_free_enc_buffer(xconn, buf_out);
271 out:
272 SMB_PERFCOUNT_END(pcd);
273
274 smbd_unlock_socket(xconn);
275 return (ret > 0);
276 }
277
278 /*******************************************************************
279 Setup the word count and byte count for a smb message.
280 ********************************************************************/
281
282 int srv_set_message(char *buf,
283 int num_words,
284 int num_bytes,
285 bool zero)
286 {
287 if (zero && (num_words || num_bytes)) {
288 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
289 }
290 SCVAL(buf,smb_wct,num_words);
291 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
292 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
293 return (smb_size + num_words*2 + num_bytes);
294 }
295
296 static bool valid_smb_header(const uint8_t *inbuf)
297 {
298 if (is_encrypted_packet(inbuf)) {
299 return true;
300 }
301 /*
302 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
303 * but it just looks weird to call strncmp for this one.
304 */
305 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
306 }
307
308 /* Socket functions for smbd packet processing. */
309
310 static bool valid_packet_size(size_t len)
311 {
312 /*
313 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
314 * of header. Don't print the error if this fits.... JRA.
315 */
316
317 if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
318 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
319 (unsigned long)len));
320 return false;
321 }
322 return true;
323 }
324
325 static NTSTATUS read_packet_remainder(int fd, char *buffer,
326 unsigned int timeout, ssize_t len)
327 {
328 NTSTATUS status;
329
330 if (len <= 0) {
331 return NT_STATUS_OK;
332 }
333
334 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
335 if (!NT_STATUS_IS_OK(status)) {
336 char addr[INET6_ADDRSTRLEN];
337 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
338 "error = %s.\n",
339 get_peer_addr(fd, addr, sizeof(addr)),
340 nt_errstr(status)));
341 }
342 return status;
343 }
344
345 /****************************************************************************
346 Attempt a zerocopy writeX read. We know here that len > smb_size-4
347 ****************************************************************************/
348
349 /*
350 * Unfortunately, earlier versions of smbclient/libsmbclient
351 * don't send this "standard" writeX header. I've fixed this
352 * for 3.2 but we'll use the old method with earlier versions.
353 * Windows and CIFSFS at least use this standard size. Not
354 * sure about MacOSX.
355 */
356
357 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
358 (2*14) + /* word count (including bcc) */ \
359 1 /* pad byte */)
360
361 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
362 const char lenbuf[4],
363 struct smbXsrv_connection *xconn,
364 int sock,
365 char **buffer,
366 unsigned int timeout,
367 size_t *p_unread,
368 size_t *len_ret)
369 {
370 /* Size of a WRITEX call (+4 byte len). */
371 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
372 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
373 ssize_t toread;
374 NTSTATUS status;
375
376 memcpy(writeX_header, lenbuf, 4);
377
378 status = read_fd_with_timeout(
379 sock, writeX_header + 4,
380 STANDARD_WRITE_AND_X_HEADER_SIZE,
381 STANDARD_WRITE_AND_X_HEADER_SIZE,
382 timeout, NULL);
383
384 if (!NT_STATUS_IS_OK(status)) {
385 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
386 "error = %s.\n",
387 smbXsrv_connection_dbg(xconn),
388 nt_errstr(status)));
389 return status;
390 }
391
392 /*
393 * Ok - now try and see if this is a possible
394 * valid writeX call.
395 */
396
397 if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
398 /*
399 * If the data offset is beyond what
400 * we've read, drain the extra bytes.
401 */
402 uint16_t doff = SVAL(writeX_header,smb_vwv11);
403 ssize_t newlen;
404
405 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
406 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
407 if (drain_socket(sock, drain) != drain) {
408 smb_panic("receive_smb_raw_talloc_partial_read:"
409 " failed to drain pending bytes");
410 }
411 } else {
412 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
413 }
414
415 /* Spoof down the length and null out the bcc. */
416 set_message_bcc(writeX_header, 0);
417 newlen = smb_len(writeX_header);
418
419 /* Copy the header we've written. */
420
421 *buffer = (char *)talloc_memdup(mem_ctx,
422 writeX_header,
423 sizeof(writeX_header));
424
425 if (*buffer == NULL) {
426 DEBUG(0, ("Could not allocate inbuf of length %d\n",
427 (int)sizeof(writeX_header)));
428 return NT_STATUS_NO_MEMORY;
429 }
430
431 /* Work out the remaining bytes. */
432 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
433 *len_ret = newlen + 4;
434 return NT_STATUS_OK;
435 }
436
437 if (!valid_packet_size(len)) {
438 return NT_STATUS_INVALID_PARAMETER;
439 }
440
441 /*
442 * Not a valid writeX call. Just do the standard
443 * talloc and return.
444 */
445
446 *buffer = talloc_array(mem_ctx, char, len+4);
447
448 if (*buffer == NULL) {
449 DEBUG(0, ("Could not allocate inbuf of length %d\n",
450 (int)len+4));
451 return NT_STATUS_NO_MEMORY;
452 }
453
454 /* Copy in what we already read. */
455 memcpy(*buffer,
456 writeX_header,
457 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
458 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
459
460 if(toread > 0) {
461 status = read_packet_remainder(
462 sock,
463 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
464 timeout, toread);
465
466 if (!NT_STATUS_IS_OK(status)) {
467 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
468 nt_errstr(status)));
469 return status;
470 }
471 }
472
473 *len_ret = len + 4;
474 return NT_STATUS_OK;
475 }
476
477 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
478 struct smbXsrv_connection *xconn,
479 int sock,
480 char **buffer, unsigned int timeout,
481 size_t *p_unread, size_t *plen)
482 {
483 char lenbuf[4];
484 size_t len;
485 int min_recv_size = lp_min_receive_file_size();
486 NTSTATUS status;
487
488 *p_unread = 0;
489
490 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
491 &len);
492 if (!NT_STATUS_IS_OK(status)) {
493 return status;
494 }
495
496 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
497 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
498 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
499 !srv_is_signing_active(xconn) &&
500 xconn->smb1.echo_handler.trusted_fde == NULL) {
501
502 return receive_smb_raw_talloc_partial_read(
503 mem_ctx, lenbuf, xconn, sock, buffer, timeout,
504 p_unread, plen);
505 }
506
507 if (!valid_packet_size(len)) {
508 return NT_STATUS_INVALID_PARAMETER;
509 }
510
511 /*
512 * The +4 here can't wrap, we've checked the length above already.
513 */
514
515 *buffer = talloc_array(mem_ctx, char, len+4);
516
517 if (*buffer == NULL) {
518 DEBUG(0, ("Could not allocate inbuf of length %d\n",
519 (int)len+4));
520 return NT_STATUS_NO_MEMORY;
521 }
522
523 memcpy(*buffer, lenbuf, sizeof(lenbuf));
524
525 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
526 if (!NT_STATUS_IS_OK(status)) {
527 return status;
528 }
529
530 *plen = len + 4;
531 return NT_STATUS_OK;
532 }
533
534 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
535 struct smbXsrv_connection *xconn,
536 int sock,
537 char **buffer, unsigned int timeout,
538 size_t *p_unread, bool *p_encrypted,
539 size_t *p_len,
540 uint32_t *seqnum,
541 bool trusted_channel)
542 {
543 size_t len = 0;
544 NTSTATUS status;
545
546 *p_encrypted = false;
547
548 status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
549 p_unread, &len);
550 if (!NT_STATUS_IS_OK(status)) {
551 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
552 ("receive_smb_raw_talloc failed for client %s "
553 "read error = %s.\n",
554 smbXsrv_connection_dbg(xconn),
555 nt_errstr(status)) );
556 return status;
557 }
558
559 if (is_encrypted_packet((uint8_t *)*buffer)) {
560 status = srv_decrypt_buffer(xconn, *buffer);
561 if (!NT_STATUS_IS_OK(status)) {
562 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
563 "incoming packet! Error %s\n",
564 nt_errstr(status) ));
565 return status;
566 }
567 *p_encrypted = true;
568 }
569
570 /* Check the incoming SMB signature. */
571 if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
572 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
573 "incoming packet!\n"));
574 return NT_STATUS_INVALID_NETWORK_RESPONSE;
575 }
576
577 *p_len = len;
578 return NT_STATUS_OK;
579 }
580
581 /*
582 * Initialize a struct smb_request from an inbuf
583 */
584
585 static bool init_smb_request(struct smb_request *req,
586 struct smbd_server_connection *sconn,
587 struct smbXsrv_connection *xconn,
588 const uint8_t *inbuf,
589 size_t unread_bytes, bool encrypted,
590 uint32_t seqnum)
591 {
592 struct smbXsrv_tcon *tcon;
593 NTSTATUS status;
594 NTTIME now;
595 size_t req_size = smb_len(inbuf) + 4;
596
597 /* Ensure we have at least smb_size bytes. */
598 if (req_size < smb_size) {
599 DEBUG(0,("init_smb_request: invalid request size %u\n",
600 (unsigned int)req_size ));
601 return false;
602 }
603
604 req->request_time = timeval_current();
605 now = timeval_to_nttime(&req->request_time);
606
607 req->cmd = CVAL(inbuf, smb_com);
608 req->flags2 = SVAL(inbuf, smb_flg2);
609 req->smbpid = SVAL(inbuf, smb_pid);
610 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
611 req->seqnum = seqnum;
612 req->vuid = SVAL(inbuf, smb_uid);
613 req->tid = SVAL(inbuf, smb_tid);
614 req->wct = CVAL(inbuf, smb_wct);
615 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
616 req->buflen = smb_buflen(inbuf);
617 req->buf = (const uint8_t *)smb_buf_const(inbuf);
618 req->unread_bytes = unread_bytes;
619 req->encrypted = encrypted;
620 req->sconn = sconn;
621 req->xconn = xconn;
622 req->conn = NULL;
623 if (xconn != NULL) {
624 status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
625 if (NT_STATUS_IS_OK(status)) {
626 req->conn = tcon->compat;
627 }
628 }
629 req->chain_fsp = NULL;
630 req->smb2req = NULL;
631 req->priv_paths = NULL;
632 req->chain = NULL;
633 req->posix_pathnames = lp_posix_pathnames();
634 smb_init_perfcount_data(&req->pcd);
635
636 /* Ensure we have at least wct words and 2 bytes of bcc. */
637 if (smb_size + req->wct*2 > req_size) {
638 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
639 (unsigned int)req->wct,
640 (unsigned int)req_size));
641 return false;
642 }
643 /* Ensure bcc is correct. */
644 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
645 DEBUG(0,("init_smb_request: invalid bcc number %u "
646 "(wct = %u, size %u)\n",
647 (unsigned int)req->buflen,
648 (unsigned int)req->wct,
649 (unsigned int)req_size));
650 return false;
651 }
652
653 req->outbuf = NULL;
654 return true;
655 }
656
657 static void process_smb(struct smbXsrv_connection *xconn,
658 uint8_t *inbuf, size_t nread, size_t unread_bytes,
659 uint32_t seqnum, bool encrypted,
660 struct smb_perfcount_data *deferred_pcd);
661
662 static void smbd_deferred_open_timer(struct tevent_context *ev,
663 struct tevent_timer *te,
664 struct timeval _tval,
665 void *private_data)
666 {
667 struct pending_message_list *msg = talloc_get_type(private_data,
668 struct pending_message_list);
669 struct smbd_server_connection *sconn = msg->sconn;
670 struct smbXsrv_connection *xconn = msg->xconn;
671 TALLOC_CTX *mem_ctx = talloc_tos();
672 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
673 uint8_t *inbuf;
674
675 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
676 msg->buf.length);
677 if (inbuf == NULL) {
678 exit_server("smbd_deferred_open_timer: talloc failed\n");
679 return;
680 }
681
682 /* We leave this message on the queue so the open code can
683 know this is a retry. */
684 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
685 (unsigned long long)mid ));
686
687 /* Mark the message as processed so this is not
688 * re-processed in error. */
689 msg->processed = true;
690
691 process_smb(xconn, inbuf,
692 msg->buf.length, 0,
693 msg->seqnum, msg->encrypted, &msg->pcd);
694
695 /* If it's still there and was processed, remove it. */
696 msg = get_deferred_open_message_smb(sconn, mid);
697 if (msg && msg->processed) {
698 remove_deferred_open_message_smb(xconn, mid);
699 }
700 }
701
702 /****************************************************************************
703 Function to push a message onto the tail of a linked list of smb messages ready
704 for processing.
705 ****************************************************************************/
706
707 static bool push_queued_message(struct smb_request *req,
708 struct timeval request_time,
709 struct timeval end_time,
710 struct deferred_open_record *open_rec)
711 {
712 int msg_len = smb_len(req->inbuf) + 4;
713 struct pending_message_list *msg;
714
715 msg = talloc_zero(NULL, struct pending_message_list);
716
717 if(msg == NULL) {
718 DEBUG(0,("push_message: malloc fail (1)\n"));
719 return False;
720 }
721 msg->sconn = req->sconn;
722 msg->xconn = req->xconn;
723
724 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
725 if(msg->buf.data == NULL) {
726 DEBUG(0,("push_message: malloc fail (2)\n"));
727 TALLOC_FREE(msg);
728 return False;
729 }
730
731 msg->request_time = request_time;
732 msg->seqnum = req->seqnum;
733 msg->encrypted = req->encrypted;
734 msg->processed = false;
735 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
736
737 if (open_rec) {
738 msg->open_rec = talloc_move(msg, &open_rec);
739 }
740
741 #if 0
742 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
743 msg,
744 end_time,
745 smbd_deferred_open_timer,
746 msg);
747 if (!msg->te) {
748 DEBUG(0,("push_message: event_add_timed failed\n"));
749 TALLOC_FREE(msg);
750 return false;
751 }
752 #endif
753
754 DLIST_ADD_END(req->sconn->deferred_open_queue, msg);
755
756 DEBUG(10,("push_message: pushed message length %u on "
757 "deferred_open_queue\n", (unsigned int)msg_len));
758
759 return True;
760 }
761
762 /****************************************************************************
763 Function to delete a sharing violation open message by mid.
764 ****************************************************************************/
765
766 void remove_deferred_open_message_smb(struct smbXsrv_connection *xconn,
767 uint64_t mid)
768 {
769 struct smbd_server_connection *sconn = xconn->client->sconn;
770 struct pending_message_list *pml;
771
772 if (sconn->using_smb2) {
773 remove_deferred_open_message_smb2(xconn, mid);
774 return;
775 }
776
777 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
778 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
779 DEBUG(10,("remove_deferred_open_message_smb: "
780 "deleting mid %llu len %u\n",
781 (unsigned long long)mid,
782 (unsigned int)pml->buf.length ));
783 DLIST_REMOVE(sconn->deferred_open_queue, pml);
784 TALLOC_FREE(pml);
785 return;
786 }
787 }
788 }
789
790 /****************************************************************************
791 Move a sharing violation open retry message to the front of the list and
792 schedule it for immediate processing.
793 ****************************************************************************/
794
795 bool schedule_deferred_open_message_smb(struct smbXsrv_connection *xconn,
796 uint64_t mid)
797 {
798 struct smbd_server_connection *sconn = xconn->client->sconn;
799 struct pending_message_list *pml;
800 int i = 0;
801
802 if (sconn->using_smb2) {
803 return schedule_deferred_open_message_smb2(xconn, mid);
804 }
805
806 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
807 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
808
809 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
810 "msg_mid = %llu\n",
811 i++,
812 (unsigned long long)msg_mid ));
813
814 if (mid == msg_mid) {
815 struct tevent_timer *te;
816
817 if (pml->processed) {
818 /* A processed message should not be
819 * rescheduled. */
820 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
821 "message mid %llu was already processed\n",
822 (unsigned long long)msg_mid ));
823 continue;
824 }
825
826 DEBUG(10,("schedule_deferred_open_message_smb: "
827 "scheduling mid %llu\n",
828 (unsigned long long)mid ));
829
830 te = tevent_add_timer(pml->sconn->ev_ctx,
831 pml,
832 timeval_zero(),
833 smbd_deferred_open_timer,
834 pml);
835 if (!te) {
836 DEBUG(10,("schedule_deferred_open_message_smb: "
837 "event_add_timed() failed, "
838 "skipping mid %llu\n",
839 (unsigned long long)msg_mid ));
840 }
841
842 TALLOC_FREE(pml->te);
843 pml->te = te;
844 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
845 return true;
846 }
847 }
848
849 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
850 "find message mid %llu\n",
851 (unsigned long long)mid ));
852
853 return false;
854 }
855
856 /****************************************************************************
857 Return true if this mid is on the deferred queue and was not yet processed.
858 ****************************************************************************/
859
860 bool open_was_deferred(struct smbXsrv_connection *xconn, uint64_t mid)
861 {
862 struct smbd_server_connection *sconn = xconn->client->sconn;
863 struct pending_message_list *pml;
864
865 if (sconn->using_smb2) {
866 return open_was_deferred_smb2(xconn, mid);
867 }
868
869 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
870 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
871 return True;
872 }
873 }
874 return False;
875 }
876
877 /****************************************************************************
878 Return the message queued by this mid.
879 ****************************************************************************/
880
881 static struct pending_message_list *get_deferred_open_message_smb(
882 struct smbd_server_connection *sconn, uint64_t mid)
883 {
884 struct pending_message_list *pml;
885
886 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
887 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
888 return pml;
889 }
890 }
891 return NULL;
892 }
893
894 /****************************************************************************
895 Get the state data queued by this mid.
896 ****************************************************************************/
897
898 bool get_deferred_open_message_state(struct smb_request *smbreq,
899 struct timeval *p_request_time,
900 struct deferred_open_record **open_rec)
901 {
902 struct pending_message_list *pml;
903
904 if (smbreq->sconn->using_smb2) {
905 return get_deferred_open_message_state_smb2(smbreq->smb2req,
906 p_request_time,
907 open_rec);
908 }
909
910 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
911 if (!pml) {
912 return false;
913 }
914 if (p_request_time) {
915 *p_request_time = pml->request_time;
916 }
917 if (open_rec != NULL) {
918 *open_rec = pml->open_rec;
919 }
920 return true;
921 }
922
923 /****************************************************************************
924 Function to push a deferred open smb message onto a linked list of local smb
925 messages ready for processing.
926 ****************************************************************************/
927
928 bool push_deferred_open_message_smb(struct smb_request *req,
929 struct timeval request_time,
930 struct timeval timeout,
931 struct file_id id,
932 struct deferred_open_record *open_rec)
933 {
934 struct timeval end_time;
935
936 if (req->smb2req) {
937 return push_deferred_open_message_smb2(req->smb2req,
938 request_time,
939 timeout,
940 id,
941 open_rec);
942 }
943
944 if (req->unread_bytes) {
945 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
946 "unread_bytes = %u\n",
947 (unsigned int)req->unread_bytes ));
948 smb_panic("push_deferred_open_message_smb: "
949 "logic error unread_bytes != 0" );
950 }
951
952 end_time = timeval_sum(&request_time, &timeout);
953
954 DEBUG(10,("push_deferred_open_message_smb: pushing message "
955 "len %u mid %llu timeout time [%u.%06u]\n",
956 (unsigned int) smb_len(req->inbuf)+4,
957 (unsigned long long)req->mid,
958 (unsigned int)end_time.tv_sec,
959 (unsigned int)end_time.tv_usec));
960
961 return push_queued_message(req, request_time, end_time, open_rec);
962 }
963
964 static void smbd_sig_term_handler(struct tevent_context *ev,
965 struct tevent_signal *se,
966 int signum,
967 int count,
968 void *siginfo,
969 void *private_data)
970 {
971 exit_server_cleanly("termination signal");
972 }
973
974 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
975 {
976 struct tevent_signal *se;
977
978 se = tevent_add_signal(sconn->ev_ctx,
979 sconn,
980 SIGTERM, 0,
981 smbd_sig_term_handler,
982 sconn);
983 if (!se) {
984 exit_server("failed to setup SIGTERM handler");
985 }
986 }
987
988 static void smbd_sig_hup_handler(struct tevent_context *ev,
989 struct tevent_signal *se,
990 int signum,
991 int count,
992 void *siginfo,
993 void *private_data)
994 {
995 struct smbd_server_connection *sconn =
996 talloc_get_type_abort(private_data,
997 struct smbd_server_connection);
998
999 change_to_root_user();
1000 DEBUG(1,("Reloading services after SIGHUP\n"));
1001 reload_services(sconn, conn_snum_used, false);
1002 }
1003
1004 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1005 {
1006 struct tevent_signal *se;
1007
1008 se = tevent_add_signal(sconn->ev_ctx,
1009 sconn,
1010 SIGHUP, 0,
1011 smbd_sig_hup_handler,
1012 sconn);
1013 if (!se) {
1014 exit_server("failed to setup SIGHUP handler");
1015 }
1016 }
1017
1018 static void smbd_conf_updated(struct messaging_context *msg,
1019 void *private_data,
1020 uint32_t msg_type,
1021 struct server_id server_id,
1022 DATA_BLOB *data)
1023 {
1024 struct smbd_server_connection *sconn =
1025 talloc_get_type_abort(private_data,
1026 struct smbd_server_connection);
1027
1028 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1029 "updated. Reloading.\n"));
1030 change_to_root_user();
1031 reload_services(sconn, conn_snum_used, false);
1032 }
1033
1034 /*
1035 * Only allow 5 outstanding trans requests. We're allocating memory, so
1036 * prevent a DoS.
1037 */
1038
1039 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1040 {
1041 int count = 0;
1042 for (; list != NULL; list = list->next) {
1043
1044 if (list->mid == mid) {
1045 return NT_STATUS_INVALID_PARAMETER;
1046 }
1047
1048 count += 1;
1049 }
1050 if (count > 5) {
1051 return NT_STATUS_INSUFFICIENT_RESOURCES;
1052 }
1053
1054 return NT_STATUS_OK;
1055 }
1056
1057 /*
1058 These flags determine some of the permissions required to do an operation
1059
1060 Note that I don't set NEED_WRITE on some write operations because they
1061 are used by some brain-dead clients when printing, and I don't want to
1062 force write permissions on print services.
1063 */
1064 #define AS_USER (1<<0)
1065 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1066 #define TIME_INIT (1<<2)
1067 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1068 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1069 #define DO_CHDIR (1<<6)
1070
1071 /*
1072 define a list of possible SMB messages and their corresponding
1073 functions. Any message that has a NULL function is unimplemented -
1074 please feel free to contribute implementations!
1075 */
1076 static const struct smb_message_struct {
1077 const char *name;
1078 void (*fn)(struct smb_request *req);
1079 int flags;
1080 } smb_messages[256] = {
1081
1082 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1083 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1084 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1085 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1086 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1087 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1088 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1089 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1090 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1091 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1092 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1093 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1094 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1095 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1096 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1097 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1098 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1099 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1100 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1101 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1102 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1103 /* 0x15 */ { NULL, NULL, 0 },
1104 /* 0x16 */ { NULL, NULL, 0 },
1105 /* 0x17 */ { NULL, NULL, 0 },
1106 /* 0x18 */ { NULL, NULL, 0 },
1107 /* 0x19 */ { NULL, NULL, 0 },
1108 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1109 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1110 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1111 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1112 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1113 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1114 /* 0x20 */ { "SMBwritec", NULL,0},
1115 /* 0x21 */ { NULL, NULL, 0 },
1116 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1117 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1118 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1119 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1120 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1121 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1122 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1123 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1124 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1125 /* 0x2b */ { "SMBecho",reply_echo,0},
1126 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1127 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1128 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1129 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1130 /* 0x30 */ { NULL, NULL, 0 },
1131 /* 0x31 */ { NULL, NULL, 0 },
1132 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1133 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1134 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1135 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1136 /* 0x36 */ { NULL, NULL, 0 },
1137 /* 0x37 */ { NULL, NULL, 0 },
1138 /* 0x38 */ { NULL, NULL, 0 },
1139 /* 0x39 */ { NULL, NULL, 0 },
1140 /* 0x3a */ { NULL, NULL, 0 },
1141 /* 0x3b */ { NULL, NULL, 0 },
1142 /* 0x3c */ { NULL, NULL, 0 },
1143 /* 0x3d */ { NULL, NULL, 0 },
1144 /* 0x3e */ { NULL, NULL, 0 },
1145 /* 0x3f */ { NULL, NULL, 0 },
1146 /* 0x40 */ { NULL, NULL, 0 },
1147 /* 0x41 */ { NULL, NULL, 0 },
1148 /* 0x42 */ { NULL, NULL, 0 },
1149 /* 0x43 */ { NULL, NULL, 0 },
1150 /* 0x44 */ { NULL, NULL, 0 },
1151 /* 0x45 */ { NULL, NULL, 0 },
1152 /* 0x46 */ { NULL, NULL, 0 },
1153 /* 0x47 */ { NULL, NULL, 0 },
1154 /* 0x48 */ { NULL, NULL, 0 },
1155 /* 0x49 */ { NULL, NULL, 0 },
1156 /* 0x4a */ { NULL, NULL, 0 },
1157 /* 0x4b */ { NULL, NULL, 0 },
1158 /* 0x4c */ { NULL, NULL, 0 },
1159 /* 0x4d */ { NULL, NULL, 0 },
1160 /* 0x4e */ { NULL, NULL, 0 },
1161 /* 0x4f */ { NULL, NULL, 0 },
1162 /* 0x50 */ { NULL, NULL, 0 },
1163 /* 0x51 */ { NULL, NULL, 0 },
1164 /* 0x52 */ { NULL, NULL, 0 },
1165 /* 0x53 */ { NULL, NULL, 0 },
1166 /* 0x54 */ { NULL, NULL, 0 },
1167 /* 0x55 */ { NULL, NULL, 0 },
1168 /* 0x56 */ { NULL, NULL, 0 },
1169 /* 0x57 */ { NULL, NULL, 0 },
1170 /* 0x58 */ { NULL, NULL, 0 },
1171 /* 0x59 */ { NULL, NULL, 0 },
1172 /* 0x5a */ { NULL, NULL, 0 },
1173 /* 0x5b */ { NULL, NULL, 0 },
1174 /* 0x5c */ { NULL, NULL, 0 },
1175 /* 0x5d */ { NULL, NULL, 0 },
1176 /* 0x5e */ { NULL, NULL, 0 },
1177 /* 0x5f */ { NULL, NULL, 0 },
1178 /* 0x60 */ { NULL, NULL, 0 },
1179 /* 0x61 */ { NULL, NULL, 0 },
1180 /* 0x62 */ { NULL, NULL, 0 },
1181 /* 0x63 */ { NULL, NULL, 0 },
1182 /* 0x64 */ { NULL, NULL, 0 },
1183 /* 0x65 */ { NULL, NULL, 0 },
1184 /* 0x66 */ { NULL, NULL, 0 },
1185 /* 0x67 */ { NULL, NULL, 0 },
1186 /* 0x68 */ { NULL, NULL, 0 },
1187 /* 0x69 */ { NULL, NULL, 0 },
1188 /* 0x6a */ { NULL, NULL, 0 },
1189 /* 0x6b */ { NULL, NULL, 0 },
1190 /* 0x6c */ { NULL, NULL, 0 },
1191 /* 0x6d */ { NULL, NULL, 0 },
1192 /* 0x6e */ { NULL, NULL, 0 },
1193 /* 0x6f */ { NULL, NULL, 0 },
1194 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1195 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1196 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1197 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1198 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1199 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1200 /* 0x76 */ { NULL, NULL, 0 },
1201 /* 0x77 */ { NULL, NULL, 0 },
1202 /* 0x78 */ { NULL, NULL, 0 },
1203 /* 0x79 */ { NULL, NULL, 0 },
1204 /* 0x7a */ { NULL, NULL, 0 },
1205 /* 0x7b */ { NULL, NULL, 0 },
1206 /* 0x7c */ { NULL, NULL, 0 },
1207 /* 0x7d */ { NULL, NULL, 0 },
1208 /* 0x7e */ { NULL, NULL, 0 },
1209 /* 0x7f */ { NULL, NULL, 0 },
1210 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1211 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1212 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1213 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1214 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1215 /* 0x85 */ { NULL, NULL, 0 },
1216 /* 0x86 */ { NULL, NULL, 0 },
1217 /* 0x87 */ { NULL, NULL, 0 },
1218 /* 0x88 */ { NULL, NULL, 0 },
1219 /* 0x89 */ { NULL, NULL, 0 },
1220 /* 0x8a */ { NULL, NULL, 0 },
1221 /* 0x8b */ { NULL, NULL, 0 },
1222 /* 0x8c */ { NULL, NULL, 0 },
1223 /* 0x8d */ { NULL, NULL, 0 },
1224 /* 0x8e */ { NULL, NULL, 0 },
1225 /* 0x8f */ { NULL, NULL, 0 },
1226 /* 0x90 */ { NULL, NULL, 0 },
1227 /* 0x91 */ { NULL, NULL, 0 },
1228 /* 0x92 */ { NULL, NULL, 0 },
1229 /* 0x93 */ { NULL, NULL, 0 },
1230 /* 0x94 */ { NULL, NULL, 0 },
1231 /* 0x95 */ { NULL, NULL, 0 },
1232 /* 0x96 */ { NULL, NULL, 0 },
1233 /* 0x97 */ { NULL, NULL, 0 },
1234 /* 0x98 */ { NULL, NULL, 0 },
1235 /* 0x99 */ { NULL, NULL, 0 },
1236 /* 0x9a */ { NULL, NULL, 0 },
1237 /* 0x9b */ { NULL, NULL, 0 },
1238 /* 0x9c */ { NULL, NULL, 0 },
1239 /* 0x9d */ { NULL, NULL, 0 },
1240 /* 0x9e */ { NULL, NULL, 0 },
1241 /* 0x9f */ { NULL, NULL, 0 },
1242 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1243 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1244 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1245 /* 0xa3 */ { NULL, NULL, 0 },
1246 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1247 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1248 /* 0xa6 */ { NULL, NULL, 0 },
1249 /* 0xa7 */ { NULL, NULL, 0 },
1250 /* 0xa8 */ { NULL, NULL, 0 },
1251 /* 0xa9 */ { NULL, NULL, 0 },
1252 /* 0xaa */ { NULL, NULL, 0 },
1253 /* 0xab */ { NULL, NULL, 0 },
1254 /* 0xac */ { NULL, NULL, 0 },
1255 /* 0xad */ { NULL, NULL, 0 },
1256 /* 0xae */ { NULL, NULL, 0 },
1257 /* 0xaf */ { NULL, NULL, 0 },
1258 /* 0xb0 */ { NULL, NULL, 0 },
1259 /* 0xb1 */ { NULL, NULL, 0 },
1260 /* 0xb2 */ { NULL, NULL, 0 },
1261 /* 0xb3 */ { NULL, NULL, 0 },
1262 /* 0xb4 */ { NULL, NULL, 0 },
1263 /* 0xb5 */ { NULL, NULL, 0 },
1264 /* 0xb6 */ { NULL, NULL, 0 },
1265 /* 0xb7 */ { NULL, NULL, 0 },
1266 /* 0xb8 */ { NULL, NULL, 0 },
1267 /* 0xb9 */ { NULL, NULL, 0 },
1268 /* 0xba */ { NULL, NULL, 0 },
1269 /* 0xbb */ { NULL, NULL, 0 },
1270 /* 0xbc */ { NULL, NULL, 0 },
1271 /* 0xbd */ { NULL, NULL, 0 },
1272 /* 0xbe */ { NULL, NULL, 0 },
1273 /* 0xbf */ { NULL, NULL, 0 },
1274 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1275 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1276 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1277 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1278 /* 0xc4 */ { NULL, NULL, 0 },
1279 /* 0xc5 */ { NULL, NULL, 0 },
1280 /* 0xc6 */ { NULL, NULL, 0 },
1281 /* 0xc7 */ { NULL, NULL, 0 },
1282 /* 0xc8 */ { NULL, NULL, 0 },
1283 /* 0xc9 */ { NULL, NULL, 0 },
1284 /* 0xca */ { NULL, NULL, 0 },
1285 /* 0xcb */ { NULL, NULL, 0 },
1286 /* 0xcc */ { NULL, NULL, 0 },
1287 /* 0xcd */ { NULL, NULL, 0 },
1288 /* 0xce */ { NULL, NULL, 0 },
1289 /* 0xcf */ { NULL, NULL, 0 },
1290 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1291 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1292 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1293 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1294 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1295 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1296 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1297 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1298 /* 0xd8 */ { NULL, NULL, 0 },
1299 /* 0xd9 */ { NULL, NULL, 0 },
1300 /* 0xda */ { NULL, NULL, 0 },
1301 /* 0xdb */ { NULL, NULL, 0 },
1302 /* 0xdc */ { NULL, NULL, 0 },
1303 /* 0xdd */ { NULL, NULL, 0 },
1304 /* 0xde */ { NULL, NULL, 0 },
1305 /* 0xdf */ { NULL, NULL, 0 },
1306 /* 0xe0 */ { NULL, NULL, 0 },
1307 /* 0xe1 */ { NULL, NULL, 0 },
1308 /* 0xe2 */ { NULL, NULL, 0 },
1309 /* 0xe3 */ { NULL, NULL, 0 },
1310 /* 0xe4 */ { NULL, NULL, 0 },
1311 /* 0xe5 */ { NULL, NULL, 0 },
1312 /* 0xe6 */ { NULL, NULL, 0 },
1313 /* 0xe7 */ { NULL, NULL, 0 },
1314 /* 0xe8 */ { NULL, NULL, 0 },
1315 /* 0xe9 */ { NULL, NULL, 0 },
1316 /* 0xea */ { NULL, NULL, 0 },
1317 /* 0xeb */ { NULL, NULL, 0 },
1318 /* 0xec */ { NULL, NULL, 0 },
1319 /* 0xed */ { NULL, NULL, 0 },
1320 /* 0xee */ { NULL, NULL, 0 },
1321 /* 0xef */ { NULL, NULL, 0 },
1322 /* 0xf0 */ { NULL, NULL, 0 },
1323 /* 0xf1 */ { NULL, NULL, 0 },
1324 /* 0xf2 */ { NULL, NULL, 0 },
1325 /* 0xf3 */ { NULL, NULL, 0 },
1326 /* 0xf4 */ { NULL, NULL, 0 },
1327 /* 0xf5 */ { NULL, NULL, 0 },
1328 /* 0xf6 */ { NULL, NULL, 0 },
1329 /* 0xf7 */ { NULL, NULL, 0 },
1330 /* 0xf8 */ { NULL, NULL, 0 },
1331 /* 0xf9 */ { NULL, NULL, 0 },
1332 /* 0xfa */ { NULL, NULL, 0 },
1333 /* 0xfb */ { NULL, NULL, 0 },
1334 /* 0xfc */ { NULL, NULL, 0 },
1335 /* 0xfd */ { NULL, NULL, 0 },
1336 /* 0xfe */ { NULL, NULL, 0 },
1337 /* 0xff */ { NULL, NULL, 0 }
1338
1339 };
1340
1341 /*******************************************************************
1342 allocate and initialize a reply packet
1343 ********************************************************************/
1344
1345 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1346 const uint8_t *inbuf, char **outbuf,
1347 uint8_t num_words, uint32_t num_bytes)
1348 {
1349 size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1350
1351 /*
1352 * Protect against integer wrap.
1353 * The SMB layer reply can be up to 0xFFFFFF bytes.
1354 */
1355 if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1356 char *msg;
1357 if (asprintf(&msg, "num_bytes too large: %u",
1358 (unsigned)num_bytes) == -1) {
1359 msg = discard_const_p(char, "num_bytes too large");
1360 }
1361 smb_panic(msg);
1362 }
1363
1364 /*
1365 * Here we include the NBT header for now.
1366 */
1367 *outbuf = talloc_array(mem_ctx, char,
1368 NBT_HDR_SIZE + smb_len);
1369 if (*outbuf == NULL) {
1370 return false;
1371 }
1372
1373 construct_reply_common(req->cmd, inbuf, *outbuf);
1374 srv_set_message(*outbuf, num_words, num_bytes, false);
1375 /*
1376 * Zero out the word area, the caller has to take care of the bcc area
1377 * himself
1378 */
1379 if (num_words != 0) {
1380 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1381 }
1382
1383 return true;
1384 }
1385
1386 void reply_outbuf(struct smb_request *req, uint8_t num_words, uint32_t num_bytes)
1387 {
1388 char *outbuf;
1389 if (!create_outbuf(req, req, req->inbuf, &outbuf, num_words,
1390 num_bytes)) {
1391 smb_panic("could not allocate output buffer\n");
1392 }
1393 req->outbuf = (uint8_t *)outbuf;
1394 }
1395
1396
1397 /*******************************************************************
1398 Dump a packet to a file.
1399 ********************************************************************/
1400
1401 static void smb_dump(const char *name, int type, const char *data)
1402 {
1403 size_t len;
1404 int fd, i;
1405 char *fname = NULL;
1406 if (DEBUGLEVEL < 50) {
1407 return;
1408 }
1409
1410 len = smb_len_tcp(data)+4;
1411 for (i=1;i<100;i++) {
1412 fname = talloc_asprintf(talloc_tos(),
1413 "/tmp/%s.%d.%s",
1414 name,
1415 i,
1416 type ? "req" : "resp");
1417 if (fname == NULL) {
1418 return;
1419 }
1420 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1421 if (fd != -1 || errno != EEXIST) break;
1422 TALLOC_FREE(fname);
1423 }
1424 if (fd != -1) {
1425 ssize_t ret = write(fd, data, len);
1426 if (ret != len)
1427 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1428 close(fd);
1429 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1430 }
1431 TALLOC_FREE(fname);
1432 }
1433
1434 static void smb1srv_update_crypto_flags(struct smbXsrv_session *session,
1435 struct smb_request *req,
1436 uint8_t type,
1437 bool *update_session_globalp,
1438 bool *update_tcon_globalp)
1439 {
1440 connection_struct *conn = req->conn;
1441 struct smbXsrv_tcon *tcon = conn ? conn->tcon : NULL;
1442 uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
1443 uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
1444 bool update_session = false;
1445 bool update_tcon = false;
1446
1447 if (req->encrypted) {
1448 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
1449 }
1450
1451 if (srv_is_signing_active(req->xconn)) {
1452 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
1453 } else if ((type == SMBecho) || (type == SMBsesssetupX)) {
1454 /*
1455 * echo can be unsigned. Sesssion setup except final
1456 * session setup response too
1457 */
1458 sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
1459 }
1460
1461 update_session |= smbXsrv_set_crypto_flag(
1462 &session->global->encryption_flags, encrypt_flag);
1463 update_session |= smbXsrv_set_crypto_flag(
1464 &session->global->signing_flags, sign_flag);
1465
1466 if (tcon) {
1467 update_tcon |= smbXsrv_set_crypto_flag(
1468 &tcon->global->encryption_flags, encrypt_flag);
1469 update_tcon |= smbXsrv_set_crypto_flag(
1470 &tcon->global->signing_flags, sign_flag);
1471 }
1472
1473 if (update_session) {
1474 session->global->channels[0].encryption_cipher = SMB_ENCRYPTION_GSSAPI;
1475 }
1476
1477 *update_session_globalp = update_session;
1478 *update_tcon_globalp = update_tcon;
1479 return;
1480 }
1481
1482 /****************************************************************************
1483 Prepare everything for calling the actual request function, and potentially
1484 call the request function via the "new" interface.
1485
1486 Return False if the "legacy" function needs to be called, everything is
1487 prepared.
1488
1489 Return True if we're done.
1490
1491 I know this API sucks, but it is the one with the least code change I could
1492 find.
1493 ****************************************************************************/
1494
1495 static connection_struct *switch_message(uint8_t type, struct smb_request *req)
1496 {
1497 int flags;
1498 uint64_t session_tag;
1499 connection_struct *conn = NULL;
1500 struct smbXsrv_connection *xconn = req->xconn;
1501 NTTIME now = timeval_to_nttime(&req->request_time);
1502 struct smbXsrv_session *session = NULL;
1503 NTSTATUS status;
1504
1505 errno = 0;
1506
1507 if (!xconn->smb1.negprot.done) {
1508 switch (type) {
1509 /*
1510 * Without a negprot the request must
1511 * either be a negprot, or one of the
1512 * evil old SMB mailslot messaging types.
1513 */
1514 case SMBnegprot:
1515 case SMBsendstrt:
1516 case SMBsendend:
1517 case SMBsendtxt:
1518 break;
1519 default:
1520 exit_server_cleanly("The first request "
1521 "should be a negprot");
1522 }
1523 }
1524
1525 if (smb_messages[type].fn == NULL) {
1526 DEBUG(0,("Unknown message type %d!\n",type));
1527 smb_dump("Unknown", 1, (const char *)req->inbuf);
1528 reply_unknown_new(req, type);
1529 return NULL;
1530 }
1531
1532 flags = smb_messages[type].flags;
1533
1534 /* In share mode security we must ignore the vuid. */
1535 session_tag = req->vuid;
1536 conn = req->conn;
1537
1538 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1539 (int)getpid(), (unsigned long)conn));
1540
1541 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1542
1543 /* Ensure this value is replaced in the incoming packet. */
1544 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1545
1546 /*
1547 * Ensure the correct username is in current_user_info. This is a
1548 * really ugly bugfix for problems with multiple session_setup_and_X's
1549 * being done and allowing %U and %G substitutions to work correctly.
1550 * There is a reason this code is done here, don't move it unless you
1551 * know what you're doing... :-).
1552 * JRA.
1553 */
1554
1555 /*
1556 * lookup an existing session
1557 *
1558 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1559 * here, the main check is still in change_to_user()
1560 */
1561 status = smb1srv_session_lookup(xconn,
1562 session_tag,
1563 now,
1564 &session);
1565 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1566 switch (type) {
1567 case SMBsesssetupX:
1568 status = NT_STATUS_OK;
1569 break;
1570 default:
1571 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1572 (unsigned long long)session_tag,
1573 (unsigned long long)req->mid));
1574 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1575 return conn;
1576 }
1577 }
1578
1579 if (session_tag != xconn->client->last_session_id) {
1580 struct user_struct *vuser = NULL;
1581
1582 xconn->client->last_session_id = session_tag;
1583 if (session) {
1584 vuser = session->compat;
1585 }
1586 if (vuser) {
1587 set_current_user_info(
1588 vuser->session_info->unix_info->sanitized_username,
1589 vuser->session_info->unix_info->unix_name,
1590 vuser->session_info->info->domain_name);
1591 }
1592 }
1593
1594 /* Does this call need to be run as the connected user? */
1595 if (flags & AS_USER) {
1596
1597 /* Does this call need a valid tree connection? */
1598 if (!conn) {
1599 /*
1600 * Amazingly, the error code depends on the command
1601 * (from Samba4).
1602 */
1603 if (type == SMBntcreateX) {
1604 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1605 } else {
1606 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1607 }
1608 return NULL;
1609 }
1610
1611 if (!change_to_user(conn,session_tag)) {
1612 DEBUG(0, ("Error: Could not change to user. Removing "
1613 "deferred open, mid=%llu.\n",
1614 (unsigned long long)req->mid));
1615 reply_force_doserror(req, ERRSRV, ERRbaduid);
1616 return conn;
1617 }
1618
1619 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1620
1621 /* Does it need write permission? */
1622 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1623 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1624 return conn;
1625 }
1626
1627 /* IPC services are limited */
1628 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1629 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1630 return conn;
1631 }
1632 } else {
1633 /* This call needs to be run as root */
1634 change_to_root_user();
1635 }
1636
1637 /* load service specific parameters */
1638 if (conn) {
1639 if (req->encrypted) {
1640 conn->encrypted_tid = true;
1641 /* encrypted required from now on. */
1642 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1643 } else if (ENCRYPTION_REQUIRED(conn)) {
1644 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1645 DEBUG(1,("service[%s] requires encryption"
1646 "%s ACCESS_DENIED. mid=%llu\n",
1647 lp_servicename(talloc_tos(), SNUM(conn)),
1648 smb_fn_name(type),
1649 (unsigned long long)req->mid));
1650 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1651 return conn;
1652 }
1653 }
1654
1655 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1656 (flags & (AS_USER|DO_CHDIR)
1657 ?True:False))) {
1658 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1659 return conn;
1660 }
1661 conn->num_smb_operations++;
1662 }
1663
1664 /*
1665 * Does this protocol need to be run as guest? (Only archane
1666 * messenger service requests have this...)
1667 */
1668 if (flags & AS_GUEST) {
1669 char *raddr;
1670 bool ok;
1671
1672 if (!change_to_guest()) {
1673 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1674 return conn;
1675 }
1676
1677 raddr = tsocket_address_inet_addr_string(xconn->remote_address,
1678 talloc_tos());
1679 if (raddr == NULL) {
1680 reply_nterror(req, NT_STATUS_NO_MEMORY);
1681 return conn;
1682 }
1683
1684 /*
1685 * Haven't we checked this in smbd_process already???
1686 */
1687
1688 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1689 xconn->remote_hostname, raddr);
1690 TALLOC_FREE(raddr);
1691
1692 if (!ok) {
1693 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1694 return conn;
1695 }
1696 }
1697
1698 /*
1699 * Update encryption and signing state tracking flags that are
1700 * used by smbstatus to display signing and encryption status.
1701 */
1702 if (session != NULL) {
1703 bool update_session_global = false;
1704 bool update_tcon_global = false;
1705
1706 smb1srv_update_crypto_flags(session, req, type,
1707 &update_session_global,
1708 &update_tcon_global);
1709
1710 if (update_session_global) {
1711 status = smbXsrv_session_update(session);
1712 if (!NT_STATUS_IS_OK(status)) {
1713 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1714 return conn;
1715 }
1716 }
1717
1718 if (update_tcon_global) {
1719 status = smbXsrv_tcon_update(req->conn->tcon);
1720 if (!NT_STATUS_IS_OK(status)) {
1721 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1722 return conn;
1723 }
1724 }
1725 }
1726
1727 smb_messages[type].fn(req);
1728 return req->conn;
1729 }
1730
1731 /****************************************************************************
1732 Construct a reply to the incoming packet.
1733 ****************************************************************************/
1734
1735 static void construct_reply(struct smbXsrv_connection *xconn,
1736 char *inbuf, int size, size_t unread_bytes,
1737 uint32_t seqnum, bool encrypted,
1738 struct smb_perfcount_data *deferred_pcd)
1739 {
1740 struct smbd_server_connection *sconn = xconn->client->sconn;
1741 struct smb_request *req;
1742
1743 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1744 smb_panic("could not allocate smb_request");
1745 }
1746
1747 if (!init_smb_request(req, sconn, xconn, (uint8_t *)inbuf, unread_bytes,
1748 encrypted, seqnum)) {
1749 exit_server_cleanly("Invalid SMB request");
1750 }
1751
1752 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1753
1754 /* we popped this message off the queue - keep original perf data */
1755 if (deferred_pcd)
1756 req->pcd = *deferred_pcd;
1757 else {
1758 SMB_PERFCOUNT_START(&req->pcd);
1759 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1760 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1761 }
1762
1763 req->conn = switch_message(req->cmd, req);
1764
1765 if (req->outbuf == NULL) {
1766 /*
1767 * Request has suspended itself, will come
1768 * back here.
1769 */
1770 return;
1771 }
1772 if (CVAL(req->outbuf,0) == 0) {
1773 show_msg((char *)req->outbuf);
1774 }
1775 smb_request_done(req);
1776 }
1777
1778 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1779 char *inbuf, int size, uint32_t seqnum,
1780 bool encrypted,
1781 struct smb_perfcount_data *deferred_pcd)
1782 {
1783 struct smb_request **reqs = NULL;
1784 struct smb_request *req;
1785 unsigned num_reqs;
1786 bool ok;
1787
1788 ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted,
1789 seqnum, &reqs, &num_reqs);
1790 if (!ok) {
1791 char errbuf[smb_size];
1792 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1793 __LINE__, __FILE__);
1794 if (!srv_send_smb(xconn, errbuf, true, seqnum, encrypted,
1795 NULL)) {
1796 exit_server_cleanly("construct_reply_chain: "
1797 "srv_send_smb failed.");
1798 }
1799 return;
1800 }
1801
1802 req = reqs[0];
1803 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1804
1805 req->conn = switch_message(req->cmd, req);
1806
1807 if (req->outbuf == NULL) {
1808 /*
1809 * Request has suspended itself, will come
1810 * back here.
1811 */
1812 return;
1813 }
1814 smb_request_done(req);
1815 }
1816
1817 /*
1818 * To be called from an async SMB handler that is potentially chained
1819 * when it is finished for shipping.
1820 */
1821
1822 void smb_request_done(struct smb_request *req)
1823 {
1824 struct smb_request **reqs = NULL;
1825 struct smb_request *first_req;
1826 size_t i, num_reqs, next_index;
1827 NTSTATUS status;
1828
1829 if (req->chain == NULL) {
1830 first_req = req;
1831 goto shipit;
1832 }
1833
1834 reqs = req->chain;
1835 num_reqs = talloc_array_length(reqs);
1836
1837 for (i=0; i<num_reqs; i++) {
1838 if (reqs[i] == req) {
1839 break;
1840 }
1841 }
1842 if (i == num_reqs) {
1843 /*
1844 * Invalid chain, should not happen
1845 */
1846 status = NT_STATUS_INTERNAL_ERROR;
1847 goto error;
1848 }
1849 next_index = i+1;
1850
1851 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1852 struct smb_request *next = reqs[next_index];
1853 struct smbXsrv_tcon *tcon;
1854 NTTIME now = timeval_to_nttime(&req->request_time);
1855
1856 next->vuid = SVAL(req->outbuf, smb_uid);
1857 next->tid = SVAL(req->outbuf, smb_tid);
1858 status = smb1srv_tcon_lookup(req->xconn, req->tid,
1859 now, &tcon);
1860 if (NT_STATUS_IS_OK(status)) {
1861 req->conn = tcon->compat;
1862 } else {
1863 req->conn = NULL;
1864 }
1865 next->chain_fsp = req->chain_fsp;
1866 next->inbuf = req->inbuf;
1867
1868 req = next;
1869 req->conn = switch_message(req->cmd, req);
1870
1871 if (req->outbuf == NULL) {
1872 /*
1873 * Request has suspended itself, will come
1874 * back here.
1875 */
1876 return;
1877 }
1878 next_index += 1;
1879 }
1880
1881 first_req = reqs[0];
1882
1883 for (i=1; i<next_index; i++) {
1884 bool ok;
1885
1886 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1887 if (!ok) {
1888 status = NT_STATUS_INTERNAL_ERROR;
1889 goto error;
1890 }
1891 }
1892
1893 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1894 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1895
1896 /*
1897 * This scary statement intends to set the
1898 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1899 * to the value last_req->outbuf carries
1900 */
1901 SSVAL(first_req->outbuf, smb_flg2,
1902 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1903 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1904
1905 /*
1906 * Transfer the error codes from the subrequest to the main one
1907 */
1908 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1909 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1910
1911 _smb_setlen_large(
1912 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1913
1914 shipit:
1915 if (!srv_send_smb(first_req->xconn,
1916 (char *)first_req->outbuf,
1917 true, first_req->seqnum+1,
1918 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1919 &first_req->pcd)) {
1920 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1921 "failed.");
1922 }
1923 TALLOC_FREE(req); /* non-chained case */
1924 TALLOC_FREE(reqs); /* chained case */
1925 return;
1926
1927 error:
1928 {
1929 char errbuf[smb_size];
1930 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1931 if (!srv_send_smb(req->xconn, errbuf, true,
1932 req->seqnum+1, req->encrypted,
1933 NULL)) {
1934 exit_server_cleanly("construct_reply_chain: "
1935 "srv_send_smb failed.");
1936 }
1937 }
1938 TALLOC_FREE(req); /* non-chained case */
1939 TALLOC_FREE(reqs); /* chained case */
1940 }
1941
1942 /****************************************************************************
1943 Process an smb from the client
1944 ****************************************************************************/
1945 static void process_smb(struct smbXsrv_connection *xconn,
1946 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1947 uint32_t seqnum, bool encrypted,
1948 struct smb_perfcount_data *deferred_pcd)
1949 {
1950 struct smbd_server_connection *sconn = xconn->client->sconn;
1951 int msg_type = CVAL(inbuf,0);
1952
1953 DO_PROFILE_INC(request);
1954
1955 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1956 smb_len(inbuf) ) );
1957 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1958 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1959
1960 if (msg_type != NBSSmessage) {
1961 /*
1962 * NetBIOS session request, keepalive, etc.
1963 */
1964 reply_special(xconn, (char *)inbuf, nread);
1965 goto done;
1966 }
1967
1968 if (sconn->using_smb2) {
1969 /* At this point we're not really using smb2,
1970 * we make the decision here.. */
1971 if (smbd_is_smb2_header(inbuf, nread)) {
1972 const uint8_t *inpdu = inbuf + NBT_HDR_SIZE;
1973 size_t pdulen = nread - NBT_HDR_SIZE;
1974 smbd_smb2_process_negprot(xconn, 0, inpdu, pdulen);
1975 return;
1976 } else if (nread >= smb_size && valid_smb_header(inbuf)
1977 && CVAL(inbuf, smb_com) != 0x72) {
1978 /* This is a non-negprot SMB1 packet.
1979 Disable SMB2 from now on. */
1980 sconn->using_smb2 = false;
1981 }
1982 }
1983
1984 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1985 * so subtract 4 from it. */
1986 if ((nread < (smb_size - 4)) || !valid_smb_header(inbuf)) {
1987 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1988 smb_len(inbuf)));
1989
1990 /* special magic for immediate exit */
1991 if ((nread == 9) &&
1992 (IVAL(inbuf, 4) == 0x74697865) &&
1993 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1994 uint8_t exitcode = CVAL(inbuf, 8);
1995 DEBUG(1, ("Exiting immediately with code %d\n",
1996 (int)exitcode));
1997 exit(exitcode);
1998 }
1999
2000 exit_server_cleanly("Non-SMB packet");
2001 }
2002
2003 show_msg((char *)inbuf);
2004
2005 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
2006 construct_reply_chain(xconn, (char *)inbuf, nread,
2007 seqnum, encrypted, deferred_pcd);
2008 } else {
2009 construct_reply(xconn, (char *)inbuf, nread, unread_bytes,
2010 seqnum, encrypted, deferred_pcd);
2011 }
2012
2013 sconn->trans_num++;
2014
2015 done:
2016 sconn->num_requests++;
2017
2018 /* The timeout_processing function isn't run nearly
2019 often enough to implement 'max log size' without
2020 overrunning the size of the file by many megabytes.
2021 This is especially true if we are running at debug
2022 level 10. Checking every 50 SMBs is a nice
2023 tradeoff of performance vs log file size overrun. */
2024
2025 if ((sconn->num_requests % 50) == 0 &&
2026 need_to_check_log_size()) {
2027 change_to_root_user();
2028 check_log_size();
2029 }
2030 }
2031
2032 /****************************************************************************
2033 Return a string containing the function name of a SMB command.
2034 ****************************************************************************/
2035
2036 const char *smb_fn_name(int type)
2037 {
2038 const char *unknown_name = "SMBunknown";
2039
2040 if (smb_messages[type].name == NULL)
2041 return(unknown_name);
2042
2043 return(smb_messages[type].name);
2044 }
2045
2046 /****************************************************************************
2047 Helper functions for contruct_reply.
2048 ****************************************************************************/
2049
2050 void add_to_common_flags2(uint32_t v)
2051 {
2052 common_flags2 |= v;
2053 }
2054
2055 void remove_from_common_flags2(uint32_t v)
2056 {
2057 common_flags2 &= ~v;
2058 }
2059
2060 static void construct_reply_common(uint8_t cmd, const uint8_t *inbuf,
2061 char *outbuf)
2062 {
2063 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
2064 uint16_t out_flags2 = common_flags2;
2065
2066 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
2067 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
2068 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
2069
2070 srv_set_message(outbuf,0,0,false);
2071
2072 SCVAL(outbuf, smb_com, cmd);
2073 SIVAL(outbuf,smb_rcls,0);
2074 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
2075 SSVAL(outbuf,smb_flg2, out_flags2);
2076 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
2077 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
2078
2079 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
2080 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
2081 SSVAL(outbuf,smb_pidhigh,SVAL(inbuf,smb_pidhigh));
2082 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
2083 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
2084 }
2085
2086 void construct_reply_common_req(struct smb_request *req, char *outbuf)
2087 {
2088 construct_reply_common(req->cmd, req->inbuf, outbuf);
2089 }
2090
2091 /**
2092 * @brief Find the smb_cmd offset of the last command pushed
2093 * @param[in] buf The buffer we're building up
2094 * @retval Where can we put our next andx cmd?
2095 *
2096 * While chaining requests, the "next" request we're looking at needs to put
2097 * its SMB_Command before the data the previous request already built up added
2098 * to the chain. Find the offset to the place where we have to put our cmd.
2099 */
2100
2101 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2102 {
2103 uint8_t cmd;
2104 size_t ofs;
2105
2106 cmd = CVAL(buf, smb_com);
2107
2108 if (!is_andx_req(cmd)) {
2109 return false;
2110 }
2111
2112 ofs = smb_vwv0;
2113
2114 while (CVAL(buf, ofs) != 0xff) {
2115
2116 if (!is_andx_req(CVAL(buf, ofs))) {
2117 return false;
2118 }
2119
2120 /*
2121 * ofs is from start of smb header, so add the 4 length
2122 * bytes. The next cmd is right after the wct field.
2123 */
2124 ofs = SVAL(buf, ofs+2) + 4 + 1;
2125
2126 if (ofs+4 >= talloc_get_size(buf)) {
2127 return false;
2128 }
2129 }
2130
2131 *pofs = ofs;
2132 return true;
2133 }
2134
2135 /**
2136 * @brief Do the smb chaining at a buffer level
2137 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
2138 * @param[in] andx_buf Buffer to be appended
2139 */
2140
2141 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2142 {
2143 uint8_t smb_command = CVAL(andx_buf, smb_com);
2144 uint8_t wct = CVAL(andx_buf, smb_wct);
2145 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
2146 uint32_t num_bytes = smb_buflen(andx_buf);
2147 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
2148
2149 uint8_t *outbuf;
2150 size_t old_size, new_size;
2151 size_t ofs;
2152 size_t chain_padding = 0;
2153 size_t andx_cmd_ofs;
2154
2155
2156 old_size = talloc_get_size(*poutbuf);
2157
2158 if ((old_size % 4) != 0) {
2159 /*
2160 * Align the wct field of subsequent requests to a 4-byte
2161 * boundary
2162 */
2163 chain_padding = 4 - (old_size % 4);
2164 }
2165
2166 /*
2167 * After the old request comes the new wct field (1 byte), the vwv's
2168 * and the num_bytes field.
2169 */
2170
2171 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2172 new_size += num_bytes;
2173
2174 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2175 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2176 (unsigned)new_size));
2177 return false;
2178 }
2179
2180 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2181 if (outbuf == NULL) {
2182 DEBUG(0, ("talloc failed\n"));
2183 return false;
2184 }
2185 *poutbuf = outbuf;
2186
2187 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2188 DEBUG(1, ("invalid command chain\n"));
2189 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2190 return false;
2191 }
2192
2193 if (chain_padding != 0) {
2194 memset(outbuf + old_size, 0, chain_padding);
2195 old_size += chain_padding;
2196 }
2197
2198 SCVAL(outbuf, andx_cmd_ofs, smb_command);
2199 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2200
2201 ofs = old_size;
2202
2203 /*
2204 * Push the chained request:
2205 *
2206 * wct field
2207 */
2208
2209 SCVAL(outbuf, ofs, wct);
2210 ofs += 1;
2211
2212 /*
2213 * vwv array
2214 */
2215
2216 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2217
2218 /*
2219 * HACK ALERT
2220 *
2221 * Read&X has an offset into its data buffer at
2222 * vwv[6]. reply_read_andx has no idea anymore that it's
2223 * running from within a chain, so we have to fix up the
2224 * offset here.
2225 *
2226 * Although it looks disgusting at this place, I want to keep
2227 * it here. The alternative would be to push knowledge about
2228 * the andx chain down into read&x again.
2229 */
2230
2231 if (smb_command == SMBreadX) {
2232 uint8_t *bytes_addr;
2233
2234 if (wct < 7) {
2235 /*
2236 * Invalid read&x response
2237 */
2238 return false;
2239 }
2240
2241 bytes_addr = outbuf + ofs /* vwv start */
2242 + sizeof(uint16_t) * wct /* vwv array */
2243 + sizeof(uint16_t) /* bcc */
2244 + 1; /* padding byte */
2245
2246 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2247 bytes_addr - outbuf - 4);
2248 }
2249
2250 ofs += sizeof(uint16_t) * wct;
2251
2252 /*
2253 * bcc (byte count)
2254 */
2255
2256 SSVAL(outbuf, ofs, num_bytes);
2257 ofs += sizeof(uint16_t);
2258
2259 /*
2260 * The bytes field
2261 */
2262
2263 memcpy(outbuf + ofs, bytes, num_bytes);
2264
2265 return true;
2266 }
2267
2268 bool smb1_is_chain(const uint8_t *buf)
2269 {
2270 uint8_t cmd, wct, andx_cmd;
2271
2272 cmd = CVAL(buf, smb_com);
2273 if (!is_andx_req(cmd)) {
2274 return false;
2275 }
2276 wct = CVAL(buf, smb_wct);
2277 if (wct < 2) {
2278 return false;
2279 }
2280 andx_cmd = CVAL(buf, smb_vwv);
2281 return (andx_cmd != 0xFF);
2282 }
2283
2284 bool smb1_walk_chain(const uint8_t *buf,
2285 bool (*fn)(uint8_t cmd,
2286 uint8_t wct, const uint16_t *vwv,
2287 uint16_t num_bytes, const uint8_t *bytes,
2288 void *private_data),
2289 void *private_data)
2290 {
2291 size_t smblen = smb_len(buf);
2292 const char *smb_buf = smb_base(buf);
2293 uint8_t cmd, chain_cmd;
2294 uint8_t wct;
2295 const uint16_t *vwv;
2296 uint16_t num_bytes;
2297 const uint8_t *bytes;
2298
2299 cmd = CVAL(buf, smb_com);
2300 wct = CVAL(buf, smb_wct);
2301 vwv = (const uint16_t *)(buf + smb_vwv);
2302 num_bytes = smb_buflen(buf);
2303 bytes = (const uint8_t *)smb_buf_const(buf);
2304
2305 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2306 return false;
2307 }
2308
2309 if (!is_andx_req(cmd)) {
2310 return true;
2311 }
2312 if (wct < 2) {
2313 return false;
2314 }
2315
2316 chain_cmd = CVAL(vwv, 0);
2317
2318 while (chain_cmd != 0xff) {
2319 uint32_t chain_offset; /* uint32_t to avoid overflow */
2320 size_t length_needed;
2321 ptrdiff_t vwv_offset;
2322
2323 chain_offset = SVAL(vwv+1, 0);
2324
2325 /*
2326 * Check if the client tries to fool us. The chain
2327 * offset needs to point beyond the current request in
2328 * the chain, it needs to strictly grow. Otherwise we
2329 * might be tricked into an endless loop always
2330 * processing the same request over and over again. We
2331 * used to assume that vwv and the byte buffer array
2332 * in a chain are always attached, but OS/2 the
2333 * Write&X/Read&X chain puts the Read&X vwv array
2334 * right behind the Write&X vwv chain. The Write&X bcc
2335 * array is put behind the Read&X vwv array. So now we
2336 * check whether the chain offset points strictly
2337 * behind the previous vwv array. req->buf points
2338 * right after the vwv array of the previous
2339 * request. See
2340 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2341 * more information.
2342 */
2343
2344 vwv_offset = ((const char *)vwv - smb_buf);
2345 if (chain_offset <= vwv_offset) {
2346 return false;
2347 }
2348
2349 /*
2350 * Next check: Make sure the chain offset does not
2351 * point beyond the overall smb request length.
2352 */
2353
2354 length_needed = chain_offset+1; /* wct */
2355 if (length_needed > smblen) {
2356 return false;
2357 }
2358
2359 /*
2360 * Now comes the pointer magic. Goal here is to set up
2361 * vwv and buf correctly again. The chain offset (the
2362 * former vwv[1]) points at the new wct field.
2363 */
2364
2365 wct = CVAL(smb_buf, chain_offset);
2366
2367 if (is_andx_req(chain_cmd) && (wct < 2)) {
2368 return false;
2369 }
2370
2371 /*
2372 * Next consistency check: Make the new vwv array fits
2373 * in the overall smb request.
2374 */
2375
2376 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2377 if (length_needed > smblen) {
2378 return false;
2379 }
2380 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2381
2382 /*
2383 * Now grab the new byte buffer....
2384 */
2385
2386 num_bytes = SVAL(vwv+wct, 0);
2387
2388 /*
2389 * .. and check that it fits.
2390 */
2391
2392 length_needed += num_bytes;
2393 if (length_needed > smblen) {
2394 return false;
2395 }
2396 bytes = (const uint8_t *)(vwv+wct+1);
2397
2398 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2399 return false;
2400 }
2401
2402 if (!is_andx_req(chain_cmd)) {
2403 return true;
2404 }
2405 chain_cmd = CVAL(vwv, 0);
2406 }
2407 return true;
2408 }
2409
2410 static bool smb1_chain_length_cb(uint8_t cmd,
2411 uint8_t wct, const uint16_t *vwv,
2412 uint16_t num_bytes, const uint8_t *bytes,
2413 void *private_data)
2414 {
2415 unsigned *count = (unsigned *)private_data;
2416 *count += 1;
2417 return true;
2418 }
2419
2420 unsigned smb1_chain_length(const uint8_t *buf)
2421 {
2422 unsigned count = 0;
2423
2424 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2425 return 0;
2426 }
2427 return count;
2428 }
2429
2430 struct smb1_parse_chain_state {
2431 TALLOC_CTX *mem_ctx;
2432 const uint8_t *buf;
2433 struct smbd_server_connection *sconn;
2434 struct smbXsrv_connection *xconn;
2435 bool encrypted;
2436 uint32_t seqnum;
2437
2438 struct smb_request **reqs;
2439 unsigned num_reqs;
2440 };
2441
2442 static bool smb1_parse_chain_cb(uint8_t cmd,
2443 uint8_t wct, const uint16_t *vwv,
2444 uint16_t num_bytes, const uint8_t *bytes,
2445 void *private_data)
2446 {
2447 struct smb1_parse_chain_state *state =
2448 (struct smb1_parse_chain_state *)private_data;
2449 struct smb_request **reqs;
2450 struct smb_request *req;
2451 bool ok;
2452
2453 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2454 struct smb_request *, state->num_reqs+1);
2455 if (reqs == NULL) {
2456 return false;
2457 }
2458 state->reqs = reqs;
2459
2460 req = talloc(reqs, struct smb_request);
2461 if (req == NULL) {
2462 return false;
2463 }
2464
2465 ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2466 state->encrypted, state->seqnum);
2467 if (!ok) {
2468 return false;
2469 }
2470 req->cmd = cmd;
2471 req->wct = wct;
2472 req->vwv = vwv;
2473 req->buflen = num_bytes;
2474 req->buf = bytes;
2475
2476 reqs[state->num_reqs] = req;
2477 state->num_reqs += 1;
2478 return true;
2479 }
2480
2481 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2482 struct smbXsrv_connection *xconn,
2483 bool encrypted, uint32_t seqnum,
2484 struct smb_request ***reqs, unsigned *num_reqs)
2485 {
2486 struct smbd_server_connection *sconn = NULL;
2487 struct smb1_parse_chain_state state;
2488 unsigned i;
2489
2490 if (xconn != NULL) {
2491 sconn = xconn->client->sconn;
2492 }
2493
2494 state.mem_ctx = mem_ctx;
2495 state.buf = buf;
2496 state.sconn = sconn;
2497 state.xconn = xconn;
2498 state.encrypted = encrypted;
2499 state.seqnum = seqnum;
2500 state.reqs = NULL;
2501 state.num_reqs = 0;
2502
2503 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2504 TALLOC_FREE(state.reqs);
2505 return false;
2506 }
2507 for (i=0; i<state.num_reqs; i++) {
2508 state.reqs[i]->chain = state.reqs;
2509 }
2510 *reqs = state.reqs;
2511 *num_reqs = state.num_reqs;
2512 return true;
2513 }
2514
2515 /****************************************************************************
2516 Check if services need reloading.
2517 ****************************************************************************/
2518
2519 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2520 {
2521
2522 if (last_smb_conf_reload_time == 0) {
2523 last_smb_conf_reload_time = t;
2524 }
2525
2526 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2527 reload_services(sconn, conn_snum_used, true);
2528 last_smb_conf_reload_time = t;
2529 }
2530 }
2531
2532 static bool fd_is_readable(int fd)
2533 {
2534 int ret, revents;
2535
2536 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2537
2538 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2539
2540 }
2541
2542 static void smbd_server_connection_write_handler(
2543 struct smbXsrv_connection *xconn)
2544 {
2545 /* TODO: make write nonblocking */
2546 }
2547
2548 static void smbd_server_connection_read_handler(
2549 struct smbXsrv_connection *xconn, int fd)
2550 {
2551 uint8_t *inbuf = NULL;
2552 size_t inbuf_len = 0;
2553 size_t unread_bytes = 0;
2554 bool encrypted = false;
2555 TALLOC_CTX *mem_ctx = talloc_tos();
2556 NTSTATUS status;
2557 uint32_t seqnum;
2558
2559 bool async_echo = lp_async_smb_echo_handler();
2560 bool from_client = false;
2561
2562 if (async_echo) {
2563 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2564 /*
2565 * This is the super-ugly hack to prefer the packets
2566 * forwarded by the echo handler over the ones by the
2567 * client directly
2568 */
2569 fd = xconn->smb1.echo_handler.trusted_fd;
2570 }
2571 }
2572
2573 from_client = (xconn->transport.sock == fd);
2574
2575 if (async_echo && from_client) {
2576 smbd_lock_socket(xconn);
2577
2578 if (!fd_is_readable(fd)) {
2579 DEBUG(10,("the echo listener was faster\n"));
2580 smbd_unlock_socket(xconn);
2581 return;
2582 }
2583 }
2584
2585 /* TODO: make this completely nonblocking */
2586 status = receive_smb_talloc(mem_ctx, xconn, fd,
2587 (char **)(void *)&inbuf,
2588 0, /* timeout */
2589 &unread_bytes,
2590 &encrypted,
2591 &inbuf_len, &seqnum,
2592 !from_client /* trusted channel */);
2593
2594 if (async_echo && from_client) {
2595 smbd_unlock_socket(xconn);
2596 }
2597
2598 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2599 goto process;
2600 }
2601 if (NT_STATUS_IS_ERR(status)) {
2602 exit_server_cleanly("failed to receive smb request");
2603 }
2604 if (!NT_STATUS_IS_OK(status)) {
2605 return;
2606 }
2607
2608 process:
2609 process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2610 seqnum, encrypted, NULL);
2611 }
2612
2613 static void smbd_server_connection_handler(struct tevent_context *ev,
2614 struct tevent_fd *fde,
2615 uint16_t flags,
2616 void *private_data)
2617 {
2618 struct smbXsrv_connection *xconn =
2619 talloc_get_type_abort(private_data,
2620 struct smbXsrv_connection);
2621
2622 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2623 /*
2624 * we're not supposed to do any io
2625 */
2626 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2627 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2628 return;
2629 }
2630
2631 if (flags & TEVENT_FD_WRITE) {
2632 smbd_server_connection_write_handler(xconn);
2633 return;
2634 }
2635 if (flags & TEVENT_FD_READ) {
2636 smbd_server_connection_read_handler(xconn, xconn->transport.sock);
2637 return;
2638 }
2639 }
2640
2641 static void smbd_server_echo_handler(struct tevent_context *ev,
2642 struct tevent_fd *fde,
2643 uint16_t flags,
2644 void *private_data)
2645 {
2646 struct smbXsrv_connection *xconn =
2647 talloc_get_type_abort(private_data,
2648 struct smbXsrv_connection);
2649
2650 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2651 /*
2652 * we're not supposed to do any io
2653 */
2654 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2655 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2656 return;
2657 }
2658
2659 if (flags & TEVENT_FD_WRITE) {
2660 smbd_server_connection_write_handler(xconn);
2661 return;
2662 }
2663 if (flags & TEVENT_FD_READ) {
2664 smbd_server_connection_read_handler(
2665 xconn, xconn->smb1.echo_handler.trusted_fd);
2666 return;
2667 }
2668 }
2669
2670 struct smbd_release_ip_state {
2671 struct smbXsrv_connection *xconn;
2672 struct tevent_immediate *im;
2673 char addr[INET6_ADDRSTRLEN];
2674 };
2675
2676 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2677 struct tevent_immediate *im,
2678 void *private_data)
2679 {
2680 struct smbd_release_ip_state *state =
2681 talloc_get_type_abort(private_data,
2682 struct smbd_release_ip_state);
2683 struct smbXsrv_connection *xconn = state->xconn;
2684
2685 if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2686 /*
2687 * smbd_server_connection_terminate() already triggered ?
2688 */
2689 return;
2690 }
2691
2692 smbd_server_connection_terminate(xconn, "CTDB_SRVID_RELEASE_IP");
2693 }
2694
2695 /****************************************************************************
2696 received when we should release a specific IP
2697 ****************************************************************************/
2698 static int release_ip(struct tevent_context *ev,
2699 uint32_t src_vnn, uint32_t dst_vnn,
2700 uint64_t dst_srvid,
2701 const uint8_t *msg, size_t msglen,
2702 void *private_data)
2703 {
2704 struct smbd_release_ip_state *state =
2705 talloc_get_type_abort(private_data,
2706 struct smbd_release_ip_state);
2707 struct smbXsrv_connection *xconn = state->xconn;
2708 const char *ip;
2709 const char *addr = state->addr;
2710 const char *p = addr;
2711
2712 if (msglen == 0) {
2713 return 0;
2714 }
2715 if (msg[msglen-1] != '\0') {
2716 return 0;
2717 }
2718
2719 ip = (const char *)msg;
2720
2721 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2722 /* avoid recursion */
2723 return 0;
2724 }
2725
2726 if (strncmp("::ffff:", addr, 7) == 0) {
2727 p = addr + 7;
2728 }
2729
2730 DEBUG(10, ("Got release IP message for %s, "
2731 "our address is %s\n", ip, p));
2732
2733 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2734 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2735 ip));
2736 /*
2737 * With SMB2 we should do a clean disconnect,
2738 * the previous_session_id in the session setup
2739 * will cleanup the old session, tcons and opens.
2740 *
2741 * A clean disconnect is needed in order to support
2742 * durable handles.
2743 *
2744 * Note: typically this is never triggered
2745 * as we got a TCP RST (triggered by ctdb event scripts)
2746 * before we get CTDB_SRVID_RELEASE_IP.
2747 *
2748 * We used to call _exit(1) here, but as this was mostly never
2749 * triggered and has implication on our process model,
2750 * we can just use smbd_server_connection_terminate()
2751 * (also for SMB1).
2752 *
2753 * We don't call smbd_server_connection_terminate() directly
2754 * as we might be called from within ctdbd_migrate(),
2755 * we need to defer our action to the next event loop
2756 */
2757 tevent_schedule_immediate(state->im, xconn->ev_ctx,
2758 smbd_release_ip_immediate, state);
2759
2760 /*
2761 * Make sure we don't get any io on the connection.
2762 */
2763 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2764 return EADDRNOTAVAIL;
2765 }
2766
2767 return 0;
2768 }
2769
2770 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2771 struct sockaddr_storage *srv,
2772 struct sockaddr_storage *clnt)
2773 {
2774 struct smbd_release_ip_state *state;
2775 struct ctdbd_connection *cconn;
2776 int ret;
2777
2778 cconn = messaging_ctdb_connection();
2779 if (cconn == NULL) {
2780 return NT_STATUS_NO_MEMORY;
2781 }
2782
2783 state = talloc_zero(xconn, struct smbd_release_ip_state);
2784 if (state == NULL) {
2785 return NT_STATUS_NO_MEMORY;
2786 }
2787 state->xconn = xconn;
2788 state->im = tevent_create_immediate(state);
2789 if (state->im == NULL) {
2790 return NT_STATUS_NO_MEMORY;
2791 }
2792 if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2793 return NT_STATUS_NO_MEMORY;
2794 }
2795
2796 ret = ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2797 if (ret != 0) {
2798 return map_nt_error_from_unix(ret);
2799 }
2800 return NT_STATUS_OK;
2801 }
2802
2803 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2804 void *private_data, uint32_t msg_type,
2805 struct server_id server_id, DATA_BLOB *data)
2806 {
2807 struct smbd_server_connection *sconn = talloc_get_type_abort(
2808 private_data, struct smbd_server_connection);
2809 const char *ip = (char *) data->data;
2810 char *client_ip;
2811
2812 DBG_DEBUG("Got kill request for client IP %s\n", ip);
2813
2814 client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2815 talloc_tos());
2816 if (client_ip == NULL) {
2817 return;
2818 }
2819
2820 if (strequal(ip, client_ip)) {
2821 DBG_WARNING("Got kill client message for %s - "
2822 "exiting immediately\n", ip);
2823 exit_server_cleanly("Forced disconnect for client");
2824 }
2825
2826 TALLOC_FREE(client_ip);
2827 }
2828
2829 /*
2830 * Send keepalive packets to our client
2831 */
2832 static bool keepalive_fn(const struct timeval *now, void *private_data)
2833 {
2834 struct smbd_server_connection *sconn = talloc_get_type_abort(
2835 private_data, struct smbd_server_connection);
2836 struct smbXsrv_connection *xconn = NULL;
2837 bool ret;
2838
2839 if (sconn->using_smb2) {
2840 /* Don't do keepalives on an SMB2 connection. */
2841 return false;
2842 }
2843
2844 /*
2845 * With SMB1 we only have 1 connection
2846 */
2847 xconn = sconn->client->connections;
2848 smbd_lock_socket(xconn);
2849 ret = send_keepalive(xconn->transport.sock);
2850 smbd_unlock_socket(xconn);
2851
2852 if (!ret) {
2853 int saved_errno = errno;
2854 /*
2855 * Try and give an error message saying what
2856 * client failed.
2857 */
2858 DEBUG(0, ("send_keepalive failed for client %s. "
2859 "Error %s - exiting\n",
2860 smbXsrv_connection_dbg(xconn),
2861 strerror(saved_errno)));
2862 errno = saved_errno;
2863 return False;
2864 }
2865 return True;
2866 }
2867
2868 /*
2869 * Do the recurring check if we're idle
2870 */
2871 static bool deadtime_fn(const struct timeval *now, void *private_data)
2872 {
2873 struct smbd_server_connection *sconn =
2874 (struct smbd_server_connection *)private_data;
2875
2876 if ((conn_num_open(sconn) == 0)
2877 || (conn_idle_all(sconn, now->tv_sec))) {
2878 DEBUG( 2, ( "Closing idle connection\n" ) );
2879 messaging_send(sconn->msg_ctx,
2880 messaging_server_id(sconn->msg_ctx),
2881 MSG_SHUTDOWN, &data_blob_null);
2882 return False;
2883 }
2884
2885 return True;
2886 }
2887
2888 /*
2889 * Do the recurring log file and smb.conf reload checks.
2890 */
2891
2892 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2893 {
2894 struct smbd_server_connection *sconn = talloc_get_type_abort(
2895 private_data, struct smbd_server_connection);
2896
2897 DEBUG(5, ("housekeeping\n"));
2898
2899 change_to_root_user();
2900
2901 /* update printer queue caches if necessary */
2902 update_monitored_printq_cache(sconn->msg_ctx);
2903
2904 /* check if we need to reload services */
2905 check_reload(sconn, time_mono(NULL));
2906
2907 /*
2908 * Force a log file check.
2909 */
2910 force_check_log_size();
2911 check_log_size();
2912 return true;
2913 }
2914
2915 /*
2916 * Read an smb packet in the echo handler child, giving the parent
2917 * smbd one second to react once the socket becomes readable.
2918 */
2919
2920 struct smbd_echo_read_state {
2921 struct tevent_context *ev;
2922 struct smbXsrv_connection *xconn;
2923
2924 char *buf;
2925 size_t buflen;
2926 uint32_t seqnum;
2927 };
2928
2929 static void smbd_echo_read_readable(struct tevent_req *subreq);
2930 static void smbd_echo_read_waited(struct tevent_req *subreq);
2931
2932 static struct tevent_req *smbd_echo_read_send(
2933 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2934 struct smbXsrv_connection *xconn)
2935 {
2936 struct tevent_req *req, *subreq;
2937 struct smbd_echo_read_state *state;
2938
2939 req = tevent_req_create(mem_ctx, &state,
2940 struct smbd_echo_read_state);
2941 if (req == NULL) {
2942 return NULL;
2943 }
2944 state->ev = ev;
2945 state->xconn = xconn;
2946
2947 subreq = wait_for_read_send(state, ev, xconn->transport.sock, false);
2948 if (tevent_req_nomem(subreq, req)) {
2949 return tevent_req_post(req, ev);
2950 }
2951 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2952 return req;
2953 }
2954
2955 static void smbd_echo_read_readable(struct tevent_req *subreq)
2956 {
2957 struct tevent_req *req = tevent_req_callback_data(
2958 subreq, struct tevent_req);
2959 struct smbd_echo_read_state *state = tevent_req_data(
2960 req, struct smbd_echo_read_state);
2961 bool ok;
2962 int err;
2963
2964 ok = wait_for_read_recv(subreq, &err);
2965 TALLOC_FREE(subreq);
2966 if (!ok) {
2967 tevent_req_nterror(req, map_nt_error_from_unix(err));
2968 return;
2969 }
2970
2971 /*
2972 * Give the parent smbd one second to step in
2973 */
2974
2975 subreq = tevent_wakeup_send(
2976 state, state->ev, timeval_current_ofs(1, 0));
2977 if (tevent_req_nomem(subreq, req)) {
2978 return;
2979 }
2980 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2981 }
2982
2983 static void smbd_echo_read_waited(struct tevent_req *subreq)
2984 {
2985 struct tevent_req *req = tevent_req_callback_data(
2986 subreq, struct tevent_req);
2987 struct smbd_echo_read_state *state = tevent_req_data(
2988 req, struct smbd_echo_read_state);
2989 struct smbXsrv_connection *xconn = state->xconn;
2990 bool ok;
2991 NTSTATUS status;
2992 size_t unread = 0;
2993 bool encrypted;
2994
2995 ok = tevent_wakeup_recv(subreq);
2996 TALLOC_FREE(subreq);
2997 if (!ok) {
2998 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2999 return;
3000 }
3001
3002 ok = smbd_lock_socket_internal(xconn);
3003 if (!ok) {
3004 tevent_req_nterror(req, map_nt_error_from_unix(errno));
3005 DEBUG(0, ("%s: failed to lock socket\n", __location__));
3006 return;
3007 }
3008
3009 if (!fd_is_readable(xconn->transport.sock)) {
3010 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
3011 (int)getpid()));
3012
3013 ok = smbd_unlock_socket_internal(xconn);
3014 if (!ok) {
3015 tevent_req_nterror(req, map_nt_error_from_unix(errno));
3016 DEBUG(1, ("%s: failed to unlock socket\n",
3017 __location__));
3018 return;
3019 }
3020
3021 subreq = wait_for_read_send(state, state->ev,
3022 xconn->transport.sock, false);
3023 if (tevent_req_nomem(subreq, req)) {
3024 return;
3025 }
3026 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
3027 return;
3028 }
3029
3030 status = receive_smb_talloc(state, xconn,
3031 xconn->transport.sock,
3032 &state->buf,
3033 0 /* timeout */,
3034 &unread,
3035 &encrypted,
3036 &state->buflen,
3037 &state->seqnum,
3038 false /* trusted_channel*/);
3039
3040 if (tevent_req_nterror(req, status)) {
3041 tevent_req_nterror(req, status);
3042 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
3043 (int)getpid(), nt_errstr(status)));
3044 return;
3045 }
3046
3047 ok = smbd_unlock_socket_internal(xconn);
3048 if (!ok) {
3049 tevent_req_nterror(req, map_nt_error_from_unix(errno));
3050 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
3051 return;
3052 }
3053 tevent_req_done(req);
3054 }
3055
3056 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3057 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
3058 {
3059 struct smbd_echo_read_state *state = tevent_req_data(
3060 req, struct smbd_echo_read_state);
3061 NTSTATUS status;
3062
3063 if (tevent_req_is_nterror(req, &status)) {
3064 return status;
3065 }
3066 *pbuf = talloc_move(mem_ctx, &state->buf);
3067 *pbuflen = state->buflen;
3068 *pseqnum = state->seqnum;
3069 return NT_STATUS_OK;
3070 }
3071
3072 struct smbd_echo_state {
3073 struct tevent_context *ev;
3074 struct iovec *pending;
3075 struct smbd_server_connection *sconn;
3076 struct smbXsrv_connection *xconn;
3077 int parent_pipe;
3078
3079 struct tevent_fd *parent_fde;
3080
3081 struct tevent_req *write_req;
3082 };
3083
3084 static void smbd_echo_writer_done(struct tevent_req *req);
3085
3086 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
3087 {
3088 int num_pending;
3089
3090 if (state->write_req != NULL) {
3091 return;
3092 }
3093
3094 num_pending = talloc_array_length(state->pending);
3095 if (num_pending == 0) {
3096 return;
3097 }
3098
3099 state->write_req = writev_send(state, state->ev, NULL,
3100 state->parent_pipe, false,
3101 state->pending, num_pending);
3102 if (state->write_req == NULL) {
3103 DEBUG(1, ("writev_send failed\n"));
3104 exit(1);
3105 }
3106
3107 talloc_steal(state->write_req, state->pending);
3108 state->pending = NULL;
3109
3110 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
3111 state);
3112 }
3113
3114 static void smbd_echo_writer_done(struct tevent_req *req)
3115 {
3116 struct smbd_echo_state *state = tevent_req_callback_data(
3117 req, struct smbd_echo_state);
3118 ssize_t written;
3119 int err;
3120
3121 written = writev_recv(req, &err);
3122 TALLOC_FREE(req);
3123 state->write_req = NULL;
3124 if (written == -1) {
3125 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3126 exit(1);
3127 }
3128 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3129 smbd_echo_activate_writer(state);
3130 }
3131
3132 static bool smbd_echo_reply(struct smbd_echo_state *state,
3133 uint8_t *inbuf, size_t inbuf_len,
3134 uint32_t seqnum)
3135 {
3136 struct smb_request req;
3137 uint16_t num_replies;
3138 char *outbuf;
3139 bool ok;
3140
3141 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3142 DEBUG(10, ("Got netbios keepalive\n"));
3143 /*
3144 * Just swallow it
3145 */
3146 return true;
3147 }
3148
3149 if (inbuf_len < smb_size) {
3150 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3151 return false;
3152 }
3153 if (!valid_smb_header(inbuf)) {
3154 DEBUG(10, ("Got invalid SMB header\n"));
3155 return false;
3156 }
3157
3158 if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3159 seqnum)) {
3160 return false;
3161 }
3162 req.inbuf = inbuf;
3163
3164 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3165 smb_messages[req.cmd].name
3166 ? smb_messages[req.cmd].name : "unknown"));
3167
3168 if (req.cmd != SMBecho) {
3169 return false;
3170 }
3171 if (req.wct < 1) {
3172 return false;
3173 }
3174
3175 num_replies = SVAL(req.vwv+0, 0);
3176 if (num_replies != 1) {
3177 /* Not a Windows "Hey, you're still there?" request */
3178 return false;
3179 }
3180
3181 if (!create_outbuf(talloc_tos(), &req, req.inbuf, &outbuf,
3182 1, req.buflen)) {
3183 DEBUG(10, ("create_outbuf failed\n"));
3184 return false;
3185 }
3186 req.outbuf = (uint8_t *)outbuf;
3187
3188 SSVAL(req.outbuf, smb_vwv0, num_replies);
3189
3190 if (req.buflen > 0) {
3191 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3192 }
3193
3194 ok = srv_send_smb(req.xconn,
3195 (char *)outbuf,
3196 true, seqnum+1,
3197 false, &req.pcd);
3198 TALLOC_FREE(outbuf);
3199 if (!ok) {
3200 exit(1);
3201 }
3202
3203 return true;
3204 }
3205
3206 static void smbd_echo_exit(struct tevent_context *ev,
3207 struct tevent_fd *fde, uint16_t flags,
3208 void *private_data)
3209 {
3210 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3211 exit(0);
3212 }
3213
3214 static void smbd_echo_got_packet(struct tevent_req *req);
3215
3216 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
3217 int parent_pipe)
3218 {
3219 struct smbd_echo_state *state;
3220 struct tevent_req *read_req;
3221
3222 state = talloc_zero(xconn, struct smbd_echo_state);
3223 if (state == NULL) {
3224 DEBUG(1, ("talloc failed\n"));
3225 return;
3226 }
3227 state->xconn = xconn;
3228 state->parent_pipe = parent_pipe;
3229 state->ev = samba_tevent_context_init(state);
3230 if (state->ev == NULL) {
3231 DEBUG(1, ("samba_tevent_context_init failed\n"));
3232 TALLOC_FREE(state);
3233 return;
3234 }
3235 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3236 TEVENT_FD_READ, smbd_echo_exit,
3237 state);
3238 if (state->parent_fde == NULL) {
3239 DEBUG(1, ("tevent_add_fd failed\n"));
3240 TALLOC_FREE(state);
3241 return;
3242 }
3243
3244 read_req = smbd_echo_read_send(state, state->ev, xconn);
3245 if (read_req == NULL) {
3246 DEBUG(1, ("smbd_echo_read_send failed\n"));
3247 TALLOC_FREE(state);
3248 return;
3249 }
3250 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3251
3252 while (true) {
3253 if (tevent_loop_once(state->ev) == -1) {
3254 DEBUG(1, ("tevent_loop_once failed: %s\n",
3255 strerror(errno)));
3256 break;
3257 }
3258 }
3259 TALLOC_FREE(state);
3260 }
3261
3262 static void smbd_echo_got_packet(struct tevent_req *req)
3263 {
3264 struct smbd_echo_state *state = tevent_req_callback_data(
3265 req, struct smbd_echo_state);
3266 NTSTATUS status;
3267 char *buf = NULL;
3268 size_t buflen = 0;
3269 uint32_t seqnum = 0;
3270 bool reply;
3271
3272 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3273 TALLOC_FREE(req);
3274 if (!NT_STATUS_IS_OK(status)) {
3275 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3276 nt_errstr(status)));
3277 exit(1);
3278 }
3279
3280 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3281 if (!reply) {
3282 size_t num_pending;
3283 struct iovec *tmp;
3284 struct iovec *iov;
3285
3286 num_pending = talloc_array_length(state->pending);
3287 tmp = talloc_realloc(state, state->pending, struct iovec,
3288 num_pending+1);
3289 if (tmp == NULL) {
3290 DEBUG(1, ("talloc_realloc failed\n"));
3291 exit(1);
3292 }
3293 state->pending = tmp;
3294
3295 if (buflen >= smb_size) {
3296 /*
3297 * place the seqnum in the packet so that the main process
3298 * can reply with signing
3299 */
3300 SIVAL(buf, smb_ss_field, seqnum);
3301 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3302 }
3303
3304 iov = &state->pending[num_pending];
3305 iov->iov_base = talloc_move(state->pending, &buf);
3306 iov->iov_len = buflen;
3307
3308 DEBUG(10,("echo_handler[%d]: forward to main\n",
3309 (int)getpid()));
3310 smbd_echo_activate_writer(state);
3311 }
3312
3313 req = smbd_echo_read_send(state, state->ev, state->xconn);
3314 if (req == NULL) {
3315 DEBUG(1, ("smbd_echo_read_send failed\n"));
3316 exit(1);
3317 }
3318 tevent_req_set_callback(req, smbd_echo_got_packet, state);
3319 }
3320
3321
3322 /*
3323 * Handle SMBecho requests in a forked child process
3324 */
3325 bool fork_echo_handler(struct smbXsrv_connection *xconn)
3326 {
3327 int listener_pipe[2];
3328 int res;
3329 pid_t child;
3330 bool use_mutex = false;
3331
3332 res = pipe(listener_pipe);
3333 if (res == -1) {
3334 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3335 return false;
3336 }
3337
3338 #ifdef HAVE_ROBUST_MUTEXES
3339 use_mutex = tdb_runtime_check_for_robust_mutexes();
3340
3341 if (use_mutex) {
3342 pthread_mutexattr_t a;
3343
3344 xconn->smb1.echo_handler.socket_mutex =
3345 anonymous_shared_allocate(sizeof(pthread_mutex_t));
3346 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3347 DEBUG(1, ("Could not create mutex shared memory: %s\n",
3348 strerror(errno)));
3349 goto fail;
3350 }
3351
3352 res = pthread_mutexattr_init(&a);
3353 if (res != 0) {
3354 DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3355 strerror(res)));
3356 goto fail;
3357 }
3358 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3359 if (res != 0) {
3360 DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3361 strerror(res)));
3362 pthread_mutexattr_destroy(&a);
3363 goto fail;
3364 }
3365 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3366 if (res != 0) {
3367 DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3368 strerror(res)));
3369 pthread_mutexattr_destroy(&a);
3370 goto fail;
3371 }
3372 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3373 if (res != 0) {
3374 DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3375 "%s\n", strerror(res)));
3376 pthread_mutexattr_destroy(&a);
3377 goto fail;
3378 }
3379 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3380 &a);
3381 pthread_mutexattr_destroy(&a);
3382 if (res != 0) {
3383 DEBUG(1, ("pthread_mutex_init failed: %s\n",
3384 strerror(res)));
3385 goto fail;
3386 }
3387 }
3388 #endif
3389
3390 if (!use_mutex) {
3391 xconn->smb1.echo_handler.socket_lock_fd =
3392 create_unlink_tmp(lp_lock_directory());
3393 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3394 DEBUG(1, ("Could not create lock fd: %s\n",
3395 strerror(errno)));
3396 goto fail;
3397 }
3398 }
3399
3400 child = fork();
3401 if (child == 0) {
3402 NTSTATUS status;
3403
3404 close(listener_pipe[0]);
3405 set_blocking(listener_pipe[1], false);
3406
3407 status = smbd_reinit_after_fork(xconn->msg_ctx, xconn->ev_ctx,
3408 true, "smbd-echo");
3409 if (!NT_STATUS_IS_OK(status)) {
3410 DEBUG(1, ("reinit_after_fork failed: %s\n",
3411 nt_errstr(status)));
3412 exit(1);
3413 }
3414 smbd_echo_loop(xconn, listener_pipe[1]);
3415 exit(0);
3416 }
3417 close(listener_pipe[1]);
3418 listener_pipe[1] = -1;
3419 xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3420
3421 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3422
3423 /*
3424 * Without smb signing this is the same as the normal smbd
3425 * listener. This needs to change once signing comes in.
3426 */
3427 xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(xconn->ev_ctx,
3428 xconn,
3429 xconn->smb1.echo_handler.trusted_fd,
3430 TEVENT_FD_READ,
3431 smbd_server_echo_handler,
3432 xconn);
3433 if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3434 DEBUG(1, ("event_add_fd failed\n"));
3435 goto fail;
3436 }
3437
3438 return true;
3439
3440 fail:
3441 if (listener_pipe[0] != -1) {
3442 close(listener_pipe[0]);
3443 }
3444 if (listener_pipe[1] != -1) {
3445 close(listener_pipe[1]);
3446 }
3447 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3448 close(xconn->smb1.echo_handler.socket_lock_fd);
3449 }
3450 #ifdef HAVE_ROBUST_MUTEXES
3451 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3452 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3453 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3454 }
3455 #endif
3456 smbd_echo_init(xconn);
3457
3458 return false;
3459 }
3460
3461 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3462 {
3463 while (user) {
3464 if (user->session_info &&
3465 (user->session_info->unix_token->uid == uid)) {
3466 return true;
3467 }
3468 user = user->next;
3469 }
3470 return false;
3471 }
3472
3473 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3474 {
3475 while (user) {
3476 if (user->session_info != NULL) {
3477 int i;
3478 struct security_unix_token *utok;
3479
3480 utok = user->session_info->unix_token;
3481 if (utok->gid == gid) {
3482 return true;
3483 }
3484 for(i=0; i<utok->ngroups; i++) {
3485 if (utok->groups[i] == gid) {
3486 return true;
3487 }
3488 }
3489 }
3490 user = user->next;
3491 }
3492 return false;
3493 }
3494
3495 static bool sid_in_use(const struct user_struct *user,
3496 const struct dom_sid *psid)
3497 {
3498 while (user) {
3499 struct security_token *tok;
3500
3501 if (user->session_info == NULL) {
3502 continue;
3503 }
3504 tok = user->session_info->security_token;
3505 if (tok == NULL) {
3506 /*
3507 * Not sure session_info->security_token can
3508 * ever be NULL. This check might be not
3509 * necessary.
3510 */
3511 continue;
3512 }
3513 if (security_token_has_sid(tok, psid)) {
3514 return true;
3515 }
3516 user = user->next;
3517 }
3518 return false;
3519 }
3520
3521 static bool id_in_use(const struct user_struct *user,
3522 const struct id_cache_ref *id)
3523 {
3524 switch(id->type) {
3525 case UID:
3526 return uid_in_use(user, id->id.uid);
3527 case GID:
3528 return gid_in_use(user, id->id.gid);
3529 case SID:
3530 return sid_in_use(user, &id->id.sid);
3531 default:
3532 break;
3533 }
3534 return false;
3535 }
3536
3537 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3538 void *private_data,
3539 uint32_t msg_type,
3540 struct server_id server_id,
3541 DATA_BLOB* data)
3542 {
3543 const char *msg = (data && data->data)
3544 ? (const char *)data->data : "<NULL>";
3545 struct id_cache_ref id;
3546 struct smbd_server_connection *sconn =
3547 talloc_get_type_abort(private_data,
3548 struct smbd_server_connection);
3549
3550 if (!id_cache_ref_parse(msg, &id)) {
3551 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3552 return;
3553 }
3554
3555 if (id_in_use(sconn->users, &id)) {
3556 exit_server_cleanly(msg);
3557 }
3558 id_cache_delete_from_cache(&id);
3559 }
3560
3561 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3562 enum protocol_types protocol)
3563 {
3564 NTSTATUS status;
3565
3566 conn->protocol = protocol;
3567
3568 if (conn->client->session_table != NULL) {
3569 return NT_STATUS_OK;
3570 }
3571
3572 if (protocol >= PROTOCOL_SMB2_02) {
3573 status = smb2srv_session_table_init(conn);
3574 if (!NT_STATUS_IS_OK(status)) {
3575 conn->protocol = PROTOCOL_NONE;
3576 return status;
3577 }
3578
3579 status = smb2srv_open_table_init(conn);
3580 if (!NT_STATUS_IS_OK(status)) {
3581 conn->protocol = PROTOCOL_NONE;
3582 return status;
3583 }
3584 } else {
3585 status = smb1srv_session_table_init(conn);
3586 if (!NT_STATUS_IS_OK(status)) {
3587 conn->protocol = PROTOCOL_NONE;
3588 return status;
3589 }
3590
3591 status = smb1srv_tcon_table_init(conn);
3592 if (!NT_STATUS_IS_OK(status)) {
3593 conn->protocol = PROTOCOL_NONE;
3594 return status;
3595 }
3596
3597 status = smb1srv_open_table_init(conn);
3598 if (!NT_STATUS_IS_OK(status)) {
3599 conn->protocol = PROTOCOL_NONE;
3600 return status;
3601 }
3602 }
3603
3604 set_Protocol(protocol);
3605 return NT_STATUS_OK;
3606 }
3607
3608 struct smbd_tevent_trace_state {
3609 struct tevent_context *ev;
3610 TALLOC_CTX *frame;
3611 SMBPROFILE_BASIC_ASYNC_STATE(profile_idle);
3612 };
3613
3614 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3615 void *private_data)
3616 {
3617 struct smbd_tevent_trace_state *state =
3618 (struct smbd_tevent_trace_state *)private_data;
3619
3620 switch (point) {
3621 case TEVENT_TRACE_BEFORE_WAIT:
3622 if (!smbprofile_dump_pending()) {
3623 /*
3624 * If there's no dump pending
3625 * we don't want to schedule a new 1 sec timer.
3626 *
3627 * Instead we want to sleep as long as nothing happens.
3628 */
3629 smbprofile_dump_setup(NULL);
3630 }
3631 SMBPROFILE_BASIC_ASYNC_START(idle, profile_p, state->profile_idle);
3632 break;
3633 case TEVENT_TRACE_AFTER_WAIT:
3634 SMBPROFILE_BASIC_ASYNC_END(state->profile_idle);
3635 if (!smbprofile_dump_pending()) {
3636 /*
3637 * We need to flush our state after sleeping
3638 * (hopefully a long time).
3639 */
3640 smbprofile_dump();
3641 /*
3642 * future profiling events should trigger timers
3643 * on our main event context.
3644 */
3645 smbprofile_dump_setup(state->ev);
3646 }
3647 break;
3648 case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3649 TALLOC_FREE(state->frame);
3650 state->frame = talloc_stackframe_pool(8192);
3651 break;
3652 case TEVENT_TRACE_AFTER_LOOP_ONCE:
3653 TALLOC_FREE(state->frame);
3654 break;
3655 }
3656
3657 errno = 0;
3658 }
3659
3660 /**
3661 * Create a debug string for the connection
3662 *
3663 * This is allocated to talloc_tos() or a string constant
3664 * in certain corner cases. The returned string should
3665 * hence not be free'd directly but only via the talloc stack.
3666 */
3667 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3668 {
3669 const char *ret;
3670
3671 /*
3672 * TODO: this can be improved later
3673 * maybe including the client guid or more
3674 */
3675 ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3676 if (ret == NULL) {
3677 return "<tsocket_address_string() failed>";
3678 }
3679
3680 return ret;
3681 }
3682
3683 NTSTATUS smbd_add_connection(struct smbXsrv_client *client, int sock_fd,
3684 struct smbXsrv_connection **_xconn)
3685 {
3686 TALLOC_CTX *frame = talloc_stackframe();
3687 struct smbXsrv_connection *xconn;
3688 struct sockaddr_storage ss_srv;
3689 void *sp_srv = (void *)&ss_srv;
3690 struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3691 struct sockaddr_storage ss_clnt;
3692 void *sp_clnt = (void *)&ss_clnt;
3693 struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3694 socklen_t sa_socklen;
3695 struct tsocket_address *local_address = NULL;
3696 struct tsocket_address *remote_address = NULL;
3697 const char *remaddr = NULL;
3698 char *p;
3699 const char *rhost = NULL;
3700 int ret;
3701 int tmp;
3702
3703 *_xconn = NULL;
3704
3705 DO_PROFILE_INC(connect);
3706
3707 xconn = talloc_zero(client, struct smbXsrv_connection);
3708 if (xconn == NULL) {
3709 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3710 TALLOC_FREE(frame);
3711 return NT_STATUS_NO_MEMORY;
3712 }
3713 talloc_steal(frame, xconn);
3714
3715 xconn->ev_ctx = client->ev_ctx;
3716 xconn->msg_ctx = client->msg_ctx;
3717 xconn->transport.sock = sock_fd;
3718 smbd_echo_init(xconn);
3719 xconn->protocol = PROTOCOL_NONE;
3720
3721 /* Ensure child is set to blocking mode */
3722 set_blocking(sock_fd,True);
3723
3724 set_socket_options(sock_fd, "SO_KEEPALIVE");
3725 set_socket_options(sock_fd, lp_socket_options());
3726
3727 sa_socklen = sizeof(ss_clnt);
3728 ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3729 if (ret != 0) {
3730 int saved_errno = errno;
3731 int level = (errno == ENOTCONN)?2:0;
3732 DEBUG(level,("getpeername() failed - %s\n",
3733 strerror(saved_errno)));
3734 TALLOC_FREE(frame);
3735 return map_nt_error_from_unix_common(saved_errno);
3736 }
3737 ret = tsocket_address_bsd_from_sockaddr(xconn,
3738 sa_clnt, sa_socklen,
3739 &remote_address);
3740 if (ret != 0) {
3741 int saved_errno = errno;
3742 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3743 __location__, strerror(saved_errno)));
3744 TALLOC_FREE(frame);
3745 return map_nt_error_from_unix_common(saved_errno);
3746 }
3747
3748 sa_socklen = sizeof(ss_srv);
3749 ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3750 if (ret != 0) {
3751 int saved_errno = errno;
3752 int level = (errno == ENOTCONN)?2:0;
3753 DEBUG(level,("getsockname() failed - %s\n",
3754 strerror(saved_errno)));
3755 TALLOC_FREE(frame);
3756 return map_nt_error_from_unix_common(saved_errno);
3757 }
3758 ret = tsocket_address_bsd_from_sockaddr(xconn,
3759 sa_srv, sa_socklen,
3760 &local_address);
3761 if (ret != 0) {
3762 int saved_errno = errno;
3763 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3764 __location__, strerror(saved_errno)));
3765 TALLOC_FREE(frame);
3766 return map_nt_error_from_unix_common(saved_errno);
3767 }
3768
3769 if (tsocket_address_is_inet(remote_address, "ip")) {
3770 remaddr = tsocket_address_inet_addr_string(remote_address,
3771 talloc_tos());
3772 if (remaddr == NULL) {
3773 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3774 __location__, strerror(errno)));
3775 TALLOC_FREE(frame);
3776 return NT_STATUS_NO_MEMORY;
3777 }
3778 } else {
3779 remaddr = "0.0.0.0";
3780 }
3781
3782 /*
3783 * Before the first packet, check the global hosts allow/ hosts deny
3784 * parameters before doing any parsing of packets passed to us by the
3785 * client. This prevents attacks on our parsing code from hosts not in
3786 * the hosts allow list.
3787 */
3788
3789 ret = get_remote_hostname(remote_address,
3790 &p, talloc_tos());
3791 if (ret < 0) {
3792 int saved_errno = errno;
3793 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3794 __location__, strerror(saved_errno)));
3795 TALLOC_FREE(frame);
3796 return map_nt_error_from_unix_common(saved_errno);
3797 }
3798 rhost = p;
3799 if (strequal(rhost, "UNKNOWN")) {
3800 rhost = remaddr;
3801 }
3802
3803 xconn->local_address = local_address;
3804 xconn->remote_address = remote_address;
3805 xconn->remote_hostname = talloc_strdup(xconn, rhost);
3806 if (xconn->remote_hostname == NULL) {
3807 return NT_STATUS_NO_MEMORY;
3808 }
3809
3810 if (!srv_init_signing(xconn)) {
3811 DEBUG(0, ("Failed to init smb_signing\n"));
3812 TALLOC_FREE(frame);
3813 return NT_STATUS_INTERNAL_ERROR;
3814 }
3815
3816 if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3817 xconn->remote_hostname,
3818 remaddr)) {
3819 DEBUG( 1, ("Connection denied from %s to %s\n",
3820 tsocket_address_string(remote_address, talloc_tos()),
3821 tsocket_address_string(local_address, talloc_tos())));
3822
3823 /*
3824 * We return a valid xconn
3825 * so that the caller can return an error message
3826 * to the client
3827 */
3828 client->connections = xconn;
3829 xconn->client = client;
3830 talloc_steal(client, xconn);
3831
3832 *_xconn = xconn;
3833 TALLOC_FREE(frame);
3834 return NT_STATUS_NETWORK_ACCESS_DENIED;
3835 }
3836
3837 DEBUG(10, ("Connection allowed from %s to %s\n",
3838 tsocket_address_string(remote_address, talloc_tos()),
3839 tsocket_address_string(local_address, talloc_tos())));
3840
3841 if (lp_clustering()) {
3842 /*
3843 * We need to tell ctdb about our client's TCP
3844 * connection, so that for failover ctdbd can send
3845 * tickle acks, triggering a reconnection by the
3846 * client.
3847 */
3848 NTSTATUS status;
3849
3850 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3851 if (!NT_STATUS_IS_OK(status)) {
3852 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3853 nt_errstr(status)));
3854 }
3855 }
3856
3857 tmp = lp_max_xmit();
3858 tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3859 tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3860
3861 xconn->smb1.negprot.max_recv = tmp;
3862
3863 xconn->smb1.sessions.done_sesssetup = false;
3864 xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3865
3866 xconn->transport.fde = tevent_add_fd(client->ev_ctx,
3867 xconn,
3868 sock_fd,
3869 TEVENT_FD_READ,
3870 smbd_server_connection_handler,
3871 xconn);
3872 if (!xconn->transport.fde) {
3873 TALLOC_FREE(frame);
3874 return NT_STATUS_NO_MEMORY;
3875 }
3876
3877 /* for now we only have one connection */
3878 DLIST_ADD_END(client->connections, xconn);
3879 xconn->client = client;
3880 talloc_steal(client, xconn);
3881
3882 *_xconn = xconn;
3883 TALLOC_FREE(frame);
3884 return NT_STATUS_OK;
3885 }
3886
3887 /****************************************************************************
3888 Process commands from the client
3889 ****************************************************************************/
3890
3891 void smbd_process(struct tevent_context *ev_ctx,
3892 struct messaging_context *msg_ctx,
3893 int sock_fd,
3894 bool interactive)
3895 {
3896 struct smbd_tevent_trace_state trace_state = {
3897 .ev = ev_ctx,
3898 .frame = talloc_stackframe(),
3899 };
3900 struct smbXsrv_client *client = NULL;
3901 struct smbd_server_connection *sconn = NULL;
3902 struct smbXsrv_connection *xconn = NULL;
3903 const char *locaddr = NULL;
3904 const char *remaddr = NULL;
3905 int ret;
3906 NTSTATUS status;
3907 struct timeval tv = timeval_current();
3908 NTTIME now = timeval_to_nttime(&tv);
3909 char *chroot_dir = NULL;
3910 int rc;
3911
3912 status = smbXsrv_client_create(ev_ctx, ev_ctx, msg_ctx, now, &client);
3913 if (!NT_STATUS_IS_OK(status)) {
3914 DBG_ERR("smbXsrv_client_create(): %s\n", nt_errstr(status));
3915 exit_server_cleanly("talloc_zero(struct smbXsrv_client).\n");
3916 }
3917
3918 /*
3919 * TODO: remove this...:-)
3920 */
3921 global_smbXsrv_client = client;
3922
3923 sconn = talloc_zero(client, struct smbd_server_connection);
3924 if (sconn == NULL) {
3925 exit_server("failed to create smbd_server_connection");
3926 }
3927
3928 client->sconn = sconn;
3929 sconn->client = client;
3930
3931 sconn->ev_ctx = ev_ctx;
3932 sconn->msg_ctx = msg_ctx;
3933
3934 if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3935 /*
3936 * We're not making the decision here,
3937 * we're just allowing the client
3938 * to decide between SMB1 and SMB2
3939 * with the first negprot
3940 * packet.
3941 */
3942 sconn->using_smb2 = true;
3943 }
3944
3945 if (!interactive) {
3946 smbd_setup_sig_term_handler(sconn);
3947 smbd_setup_sig_hup_handler(sconn);
3948
3949 if (!serverid_register(messaging_server_id(msg_ctx),
3950 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3951 |FLAG_MSG_DBWRAP
3952 |FLAG_MSG_PRINT_GENERAL)) {
3953 exit_server_cleanly("Could not register myself in "
3954 "serverid.tdb");
3955 }
3956 }
3957
3958 status = smbd_add_connection(client, sock_fd, &xconn);
3959 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3960 /*
3961 * send a negative session response "not listening on calling
3962 * name"
3963 */
3964 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3965 (void)srv_send_smb(xconn,(char *)buf, false,
3966 0, false, NULL);
3967 exit_server_cleanly("connection denied");
3968 } else if (!NT_STATUS_IS_OK(status)) {
3969 exit_server_cleanly(nt_errstr(status));
3970 }
3971
3972 sconn->local_address =
3973 tsocket_address_copy(xconn->local_address, sconn);
3974 if (sconn->local_address == NULL) {
3975 exit_server_cleanly("tsocket_address_copy() failed");
3976 }
3977 sconn->remote_address =
3978 tsocket_address_copy(xconn->remote_address, sconn);
3979 if (sconn->remote_address == NULL) {
3980 exit_server_cleanly("tsocket_address_copy() failed");
3981 }
3982 sconn->remote_hostname =
3983 talloc_strdup(sconn, xconn->remote_hostname);
3984 if (sconn->remote_hostname == NULL) {
3985 exit_server_cleanly("tsocket_strdup() failed");
3986 }
3987
3988 if (tsocket_address_is_inet(sconn->local_address, "ip")) {
3989 locaddr = tsocket_address_inet_addr_string(
3990 sconn->local_address,
3991 talloc_tos());
3992 if (locaddr == NULL) {
3993 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3994 __location__, strerror(errno)));
3995 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3996 }
3997 } else {
3998 locaddr = "0.0.0.0";
3999 }
4000
4001 if (tsocket_address_is_inet(sconn->remote_address, "ip")) {
4002 remaddr = tsocket_address_inet_addr_string(
4003 sconn->remote_address,
4004 talloc_tos());
4005 if (remaddr == NULL) {
4006 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
4007 __location__, strerror(errno)));
4008 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
4009 }
4010 } else {
4011 remaddr = "0.0.0.0";
4012 }
4013
4014 /* this is needed so that we get decent entries
4015 in smbstatus for port 445 connects */
4016 set_remote_machine_name(remaddr, false);
4017 reload_services(sconn, conn_snum_used, true);
4018 sub_set_socket_ids(remaddr,
4019 sconn->remote_hostname,
4020 locaddr);
4021
4022 if (lp_preload_modules()) {
4023 smb_load_all_modules_absoute_path(lp_preload_modules());
4024 }
4025
4026 smb_perfcount_init();
4027
4028 if (!init_account_policy()) {
4029 exit_server("Could not open account policy tdb.\n");
4030 }
4031
4032 chroot_dir = lp_root_directory(talloc_tos());
4033 if (chroot_dir[0] != '\0') {
4034 rc = chdir(chroot_dir);
4035 if (rc != 0) {
4036 DBG_ERR("Failed to chdir to %s\n", chroot_dir);
4037 exit_server("Failed to chdir()");
4038 }
4039
4040 rc = chroot(chroot_dir);
4041 if (rc != 0) {
4042 DBG_ERR("Failed to change root to %s\n", chroot_dir);
4043 exit_server("Failed to chroot()");
4044 }
4045 DBG_WARNING("Changed root to %s\n", chroot_dir);
4046
4047 TALLOC_FREE(chroot_dir);
4048 }
4049
4050 if (!file_init(sconn)) {
4051 exit_server("file_init() failed");
4052 }
4053
4054 /* Setup oplocks */
4055 if (!init_oplocks(sconn))
4056 exit_server("Failed to init oplocks");
4057
4058 /* register our message handlers */
4059 messaging_register(sconn->msg_ctx, sconn,
4060 MSG_SMB_FORCE_TDIS, msg_force_tdis);
4061 messaging_register(sconn->msg_ctx, sconn,
4062 MSG_SMB_CLOSE_FILE, msg_close_file);
4063 messaging_register(sconn->msg_ctx, sconn,
4064 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
4065
4066 id_cache_register_msgs(sconn->msg_ctx);
4067 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
4068 messaging_register(sconn->msg_ctx, sconn,
4069 ID_CACHE_KILL, smbd_id_cache_kill);
4070
4071 messaging_deregister(sconn->msg_ctx,
4072 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
4073 messaging_register(sconn->msg_ctx, sconn,
4074 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
4075
4076 messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
4077 NULL);
4078 messaging_register(sconn->msg_ctx, sconn,
4079 MSG_SMB_KILL_CLIENT_IP,
4080 msg_kill_client_ip);
4081
4082 messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
4083
4084 /*
4085 * Use the default MSG_DEBUG handler to avoid rebroadcasting
4086 * MSGs to all child processes
4087 */
4088 messaging_deregister(sconn->msg_ctx,
4089 MSG_DEBUG, NULL);
4090 messaging_register(sconn->msg_ctx, NULL,
4091 MSG_DEBUG, debug_message);
4092
4093 if ((lp_keepalive() != 0)
4094 && !(event_add_idle(ev_ctx, NULL,
4095 timeval_set(lp_keepalive(), 0),
4096 "keepalive", keepalive_fn,
4097 sconn))) {
4098 DEBUG(0, ("Could not add keepalive event\n"));
4099 exit(1);
4100 }
4101
4102 if (!(event_add_idle(ev_ctx, NULL,
4103 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
4104 "deadtime", deadtime_fn, sconn))) {
4105 DEBUG(0, ("Could not add deadtime event\n"));
4106 exit(1);
4107 }
4108
4109 if (!(event_add_idle(ev_ctx, NULL,
4110 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
4111 "housekeeping", housekeeping_fn, sconn))) {
4112 DEBUG(0, ("Could not add housekeeping event\n"));
4113 exit(1);
4114 }
4115
4116 smbprofile_dump_setup(ev_ctx);
4117
4118 if (!init_dptrs(sconn)) {
4119 exit_server("init_dptrs() failed");
4120 }
4121
4122 TALLOC_FREE(trace_state.frame);
4123
4124 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback,
4125 &trace_state);
4126
4127 ret = tevent_loop_wait(ev_ctx);
4128 if (ret != 0) {
4129 DEBUG(1, ("tevent_loop_wait failed: %d, %s,"
4130 " exiting\n", ret, strerror(errno)));
4131 }
4132
4133 TALLOC_FREE(trace_state.frame);
4134
4135 exit_server_cleanly(NULL);
4136 }
4137
4138 bool req_is_in_chain(const struct smb_request *req)
4139 {
4140 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
4141 /*
4142 * We're right now handling a subsequent request, so we must
4143 * be in a chain
4144 */
4145 return true;
4146 }
4147
4148 if (!is_andx_req(req->cmd)) {
4149 return false;
4150 }
4151
4152 if (req->wct < 2) {
4153 /*
4154 * Okay, an illegal request, but definitely not chained :-)
4155 */
4156 return false;
4157 }
4158
4159 return (CVAL(req->vwv+0, 0) != 0xFF);
4160 }
Samba GIT mirror