?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: Fix off-by 4 error in wrap protection code in create_outbuf()
[Samba.git] / source3 / smbd / process.c
blob1ebda799c96937eba911502b2f0fa614f725ed96
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39 #include "../libcli/security/dom_sid.h"
40 #include "../libcli/security/security_token.h"
41 #include "lib/id_cache.h"
42 #include "serverid.h"
43
44 /* Internal message queue for deferred opens. */
45 struct pending_message_list {
46 struct pending_message_list *next, *prev;
47 struct timeval request_time; /* When was this first issued? */
48 struct smbd_server_connection *sconn;
49 struct tevent_timer *te;
50 struct smb_perfcount_data pcd;
51 uint32_t seqnum;
52 bool encrypted;
53 bool processed;
54 DATA_BLOB buf;
55 DATA_BLOB private_data;
56 };
57
58 static void construct_reply_common(struct smb_request *req, const char *inbuf,
59 char *outbuf);
60 static struct pending_message_list *get_deferred_open_message_smb(
61 struct smbd_server_connection *sconn, uint64_t mid);
62 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
63
64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
65 {
66 bool ok;
67
68 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
69 return true;
70 }
71
72 sconn->smb1.echo_handler.ref_count++;
73
74 if (sconn->smb1.echo_handler.ref_count > 1) {
75 return true;
76 }
77
78 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
79
80 do {
81 ok = fcntl_lock(
82 sconn->smb1.echo_handler.socket_lock_fd,
83 F_SETLKW, 0, 0, F_WRLCK);
84 } while (!ok && (errno == EINTR));
85
86 if (!ok) {
87 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
88 return false;
89 }
90
91 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
92
93 return true;
94 }
95
96 void smbd_lock_socket(struct smbd_server_connection *sconn)
97 {
98 if (!smbd_lock_socket_internal(sconn)) {
99 exit_server_cleanly("failed to lock socket");
100 }
101 }
102
103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
104 {
105 bool ok;
106
107 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
108 return true;
109 }
110
111 sconn->smb1.echo_handler.ref_count--;
112
113 if (sconn->smb1.echo_handler.ref_count > 0) {
114 return true;
115 }
116
117 do {
118 ok = fcntl_lock(
119 sconn->smb1.echo_handler.socket_lock_fd,
120 F_SETLKW, 0, 0, F_UNLCK);
121 } while (!ok && (errno == EINTR));
122
123 if (!ok) {
124 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
125 return false;
126 }
127
128 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
129
130 return true;
131 }
132
133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
134 {
135 if (!smbd_unlock_socket_internal(sconn)) {
136 exit_server_cleanly("failed to unlock socket");
137 }
138 }
139
140 /* Accessor function for smb_read_error for smbd functions. */
141
142 /****************************************************************************
143 Send an smb to a fd.
144 ****************************************************************************/
145
146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
147 bool do_signing, uint32_t seqnum,
148 bool do_encrypt,
149 struct smb_perfcount_data *pcd)
150 {
151 size_t len = 0;
152 size_t nwritten=0;
153 ssize_t ret;
154 char *buf_out = buffer;
155
156 smbd_lock_socket(sconn);
157
158 if (do_signing) {
159 /* Sign the outgoing packet if required. */
160 srv_calculate_sign_mac(sconn, buf_out, seqnum);
161 }
162
163 if (do_encrypt) {
164 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
165 if (!NT_STATUS_IS_OK(status)) {
166 DEBUG(0, ("send_smb: SMB encryption failed "
167 "on outgoing packet! Error %s\n",
168 nt_errstr(status) ));
169 goto out;
170 }
171 }
172
173 len = smb_len_large(buf_out) + 4;
174
175 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
176 if (ret <= 0) {
177
178 char addr[INET6_ADDRSTRLEN];
179 /*
180 * Try and give an error message saying what
181 * client failed.
182 */
183 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
184 (int)getpid(), (int)len,
185 get_peer_addr(sconn->sock, addr, sizeof(addr)),
186 (int)ret, strerror(errno) ));
187
188 srv_free_enc_buffer(sconn, buf_out);
189 goto out;
190 }
191
192 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
193 srv_free_enc_buffer(sconn, buf_out);
194 out:
195 SMB_PERFCOUNT_END(pcd);
196
197 smbd_unlock_socket(sconn);
198 return true;
199 }
200
201 /*******************************************************************
202 Setup the word count and byte count for a smb message.
203 ********************************************************************/
204
205 int srv_set_message(char *buf,
206 int num_words,
207 int num_bytes,
208 bool zero)
209 {
210 if (zero && (num_words || num_bytes)) {
211 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
212 }
213 SCVAL(buf,smb_wct,num_words);
214 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
215 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
216 return (smb_size + num_words*2 + num_bytes);
217 }
218
219 static bool valid_smb_header(struct smbd_server_connection *sconn,
220 const uint8_t *inbuf)
221 {
222 if (is_encrypted_packet(sconn, inbuf)) {
223 return true;
224 }
225 /*
226 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
227 * but it just looks weird to call strncmp for this one.
228 */
229 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
230 }
231
232 /* Socket functions for smbd packet processing. */
233
234 static bool valid_packet_size(size_t len)
235 {
236 /*
237 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
238 * of header. Don't print the error if this fits.... JRA.
239 */
240
241 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
242 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
243 (unsigned long)len));
244 return false;
245 }
246 return true;
247 }
248
249 static NTSTATUS read_packet_remainder(int fd, char *buffer,
250 unsigned int timeout, ssize_t len)
251 {
252 NTSTATUS status;
253
254 if (len <= 0) {
255 return NT_STATUS_OK;
256 }
257
258 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
259 if (!NT_STATUS_IS_OK(status)) {
260 char addr[INET6_ADDRSTRLEN];
261 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
262 "error = %s.\n",
263 get_peer_addr(fd, addr, sizeof(addr)),
264 nt_errstr(status)));
265 }
266 return status;
267 }
268
269 /****************************************************************************
270 Attempt a zerocopy writeX read. We know here that len > smb_size-4
271 ****************************************************************************/
272
273 /*
274 * Unfortunately, earlier versions of smbclient/libsmbclient
275 * don't send this "standard" writeX header. I've fixed this
276 * for 3.2 but we'll use the old method with earlier versions.
277 * Windows and CIFSFS at least use this standard size. Not
278 * sure about MacOSX.
279 */
280
281 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
282 (2*14) + /* word count (including bcc) */ \
283 1 /* pad byte */)
284
285 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
286 const char lenbuf[4],
287 struct smbd_server_connection *sconn,
288 int sock,
289 char **buffer,
290 unsigned int timeout,
291 size_t *p_unread,
292 size_t *len_ret)
293 {
294 /* Size of a WRITEX call (+4 byte len). */
295 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
296 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
297 ssize_t toread;
298 NTSTATUS status;
299
300 memcpy(writeX_header, lenbuf, 4);
301
302 status = read_fd_with_timeout(
303 sock, writeX_header + 4,
304 STANDARD_WRITE_AND_X_HEADER_SIZE,
305 STANDARD_WRITE_AND_X_HEADER_SIZE,
306 timeout, NULL);
307
308 if (!NT_STATUS_IS_OK(status)) {
309 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
310 "error = %s.\n",
311 tsocket_address_string(sconn->remote_address,
312 talloc_tos()),
313 nt_errstr(status)));
314 return status;
315 }
316
317 /*
318 * Ok - now try and see if this is a possible
319 * valid writeX call.
320 */
321
322 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
323 /*
324 * If the data offset is beyond what
325 * we've read, drain the extra bytes.
326 */
327 uint16_t doff = SVAL(writeX_header,smb_vwv11);
328 ssize_t newlen;
329
330 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
331 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
332 if (drain_socket(sock, drain) != drain) {
333 smb_panic("receive_smb_raw_talloc_partial_read:"
334 " failed to drain pending bytes");
335 }
336 } else {
337 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
338 }
339
340 /* Spoof down the length and null out the bcc. */
341 set_message_bcc(writeX_header, 0);
342 newlen = smb_len(writeX_header);
343
344 /* Copy the header we've written. */
345
346 *buffer = (char *)talloc_memdup(mem_ctx,
347 writeX_header,
348 sizeof(writeX_header));
349
350 if (*buffer == NULL) {
351 DEBUG(0, ("Could not allocate inbuf of length %d\n",
352 (int)sizeof(writeX_header)));
353 return NT_STATUS_NO_MEMORY;
354 }
355
356 /* Work out the remaining bytes. */
357 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
358 *len_ret = newlen + 4;
359 return NT_STATUS_OK;
360 }
361
362 if (!valid_packet_size(len)) {
363 return NT_STATUS_INVALID_PARAMETER;
364 }
365
366 /*
367 * Not a valid writeX call. Just do the standard
368 * talloc and return.
369 */
370
371 *buffer = talloc_array(mem_ctx, char, len+4);
372
373 if (*buffer == NULL) {
374 DEBUG(0, ("Could not allocate inbuf of length %d\n",
375 (int)len+4));
376 return NT_STATUS_NO_MEMORY;
377 }
378
379 /* Copy in what we already read. */
380 memcpy(*buffer,
381 writeX_header,
382 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
383 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
384
385 if(toread > 0) {
386 status = read_packet_remainder(
387 sock,
388 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
389 timeout, toread);
390
391 if (!NT_STATUS_IS_OK(status)) {
392 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
393 nt_errstr(status)));
394 return status;
395 }
396 }
397
398 *len_ret = len + 4;
399 return NT_STATUS_OK;
400 }
401
402 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
403 struct smbd_server_connection *sconn,
404 int sock,
405 char **buffer, unsigned int timeout,
406 size_t *p_unread, size_t *plen)
407 {
408 char lenbuf[4];
409 size_t len;
410 int min_recv_size = lp_min_receive_file_size();
411 NTSTATUS status;
412
413 *p_unread = 0;
414
415 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
416 &len);
417 if (!NT_STATUS_IS_OK(status)) {
418 return status;
419 }
420
421 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
422 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
423 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
424 !srv_is_signing_active(sconn) &&
425 sconn->smb1.echo_handler.trusted_fde == NULL) {
426
427 return receive_smb_raw_talloc_partial_read(
428 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
429 p_unread, plen);
430 }
431
432 if (!valid_packet_size(len)) {
433 return NT_STATUS_INVALID_PARAMETER;
434 }
435
436 /*
437 * The +4 here can't wrap, we've checked the length above already.
438 */
439
440 *buffer = talloc_array(mem_ctx, char, len+4);
441
442 if (*buffer == NULL) {
443 DEBUG(0, ("Could not allocate inbuf of length %d\n",
444 (int)len+4));
445 return NT_STATUS_NO_MEMORY;
446 }
447
448 memcpy(*buffer, lenbuf, sizeof(lenbuf));
449
450 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
451 if (!NT_STATUS_IS_OK(status)) {
452 return status;
453 }
454
455 *plen = len + 4;
456 return NT_STATUS_OK;
457 }
458
459 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
460 struct smbd_server_connection *sconn,
461 int sock,
462 char **buffer, unsigned int timeout,
463 size_t *p_unread, bool *p_encrypted,
464 size_t *p_len,
465 uint32_t *seqnum,
466 bool trusted_channel)
467 {
468 size_t len = 0;
469 NTSTATUS status;
470
471 *p_encrypted = false;
472
473 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
474 p_unread, &len);
475 if (!NT_STATUS_IS_OK(status)) {
476 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
477 ("receive_smb_raw_talloc failed for client %s "
478 "read error = %s.\n",
479 tsocket_address_string(sconn->remote_address,
480 talloc_tos()),
481 nt_errstr(status)) );
482 return status;
483 }
484
485 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
486 status = srv_decrypt_buffer(sconn, *buffer);
487 if (!NT_STATUS_IS_OK(status)) {
488 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
489 "incoming packet! Error %s\n",
490 nt_errstr(status) ));
491 return status;
492 }
493 *p_encrypted = true;
494 }
495
496 /* Check the incoming SMB signature. */
497 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
498 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
499 "incoming packet!\n"));
500 return NT_STATUS_INVALID_NETWORK_RESPONSE;
501 }
502
503 *p_len = len;
504 return NT_STATUS_OK;
505 }
506
507 /*
508 * Initialize a struct smb_request from an inbuf
509 */
510
511 static bool init_smb_request(struct smb_request *req,
512 struct smbd_server_connection *sconn,
513 const uint8 *inbuf,
514 size_t unread_bytes, bool encrypted,
515 uint32_t seqnum)
516 {
517 struct smbXsrv_tcon *tcon;
518 NTSTATUS status;
519 NTTIME now;
520 size_t req_size = smb_len(inbuf) + 4;
521
522 /* Ensure we have at least smb_size bytes. */
523 if (req_size < smb_size) {
524 DEBUG(0,("init_smb_request: invalid request size %u\n",
525 (unsigned int)req_size ));
526 return false;
527 }
528
529 req->request_time = timeval_current();
530 now = timeval_to_nttime(&req->request_time);
531
532 req->cmd = CVAL(inbuf, smb_com);
533 req->flags2 = SVAL(inbuf, smb_flg2);
534 req->smbpid = SVAL(inbuf, smb_pid);
535 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
536 req->seqnum = seqnum;
537 req->vuid = SVAL(inbuf, smb_uid);
538 req->tid = SVAL(inbuf, smb_tid);
539 req->wct = CVAL(inbuf, smb_wct);
540 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
541 req->buflen = smb_buflen(inbuf);
542 req->buf = (const uint8_t *)smb_buf_const(inbuf);
543 req->unread_bytes = unread_bytes;
544 req->encrypted = encrypted;
545 req->sconn = sconn;
546 status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
547 if (NT_STATUS_IS_OK(status)) {
548 req->conn = tcon->compat;
549 } else {
550 req->conn = NULL;
551 }
552 req->chain_fsp = NULL;
553 req->smb2req = NULL;
554 req->priv_paths = NULL;
555 req->chain = NULL;
556 smb_init_perfcount_data(&req->pcd);
557
558 /* Ensure we have at least wct words and 2 bytes of bcc. */
559 if (smb_size + req->wct*2 > req_size) {
560 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
561 (unsigned int)req->wct,
562 (unsigned int)req_size));
563 return false;
564 }
565 /* Ensure bcc is correct. */
566 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
567 DEBUG(0,("init_smb_request: invalid bcc number %u "
568 "(wct = %u, size %u)\n",
569 (unsigned int)req->buflen,
570 (unsigned int)req->wct,
571 (unsigned int)req_size));
572 return false;
573 }
574
575 req->outbuf = NULL;
576 return true;
577 }
578
579 static void process_smb(struct smbd_server_connection *conn,
580 uint8_t *inbuf, size_t nread, size_t unread_bytes,
581 uint32_t seqnum, bool encrypted,
582 struct smb_perfcount_data *deferred_pcd);
583
584 static void smbd_deferred_open_timer(struct tevent_context *ev,
585 struct tevent_timer *te,
586 struct timeval _tval,
587 void *private_data)
588 {
589 struct pending_message_list *msg = talloc_get_type(private_data,
590 struct pending_message_list);
591 struct smbd_server_connection *sconn = msg->sconn;
592 TALLOC_CTX *mem_ctx = talloc_tos();
593 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
594 uint8_t *inbuf;
595
596 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
597 msg->buf.length);
598 if (inbuf == NULL) {
599 exit_server("smbd_deferred_open_timer: talloc failed\n");
600 return;
601 }
602
603 /* We leave this message on the queue so the open code can
604 know this is a retry. */
605 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
606 (unsigned long long)mid ));
607
608 /* Mark the message as processed so this is not
609 * re-processed in error. */
610 msg->processed = true;
611
612 process_smb(sconn, inbuf,
613 msg->buf.length, 0,
614 msg->seqnum, msg->encrypted, &msg->pcd);
615
616 /* If it's still there and was processed, remove it. */
617 msg = get_deferred_open_message_smb(sconn, mid);
618 if (msg && msg->processed) {
619 remove_deferred_open_message_smb(sconn, mid);
620 }
621 }
622
623 /****************************************************************************
624 Function to push a message onto the tail of a linked list of smb messages ready
625 for processing.
626 ****************************************************************************/
627
628 static bool push_queued_message(struct smb_request *req,
629 struct timeval request_time,
630 struct timeval end_time,
631 char *private_data, size_t private_len)
632 {
633 int msg_len = smb_len(req->inbuf) + 4;
634 struct pending_message_list *msg;
635
636 msg = talloc_zero(NULL, struct pending_message_list);
637
638 if(msg == NULL) {
639 DEBUG(0,("push_message: malloc fail (1)\n"));
640 return False;
641 }
642 msg->sconn = req->sconn;
643
644 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
645 if(msg->buf.data == NULL) {
646 DEBUG(0,("push_message: malloc fail (2)\n"));
647 TALLOC_FREE(msg);
648 return False;
649 }
650
651 msg->request_time = request_time;
652 msg->seqnum = req->seqnum;
653 msg->encrypted = req->encrypted;
654 msg->processed = false;
655 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
656
657 if (private_data) {
658 msg->private_data = data_blob_talloc(msg, private_data,
659 private_len);
660 if (msg->private_data.data == NULL) {
661 DEBUG(0,("push_message: malloc fail (3)\n"));
662 TALLOC_FREE(msg);
663 return False;
664 }
665 }
666
667 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
668 msg,
669 end_time,
670 smbd_deferred_open_timer,
671 msg);
672 if (!msg->te) {
673 DEBUG(0,("push_message: event_add_timed failed\n"));
674 TALLOC_FREE(msg);
675 return false;
676 }
677
678 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
679 struct pending_message_list *);
680
681 DEBUG(10,("push_message: pushed message length %u on "
682 "deferred_open_queue\n", (unsigned int)msg_len));
683
684 return True;
685 }
686
687 /****************************************************************************
688 Function to delete a sharing violation open message by mid.
689 ****************************************************************************/
690
691 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
692 uint64_t mid)
693 {
694 struct pending_message_list *pml;
695
696 if (sconn->using_smb2) {
697 remove_deferred_open_message_smb2(sconn, mid);
698 return;
699 }
700
701 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
702 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
703 DEBUG(10,("remove_deferred_open_message_smb: "
704 "deleting mid %llu len %u\n",
705 (unsigned long long)mid,
706 (unsigned int)pml->buf.length ));
707 DLIST_REMOVE(sconn->deferred_open_queue, pml);
708 TALLOC_FREE(pml);
709 return;
710 }
711 }
712 }
713
714 /****************************************************************************
715 Move a sharing violation open retry message to the front of the list and
716 schedule it for immediate processing.
717 ****************************************************************************/
718
719 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
720 uint64_t mid)
721 {
722 struct pending_message_list *pml;
723 int i = 0;
724
725 if (sconn->using_smb2) {
726 return schedule_deferred_open_message_smb2(sconn, mid);
727 }
728
729 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
730 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
731
732 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
733 "msg_mid = %llu\n",
734 i++,
735 (unsigned long long)msg_mid ));
736
737 if (mid == msg_mid) {
738 struct tevent_timer *te;
739
740 if (pml->processed) {
741 /* A processed message should not be
742 * rescheduled. */
743 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
744 "message mid %llu was already processed\n",
745 (unsigned long long)msg_mid ));
746 continue;
747 }
748
749 DEBUG(10,("schedule_deferred_open_message_smb: "
750 "scheduling mid %llu\n",
751 (unsigned long long)mid ));
752
753 te = tevent_add_timer(pml->sconn->ev_ctx,
754 pml,
755 timeval_zero(),
756 smbd_deferred_open_timer,
757 pml);
758 if (!te) {
759 DEBUG(10,("schedule_deferred_open_message_smb: "
760 "event_add_timed() failed, "
761 "skipping mid %llu\n",
762 (unsigned long long)msg_mid ));
763 }
764
765 TALLOC_FREE(pml->te);
766 pml->te = te;
767 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
768 return true;
769 }
770 }
771
772 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
773 "find message mid %llu\n",
774 (unsigned long long)mid ));
775
776 return false;
777 }
778
779 /****************************************************************************
780 Return true if this mid is on the deferred queue and was not yet processed.
781 ****************************************************************************/
782
783 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
784 {
785 struct pending_message_list *pml;
786
787 if (sconn->using_smb2) {
788 return open_was_deferred_smb2(sconn, mid);
789 }
790
791 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
792 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
793 return True;
794 }
795 }
796 return False;
797 }
798
799 /****************************************************************************
800 Return the message queued by this mid.
801 ****************************************************************************/
802
803 static struct pending_message_list *get_deferred_open_message_smb(
804 struct smbd_server_connection *sconn, uint64_t mid)
805 {
806 struct pending_message_list *pml;
807
808 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
809 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
810 return pml;
811 }
812 }
813 return NULL;
814 }
815
816 /****************************************************************************
817 Get the state data queued by this mid.
818 ****************************************************************************/
819
820 bool get_deferred_open_message_state(struct smb_request *smbreq,
821 struct timeval *p_request_time,
822 void **pp_state)
823 {
824 struct pending_message_list *pml;
825
826 if (smbreq->sconn->using_smb2) {
827 return get_deferred_open_message_state_smb2(smbreq->smb2req,
828 p_request_time,
829 pp_state);
830 }
831
832 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
833 if (!pml) {
834 return false;
835 }
836 if (p_request_time) {
837 *p_request_time = pml->request_time;
838 }
839 if (pp_state) {
840 *pp_state = (void *)pml->private_data.data;
841 }
842 return true;
843 }
844
845 /****************************************************************************
846 Function to push a deferred open smb message onto a linked list of local smb
847 messages ready for processing.
848 ****************************************************************************/
849
850 bool push_deferred_open_message_smb(struct smb_request *req,
851 struct timeval request_time,
852 struct timeval timeout,
853 struct file_id id,
854 char *private_data, size_t priv_len)
855 {
856 struct timeval end_time;
857
858 if (req->smb2req) {
859 return push_deferred_open_message_smb2(req->smb2req,
860 request_time,
861 timeout,
862 id,
863 private_data,
864 priv_len);
865 }
866
867 if (req->unread_bytes) {
868 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
869 "unread_bytes = %u\n",
870 (unsigned int)req->unread_bytes ));
871 smb_panic("push_deferred_open_message_smb: "
872 "logic error unread_bytes != 0" );
873 }
874
875 end_time = timeval_sum(&request_time, &timeout);
876
877 DEBUG(10,("push_deferred_open_message_smb: pushing message "
878 "len %u mid %llu timeout time [%u.%06u]\n",
879 (unsigned int) smb_len(req->inbuf)+4,
880 (unsigned long long)req->mid,
881 (unsigned int)end_time.tv_sec,
882 (unsigned int)end_time.tv_usec));
883
884 return push_queued_message(req, request_time, end_time,
885 private_data, priv_len);
886 }
887
888 static void smbd_sig_term_handler(struct tevent_context *ev,
889 struct tevent_signal *se,
890 int signum,
891 int count,
892 void *siginfo,
893 void *private_data)
894 {
895 exit_server_cleanly("termination signal");
896 }
897
898 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
899 {
900 struct tevent_signal *se;
901
902 se = tevent_add_signal(sconn->ev_ctx,
903 sconn,
904 SIGTERM, 0,
905 smbd_sig_term_handler,
906 sconn);
907 if (!se) {
908 exit_server("failed to setup SIGTERM handler");
909 }
910 }
911
912 static void smbd_sig_hup_handler(struct tevent_context *ev,
913 struct tevent_signal *se,
914 int signum,
915 int count,
916 void *siginfo,
917 void *private_data)
918 {
919 struct smbd_server_connection *sconn =
920 talloc_get_type_abort(private_data,
921 struct smbd_server_connection);
922
923 change_to_root_user();
924 DEBUG(1,("Reloading services after SIGHUP\n"));
925 reload_services(sconn, conn_snum_used, false);
926 }
927
928 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
929 {
930 struct tevent_signal *se;
931
932 se = tevent_add_signal(sconn->ev_ctx,
933 sconn,
934 SIGHUP, 0,
935 smbd_sig_hup_handler,
936 sconn);
937 if (!se) {
938 exit_server("failed to setup SIGHUP handler");
939 }
940 }
941
942 static void smbd_conf_updated(struct messaging_context *msg,
943 void *private_data,
944 uint32_t msg_type,
945 struct server_id server_id,
946 DATA_BLOB *data)
947 {
948 struct smbd_server_connection *sconn =
949 talloc_get_type_abort(private_data,
950 struct smbd_server_connection);
951
952 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
953 "updated. Reloading.\n"));
954 change_to_root_user();
955 reload_services(sconn, conn_snum_used, false);
956 }
957
958 /*
959 * Only allow 5 outstanding trans requests. We're allocating memory, so
960 * prevent a DoS.
961 */
962
963 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
964 {
965 int count = 0;
966 for (; list != NULL; list = list->next) {
967
968 if (list->mid == mid) {
969 return NT_STATUS_INVALID_PARAMETER;
970 }
971
972 count += 1;
973 }
974 if (count > 5) {
975 return NT_STATUS_INSUFFICIENT_RESOURCES;
976 }
977
978 return NT_STATUS_OK;
979 }
980
981 /*
982 These flags determine some of the permissions required to do an operation
983
984 Note that I don't set NEED_WRITE on some write operations because they
985 are used by some brain-dead clients when printing, and I don't want to
986 force write permissions on print services.
987 */
988 #define AS_USER (1<<0)
989 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
990 #define TIME_INIT (1<<2)
991 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
992 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
993 #define DO_CHDIR (1<<6)
994
995 /*
996 define a list of possible SMB messages and their corresponding
997 functions. Any message that has a NULL function is unimplemented -
998 please feel free to contribute implementations!
999 */
1000 static const struct smb_message_struct {
1001 const char *name;
1002 void (*fn)(struct smb_request *req);
1003 int flags;
1004 } smb_messages[256] = {
1005
1006 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1007 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1008 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1009 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1010 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1011 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1012 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1013 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1014 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1015 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1016 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1017 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1018 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1019 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1020 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1021 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1022 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1023 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1024 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1025 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1026 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1027 /* 0x15 */ { NULL, NULL, 0 },
1028 /* 0x16 */ { NULL, NULL, 0 },
1029 /* 0x17 */ { NULL, NULL, 0 },
1030 /* 0x18 */ { NULL, NULL, 0 },
1031 /* 0x19 */ { NULL, NULL, 0 },
1032 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1033 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1034 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1035 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1036 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1037 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1038 /* 0x20 */ { "SMBwritec", NULL,0},
1039 /* 0x21 */ { NULL, NULL, 0 },
1040 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1041 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1042 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1043 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1044 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1045 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1046 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1047 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1048 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1049 /* 0x2b */ { "SMBecho",reply_echo,0},
1050 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1051 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1052 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1053 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1054 /* 0x30 */ { NULL, NULL, 0 },
1055 /* 0x31 */ { NULL, NULL, 0 },
1056 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1057 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1058 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1059 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1060 /* 0x36 */ { NULL, NULL, 0 },
1061 /* 0x37 */ { NULL, NULL, 0 },
1062 /* 0x38 */ { NULL, NULL, 0 },
1063 /* 0x39 */ { NULL, NULL, 0 },
1064 /* 0x3a */ { NULL, NULL, 0 },
1065 /* 0x3b */ { NULL, NULL, 0 },
1066 /* 0x3c */ { NULL, NULL, 0 },
1067 /* 0x3d */ { NULL, NULL, 0 },
1068 /* 0x3e */ { NULL, NULL, 0 },
1069 /* 0x3f */ { NULL, NULL, 0 },
1070 /* 0x40 */ { NULL, NULL, 0 },
1071 /* 0x41 */ { NULL, NULL, 0 },
1072 /* 0x42 */ { NULL, NULL, 0 },
1073 /* 0x43 */ { NULL, NULL, 0 },
1074 /* 0x44 */ { NULL, NULL, 0 },
1075 /* 0x45 */ { NULL, NULL, 0 },
1076 /* 0x46 */ { NULL, NULL, 0 },
1077 /* 0x47 */ { NULL, NULL, 0 },
1078 /* 0x48 */ { NULL, NULL, 0 },
1079 /* 0x49 */ { NULL, NULL, 0 },
1080 /* 0x4a */ { NULL, NULL, 0 },
1081 /* 0x4b */ { NULL, NULL, 0 },
1082 /* 0x4c */ { NULL, NULL, 0 },
1083 /* 0x4d */ { NULL, NULL, 0 },
1084 /* 0x4e */ { NULL, NULL, 0 },
1085 /* 0x4f */ { NULL, NULL, 0 },
1086 /* 0x50 */ { NULL, NULL, 0 },
1087 /* 0x51 */ { NULL, NULL, 0 },
1088 /* 0x52 */ { NULL, NULL, 0 },
1089 /* 0x53 */ { NULL, NULL, 0 },
1090 /* 0x54 */ { NULL, NULL, 0 },
1091 /* 0x55 */ { NULL, NULL, 0 },
1092 /* 0x56 */ { NULL, NULL, 0 },
1093 /* 0x57 */ { NULL, NULL, 0 },
1094 /* 0x58 */ { NULL, NULL, 0 },
1095 /* 0x59 */ { NULL, NULL, 0 },
1096 /* 0x5a */ { NULL, NULL, 0 },
1097 /* 0x5b */ { NULL, NULL, 0 },
1098 /* 0x5c */ { NULL, NULL, 0 },
1099 /* 0x5d */ { NULL, NULL, 0 },
1100 /* 0x5e */ { NULL, NULL, 0 },
1101 /* 0x5f */ { NULL, NULL, 0 },
1102 /* 0x60 */ { NULL, NULL, 0 },
1103 /* 0x61 */ { NULL, NULL, 0 },
1104 /* 0x62 */ { NULL, NULL, 0 },
1105 /* 0x63 */ { NULL, NULL, 0 },
1106 /* 0x64 */ { NULL, NULL, 0 },
1107 /* 0x65 */ { NULL, NULL, 0 },
1108 /* 0x66 */ { NULL, NULL, 0 },
1109 /* 0x67 */ { NULL, NULL, 0 },
1110 /* 0x68 */ { NULL, NULL, 0 },
1111 /* 0x69 */ { NULL, NULL, 0 },
1112 /* 0x6a */ { NULL, NULL, 0 },
1113 /* 0x6b */ { NULL, NULL, 0 },
1114 /* 0x6c */ { NULL, NULL, 0 },
1115 /* 0x6d */ { NULL, NULL, 0 },
1116 /* 0x6e */ { NULL, NULL, 0 },
1117 /* 0x6f */ { NULL, NULL, 0 },
1118 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1119 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1120 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1121 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1122 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1123 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1124 /* 0x76 */ { NULL, NULL, 0 },
1125 /* 0x77 */ { NULL, NULL, 0 },
1126 /* 0x78 */ { NULL, NULL, 0 },
1127 /* 0x79 */ { NULL, NULL, 0 },
1128 /* 0x7a */ { NULL, NULL, 0 },
1129 /* 0x7b */ { NULL, NULL, 0 },
1130 /* 0x7c */ { NULL, NULL, 0 },
1131 /* 0x7d */ { NULL, NULL, 0 },
1132 /* 0x7e */ { NULL, NULL, 0 },
1133 /* 0x7f */ { NULL, NULL, 0 },
1134 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1135 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1136 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1137 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1138 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1139 /* 0x85 */ { NULL, NULL, 0 },
1140 /* 0x86 */ { NULL, NULL, 0 },
1141 /* 0x87 */ { NULL, NULL, 0 },
1142 /* 0x88 */ { NULL, NULL, 0 },
1143 /* 0x89 */ { NULL, NULL, 0 },
1144 /* 0x8a */ { NULL, NULL, 0 },
1145 /* 0x8b */ { NULL, NULL, 0 },
1146 /* 0x8c */ { NULL, NULL, 0 },
1147 /* 0x8d */ { NULL, NULL, 0 },
1148 /* 0x8e */ { NULL, NULL, 0 },
1149 /* 0x8f */ { NULL, NULL, 0 },
1150 /* 0x90 */ { NULL, NULL, 0 },
1151 /* 0x91 */ { NULL, NULL, 0 },
1152 /* 0x92 */ { NULL, NULL, 0 },
1153 /* 0x93 */ { NULL, NULL, 0 },
1154 /* 0x94 */ { NULL, NULL, 0 },
1155 /* 0x95 */ { NULL, NULL, 0 },
1156 /* 0x96 */ { NULL, NULL, 0 },
1157 /* 0x97 */ { NULL, NULL, 0 },
1158 /* 0x98 */ { NULL, NULL, 0 },
1159 /* 0x99 */ { NULL, NULL, 0 },
1160 /* 0x9a */ { NULL, NULL, 0 },
1161 /* 0x9b */ { NULL, NULL, 0 },
1162 /* 0x9c */ { NULL, NULL, 0 },
1163 /* 0x9d */ { NULL, NULL, 0 },
1164 /* 0x9e */ { NULL, NULL, 0 },
1165 /* 0x9f */ { NULL, NULL, 0 },
1166 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1167 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1168 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1169 /* 0xa3 */ { NULL, NULL, 0 },
1170 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1171 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1172 /* 0xa6 */ { NULL, NULL, 0 },
1173 /* 0xa7 */ { NULL, NULL, 0 },
1174 /* 0xa8 */ { NULL, NULL, 0 },
1175 /* 0xa9 */ { NULL, NULL, 0 },
1176 /* 0xaa */ { NULL, NULL, 0 },
1177 /* 0xab */ { NULL, NULL, 0 },
1178 /* 0xac */ { NULL, NULL, 0 },
1179 /* 0xad */ { NULL, NULL, 0 },
1180 /* 0xae */ { NULL, NULL, 0 },
1181 /* 0xaf */ { NULL, NULL, 0 },
1182 /* 0xb0 */ { NULL, NULL, 0 },
1183 /* 0xb1 */ { NULL, NULL, 0 },
1184 /* 0xb2 */ { NULL, NULL, 0 },
1185 /* 0xb3 */ { NULL, NULL, 0 },
1186 /* 0xb4 */ { NULL, NULL, 0 },
1187 /* 0xb5 */ { NULL, NULL, 0 },
1188 /* 0xb6 */ { NULL, NULL, 0 },
1189 /* 0xb7 */ { NULL, NULL, 0 },
1190 /* 0xb8 */ { NULL, NULL, 0 },
1191 /* 0xb9 */ { NULL, NULL, 0 },
1192 /* 0xba */ { NULL, NULL, 0 },
1193 /* 0xbb */ { NULL, NULL, 0 },
1194 /* 0xbc */ { NULL, NULL, 0 },
1195 /* 0xbd */ { NULL, NULL, 0 },
1196 /* 0xbe */ { NULL, NULL, 0 },
1197 /* 0xbf */ { NULL, NULL, 0 },
1198 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1199 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1200 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1201 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1202 /* 0xc4 */ { NULL, NULL, 0 },
1203 /* 0xc5 */ { NULL, NULL, 0 },
1204 /* 0xc6 */ { NULL, NULL, 0 },
1205 /* 0xc7 */ { NULL, NULL, 0 },
1206 /* 0xc8 */ { NULL, NULL, 0 },
1207 /* 0xc9 */ { NULL, NULL, 0 },
1208 /* 0xca */ { NULL, NULL, 0 },
1209 /* 0xcb */ { NULL, NULL, 0 },
1210 /* 0xcc */ { NULL, NULL, 0 },
1211 /* 0xcd */ { NULL, NULL, 0 },
1212 /* 0xce */ { NULL, NULL, 0 },
1213 /* 0xcf */ { NULL, NULL, 0 },
1214 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1215 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1216 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1217 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1218 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1219 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1220 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1221 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1222 /* 0xd8 */ { NULL, NULL, 0 },
1223 /* 0xd9 */ { NULL, NULL, 0 },
1224 /* 0xda */ { NULL, NULL, 0 },
1225 /* 0xdb */ { NULL, NULL, 0 },
1226 /* 0xdc */ { NULL, NULL, 0 },
1227 /* 0xdd */ { NULL, NULL, 0 },
1228 /* 0xde */ { NULL, NULL, 0 },
1229 /* 0xdf */ { NULL, NULL, 0 },
1230 /* 0xe0 */ { NULL, NULL, 0 },
1231 /* 0xe1 */ { NULL, NULL, 0 },
1232 /* 0xe2 */ { NULL, NULL, 0 },
1233 /* 0xe3 */ { NULL, NULL, 0 },
1234 /* 0xe4 */ { NULL, NULL, 0 },
1235 /* 0xe5 */ { NULL, NULL, 0 },
1236 /* 0xe6 */ { NULL, NULL, 0 },
1237 /* 0xe7 */ { NULL, NULL, 0 },
1238 /* 0xe8 */ { NULL, NULL, 0 },
1239 /* 0xe9 */ { NULL, NULL, 0 },
1240 /* 0xea */ { NULL, NULL, 0 },
1241 /* 0xeb */ { NULL, NULL, 0 },
1242 /* 0xec */ { NULL, NULL, 0 },
1243 /* 0xed */ { NULL, NULL, 0 },
1244 /* 0xee */ { NULL, NULL, 0 },
1245 /* 0xef */ { NULL, NULL, 0 },
1246 /* 0xf0 */ { NULL, NULL, 0 },
1247 /* 0xf1 */ { NULL, NULL, 0 },
1248 /* 0xf2 */ { NULL, NULL, 0 },
1249 /* 0xf3 */ { NULL, NULL, 0 },
1250 /* 0xf4 */ { NULL, NULL, 0 },
1251 /* 0xf5 */ { NULL, NULL, 0 },
1252 /* 0xf6 */ { NULL, NULL, 0 },
1253 /* 0xf7 */ { NULL, NULL, 0 },
1254 /* 0xf8 */ { NULL, NULL, 0 },
1255 /* 0xf9 */ { NULL, NULL, 0 },
1256 /* 0xfa */ { NULL, NULL, 0 },
1257 /* 0xfb */ { NULL, NULL, 0 },
1258 /* 0xfc */ { NULL, NULL, 0 },
1259 /* 0xfd */ { NULL, NULL, 0 },
1260 /* 0xfe */ { NULL, NULL, 0 },
1261 /* 0xff */ { NULL, NULL, 0 }
1262
1263 };
1264
1265 /*******************************************************************
1266 allocate and initialize a reply packet
1267 ********************************************************************/
1268
1269 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1270 const char *inbuf, char **outbuf, uint8_t num_words,
1271 uint32_t num_bytes)
1272 {
1273 size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1274
1275 /*
1276 * Protect against integer wrap.
1277 * The SMB layer reply can be up to 0xFFFFFF bytes.
1278 */
1279 if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1280 char *msg;
1281 if (asprintf(&msg, "num_bytes too large: %u",
1282 (unsigned)num_bytes) == -1) {
1283 msg = discard_const_p(char, "num_bytes too large");
1284 }
1285 smb_panic(msg);
1286 }
1287
1288 /*
1289 * Here we include the NBT header for now.
1290 */
1291 *outbuf = talloc_array(mem_ctx, char,
1292 NBT_HDR_SIZE + smb_len);
1293 if (*outbuf == NULL) {
1294 return false;
1295 }
1296
1297 construct_reply_common(req, inbuf, *outbuf);
1298 srv_set_message(*outbuf, num_words, num_bytes, false);
1299 /*
1300 * Zero out the word area, the caller has to take care of the bcc area
1301 * himself
1302 */
1303 if (num_words != 0) {
1304 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1305 }
1306
1307 return true;
1308 }
1309
1310 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1311 {
1312 char *outbuf;
1313 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1314 num_bytes)) {
1315 smb_panic("could not allocate output buffer\n");
1316 }
1317 req->outbuf = (uint8_t *)outbuf;
1318 }
1319
1320
1321 /*******************************************************************
1322 Dump a packet to a file.
1323 ********************************************************************/
1324
1325 static void smb_dump(const char *name, int type, const char *data)
1326 {
1327 size_t len;
1328 int fd, i;
1329 char *fname = NULL;
1330 if (DEBUGLEVEL < 50) {
1331 return;
1332 }
1333
1334 len = smb_len_tcp(data)+4;
1335 for (i=1;i<100;i++) {
1336 fname = talloc_asprintf(talloc_tos(),
1337 "/tmp/%s.%d.%s",
1338 name,
1339 i,
1340 type ? "req" : "resp");
1341 if (fname == NULL) {
1342 return;
1343 }
1344 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1345 if (fd != -1 || errno != EEXIST) break;
1346 TALLOC_FREE(fname);
1347 }
1348 if (fd != -1) {
1349 ssize_t ret = write(fd, data, len);
1350 if (ret != len)
1351 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1352 close(fd);
1353 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1354 }
1355 TALLOC_FREE(fname);
1356 }
1357
1358 /****************************************************************************
1359 Prepare everything for calling the actual request function, and potentially
1360 call the request function via the "new" interface.
1361
1362 Return False if the "legacy" function needs to be called, everything is
1363 prepared.
1364
1365 Return True if we're done.
1366
1367 I know this API sucks, but it is the one with the least code change I could
1368 find.
1369 ****************************************************************************/
1370
1371 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1372 {
1373 int flags;
1374 uint64_t session_tag;
1375 connection_struct *conn = NULL;
1376 struct smbd_server_connection *sconn = req->sconn;
1377 NTTIME now = timeval_to_nttime(&req->request_time);
1378 struct smbXsrv_session *session = NULL;
1379 NTSTATUS status;
1380
1381 errno = 0;
1382
1383 if (smb_messages[type].fn == NULL) {
1384 DEBUG(0,("Unknown message type %d!\n",type));
1385 smb_dump("Unknown", 1, (const char *)req->inbuf);
1386 reply_unknown_new(req, type);
1387 return NULL;
1388 }
1389
1390 flags = smb_messages[type].flags;
1391
1392 /* In share mode security we must ignore the vuid. */
1393 session_tag = req->vuid;
1394 conn = req->conn;
1395
1396 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1397 (int)getpid(), (unsigned long)conn));
1398
1399 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1400
1401 /* Ensure this value is replaced in the incoming packet. */
1402 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1403
1404 /*
1405 * Ensure the correct username is in current_user_info. This is a
1406 * really ugly bugfix for problems with multiple session_setup_and_X's
1407 * being done and allowing %U and %G substitutions to work correctly.
1408 * There is a reason this code is done here, don't move it unless you
1409 * know what you're doing... :-).
1410 * JRA.
1411 */
1412
1413 /*
1414 * lookup an existing session
1415 *
1416 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1417 * here, the main check is still in change_to_user()
1418 */
1419 status = smb1srv_session_lookup(sconn->conn,
1420 session_tag,
1421 now,
1422 &session);
1423 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1424 switch (type) {
1425 case SMBsesssetupX:
1426 status = NT_STATUS_OK;
1427 break;
1428 default:
1429 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1430 (unsigned long long)session_tag,
1431 (unsigned long long)req->mid));
1432 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1433 return conn;
1434 }
1435 }
1436
1437 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1438 struct user_struct *vuser = NULL;
1439
1440 sconn->smb1.sessions.last_session_tag = session_tag;
1441 if (session) {
1442 vuser = session->compat;
1443 }
1444 if (vuser) {
1445 set_current_user_info(
1446 vuser->session_info->unix_info->sanitized_username,
1447 vuser->session_info->unix_info->unix_name,
1448 vuser->session_info->info->domain_name);
1449 }
1450 }
1451
1452 /* Does this call need to be run as the connected user? */
1453 if (flags & AS_USER) {
1454
1455 /* Does this call need a valid tree connection? */
1456 if (!conn) {
1457 /*
1458 * Amazingly, the error code depends on the command
1459 * (from Samba4).
1460 */
1461 if (type == SMBntcreateX) {
1462 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1463 } else {
1464 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1465 }
1466 return NULL;
1467 }
1468
1469 if (!change_to_user(conn,session_tag)) {
1470 DEBUG(0, ("Error: Could not change to user. Removing "
1471 "deferred open, mid=%llu.\n",
1472 (unsigned long long)req->mid));
1473 reply_force_doserror(req, ERRSRV, ERRbaduid);
1474 return conn;
1475 }
1476
1477 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1478
1479 /* Does it need write permission? */
1480 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1481 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1482 return conn;
1483 }
1484
1485 /* IPC services are limited */
1486 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1487 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1488 return conn;
1489 }
1490 } else {
1491 /* This call needs to be run as root */
1492 change_to_root_user();
1493 }
1494
1495 /* load service specific parameters */
1496 if (conn) {
1497 if (req->encrypted) {
1498 conn->encrypted_tid = true;
1499 /* encrypted required from now on. */
1500 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1501 } else if (ENCRYPTION_REQUIRED(conn)) {
1502 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1503 DEBUG(1,("service[%s] requires encryption"
1504 "%s ACCESS_DENIED. mid=%llu\n",
1505 lp_servicename(talloc_tos(), SNUM(conn)),
1506 smb_fn_name(type),
1507 (unsigned long long)req->mid));
1508 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1509 return conn;
1510 }
1511 }
1512
1513 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1514 (flags & (AS_USER|DO_CHDIR)
1515 ?True:False))) {
1516 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1517 return conn;
1518 }
1519 conn->num_smb_operations++;
1520 }
1521
1522 /*
1523 * Does this protocol need to be run as guest? (Only archane
1524 * messenger service requests have this...)
1525 */
1526 if (flags & AS_GUEST) {
1527 char *raddr;
1528 bool ok;
1529
1530 if (!change_to_guest()) {
1531 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1532 return conn;
1533 }
1534
1535 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1536 talloc_tos());
1537 if (raddr == NULL) {
1538 reply_nterror(req, NT_STATUS_NO_MEMORY);
1539 return conn;
1540 }
1541
1542 /*
1543 * Haven't we checked this in smbd_process already???
1544 */
1545
1546 ok = allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1547 sconn->remote_hostname, raddr);
1548 TALLOC_FREE(raddr);
1549
1550 if (!ok) {
1551 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1552 return conn;
1553 }
1554 }
1555
1556 smb_messages[type].fn(req);
1557 return req->conn;
1558 }
1559
1560 /****************************************************************************
1561 Construct a reply to the incoming packet.
1562 ****************************************************************************/
1563
1564 static void construct_reply(struct smbd_server_connection *sconn,
1565 char *inbuf, int size, size_t unread_bytes,
1566 uint32_t seqnum, bool encrypted,
1567 struct smb_perfcount_data *deferred_pcd)
1568 {
1569 connection_struct *conn;
1570 struct smb_request *req;
1571
1572 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1573 smb_panic("could not allocate smb_request");
1574 }
1575
1576 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1577 encrypted, seqnum)) {
1578 exit_server_cleanly("Invalid SMB request");
1579 }
1580
1581 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1582
1583 /* we popped this message off the queue - keep original perf data */
1584 if (deferred_pcd)
1585 req->pcd = *deferred_pcd;
1586 else {
1587 SMB_PERFCOUNT_START(&req->pcd);
1588 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1589 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1590 }
1591
1592 conn = switch_message(req->cmd, req);
1593
1594 if (req->outbuf == NULL) {
1595 return;
1596 }
1597
1598 if (CVAL(req->outbuf,0) == 0) {
1599 show_msg((char *)req->outbuf);
1600 }
1601
1602 if (!srv_send_smb(req->sconn,
1603 (char *)req->outbuf,
1604 true, req->seqnum+1,
1605 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1606 &req->pcd)) {
1607 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1608 }
1609
1610 TALLOC_FREE(req);
1611
1612 return;
1613 }
1614
1615 static void construct_reply_chain(struct smbd_server_connection *sconn,
1616 char *inbuf, int size, uint32_t seqnum,
1617 bool encrypted,
1618 struct smb_perfcount_data *deferred_pcd)
1619 {
1620 struct smb_request **reqs = NULL;
1621 struct smb_request *req;
1622 unsigned num_reqs;
1623 bool ok;
1624
1625 ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1626 seqnum, &reqs, &num_reqs);
1627 if (!ok) {
1628 char errbuf[smb_size];
1629 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1630 __LINE__, __FILE__);
1631 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1632 NULL)) {
1633 exit_server_cleanly("construct_reply_chain: "
1634 "srv_send_smb failed.");
1635 }
1636 return;
1637 }
1638
1639 req = reqs[0];
1640 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1641
1642 req->conn = switch_message(req->cmd, req);
1643
1644 if (req->outbuf == NULL) {
1645 /*
1646 * Request has suspended itself, will come
1647 * back here.
1648 */
1649 return;
1650 }
1651 smb_request_done(req);
1652 }
1653
1654 /*
1655 * To be called from an async SMB handler that is potentially chained
1656 * when it is finished for shipping.
1657 */
1658
1659 void smb_request_done(struct smb_request *req)
1660 {
1661 struct smb_request **reqs = NULL;
1662 struct smb_request *first_req;
1663 size_t i, num_reqs, next_index;
1664 NTSTATUS status;
1665
1666 if (req->chain == NULL) {
1667 first_req = req;
1668 goto shipit;
1669 }
1670
1671 reqs = req->chain;
1672 num_reqs = talloc_array_length(reqs);
1673
1674 for (i=0; i<num_reqs; i++) {
1675 if (reqs[i] == req) {
1676 break;
1677 }
1678 }
1679 if (i == num_reqs) {
1680 /*
1681 * Invalid chain, should not happen
1682 */
1683 status = NT_STATUS_INTERNAL_ERROR;
1684 goto error;
1685 }
1686 next_index = i+1;
1687
1688 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1689 struct smb_request *next = reqs[next_index];
1690 struct smbXsrv_tcon *tcon;
1691 NTTIME now = timeval_to_nttime(&req->request_time);
1692
1693 next->vuid = SVAL(req->outbuf, smb_uid);
1694 next->tid = SVAL(req->outbuf, smb_tid);
1695 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1696 now, &tcon);
1697 if (NT_STATUS_IS_OK(status)) {
1698 req->conn = tcon->compat;
1699 } else {
1700 req->conn = NULL;
1701 }
1702 next->chain_fsp = req->chain_fsp;
1703 next->inbuf = (uint8_t *)req->inbuf;
1704
1705 req = next;
1706 req->conn = switch_message(req->cmd, req);
1707
1708 if (req->outbuf == NULL) {
1709 /*
1710 * Request has suspended itself, will come
1711 * back here.
1712 */
1713 return;
1714 }
1715 next_index += 1;
1716 }
1717
1718 first_req = reqs[0];
1719
1720 for (i=1; i<next_index; i++) {
1721 bool ok;
1722
1723 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1724 if (!ok) {
1725 status = NT_STATUS_INTERNAL_ERROR;
1726 goto error;
1727 }
1728 }
1729
1730 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1731 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1732
1733 /*
1734 * This scary statement intends to set the
1735 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1736 * to the value last_req->outbuf carries
1737 */
1738 SSVAL(first_req->outbuf, smb_flg2,
1739 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1740 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1741
1742 /*
1743 * Transfer the error codes from the subrequest to the main one
1744 */
1745 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1746 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1747
1748 _smb_setlen_large(
1749 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1750
1751 shipit:
1752 if (!srv_send_smb(first_req->sconn,
1753 (char *)first_req->outbuf,
1754 true, first_req->seqnum+1,
1755 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1756 &first_req->pcd)) {
1757 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1758 "failed.");
1759 }
1760 TALLOC_FREE(req); /* non-chained case */
1761 TALLOC_FREE(reqs); /* chained case */
1762 return;
1763
1764 error:
1765 {
1766 char errbuf[smb_size];
1767 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1768 if (!srv_send_smb(req->sconn, errbuf, true,
1769 req->seqnum+1, req->encrypted,
1770 NULL)) {
1771 exit_server_cleanly("construct_reply_chain: "
1772 "srv_send_smb failed.");
1773 }
1774 }
1775 TALLOC_FREE(req); /* non-chained case */
1776 TALLOC_FREE(reqs); /* chained case */
1777 }
1778
1779 /****************************************************************************
1780 Process an smb from the client
1781 ****************************************************************************/
1782 static void process_smb(struct smbd_server_connection *sconn,
1783 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1784 uint32_t seqnum, bool encrypted,
1785 struct smb_perfcount_data *deferred_pcd)
1786 {
1787 int msg_type = CVAL(inbuf,0);
1788
1789 DO_PROFILE_INC(smb_count);
1790
1791 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1792 smb_len(inbuf) ) );
1793 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1794 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1795
1796 if (msg_type != NBSSmessage) {
1797 /*
1798 * NetBIOS session request, keepalive, etc.
1799 */
1800 reply_special(sconn, (char *)inbuf, nread);
1801 goto done;
1802 }
1803
1804 if (sconn->using_smb2) {
1805 /* At this point we're not really using smb2,
1806 * we make the decision here.. */
1807 if (smbd_is_smb2_header(inbuf, nread)) {
1808 smbd_smb2_first_negprot(sconn, inbuf, nread);
1809 return;
1810 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1811 && CVAL(inbuf, smb_com) != 0x72) {
1812 /* This is a non-negprot SMB1 packet.
1813 Disable SMB2 from now on. */
1814 sconn->using_smb2 = false;
1815 }
1816 }
1817
1818 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1819 * so subtract 4 from it. */
1820 if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1821 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1822 smb_len(inbuf)));
1823
1824 /* special magic for immediate exit */
1825 if ((nread == 9) &&
1826 (IVAL(inbuf, 4) == 0x74697865) &&
1827 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1828 uint8_t exitcode = CVAL(inbuf, 8);
1829 DEBUG(1, ("Exiting immediately with code %d\n",
1830 (int)exitcode));
1831 exit(exitcode);
1832 }
1833
1834 exit_server_cleanly("Non-SMB packet");
1835 }
1836
1837 show_msg((char *)inbuf);
1838
1839 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1840 construct_reply_chain(sconn, (char *)inbuf, nread,
1841 seqnum, encrypted, deferred_pcd);
1842 } else {
1843 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1844 seqnum, encrypted, deferred_pcd);
1845 }
1846
1847 sconn->trans_num++;
1848
1849 done:
1850 sconn->num_requests++;
1851
1852 /* The timeout_processing function isn't run nearly
1853 often enough to implement 'max log size' without
1854 overrunning the size of the file by many megabytes.
1855 This is especially true if we are running at debug
1856 level 10. Checking every 50 SMBs is a nice
1857 tradeoff of performance vs log file size overrun. */
1858
1859 if ((sconn->num_requests % 50) == 0 &&
1860 need_to_check_log_size()) {
1861 change_to_root_user();
1862 check_log_size();
1863 }
1864 }
1865
1866 /****************************************************************************
1867 Return a string containing the function name of a SMB command.
1868 ****************************************************************************/
1869
1870 const char *smb_fn_name(int type)
1871 {
1872 const char *unknown_name = "SMBunknown";
1873
1874 if (smb_messages[type].name == NULL)
1875 return(unknown_name);
1876
1877 return(smb_messages[type].name);
1878 }
1879
1880 /****************************************************************************
1881 Helper functions for contruct_reply.
1882 ****************************************************************************/
1883
1884 void add_to_common_flags2(uint32 v)
1885 {
1886 common_flags2 |= v;
1887 }
1888
1889 void remove_from_common_flags2(uint32 v)
1890 {
1891 common_flags2 &= ~v;
1892 }
1893
1894 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1895 char *outbuf)
1896 {
1897 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1898 uint16_t out_flags2 = common_flags2;
1899
1900 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1901 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1902 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1903
1904 srv_set_message(outbuf,0,0,false);
1905
1906 SCVAL(outbuf, smb_com, req->cmd);
1907 SIVAL(outbuf,smb_rcls,0);
1908 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1909 SSVAL(outbuf,smb_flg2, out_flags2);
1910 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1911 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1912
1913 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1914 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1915 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1916 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1917 }
1918
1919 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1920 {
1921 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1922 }
1923
1924 /**
1925 * @brief Find the smb_cmd offset of the last command pushed
1926 * @param[in] buf The buffer we're building up
1927 * @retval Where can we put our next andx cmd?
1928 *
1929 * While chaining requests, the "next" request we're looking at needs to put
1930 * its SMB_Command before the data the previous request already built up added
1931 * to the chain. Find the offset to the place where we have to put our cmd.
1932 */
1933
1934 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1935 {
1936 uint8_t cmd;
1937 size_t ofs;
1938
1939 cmd = CVAL(buf, smb_com);
1940
1941 if (!is_andx_req(cmd)) {
1942 return false;
1943 }
1944
1945 ofs = smb_vwv0;
1946
1947 while (CVAL(buf, ofs) != 0xff) {
1948
1949 if (!is_andx_req(CVAL(buf, ofs))) {
1950 return false;
1951 }
1952
1953 /*
1954 * ofs is from start of smb header, so add the 4 length
1955 * bytes. The next cmd is right after the wct field.
1956 */
1957 ofs = SVAL(buf, ofs+2) + 4 + 1;
1958
1959 if (ofs+4 >= talloc_get_size(buf)) {
1960 return false;
1961 }
1962 }
1963
1964 *pofs = ofs;
1965 return true;
1966 }
1967
1968 /**
1969 * @brief Do the smb chaining at a buffer level
1970 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1971 * @param[in] andx_buf Buffer to be appended
1972 */
1973
1974 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1975 {
1976 uint8_t smb_command = CVAL(andx_buf, smb_com);
1977 uint8_t wct = CVAL(andx_buf, smb_wct);
1978 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1979 uint32_t num_bytes = smb_buflen(andx_buf);
1980 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1981
1982 uint8_t *outbuf;
1983 size_t old_size, new_size;
1984 size_t ofs;
1985 size_t chain_padding = 0;
1986 size_t andx_cmd_ofs;
1987
1988
1989 old_size = talloc_get_size(*poutbuf);
1990
1991 if ((old_size % 4) != 0) {
1992 /*
1993 * Align the wct field of subsequent requests to a 4-byte
1994 * boundary
1995 */
1996 chain_padding = 4 - (old_size % 4);
1997 }
1998
1999 /*
2000 * After the old request comes the new wct field (1 byte), the vwv's
2001 * and the num_bytes field.
2002 */
2003
2004 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2005 new_size += num_bytes;
2006
2007 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2008 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2009 (unsigned)new_size));
2010 return false;
2011 }
2012
2013 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2014 if (outbuf == NULL) {
2015 DEBUG(0, ("talloc failed\n"));
2016 return false;
2017 }
2018 *poutbuf = outbuf;
2019
2020 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2021 DEBUG(1, ("invalid command chain\n"));
2022 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2023 return false;
2024 }
2025
2026 if (chain_padding != 0) {
2027 memset(outbuf + old_size, 0, chain_padding);
2028 old_size += chain_padding;
2029 }
2030
2031 SCVAL(outbuf, andx_cmd_ofs, smb_command);
2032 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2033
2034 ofs = old_size;
2035
2036 /*
2037 * Push the chained request:
2038 *
2039 * wct field
2040 */
2041
2042 SCVAL(outbuf, ofs, wct);
2043 ofs += 1;
2044
2045 /*
2046 * vwv array
2047 */
2048
2049 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2050
2051 /*
2052 * HACK ALERT
2053 *
2054 * Read&X has an offset into its data buffer at
2055 * vwv[6]. reply_read_andx has no idea anymore that it's
2056 * running from within a chain, so we have to fix up the
2057 * offset here.
2058 *
2059 * Although it looks disgusting at this place, I want to keep
2060 * it here. The alternative would be to push knowledge about
2061 * the andx chain down into read&x again.
2062 */
2063
2064 if (smb_command == SMBreadX) {
2065 uint8_t *bytes_addr;
2066
2067 if (wct < 7) {
2068 /*
2069 * Invalid read&x response
2070 */
2071 return false;
2072 }
2073
2074 bytes_addr = outbuf + ofs /* vwv start */
2075 + sizeof(uint16_t) * wct /* vwv array */
2076 + sizeof(uint16_t); /* bcc */
2077
2078 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2079 bytes_addr - outbuf - 4);
2080 }
2081
2082 ofs += sizeof(uint16_t) * wct;
2083
2084 /*
2085 * bcc (byte count)
2086 */
2087
2088 SSVAL(outbuf, ofs, num_bytes);
2089 ofs += sizeof(uint16_t);
2090
2091 /*
2092 * The bytes field
2093 */
2094
2095 memcpy(outbuf + ofs, bytes, num_bytes);
2096
2097 return true;
2098 }
2099
2100 bool smb1_is_chain(const uint8_t *buf)
2101 {
2102 uint8_t cmd, wct, andx_cmd;
2103
2104 cmd = CVAL(buf, smb_com);
2105 if (!is_andx_req(cmd)) {
2106 return false;
2107 }
2108 wct = CVAL(buf, smb_wct);
2109 if (wct < 2) {
2110 return false;
2111 }
2112 andx_cmd = CVAL(buf, smb_vwv);
2113 return (andx_cmd != 0xFF);
2114 }
2115
2116 bool smb1_walk_chain(const uint8_t *buf,
2117 bool (*fn)(uint8_t cmd,
2118 uint8_t wct, const uint16_t *vwv,
2119 uint16_t num_bytes, const uint8_t *bytes,
2120 void *private_data),
2121 void *private_data)
2122 {
2123 size_t smblen = smb_len(buf);
2124 const char *smb_buf = smb_base(buf);
2125 uint8_t cmd, chain_cmd;
2126 uint8_t wct;
2127 const uint16_t *vwv;
2128 uint16_t num_bytes;
2129 const uint8_t *bytes;
2130
2131 cmd = CVAL(buf, smb_com);
2132 wct = CVAL(buf, smb_wct);
2133 vwv = (const uint16_t *)(buf + smb_vwv);
2134 num_bytes = smb_buflen(buf);
2135 bytes = (uint8_t *)smb_buf_const(buf);
2136
2137 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2138 return false;
2139 }
2140
2141 if (!is_andx_req(cmd)) {
2142 return true;
2143 }
2144 if (wct < 2) {
2145 return false;
2146 }
2147
2148 chain_cmd = CVAL(vwv, 0);
2149
2150 while (chain_cmd != 0xff) {
2151 uint32_t chain_offset; /* uint32_t to avoid overflow */
2152 size_t length_needed;
2153 ptrdiff_t vwv_offset;
2154
2155 chain_offset = SVAL(vwv+1, 0);
2156
2157 /*
2158 * Check if the client tries to fool us. The chain
2159 * offset needs to point beyond the current request in
2160 * the chain, it needs to strictly grow. Otherwise we
2161 * might be tricked into an endless loop always
2162 * processing the same request over and over again. We
2163 * used to assume that vwv and the byte buffer array
2164 * in a chain are always attached, but OS/2 the
2165 * Write&X/Read&X chain puts the Read&X vwv array
2166 * right behind the Write&X vwv chain. The Write&X bcc
2167 * array is put behind the Read&X vwv array. So now we
2168 * check whether the chain offset points strictly
2169 * behind the previous vwv array. req->buf points
2170 * right after the vwv array of the previous
2171 * request. See
2172 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2173 * more information.
2174 */
2175
2176 vwv_offset = ((const char *)vwv - smb_buf);
2177 if (chain_offset <= vwv_offset) {
2178 return false;
2179 }
2180
2181 /*
2182 * Next check: Make sure the chain offset does not
2183 * point beyond the overall smb request length.
2184 */
2185
2186 length_needed = chain_offset+1; /* wct */
2187 if (length_needed > smblen) {
2188 return false;
2189 }
2190
2191 /*
2192 * Now comes the pointer magic. Goal here is to set up
2193 * vwv and buf correctly again. The chain offset (the
2194 * former vwv[1]) points at the new wct field.
2195 */
2196
2197 wct = CVAL(smb_buf, chain_offset);
2198
2199 if (is_andx_req(chain_cmd) && (wct < 2)) {
2200 return false;
2201 }
2202
2203 /*
2204 * Next consistency check: Make the new vwv array fits
2205 * in the overall smb request.
2206 */
2207
2208 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2209 if (length_needed > smblen) {
2210 return false;
2211 }
2212 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2213
2214 /*
2215 * Now grab the new byte buffer....
2216 */
2217
2218 num_bytes = SVAL(vwv+wct, 0);
2219
2220 /*
2221 * .. and check that it fits.
2222 */
2223
2224 length_needed += num_bytes;
2225 if (length_needed > smblen) {
2226 return false;
2227 }
2228 bytes = (const uint8_t *)(vwv+wct+1);
2229
2230 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2231 return false;
2232 }
2233
2234 if (!is_andx_req(chain_cmd)) {
2235 return true;
2236 }
2237 chain_cmd = CVAL(vwv, 0);
2238 }
2239 return true;
2240 }
2241
2242 static bool smb1_chain_length_cb(uint8_t cmd,
2243 uint8_t wct, const uint16_t *vwv,
2244 uint16_t num_bytes, const uint8_t *bytes,
2245 void *private_data)
2246 {
2247 unsigned *count = (unsigned *)private_data;
2248 *count += 1;
2249 return true;
2250 }
2251
2252 unsigned smb1_chain_length(const uint8_t *buf)
2253 {
2254 unsigned count = 0;
2255
2256 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2257 return 0;
2258 }
2259 return count;
2260 }
2261
2262 struct smb1_parse_chain_state {
2263 TALLOC_CTX *mem_ctx;
2264 const uint8_t *buf;
2265 struct smbd_server_connection *sconn;
2266 bool encrypted;
2267 uint32_t seqnum;
2268
2269 struct smb_request **reqs;
2270 unsigned num_reqs;
2271 };
2272
2273 static bool smb1_parse_chain_cb(uint8_t cmd,
2274 uint8_t wct, const uint16_t *vwv,
2275 uint16_t num_bytes, const uint8_t *bytes,
2276 void *private_data)
2277 {
2278 struct smb1_parse_chain_state *state =
2279 (struct smb1_parse_chain_state *)private_data;
2280 struct smb_request **reqs;
2281 struct smb_request *req;
2282 bool ok;
2283
2284 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2285 struct smb_request *, state->num_reqs+1);
2286 if (reqs == NULL) {
2287 return false;
2288 }
2289 state->reqs = reqs;
2290
2291 req = talloc(reqs, struct smb_request);
2292 if (req == NULL) {
2293 return false;
2294 }
2295
2296 ok = init_smb_request(req, state->sconn, state->buf, 0,
2297 state->encrypted, state->seqnum);
2298 if (!ok) {
2299 return false;
2300 }
2301 req->cmd = cmd;
2302 req->wct = wct;
2303 req->vwv = vwv;
2304 req->buflen = num_bytes;
2305 req->buf = bytes;
2306
2307 reqs[state->num_reqs] = req;
2308 state->num_reqs += 1;
2309 return true;
2310 }
2311
2312 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2313 struct smbd_server_connection *sconn,
2314 bool encrypted, uint32_t seqnum,
2315 struct smb_request ***reqs, unsigned *num_reqs)
2316 {
2317 struct smb1_parse_chain_state state;
2318 unsigned i;
2319
2320 state.mem_ctx = mem_ctx;
2321 state.buf = buf;
2322 state.sconn = sconn;
2323 state.encrypted = encrypted;
2324 state.seqnum = seqnum;
2325 state.reqs = NULL;
2326 state.num_reqs = 0;
2327
2328 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2329 TALLOC_FREE(state.reqs);
2330 return false;
2331 }
2332 for (i=0; i<state.num_reqs; i++) {
2333 state.reqs[i]->chain = state.reqs;
2334 }
2335 *reqs = state.reqs;
2336 *num_reqs = state.num_reqs;
2337 return true;
2338 }
2339
2340 /****************************************************************************
2341 Check if services need reloading.
2342 ****************************************************************************/
2343
2344 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2345 {
2346
2347 if (last_smb_conf_reload_time == 0) {
2348 last_smb_conf_reload_time = t;
2349 }
2350
2351 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2352 reload_services(sconn, conn_snum_used, true);
2353 last_smb_conf_reload_time = t;
2354 }
2355 }
2356
2357 static bool fd_is_readable(int fd)
2358 {
2359 int ret, revents;
2360
2361 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2362
2363 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2364
2365 }
2366
2367 static void smbd_server_connection_write_handler(
2368 struct smbd_server_connection *sconn)
2369 {
2370 /* TODO: make write nonblocking */
2371 }
2372
2373 static void smbd_server_connection_read_handler(
2374 struct smbd_server_connection *sconn, int fd)
2375 {
2376 uint8_t *inbuf = NULL;
2377 size_t inbuf_len = 0;
2378 size_t unread_bytes = 0;
2379 bool encrypted = false;
2380 TALLOC_CTX *mem_ctx = talloc_tos();
2381 NTSTATUS status;
2382 uint32_t seqnum;
2383
2384 bool from_client;
2385
2386 if (lp_async_smb_echo_handler()
2387 && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2388 /*
2389 * This is the super-ugly hack to prefer the packets
2390 * forwarded by the echo handler over the ones by the
2391 * client directly
2392 */
2393 fd = sconn->smb1.echo_handler.trusted_fd;
2394 }
2395
2396 from_client = (sconn->sock == fd);
2397
2398 if (from_client) {
2399 smbd_lock_socket(sconn);
2400
2401 if (!fd_is_readable(fd)) {
2402 DEBUG(10,("the echo listener was faster\n"));
2403 smbd_unlock_socket(sconn);
2404 return;
2405 }
2406 }
2407
2408 /* TODO: make this completely nonblocking */
2409 status = receive_smb_talloc(mem_ctx, sconn, fd,
2410 (char **)(void *)&inbuf,
2411 0, /* timeout */
2412 &unread_bytes,
2413 &encrypted,
2414 &inbuf_len, &seqnum,
2415 false /* trusted channel */);
2416
2417 if (from_client) {
2418 smbd_unlock_socket(sconn);
2419 }
2420
2421 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2422 goto process;
2423 }
2424 if (NT_STATUS_IS_ERR(status)) {
2425 exit_server_cleanly("failed to receive smb request");
2426 }
2427 if (!NT_STATUS_IS_OK(status)) {
2428 return;
2429 }
2430
2431 process:
2432 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2433 seqnum, encrypted, NULL);
2434 }
2435
2436 static void smbd_server_connection_handler(struct tevent_context *ev,
2437 struct tevent_fd *fde,
2438 uint16_t flags,
2439 void *private_data)
2440 {
2441 struct smbd_server_connection *conn = talloc_get_type(private_data,
2442 struct smbd_server_connection);
2443
2444 if (flags & TEVENT_FD_WRITE) {
2445 smbd_server_connection_write_handler(conn);
2446 return;
2447 }
2448 if (flags & TEVENT_FD_READ) {
2449 smbd_server_connection_read_handler(conn, conn->sock);
2450 return;
2451 }
2452 }
2453
2454 static void smbd_server_echo_handler(struct tevent_context *ev,
2455 struct tevent_fd *fde,
2456 uint16_t flags,
2457 void *private_data)
2458 {
2459 struct smbd_server_connection *conn = talloc_get_type(private_data,
2460 struct smbd_server_connection);
2461
2462 if (flags & TEVENT_FD_WRITE) {
2463 smbd_server_connection_write_handler(conn);
2464 return;
2465 }
2466 if (flags & TEVENT_FD_READ) {
2467 smbd_server_connection_read_handler(
2468 conn, conn->smb1.echo_handler.trusted_fd);
2469 return;
2470 }
2471 }
2472
2473 #ifdef CLUSTER_SUPPORT
2474
2475 struct smbd_release_ip_state {
2476 struct smbd_server_connection *sconn;
2477 char addr[INET6_ADDRSTRLEN];
2478 };
2479
2480 /****************************************************************************
2481 received when we should release a specific IP
2482 ****************************************************************************/
2483 static void release_ip(const char *ip, void *priv)
2484 {
2485 struct smbd_release_ip_state *state =
2486 talloc_get_type_abort(priv,
2487 struct smbd_release_ip_state);
2488 const char *addr = state->addr;
2489 const char *p = addr;
2490
2491 if (strncmp("::ffff:", addr, 7) == 0) {
2492 p = addr + 7;
2493 }
2494
2495 DEBUG(10, ("Got release IP message for %s, "
2496 "our address is %s\n", ip, p));
2497
2498 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2499 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2500 ip));
2501 /*
2502 * With SMB2 we should do a clean disconnect,
2503 * the previous_session_id in the session setup
2504 * will cleanup the old session, tcons and opens.
2505 *
2506 * A clean disconnect is needed in order to support
2507 * durable handles.
2508 *
2509 * Note: typically this is never triggered
2510 * as we got a TCP RST (triggered by ctdb event scripts)
2511 * before we get CTDB_SRVID_RELEASE_IP.
2512 *
2513 * We used to call _exit(1) here, but as this was mostly never
2514 * triggered and has implication on our process model,
2515 * we can just use smbd_server_connection_terminate()
2516 * (also for SMB1).
2517 */
2518 smbd_server_connection_terminate(state->sconn,
2519 "CTDB_SRVID_RELEASE_IP");
2520 return;
2521 }
2522 }
2523
2524 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2525 struct sockaddr_storage *srv,
2526 struct sockaddr_storage *clnt)
2527 {
2528 struct smbd_release_ip_state *state;
2529 struct ctdbd_connection *cconn;
2530
2531 cconn = messaging_ctdbd_connection();
2532 if (cconn == NULL) {
2533 return NT_STATUS_NO_MEMORY;
2534 }
2535
2536 state = talloc_zero(sconn, struct smbd_release_ip_state);
2537 if (state == NULL) {
2538 return NT_STATUS_NO_MEMORY;
2539 }
2540 state->sconn = sconn;
2541 if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2542 return NT_STATUS_NO_MEMORY;
2543 }
2544
2545 return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2546 }
2547
2548 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2549 struct sockaddr_storage *client)
2550 {
2551 socklen_t length;
2552 length = sizeof(*server);
2553 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2554 return -1;
2555 }
2556 length = sizeof(*client);
2557 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2558 return -1;
2559 }
2560 return 0;
2561 }
2562 #endif
2563
2564 /*
2565 * Send keepalive packets to our client
2566 */
2567 static bool keepalive_fn(const struct timeval *now, void *private_data)
2568 {
2569 struct smbd_server_connection *sconn = talloc_get_type_abort(
2570 private_data, struct smbd_server_connection);
2571 bool ret;
2572
2573 if (sconn->using_smb2) {
2574 /* Don't do keepalives on an SMB2 connection. */
2575 return false;
2576 }
2577
2578 smbd_lock_socket(sconn);
2579 ret = send_keepalive(sconn->sock);
2580 smbd_unlock_socket(sconn);
2581
2582 if (!ret) {
2583 char addr[INET6_ADDRSTRLEN];
2584 /*
2585 * Try and give an error message saying what
2586 * client failed.
2587 */
2588 DEBUG(0, ("send_keepalive failed for client %s. "
2589 "Error %s - exiting\n",
2590 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2591 strerror(errno)));
2592 return False;
2593 }
2594 return True;
2595 }
2596
2597 /*
2598 * Do the recurring check if we're idle
2599 */
2600 static bool deadtime_fn(const struct timeval *now, void *private_data)
2601 {
2602 struct smbd_server_connection *sconn =
2603 (struct smbd_server_connection *)private_data;
2604
2605 if ((conn_num_open(sconn) == 0)
2606 || (conn_idle_all(sconn, now->tv_sec))) {
2607 DEBUG( 2, ( "Closing idle connection\n" ) );
2608 messaging_send(sconn->msg_ctx,
2609 messaging_server_id(sconn->msg_ctx),
2610 MSG_SHUTDOWN, &data_blob_null);
2611 return False;
2612 }
2613
2614 return True;
2615 }
2616
2617 /*
2618 * Do the recurring log file and smb.conf reload checks.
2619 */
2620
2621 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2622 {
2623 struct smbd_server_connection *sconn = talloc_get_type_abort(
2624 private_data, struct smbd_server_connection);
2625
2626 DEBUG(5, ("housekeeping\n"));
2627
2628 change_to_root_user();
2629
2630 /* update printer queue caches if necessary */
2631 update_monitored_printq_cache(sconn->msg_ctx);
2632
2633 /* check if we need to reload services */
2634 check_reload(sconn, time_mono(NULL));
2635
2636 /*
2637 * Force a log file check.
2638 */
2639 force_check_log_size();
2640 check_log_size();
2641 return true;
2642 }
2643
2644 /*
2645 * Read an smb packet in the echo handler child, giving the parent
2646 * smbd one second to react once the socket becomes readable.
2647 */
2648
2649 struct smbd_echo_read_state {
2650 struct tevent_context *ev;
2651 struct smbd_server_connection *sconn;
2652
2653 char *buf;
2654 size_t buflen;
2655 uint32_t seqnum;
2656 };
2657
2658 static void smbd_echo_read_readable(struct tevent_req *subreq);
2659 static void smbd_echo_read_waited(struct tevent_req *subreq);
2660
2661 static struct tevent_req *smbd_echo_read_send(
2662 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2663 struct smbd_server_connection *sconn)
2664 {
2665 struct tevent_req *req, *subreq;
2666 struct smbd_echo_read_state *state;
2667
2668 req = tevent_req_create(mem_ctx, &state,
2669 struct smbd_echo_read_state);
2670 if (req == NULL) {
2671 return NULL;
2672 }
2673 state->ev = ev;
2674 state->sconn = sconn;
2675
2676 subreq = wait_for_read_send(state, ev, sconn->sock);
2677 if (tevent_req_nomem(subreq, req)) {
2678 return tevent_req_post(req, ev);
2679 }
2680 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2681 return req;
2682 }
2683
2684 static void smbd_echo_read_readable(struct tevent_req *subreq)
2685 {
2686 struct tevent_req *req = tevent_req_callback_data(
2687 subreq, struct tevent_req);
2688 struct smbd_echo_read_state *state = tevent_req_data(
2689 req, struct smbd_echo_read_state);
2690 bool ok;
2691 int err;
2692
2693 ok = wait_for_read_recv(subreq, &err);
2694 TALLOC_FREE(subreq);
2695 if (!ok) {
2696 tevent_req_nterror(req, map_nt_error_from_unix(err));
2697 return;
2698 }
2699
2700 /*
2701 * Give the parent smbd one second to step in
2702 */
2703
2704 subreq = tevent_wakeup_send(
2705 state, state->ev, timeval_current_ofs(1, 0));
2706 if (tevent_req_nomem(subreq, req)) {
2707 return;
2708 }
2709 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2710 }
2711
2712 static void smbd_echo_read_waited(struct tevent_req *subreq)
2713 {
2714 struct tevent_req *req = tevent_req_callback_data(
2715 subreq, struct tevent_req);
2716 struct smbd_echo_read_state *state = tevent_req_data(
2717 req, struct smbd_echo_read_state);
2718 struct smbd_server_connection *sconn = state->sconn;
2719 bool ok;
2720 NTSTATUS status;
2721 size_t unread = 0;
2722 bool encrypted;
2723
2724 ok = tevent_wakeup_recv(subreq);
2725 TALLOC_FREE(subreq);
2726 if (!ok) {
2727 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2728 return;
2729 }
2730
2731 ok = smbd_lock_socket_internal(sconn);
2732 if (!ok) {
2733 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2734 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2735 return;
2736 }
2737
2738 if (!fd_is_readable(sconn->sock)) {
2739 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2740 (int)getpid()));
2741
2742 ok = smbd_unlock_socket_internal(sconn);
2743 if (!ok) {
2744 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2745 DEBUG(1, ("%s: failed to unlock socket\n",
2746 __location__));
2747 return;
2748 }
2749
2750 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2751 if (tevent_req_nomem(subreq, req)) {
2752 return;
2753 }
2754 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2755 return;
2756 }
2757
2758 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2759 0 /* timeout */,
2760 &unread,
2761 &encrypted,
2762 &state->buflen,
2763 &state->seqnum,
2764 false /* trusted_channel*/);
2765
2766 if (tevent_req_nterror(req, status)) {
2767 tevent_req_nterror(req, status);
2768 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2769 (int)getpid(), nt_errstr(status)));
2770 return;
2771 }
2772
2773 ok = smbd_unlock_socket_internal(sconn);
2774 if (!ok) {
2775 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2776 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2777 return;
2778 }
2779 tevent_req_done(req);
2780 }
2781
2782 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2783 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2784 {
2785 struct smbd_echo_read_state *state = tevent_req_data(
2786 req, struct smbd_echo_read_state);
2787 NTSTATUS status;
2788
2789 if (tevent_req_is_nterror(req, &status)) {
2790 return status;
2791 }
2792 *pbuf = talloc_move(mem_ctx, &state->buf);
2793 *pbuflen = state->buflen;
2794 *pseqnum = state->seqnum;
2795 return NT_STATUS_OK;
2796 }
2797
2798 struct smbd_echo_state {
2799 struct tevent_context *ev;
2800 struct iovec *pending;
2801 struct smbd_server_connection *sconn;
2802 int parent_pipe;
2803
2804 struct tevent_fd *parent_fde;
2805
2806 struct tevent_req *write_req;
2807 };
2808
2809 static void smbd_echo_writer_done(struct tevent_req *req);
2810
2811 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2812 {
2813 int num_pending;
2814
2815 if (state->write_req != NULL) {
2816 return;
2817 }
2818
2819 num_pending = talloc_array_length(state->pending);
2820 if (num_pending == 0) {
2821 return;
2822 }
2823
2824 state->write_req = writev_send(state, state->ev, NULL,
2825 state->parent_pipe, false,
2826 state->pending, num_pending);
2827 if (state->write_req == NULL) {
2828 DEBUG(1, ("writev_send failed\n"));
2829 exit(1);
2830 }
2831
2832 talloc_steal(state->write_req, state->pending);
2833 state->pending = NULL;
2834
2835 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2836 state);
2837 }
2838
2839 static void smbd_echo_writer_done(struct tevent_req *req)
2840 {
2841 struct smbd_echo_state *state = tevent_req_callback_data(
2842 req, struct smbd_echo_state);
2843 ssize_t written;
2844 int err;
2845
2846 written = writev_recv(req, &err);
2847 TALLOC_FREE(req);
2848 state->write_req = NULL;
2849 if (written == -1) {
2850 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2851 exit(1);
2852 }
2853 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2854 smbd_echo_activate_writer(state);
2855 }
2856
2857 static bool smbd_echo_reply(struct smbd_echo_state *state,
2858 uint8_t *inbuf, size_t inbuf_len,
2859 uint32_t seqnum)
2860 {
2861 struct smb_request req;
2862 uint16_t num_replies;
2863 char *outbuf;
2864 bool ok;
2865
2866 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2867 DEBUG(10, ("Got netbios keepalive\n"));
2868 /*
2869 * Just swallow it
2870 */
2871 return true;
2872 }
2873
2874 if (inbuf_len < smb_size) {
2875 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2876 return false;
2877 }
2878 if (!valid_smb_header(state->sconn, inbuf)) {
2879 DEBUG(10, ("Got invalid SMB header\n"));
2880 return false;
2881 }
2882
2883 if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2884 seqnum)) {
2885 return false;
2886 }
2887 req.inbuf = inbuf;
2888
2889 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2890 smb_messages[req.cmd].name
2891 ? smb_messages[req.cmd].name : "unknown"));
2892
2893 if (req.cmd != SMBecho) {
2894 return false;
2895 }
2896 if (req.wct < 1) {
2897 return false;
2898 }
2899
2900 num_replies = SVAL(req.vwv+0, 0);
2901 if (num_replies != 1) {
2902 /* Not a Windows "Hey, you're still there?" request */
2903 return false;
2904 }
2905
2906 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2907 1, req.buflen)) {
2908 DEBUG(10, ("create_outbuf failed\n"));
2909 return false;
2910 }
2911 req.outbuf = (uint8_t *)outbuf;
2912
2913 SSVAL(req.outbuf, smb_vwv0, num_replies);
2914
2915 if (req.buflen > 0) {
2916 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2917 }
2918
2919 ok = srv_send_smb(req.sconn,
2920 (char *)outbuf,
2921 true, seqnum+1,
2922 false, &req.pcd);
2923 TALLOC_FREE(outbuf);
2924 if (!ok) {
2925 exit(1);
2926 }
2927
2928 return true;
2929 }
2930
2931 static void smbd_echo_exit(struct tevent_context *ev,
2932 struct tevent_fd *fde, uint16_t flags,
2933 void *private_data)
2934 {
2935 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2936 exit(0);
2937 }
2938
2939 static void smbd_echo_got_packet(struct tevent_req *req);
2940
2941 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2942 int parent_pipe)
2943 {
2944 struct smbd_echo_state *state;
2945 struct tevent_req *read_req;
2946
2947 state = talloc_zero(sconn, struct smbd_echo_state);
2948 if (state == NULL) {
2949 DEBUG(1, ("talloc failed\n"));
2950 return;
2951 }
2952 state->sconn = sconn;
2953 state->parent_pipe = parent_pipe;
2954 state->ev = s3_tevent_context_init(state);
2955 if (state->ev == NULL) {
2956 DEBUG(1, ("tevent_context_init failed\n"));
2957 TALLOC_FREE(state);
2958 return;
2959 }
2960 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2961 TEVENT_FD_READ, smbd_echo_exit,
2962 state);
2963 if (state->parent_fde == NULL) {
2964 DEBUG(1, ("tevent_add_fd failed\n"));
2965 TALLOC_FREE(state);
2966 return;
2967 }
2968
2969 read_req = smbd_echo_read_send(state, state->ev, sconn);
2970 if (read_req == NULL) {
2971 DEBUG(1, ("smbd_echo_read_send failed\n"));
2972 TALLOC_FREE(state);
2973 return;
2974 }
2975 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2976
2977 while (true) {
2978 if (tevent_loop_once(state->ev) == -1) {
2979 DEBUG(1, ("tevent_loop_once failed: %s\n",
2980 strerror(errno)));
2981 break;
2982 }
2983 }
2984 TALLOC_FREE(state);
2985 }
2986
2987 static void smbd_echo_got_packet(struct tevent_req *req)
2988 {
2989 struct smbd_echo_state *state = tevent_req_callback_data(
2990 req, struct smbd_echo_state);
2991 NTSTATUS status;
2992 char *buf = NULL;
2993 size_t buflen = 0;
2994 uint32_t seqnum = 0;
2995 bool reply;
2996
2997 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2998 TALLOC_FREE(req);
2999 if (!NT_STATUS_IS_OK(status)) {
3000 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3001 nt_errstr(status)));
3002 exit(1);
3003 }
3004
3005 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3006 if (!reply) {
3007 size_t num_pending;
3008 struct iovec *tmp;
3009 struct iovec *iov;
3010
3011 num_pending = talloc_array_length(state->pending);
3012 tmp = talloc_realloc(state, state->pending, struct iovec,
3013 num_pending+1);
3014 if (tmp == NULL) {
3015 DEBUG(1, ("talloc_realloc failed\n"));
3016 exit(1);
3017 }
3018 state->pending = tmp;
3019
3020 if (buflen >= smb_size) {
3021 /*
3022 * place the seqnum in the packet so that the main process
3023 * can reply with signing
3024 */
3025 SIVAL(buf, smb_ss_field, seqnum);
3026 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3027 }
3028
3029 iov = &state->pending[num_pending];
3030 iov->iov_base = talloc_move(state->pending, &buf);
3031 iov->iov_len = buflen;
3032
3033 DEBUG(10,("echo_handler[%d]: forward to main\n",
3034 (int)getpid()));
3035 smbd_echo_activate_writer(state);
3036 }
3037
3038 req = smbd_echo_read_send(state, state->ev, state->sconn);
3039 if (req == NULL) {
3040 DEBUG(1, ("smbd_echo_read_send failed\n"));
3041 exit(1);
3042 }
3043 tevent_req_set_callback(req, smbd_echo_got_packet, state);
3044 }
3045
3046
3047 /*
3048 * Handle SMBecho requests in a forked child process
3049 */
3050 bool fork_echo_handler(struct smbd_server_connection *sconn)
3051 {
3052 int listener_pipe[2];
3053 int res;
3054 pid_t child;
3055
3056 res = pipe(listener_pipe);
3057 if (res == -1) {
3058 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3059 return false;
3060 }
3061 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
3062 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3063 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
3064 goto fail;
3065 }
3066
3067 child = fork();
3068 if (child == 0) {
3069 NTSTATUS status;
3070
3071 close(listener_pipe[0]);
3072 set_blocking(listener_pipe[1], false);
3073
3074 status = reinit_after_fork(sconn->msg_ctx,
3075 sconn->ev_ctx,
3076 true);
3077 if (!NT_STATUS_IS_OK(status)) {
3078 DEBUG(1, ("reinit_after_fork failed: %s\n",
3079 nt_errstr(status)));
3080 exit(1);
3081 }
3082 smbd_echo_loop(sconn, listener_pipe[1]);
3083 exit(0);
3084 }
3085 close(listener_pipe[1]);
3086 listener_pipe[1] = -1;
3087 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3088
3089 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3090
3091 /*
3092 * Without smb signing this is the same as the normal smbd
3093 * listener. This needs to change once signing comes in.
3094 */
3095 sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3096 sconn,
3097 sconn->smb1.echo_handler.trusted_fd,
3098 TEVENT_FD_READ,
3099 smbd_server_echo_handler,
3100 sconn);
3101 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3102 DEBUG(1, ("event_add_fd failed\n"));
3103 goto fail;
3104 }
3105
3106 return true;
3107
3108 fail:
3109 if (listener_pipe[0] != -1) {
3110 close(listener_pipe[0]);
3111 }
3112 if (listener_pipe[1] != -1) {
3113 close(listener_pipe[1]);
3114 }
3115 sconn->smb1.echo_handler.trusted_fd = -1;
3116 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3117 close(sconn->smb1.echo_handler.socket_lock_fd);
3118 }
3119 sconn->smb1.echo_handler.trusted_fd = -1;
3120 sconn->smb1.echo_handler.socket_lock_fd = -1;
3121 return false;
3122 }
3123
3124 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3125 {
3126 while (user) {
3127 if (user->session_info &&
3128 (user->session_info->unix_token->uid == uid)) {
3129 return true;
3130 }
3131 user = user->next;
3132 }
3133 return false;
3134 }
3135
3136 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3137 {
3138 while (user) {
3139 if (user->session_info != NULL) {
3140 int i;
3141 struct security_unix_token *utok;
3142
3143 utok = user->session_info->unix_token;
3144 if (utok->gid == gid) {
3145 return true;
3146 }
3147 for(i=0; i<utok->ngroups; i++) {
3148 if (utok->groups[i] == gid) {
3149 return true;
3150 }
3151 }
3152 }
3153 user = user->next;
3154 }
3155 return false;
3156 }
3157
3158 static bool sid_in_use(const struct user_struct *user,
3159 const struct dom_sid *psid)
3160 {
3161 while (user) {
3162 struct security_token *tok;
3163
3164 if (user->session_info == NULL) {
3165 continue;
3166 }
3167 tok = user->session_info->security_token;
3168 if (tok == NULL) {
3169 /*
3170 * Not sure session_info->security_token can
3171 * ever be NULL. This check might be not
3172 * necessary.
3173 */
3174 continue;
3175 }
3176 if (security_token_has_sid(tok, psid)) {
3177 return true;
3178 }
3179 user = user->next;
3180 }
3181 return false;
3182 }
3183
3184 static bool id_in_use(const struct user_struct *user,
3185 const struct id_cache_ref *id)
3186 {
3187 switch(id->type) {
3188 case UID:
3189 return uid_in_use(user, id->id.uid);
3190 case GID:
3191 return gid_in_use(user, id->id.gid);
3192 case SID:
3193 return sid_in_use(user, &id->id.sid);
3194 default:
3195 break;
3196 }
3197 return false;
3198 }
3199
3200 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3201 void *private_data,
3202 uint32_t msg_type,
3203 struct server_id server_id,
3204 DATA_BLOB* data)
3205 {
3206 const char *msg = (data && data->data)
3207 ? (const char *)data->data : "<NULL>";
3208 struct id_cache_ref id;
3209 struct smbd_server_connection *sconn =
3210 talloc_get_type_abort(private_data,
3211 struct smbd_server_connection);
3212
3213 if (!id_cache_ref_parse(msg, &id)) {
3214 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3215 return;
3216 }
3217
3218 if (id_in_use(sconn->users, &id)) {
3219 exit_server_cleanly(msg);
3220 }
3221 id_cache_delete_from_cache(&id);
3222 }
3223
3224 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3225 enum protocol_types protocol)
3226 {
3227 NTSTATUS status;
3228
3229 set_Protocol(protocol);
3230 conn->protocol = protocol;
3231
3232 if (protocol >= PROTOCOL_SMB2_02) {
3233 status = smb2srv_session_table_init(conn);
3234 if (!NT_STATUS_IS_OK(status)) {
3235 return status;
3236 }
3237
3238 status = smb2srv_open_table_init(conn);
3239 if (!NT_STATUS_IS_OK(status)) {
3240 return status;
3241 }
3242 } else {
3243 status = smb1srv_session_table_init(conn);
3244 if (!NT_STATUS_IS_OK(status)) {
3245 return status;
3246 }
3247
3248 status = smb1srv_tcon_table_init(conn);
3249 if (!NT_STATUS_IS_OK(status)) {
3250 return status;
3251 }
3252
3253 status = smb1srv_open_table_init(conn);
3254 if (!NT_STATUS_IS_OK(status)) {
3255 return status;
3256 }
3257 }
3258
3259 return NT_STATUS_OK;
3260 }
3261
3262 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3263 void *private_data)
3264 {
3265 struct smbXsrv_connection *conn =
3266 talloc_get_type_abort(private_data,
3267 struct smbXsrv_connection);
3268
3269 switch (point) {
3270 case TEVENT_TRACE_BEFORE_WAIT:
3271 /*
3272 * This just removes compiler warning
3273 * without profile support
3274 */
3275 conn->smbd_idle_profstamp = 0;
3276 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3277 break;
3278 case TEVENT_TRACE_AFTER_WAIT:
3279 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3280 break;
3281 }
3282 }
3283
3284 /****************************************************************************
3285 Process commands from the client
3286 ****************************************************************************/
3287
3288 void smbd_process(struct tevent_context *ev_ctx,
3289 struct messaging_context *msg_ctx,
3290 int sock_fd,
3291 bool interactive)
3292 {
3293 TALLOC_CTX *frame = talloc_stackframe();
3294 struct smbXsrv_connection *conn;
3295 struct smbd_server_connection *sconn;
3296 struct sockaddr_storage ss;
3297 struct sockaddr *sa = NULL;
3298 socklen_t sa_socklen;
3299 struct tsocket_address *local_address = NULL;
3300 struct tsocket_address *remote_address = NULL;
3301 const char *locaddr = NULL;
3302 const char *remaddr = NULL;
3303 char *rhost;
3304 int ret;
3305
3306 conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3307 if (conn == NULL) {
3308 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3309 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3310 }
3311
3312 conn->ev_ctx = ev_ctx;
3313 conn->msg_ctx = msg_ctx;
3314
3315 sconn = talloc_zero(conn, struct smbd_server_connection);
3316 if (!sconn) {
3317 exit_server("failed to create smbd_server_connection");
3318 }
3319
3320 conn->sconn = sconn;
3321 sconn->conn = conn;
3322
3323 /*
3324 * TODO: remove this...:-)
3325 */
3326 global_smbXsrv_connection = conn;
3327
3328 sconn->ev_ctx = ev_ctx;
3329 sconn->msg_ctx = msg_ctx;
3330 sconn->sock = sock_fd;
3331 sconn->smb1.echo_handler.trusted_fd = -1;
3332 sconn->smb1.echo_handler.socket_lock_fd = -1;
3333
3334 if (!interactive) {
3335 smbd_setup_sig_term_handler(sconn);
3336 smbd_setup_sig_hup_handler(sconn);
3337
3338 if (!serverid_register(messaging_server_id(msg_ctx),
3339 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3340 |FLAG_MSG_DBWRAP
3341 |FLAG_MSG_PRINT_GENERAL)) {
3342 exit_server_cleanly("Could not register myself in "
3343 "serverid.tdb");
3344 }
3345 }
3346
3347 if (lp_srv_maxprotocol() >= PROTOCOL_SMB2_02) {
3348 /*
3349 * We're not making the decision here,
3350 * we're just allowing the client
3351 * to decide between SMB1 and SMB2
3352 * with the first negprot
3353 * packet.
3354 */
3355 sconn->using_smb2 = true;
3356 }
3357
3358 /* Ensure child is set to blocking mode */
3359 set_blocking(sconn->sock,True);
3360
3361 set_socket_options(sconn->sock, "SO_KEEPALIVE");
3362 set_socket_options(sconn->sock, lp_socket_options());
3363
3364 sa = (struct sockaddr *)(void *)&ss;
3365 sa_socklen = sizeof(ss);
3366 ret = getpeername(sconn->sock, sa, &sa_socklen);
3367 if (ret != 0) {
3368 int level = (errno == ENOTCONN)?2:0;
3369 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3370 exit_server_cleanly("getpeername() failed.\n");
3371 }
3372 ret = tsocket_address_bsd_from_sockaddr(sconn,
3373 sa, sa_socklen,
3374 &remote_address);
3375 if (ret != 0) {
3376 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3377 __location__, strerror(errno)));
3378 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3379 }
3380
3381 sa = (struct sockaddr *)(void *)&ss;
3382 sa_socklen = sizeof(ss);
3383 ret = getsockname(sconn->sock, sa, &sa_socklen);
3384 if (ret != 0) {
3385 int level = (errno == ENOTCONN)?2:0;
3386 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3387 exit_server_cleanly("getsockname() failed.\n");
3388 }
3389 ret = tsocket_address_bsd_from_sockaddr(sconn,
3390 sa, sa_socklen,
3391 &local_address);
3392 if (ret != 0) {
3393 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3394 __location__, strerror(errno)));
3395 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3396 }
3397
3398 sconn->local_address = local_address;
3399 sconn->remote_address = remote_address;
3400
3401 if (tsocket_address_is_inet(local_address, "ip")) {
3402 locaddr = tsocket_address_inet_addr_string(
3403 sconn->local_address,
3404 talloc_tos());
3405 if (locaddr == NULL) {
3406 DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3407 __location__, strerror(errno)));
3408 exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3409 }
3410 } else {
3411 locaddr = "0.0.0.0";
3412 }
3413
3414 if (tsocket_address_is_inet(remote_address, "ip")) {
3415 remaddr = tsocket_address_inet_addr_string(
3416 sconn->remote_address,
3417 talloc_tos());
3418 if (remaddr == NULL) {
3419 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3420 __location__, strerror(errno)));
3421 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3422 }
3423 } else {
3424 remaddr = "0.0.0.0";
3425 }
3426
3427 /* this is needed so that we get decent entries
3428 in smbstatus for port 445 connects */
3429 set_remote_machine_name(remaddr, false);
3430 reload_services(sconn, conn_snum_used, true);
3431
3432 /*
3433 * Before the first packet, check the global hosts allow/ hosts deny
3434 * parameters before doing any parsing of packets passed to us by the
3435 * client. This prevents attacks on our parsing code from hosts not in
3436 * the hosts allow list.
3437 */
3438
3439 ret = get_remote_hostname(remote_address,
3440 &rhost,
3441 talloc_tos());
3442 if (ret < 0) {
3443 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3444 __location__, strerror(errno)));
3445 exit_server_cleanly("get_remote_hostname failed.\n");
3446 }
3447 if (strequal(rhost, "UNKNOWN")) {
3448 rhost = talloc_strdup(talloc_tos(), remaddr);
3449 }
3450 sconn->remote_hostname = talloc_move(sconn, &rhost);
3451
3452 sub_set_socket_ids(remaddr,
3453 sconn->remote_hostname,
3454 locaddr);
3455
3456 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3457 sconn->remote_hostname,
3458 remaddr)) {
3459 /*
3460 * send a negative session response "not listening on calling
3461 * name"
3462 */
3463 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3464 DEBUG( 1, ("Connection denied from %s to %s\n",
3465 tsocket_address_string(remote_address, talloc_tos()),
3466 tsocket_address_string(local_address, talloc_tos())));
3467 (void)srv_send_smb(sconn,(char *)buf, false,
3468 0, false, NULL);
3469 exit_server_cleanly("connection denied");
3470 }
3471
3472 DEBUG(10, ("Connection allowed from %s to %s\n",
3473 tsocket_address_string(remote_address, talloc_tos()),
3474 tsocket_address_string(local_address, talloc_tos())));
3475
3476 if (lp_preload_modules()) {
3477 smb_load_modules(lp_preload_modules());
3478 }
3479
3480 smb_perfcount_init();
3481
3482 if (!init_account_policy()) {
3483 exit_server("Could not open account policy tdb.\n");
3484 }
3485
3486 if (*lp_rootdir(talloc_tos())) {
3487 if (chroot(lp_rootdir(talloc_tos())) != 0) {
3488 DEBUG(0,("Failed to change root to %s\n",
3489 lp_rootdir(talloc_tos())));
3490 exit_server("Failed to chroot()");
3491 }
3492 if (chdir("/") == -1) {
3493 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir(talloc_tos())));
3494 exit_server("Failed to chroot()");
3495 }
3496 DEBUG(0,("Changed root to %s\n", lp_rootdir(talloc_tos())));
3497 }
3498
3499 if (!srv_init_signing(sconn)) {
3500 exit_server("Failed to init smb_signing");
3501 }
3502
3503 if (!file_init(sconn)) {
3504 exit_server("file_init() failed");
3505 }
3506
3507 /* Setup oplocks */
3508 if (!init_oplocks(sconn))
3509 exit_server("Failed to init oplocks");
3510
3511 /* register our message handlers */
3512 messaging_register(sconn->msg_ctx, sconn,
3513 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3514 messaging_register(sconn->msg_ctx, sconn,
3515 MSG_SMB_CLOSE_FILE, msg_close_file);
3516 messaging_register(sconn->msg_ctx, sconn,
3517 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3518
3519 id_cache_register_msgs(sconn->msg_ctx);
3520 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3521 messaging_register(sconn->msg_ctx, sconn,
3522 ID_CACHE_KILL, smbd_id_cache_kill);
3523
3524 messaging_deregister(sconn->msg_ctx,
3525 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3526 messaging_register(sconn->msg_ctx, sconn,
3527 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3528
3529 /*
3530 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3531 * MSGs to all child processes
3532 */
3533 messaging_deregister(sconn->msg_ctx,
3534 MSG_DEBUG, NULL);
3535 messaging_register(sconn->msg_ctx, NULL,
3536 MSG_DEBUG, debug_message);
3537
3538 if ((lp_keepalive() != 0)
3539 && !(event_add_idle(ev_ctx, NULL,
3540 timeval_set(lp_keepalive(), 0),
3541 "keepalive", keepalive_fn,
3542 sconn))) {
3543 DEBUG(0, ("Could not add keepalive event\n"));
3544 exit(1);
3545 }
3546
3547 if (!(event_add_idle(ev_ctx, NULL,
3548 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3549 "deadtime", deadtime_fn, sconn))) {
3550 DEBUG(0, ("Could not add deadtime event\n"));
3551 exit(1);
3552 }
3553
3554 if (!(event_add_idle(ev_ctx, NULL,
3555 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3556 "housekeeping", housekeeping_fn, sconn))) {
3557 DEBUG(0, ("Could not add housekeeping event\n"));
3558 exit(1);
3559 }
3560
3561 #ifdef CLUSTER_SUPPORT
3562
3563 if (lp_clustering()) {
3564 /*
3565 * We need to tell ctdb about our client's TCP
3566 * connection, so that for failover ctdbd can send
3567 * tickle acks, triggering a reconnection by the
3568 * client.
3569 */
3570
3571 struct sockaddr_storage srv, clnt;
3572
3573 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3574 NTSTATUS status;
3575 status = smbd_register_ips(sconn, &srv, &clnt);
3576 if (!NT_STATUS_IS_OK(status)) {
3577 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3578 nt_errstr(status)));
3579 }
3580 } else
3581 {
3582 DEBUG(0,("Unable to get tcp info for "
3583 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3584 strerror(errno)));
3585 }
3586 }
3587
3588 #endif
3589
3590 sconn->nbt.got_session = false;
3591
3592 sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
3593
3594 sconn->smb1.sessions.done_sesssetup = false;
3595 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3596 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3597
3598 if (!init_dptrs(sconn)) {
3599 exit_server("init_dptrs() failed");
3600 }
3601
3602 sconn->smb1.fde = tevent_add_fd(ev_ctx,
3603 sconn,
3604 sconn->sock,
3605 TEVENT_FD_READ,
3606 smbd_server_connection_handler,
3607 sconn);
3608 if (!sconn->smb1.fde) {
3609 exit_server("failed to create smbd_server_connection fde");
3610 }
3611
3612 sconn->conn->local_address = sconn->local_address;
3613 sconn->conn->remote_address = sconn->remote_address;
3614 sconn->conn->remote_hostname = sconn->remote_hostname;
3615 sconn->conn->protocol = PROTOCOL_NONE;
3616
3617 TALLOC_FREE(frame);
3618
3619 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3620
3621 while (True) {
3622 frame = talloc_stackframe_pool(8192);
3623
3624 errno = 0;
3625 if (tevent_loop_once(ev_ctx) == -1) {
3626 if (errno != EINTR) {
3627 DEBUG(3, ("tevent_loop_once failed: %s,"
3628 " exiting\n", strerror(errno) ));
3629 break;
3630 }
3631 }
3632
3633 TALLOC_FREE(frame);
3634 }
3635
3636 exit_server_cleanly(NULL);
3637 }
3638
3639 bool req_is_in_chain(const struct smb_request *req)
3640 {
3641 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3642 /*
3643 * We're right now handling a subsequent request, so we must
3644 * be in a chain
3645 */
3646 return true;
3647 }
3648
3649 if (!is_andx_req(req->cmd)) {
3650 return false;
3651 }
3652
3653 if (req->wct < 2) {
3654 /*
3655 * Okay, an illegal request, but definitely not chained :-)
3656 */
3657 return false;
3658 }
3659
3660 return (CVAL(req->vwv+0, 0) != 0xFF);
3661 }
Samba GIT mirror