?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2_server: pass smbXsrv_connection to smbd_smb2_first_negprot()
[Samba.git] / source3 / smbd / process.c
blobb970f00b9d3385822bc546b36ac04898d5ca6e4b
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39 #include "../libcli/security/dom_sid.h"
40 #include "../libcli/security/security_token.h"
41 #include "lib/id_cache.h"
42 #include "serverid.h"
43 #include "system/threads.h"
44
45 /* Internal message queue for deferred opens. */
46 struct pending_message_list {
47 struct pending_message_list *next, *prev;
48 struct timeval request_time; /* When was this first issued? */
49 struct smbd_server_connection *sconn;
50 struct smbXsrv_connection *xconn;
51 struct tevent_timer *te;
52 struct smb_perfcount_data pcd;
53 uint32_t seqnum;
54 bool encrypted;
55 bool processed;
56 DATA_BLOB buf;
57 struct deferred_open_record *open_rec;
58 };
59
60 static void construct_reply_common(struct smb_request *req, const char *inbuf,
61 char *outbuf);
62 static struct pending_message_list *get_deferred_open_message_smb(
63 struct smbd_server_connection *sconn, uint64_t mid);
64 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
65
66 static void smbd_echo_init(struct smbXsrv_connection *xconn)
67 {
68 xconn->smb1.echo_handler.trusted_fd = -1;
69 xconn->smb1.echo_handler.socket_lock_fd = -1;
70 #ifdef HAVE_ROBUST_MUTEXES
71 xconn->smb1.echo_handler.socket_mutex = NULL;
72 #endif
73 }
74
75 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
76 {
77 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
78 return true;
79 }
80
81 #ifdef HAVE_ROBUST_MUTEXES
82 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
83 return true;
84 }
85 #endif
86
87 return false;
88 }
89
90 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
91 {
92 struct smbXsrv_connection *xconn = sconn->conn;
93
94 if (!smbd_echo_active(xconn)) {
95 return true;
96 }
97
98 xconn->smb1.echo_handler.ref_count++;
99
100 if (xconn->smb1.echo_handler.ref_count > 1) {
101 return true;
102 }
103
104 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
105
106 #ifdef HAVE_ROBUST_MUTEXES
107 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
108 int ret = EINTR;
109
110 while (ret == EINTR) {
111 ret = pthread_mutex_lock(
112 xconn->smb1.echo_handler.socket_mutex);
113 if (ret == 0) {
114 break;
115 }
116 }
117 if (ret != 0) {
118 DEBUG(1, ("pthread_mutex_lock failed: %s\n",
119 strerror(ret)));
120 return false;
121 }
122 }
123 #endif
124
125 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
126 bool ok;
127
128 do {
129 ok = fcntl_lock(
130 xconn->smb1.echo_handler.socket_lock_fd,
131 F_SETLKW, 0, 0, F_WRLCK);
132 } while (!ok && (errno == EINTR));
133
134 if (!ok) {
135 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
136 return false;
137 }
138 }
139
140 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
141
142 return true;
143 }
144
145 void smbd_lock_socket(struct smbd_server_connection *sconn)
146 {
147 if (!smbd_lock_socket_internal(sconn)) {
148 exit_server_cleanly("failed to lock socket");
149 }
150 }
151
152 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
153 {
154 struct smbXsrv_connection *xconn = sconn->conn;
155
156 if (!smbd_echo_active(xconn)) {
157 return true;
158 }
159
160 xconn->smb1.echo_handler.ref_count--;
161
162 if (xconn->smb1.echo_handler.ref_count > 0) {
163 return true;
164 }
165
166 #ifdef HAVE_ROBUST_MUTEXES
167 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
168 int ret = EINTR;
169
170 while (ret == EINTR) {
171 ret = pthread_mutex_unlock(
172 xconn->smb1.echo_handler.socket_mutex);
173 if (ret == 0) {
174 break;
175 }
176 }
177 if (ret != 0) {
178 DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
179 strerror(ret)));
180 return false;
181 }
182 }
183 #endif
184
185 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
186 bool ok;
187
188 do {
189 ok = fcntl_lock(
190 xconn->smb1.echo_handler.socket_lock_fd,
191 F_SETLKW, 0, 0, F_UNLCK);
192 } while (!ok && (errno == EINTR));
193
194 if (!ok) {
195 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
196 return false;
197 }
198 }
199
200 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
201
202 return true;
203 }
204
205 void smbd_unlock_socket(struct smbd_server_connection *sconn)
206 {
207 if (!smbd_unlock_socket_internal(sconn)) {
208 exit_server_cleanly("failed to unlock socket");
209 }
210 }
211
212 /* Accessor function for smb_read_error for smbd functions. */
213
214 /****************************************************************************
215 Send an smb to a fd.
216 ****************************************************************************/
217
218 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
219 bool do_signing, uint32_t seqnum,
220 bool do_encrypt,
221 struct smb_perfcount_data *pcd)
222 {
223 struct smbXsrv_connection *xconn = sconn->conn;
224 size_t len = 0;
225 ssize_t ret;
226 char *buf_out = buffer;
227
228 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
229 /*
230 * we're not supposed to do any io
231 */
232 return true;
233 }
234
235 smbd_lock_socket(sconn);
236
237 if (do_signing) {
238 /* Sign the outgoing packet if required. */
239 srv_calculate_sign_mac(xconn, buf_out, seqnum);
240 }
241
242 if (do_encrypt) {
243 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
244 if (!NT_STATUS_IS_OK(status)) {
245 DEBUG(0, ("send_smb: SMB encryption failed "
246 "on outgoing packet! Error %s\n",
247 nt_errstr(status) ));
248 ret = -1;
249 goto out;
250 }
251 }
252
253 len = smb_len_large(buf_out) + 4;
254
255 ret = write_data(xconn->transport.sock, buf_out, len);
256 if (ret <= 0) {
257 int saved_errno = errno;
258 /*
259 * Try and give an error message saying what
260 * client failed.
261 */
262 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
263 (int)getpid(), (int)len,
264 smbXsrv_connection_dbg(xconn),
265 (int)ret, strerror(saved_errno)));
266 errno = saved_errno;
267
268 srv_free_enc_buffer(sconn, buf_out);
269 goto out;
270 }
271
272 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
273 srv_free_enc_buffer(sconn, buf_out);
274 out:
275 SMB_PERFCOUNT_END(pcd);
276
277 smbd_unlock_socket(sconn);
278 return (ret > 0);
279 }
280
281 /*******************************************************************
282 Setup the word count and byte count for a smb message.
283 ********************************************************************/
284
285 int srv_set_message(char *buf,
286 int num_words,
287 int num_bytes,
288 bool zero)
289 {
290 if (zero && (num_words || num_bytes)) {
291 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
292 }
293 SCVAL(buf,smb_wct,num_words);
294 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
295 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
296 return (smb_size + num_words*2 + num_bytes);
297 }
298
299 static bool valid_smb_header(struct smbd_server_connection *sconn,
300 const uint8_t *inbuf)
301 {
302 if (is_encrypted_packet(sconn, inbuf)) {
303 return true;
304 }
305 /*
306 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
307 * but it just looks weird to call strncmp for this one.
308 */
309 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
310 }
311
312 /* Socket functions for smbd packet processing. */
313
314 static bool valid_packet_size(size_t len)
315 {
316 /*
317 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
318 * of header. Don't print the error if this fits.... JRA.
319 */
320
321 if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
322 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
323 (unsigned long)len));
324 return false;
325 }
326 return true;
327 }
328
329 static NTSTATUS read_packet_remainder(int fd, char *buffer,
330 unsigned int timeout, ssize_t len)
331 {
332 NTSTATUS status;
333
334 if (len <= 0) {
335 return NT_STATUS_OK;
336 }
337
338 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
339 if (!NT_STATUS_IS_OK(status)) {
340 char addr[INET6_ADDRSTRLEN];
341 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
342 "error = %s.\n",
343 get_peer_addr(fd, addr, sizeof(addr)),
344 nt_errstr(status)));
345 }
346 return status;
347 }
348
349 /****************************************************************************
350 Attempt a zerocopy writeX read. We know here that len > smb_size-4
351 ****************************************************************************/
352
353 /*
354 * Unfortunately, earlier versions of smbclient/libsmbclient
355 * don't send this "standard" writeX header. I've fixed this
356 * for 3.2 but we'll use the old method with earlier versions.
357 * Windows and CIFSFS at least use this standard size. Not
358 * sure about MacOSX.
359 */
360
361 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
362 (2*14) + /* word count (including bcc) */ \
363 1 /* pad byte */)
364
365 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
366 const char lenbuf[4],
367 struct smbd_server_connection *sconn,
368 int sock,
369 char **buffer,
370 unsigned int timeout,
371 size_t *p_unread,
372 size_t *len_ret)
373 {
374 /* Size of a WRITEX call (+4 byte len). */
375 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
376 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
377 ssize_t toread;
378 NTSTATUS status;
379
380 memcpy(writeX_header, lenbuf, 4);
381
382 status = read_fd_with_timeout(
383 sock, writeX_header + 4,
384 STANDARD_WRITE_AND_X_HEADER_SIZE,
385 STANDARD_WRITE_AND_X_HEADER_SIZE,
386 timeout, NULL);
387
388 if (!NT_STATUS_IS_OK(status)) {
389 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
390 "error = %s.\n",
391 tsocket_address_string(sconn->remote_address,
392 talloc_tos()),
393 nt_errstr(status)));
394 return status;
395 }
396
397 /*
398 * Ok - now try and see if this is a possible
399 * valid writeX call.
400 */
401
402 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
403 /*
404 * If the data offset is beyond what
405 * we've read, drain the extra bytes.
406 */
407 uint16_t doff = SVAL(writeX_header,smb_vwv11);
408 ssize_t newlen;
409
410 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
411 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
412 if (drain_socket(sock, drain) != drain) {
413 smb_panic("receive_smb_raw_talloc_partial_read:"
414 " failed to drain pending bytes");
415 }
416 } else {
417 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
418 }
419
420 /* Spoof down the length and null out the bcc. */
421 set_message_bcc(writeX_header, 0);
422 newlen = smb_len(writeX_header);
423
424 /* Copy the header we've written. */
425
426 *buffer = (char *)talloc_memdup(mem_ctx,
427 writeX_header,
428 sizeof(writeX_header));
429
430 if (*buffer == NULL) {
431 DEBUG(0, ("Could not allocate inbuf of length %d\n",
432 (int)sizeof(writeX_header)));
433 return NT_STATUS_NO_MEMORY;
434 }
435
436 /* Work out the remaining bytes. */
437 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
438 *len_ret = newlen + 4;
439 return NT_STATUS_OK;
440 }
441
442 if (!valid_packet_size(len)) {
443 return NT_STATUS_INVALID_PARAMETER;
444 }
445
446 /*
447 * Not a valid writeX call. Just do the standard
448 * talloc and return.
449 */
450
451 *buffer = talloc_array(mem_ctx, char, len+4);
452
453 if (*buffer == NULL) {
454 DEBUG(0, ("Could not allocate inbuf of length %d\n",
455 (int)len+4));
456 return NT_STATUS_NO_MEMORY;
457 }
458
459 /* Copy in what we already read. */
460 memcpy(*buffer,
461 writeX_header,
462 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
463 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
464
465 if(toread > 0) {
466 status = read_packet_remainder(
467 sock,
468 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
469 timeout, toread);
470
471 if (!NT_STATUS_IS_OK(status)) {
472 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
473 nt_errstr(status)));
474 return status;
475 }
476 }
477
478 *len_ret = len + 4;
479 return NT_STATUS_OK;
480 }
481
482 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
483 struct smbd_server_connection *sconn,
484 int sock,
485 char **buffer, unsigned int timeout,
486 size_t *p_unread, size_t *plen)
487 {
488 struct smbXsrv_connection *xconn = sconn->conn;
489 char lenbuf[4];
490 size_t len;
491 int min_recv_size = lp_min_receive_file_size();
492 NTSTATUS status;
493
494 *p_unread = 0;
495
496 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
497 &len);
498 if (!NT_STATUS_IS_OK(status)) {
499 return status;
500 }
501
502 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
503 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
504 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
505 !srv_is_signing_active(xconn) &&
506 xconn->smb1.echo_handler.trusted_fde == NULL) {
507
508 return receive_smb_raw_talloc_partial_read(
509 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
510 p_unread, plen);
511 }
512
513 if (!valid_packet_size(len)) {
514 return NT_STATUS_INVALID_PARAMETER;
515 }
516
517 /*
518 * The +4 here can't wrap, we've checked the length above already.
519 */
520
521 *buffer = talloc_array(mem_ctx, char, len+4);
522
523 if (*buffer == NULL) {
524 DEBUG(0, ("Could not allocate inbuf of length %d\n",
525 (int)len+4));
526 return NT_STATUS_NO_MEMORY;
527 }
528
529 memcpy(*buffer, lenbuf, sizeof(lenbuf));
530
531 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
532 if (!NT_STATUS_IS_OK(status)) {
533 return status;
534 }
535
536 *plen = len + 4;
537 return NT_STATUS_OK;
538 }
539
540 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
541 struct smbd_server_connection *sconn,
542 int sock,
543 char **buffer, unsigned int timeout,
544 size_t *p_unread, bool *p_encrypted,
545 size_t *p_len,
546 uint32_t *seqnum,
547 bool trusted_channel)
548 {
549 struct smbXsrv_connection *xconn = sconn->conn;
550 size_t len = 0;
551 NTSTATUS status;
552
553 *p_encrypted = false;
554
555 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
556 p_unread, &len);
557 if (!NT_STATUS_IS_OK(status)) {
558 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
559 ("receive_smb_raw_talloc failed for client %s "
560 "read error = %s.\n",
561 tsocket_address_string(sconn->remote_address,
562 talloc_tos()),
563 nt_errstr(status)) );
564 return status;
565 }
566
567 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
568 status = srv_decrypt_buffer(sconn, *buffer);
569 if (!NT_STATUS_IS_OK(status)) {
570 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
571 "incoming packet! Error %s\n",
572 nt_errstr(status) ));
573 return status;
574 }
575 *p_encrypted = true;
576 }
577
578 /* Check the incoming SMB signature. */
579 if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
580 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
581 "incoming packet!\n"));
582 return NT_STATUS_INVALID_NETWORK_RESPONSE;
583 }
584
585 *p_len = len;
586 return NT_STATUS_OK;
587 }
588
589 /*
590 * Initialize a struct smb_request from an inbuf
591 */
592
593 static bool init_smb_request(struct smb_request *req,
594 struct smbd_server_connection *sconn,
595 struct smbXsrv_connection *xconn,
596 const uint8 *inbuf,
597 size_t unread_bytes, bool encrypted,
598 uint32_t seqnum)
599 {
600 struct smbXsrv_tcon *tcon;
601 NTSTATUS status;
602 NTTIME now;
603 size_t req_size = smb_len(inbuf) + 4;
604
605 /* Ensure we have at least smb_size bytes. */
606 if (req_size < smb_size) {
607 DEBUG(0,("init_smb_request: invalid request size %u\n",
608 (unsigned int)req_size ));
609 return false;
610 }
611
612 req->request_time = timeval_current();
613 now = timeval_to_nttime(&req->request_time);
614
615 req->cmd = CVAL(inbuf, smb_com);
616 req->flags2 = SVAL(inbuf, smb_flg2);
617 req->smbpid = SVAL(inbuf, smb_pid);
618 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
619 req->seqnum = seqnum;
620 req->vuid = SVAL(inbuf, smb_uid);
621 req->tid = SVAL(inbuf, smb_tid);
622 req->wct = CVAL(inbuf, smb_wct);
623 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
624 req->buflen = smb_buflen(inbuf);
625 req->buf = (const uint8_t *)smb_buf_const(inbuf);
626 req->unread_bytes = unread_bytes;
627 req->encrypted = encrypted;
628 req->sconn = sconn;
629 req->xconn = xconn;
630 status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
631 if (NT_STATUS_IS_OK(status)) {
632 req->conn = tcon->compat;
633 } else {
634 req->conn = NULL;
635 }
636 req->chain_fsp = NULL;
637 req->smb2req = NULL;
638 req->priv_paths = NULL;
639 req->chain = NULL;
640 smb_init_perfcount_data(&req->pcd);
641
642 /* Ensure we have at least wct words and 2 bytes of bcc. */
643 if (smb_size + req->wct*2 > req_size) {
644 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
645 (unsigned int)req->wct,
646 (unsigned int)req_size));
647 return false;
648 }
649 /* Ensure bcc is correct. */
650 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
651 DEBUG(0,("init_smb_request: invalid bcc number %u "
652 "(wct = %u, size %u)\n",
653 (unsigned int)req->buflen,
654 (unsigned int)req->wct,
655 (unsigned int)req_size));
656 return false;
657 }
658
659 req->outbuf = NULL;
660 return true;
661 }
662
663 static void process_smb(struct smbXsrv_connection *xconn,
664 uint8_t *inbuf, size_t nread, size_t unread_bytes,
665 uint32_t seqnum, bool encrypted,
666 struct smb_perfcount_data *deferred_pcd);
667
668 static void smbd_deferred_open_timer(struct tevent_context *ev,
669 struct tevent_timer *te,
670 struct timeval _tval,
671 void *private_data)
672 {
673 struct pending_message_list *msg = talloc_get_type(private_data,
674 struct pending_message_list);
675 struct smbd_server_connection *sconn = msg->sconn;
676 struct smbXsrv_connection *xconn = msg->xconn;
677 TALLOC_CTX *mem_ctx = talloc_tos();
678 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
679 uint8_t *inbuf;
680
681 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
682 msg->buf.length);
683 if (inbuf == NULL) {
684 exit_server("smbd_deferred_open_timer: talloc failed\n");
685 return;
686 }
687
688 /* We leave this message on the queue so the open code can
689 know this is a retry. */
690 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
691 (unsigned long long)mid ));
692
693 /* Mark the message as processed so this is not
694 * re-processed in error. */
695 msg->processed = true;
696
697 process_smb(xconn, inbuf,
698 msg->buf.length, 0,
699 msg->seqnum, msg->encrypted, &msg->pcd);
700
701 /* If it's still there and was processed, remove it. */
702 msg = get_deferred_open_message_smb(sconn, mid);
703 if (msg && msg->processed) {
704 remove_deferred_open_message_smb(sconn, mid);
705 }
706 }
707
708 /****************************************************************************
709 Function to push a message onto the tail of a linked list of smb messages ready
710 for processing.
711 ****************************************************************************/
712
713 static bool push_queued_message(struct smb_request *req,
714 struct timeval request_time,
715 struct timeval end_time,
716 struct deferred_open_record *open_rec)
717 {
718 int msg_len = smb_len(req->inbuf) + 4;
719 struct pending_message_list *msg;
720
721 msg = talloc_zero(NULL, struct pending_message_list);
722
723 if(msg == NULL) {
724 DEBUG(0,("push_message: malloc fail (1)\n"));
725 return False;
726 }
727 msg->sconn = req->sconn;
728 msg->xconn = req->xconn;
729
730 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
731 if(msg->buf.data == NULL) {
732 DEBUG(0,("push_message: malloc fail (2)\n"));
733 TALLOC_FREE(msg);
734 return False;
735 }
736
737 msg->request_time = request_time;
738 msg->seqnum = req->seqnum;
739 msg->encrypted = req->encrypted;
740 msg->processed = false;
741 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
742
743 if (open_rec) {
744 msg->open_rec = talloc_move(msg, &open_rec);
745 }
746
747 #if 0
748 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
749 msg,
750 end_time,
751 smbd_deferred_open_timer,
752 msg);
753 if (!msg->te) {
754 DEBUG(0,("push_message: event_add_timed failed\n"));
755 TALLOC_FREE(msg);
756 return false;
757 }
758 #endif
759
760 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
761 struct pending_message_list *);
762
763 DEBUG(10,("push_message: pushed message length %u on "
764 "deferred_open_queue\n", (unsigned int)msg_len));
765
766 return True;
767 }
768
769 /****************************************************************************
770 Function to delete a sharing violation open message by mid.
771 ****************************************************************************/
772
773 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
774 uint64_t mid)
775 {
776 struct pending_message_list *pml;
777
778 if (sconn->using_smb2) {
779 remove_deferred_open_message_smb2(sconn, mid);
780 return;
781 }
782
783 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
784 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
785 DEBUG(10,("remove_deferred_open_message_smb: "
786 "deleting mid %llu len %u\n",
787 (unsigned long long)mid,
788 (unsigned int)pml->buf.length ));
789 DLIST_REMOVE(sconn->deferred_open_queue, pml);
790 TALLOC_FREE(pml);
791 return;
792 }
793 }
794 }
795
796 /****************************************************************************
797 Move a sharing violation open retry message to the front of the list and
798 schedule it for immediate processing.
799 ****************************************************************************/
800
801 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
802 uint64_t mid)
803 {
804 struct pending_message_list *pml;
805 int i = 0;
806
807 if (sconn->using_smb2) {
808 return schedule_deferred_open_message_smb2(sconn, mid);
809 }
810
811 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
812 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
813
814 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
815 "msg_mid = %llu\n",
816 i++,
817 (unsigned long long)msg_mid ));
818
819 if (mid == msg_mid) {
820 struct tevent_timer *te;
821
822 if (pml->processed) {
823 /* A processed message should not be
824 * rescheduled. */
825 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
826 "message mid %llu was already processed\n",
827 (unsigned long long)msg_mid ));
828 continue;
829 }
830
831 DEBUG(10,("schedule_deferred_open_message_smb: "
832 "scheduling mid %llu\n",
833 (unsigned long long)mid ));
834
835 te = tevent_add_timer(pml->sconn->ev_ctx,
836 pml,
837 timeval_zero(),
838 smbd_deferred_open_timer,
839 pml);
840 if (!te) {
841 DEBUG(10,("schedule_deferred_open_message_smb: "
842 "event_add_timed() failed, "
843 "skipping mid %llu\n",
844 (unsigned long long)msg_mid ));
845 }
846
847 TALLOC_FREE(pml->te);
848 pml->te = te;
849 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
850 return true;
851 }
852 }
853
854 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
855 "find message mid %llu\n",
856 (unsigned long long)mid ));
857
858 return false;
859 }
860
861 /****************************************************************************
862 Return true if this mid is on the deferred queue and was not yet processed.
863 ****************************************************************************/
864
865 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
866 {
867 struct pending_message_list *pml;
868
869 if (sconn->using_smb2) {
870 return open_was_deferred_smb2(sconn, mid);
871 }
872
873 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
874 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
875 return True;
876 }
877 }
878 return False;
879 }
880
881 /****************************************************************************
882 Return the message queued by this mid.
883 ****************************************************************************/
884
885 static struct pending_message_list *get_deferred_open_message_smb(
886 struct smbd_server_connection *sconn, uint64_t mid)
887 {
888 struct pending_message_list *pml;
889
890 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
891 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
892 return pml;
893 }
894 }
895 return NULL;
896 }
897
898 /****************************************************************************
899 Get the state data queued by this mid.
900 ****************************************************************************/
901
902 bool get_deferred_open_message_state(struct smb_request *smbreq,
903 struct timeval *p_request_time,
904 struct deferred_open_record **open_rec)
905 {
906 struct pending_message_list *pml;
907
908 if (smbreq->sconn->using_smb2) {
909 return get_deferred_open_message_state_smb2(smbreq->smb2req,
910 p_request_time,
911 open_rec);
912 }
913
914 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
915 if (!pml) {
916 return false;
917 }
918 if (p_request_time) {
919 *p_request_time = pml->request_time;
920 }
921 if (open_rec != NULL) {
922 *open_rec = pml->open_rec;
923 }
924 return true;
925 }
926
927 /****************************************************************************
928 Function to push a deferred open smb message onto a linked list of local smb
929 messages ready for processing.
930 ****************************************************************************/
931
932 bool push_deferred_open_message_smb(struct smb_request *req,
933 struct timeval request_time,
934 struct timeval timeout,
935 struct file_id id,
936 struct deferred_open_record *open_rec)
937 {
938 struct timeval end_time;
939
940 if (req->smb2req) {
941 return push_deferred_open_message_smb2(req->smb2req,
942 request_time,
943 timeout,
944 id,
945 open_rec);
946 }
947
948 if (req->unread_bytes) {
949 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
950 "unread_bytes = %u\n",
951 (unsigned int)req->unread_bytes ));
952 smb_panic("push_deferred_open_message_smb: "
953 "logic error unread_bytes != 0" );
954 }
955
956 end_time = timeval_sum(&request_time, &timeout);
957
958 DEBUG(10,("push_deferred_open_message_smb: pushing message "
959 "len %u mid %llu timeout time [%u.%06u]\n",
960 (unsigned int) smb_len(req->inbuf)+4,
961 (unsigned long long)req->mid,
962 (unsigned int)end_time.tv_sec,
963 (unsigned int)end_time.tv_usec));
964
965 return push_queued_message(req, request_time, end_time, open_rec);
966 }
967
968 static void smbd_sig_term_handler(struct tevent_context *ev,
969 struct tevent_signal *se,
970 int signum,
971 int count,
972 void *siginfo,
973 void *private_data)
974 {
975 exit_server_cleanly("termination signal");
976 }
977
978 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
979 {
980 struct tevent_signal *se;
981
982 se = tevent_add_signal(sconn->ev_ctx,
983 sconn,
984 SIGTERM, 0,
985 smbd_sig_term_handler,
986 sconn);
987 if (!se) {
988 exit_server("failed to setup SIGTERM handler");
989 }
990 }
991
992 static void smbd_sig_hup_handler(struct tevent_context *ev,
993 struct tevent_signal *se,
994 int signum,
995 int count,
996 void *siginfo,
997 void *private_data)
998 {
999 struct smbd_server_connection *sconn =
1000 talloc_get_type_abort(private_data,
1001 struct smbd_server_connection);
1002
1003 change_to_root_user();
1004 DEBUG(1,("Reloading services after SIGHUP\n"));
1005 reload_services(sconn, conn_snum_used, false);
1006 }
1007
1008 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1009 {
1010 struct tevent_signal *se;
1011
1012 se = tevent_add_signal(sconn->ev_ctx,
1013 sconn,
1014 SIGHUP, 0,
1015 smbd_sig_hup_handler,
1016 sconn);
1017 if (!se) {
1018 exit_server("failed to setup SIGHUP handler");
1019 }
1020 }
1021
1022 static void smbd_conf_updated(struct messaging_context *msg,
1023 void *private_data,
1024 uint32_t msg_type,
1025 struct server_id server_id,
1026 DATA_BLOB *data)
1027 {
1028 struct smbd_server_connection *sconn =
1029 talloc_get_type_abort(private_data,
1030 struct smbd_server_connection);
1031
1032 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1033 "updated. Reloading.\n"));
1034 change_to_root_user();
1035 reload_services(sconn, conn_snum_used, false);
1036 }
1037
1038 /*
1039 * Only allow 5 outstanding trans requests. We're allocating memory, so
1040 * prevent a DoS.
1041 */
1042
1043 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1044 {
1045 int count = 0;
1046 for (; list != NULL; list = list->next) {
1047
1048 if (list->mid == mid) {
1049 return NT_STATUS_INVALID_PARAMETER;
1050 }
1051
1052 count += 1;
1053 }
1054 if (count > 5) {
1055 return NT_STATUS_INSUFFICIENT_RESOURCES;
1056 }
1057
1058 return NT_STATUS_OK;
1059 }
1060
1061 /*
1062 These flags determine some of the permissions required to do an operation
1063
1064 Note that I don't set NEED_WRITE on some write operations because they
1065 are used by some brain-dead clients when printing, and I don't want to
1066 force write permissions on print services.
1067 */
1068 #define AS_USER (1<<0)
1069 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1070 #define TIME_INIT (1<<2)
1071 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1072 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1073 #define DO_CHDIR (1<<6)
1074
1075 /*
1076 define a list of possible SMB messages and their corresponding
1077 functions. Any message that has a NULL function is unimplemented -
1078 please feel free to contribute implementations!
1079 */
1080 static const struct smb_message_struct {
1081 const char *name;
1082 void (*fn)(struct smb_request *req);
1083 int flags;
1084 } smb_messages[256] = {
1085
1086 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1087 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1088 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1089 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1090 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1091 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1092 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1093 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1094 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1095 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1096 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1097 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1098 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1099 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1100 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1101 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1102 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1103 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1104 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1105 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1106 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1107 /* 0x15 */ { NULL, NULL, 0 },
1108 /* 0x16 */ { NULL, NULL, 0 },
1109 /* 0x17 */ { NULL, NULL, 0 },
1110 /* 0x18 */ { NULL, NULL, 0 },
1111 /* 0x19 */ { NULL, NULL, 0 },
1112 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1113 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1114 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1115 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1116 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1117 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1118 /* 0x20 */ { "SMBwritec", NULL,0},
1119 /* 0x21 */ { NULL, NULL, 0 },
1120 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1121 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1122 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1123 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1124 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1125 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1126 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1127 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1128 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1129 /* 0x2b */ { "SMBecho",reply_echo,0},
1130 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1131 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1132 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1133 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1134 /* 0x30 */ { NULL, NULL, 0 },
1135 /* 0x31 */ { NULL, NULL, 0 },
1136 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1137 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1138 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1139 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1140 /* 0x36 */ { NULL, NULL, 0 },
1141 /* 0x37 */ { NULL, NULL, 0 },
1142 /* 0x38 */ { NULL, NULL, 0 },
1143 /* 0x39 */ { NULL, NULL, 0 },
1144 /* 0x3a */ { NULL, NULL, 0 },
1145 /* 0x3b */ { NULL, NULL, 0 },
1146 /* 0x3c */ { NULL, NULL, 0 },
1147 /* 0x3d */ { NULL, NULL, 0 },
1148 /* 0x3e */ { NULL, NULL, 0 },
1149 /* 0x3f */ { NULL, NULL, 0 },
1150 /* 0x40 */ { NULL, NULL, 0 },
1151 /* 0x41 */ { NULL, NULL, 0 },
1152 /* 0x42 */ { NULL, NULL, 0 },
1153 /* 0x43 */ { NULL, NULL, 0 },
1154 /* 0x44 */ { NULL, NULL, 0 },
1155 /* 0x45 */ { NULL, NULL, 0 },
1156 /* 0x46 */ { NULL, NULL, 0 },
1157 /* 0x47 */ { NULL, NULL, 0 },
1158 /* 0x48 */ { NULL, NULL, 0 },
1159 /* 0x49 */ { NULL, NULL, 0 },
1160 /* 0x4a */ { NULL, NULL, 0 },
1161 /* 0x4b */ { NULL, NULL, 0 },
1162 /* 0x4c */ { NULL, NULL, 0 },
1163 /* 0x4d */ { NULL, NULL, 0 },
1164 /* 0x4e */ { NULL, NULL, 0 },
1165 /* 0x4f */ { NULL, NULL, 0 },
1166 /* 0x50 */ { NULL, NULL, 0 },
1167 /* 0x51 */ { NULL, NULL, 0 },
1168 /* 0x52 */ { NULL, NULL, 0 },
1169 /* 0x53 */ { NULL, NULL, 0 },
1170 /* 0x54 */ { NULL, NULL, 0 },
1171 /* 0x55 */ { NULL, NULL, 0 },
1172 /* 0x56 */ { NULL, NULL, 0 },
1173 /* 0x57 */ { NULL, NULL, 0 },
1174 /* 0x58 */ { NULL, NULL, 0 },
1175 /* 0x59 */ { NULL, NULL, 0 },
1176 /* 0x5a */ { NULL, NULL, 0 },
1177 /* 0x5b */ { NULL, NULL, 0 },
1178 /* 0x5c */ { NULL, NULL, 0 },
1179 /* 0x5d */ { NULL, NULL, 0 },
1180 /* 0x5e */ { NULL, NULL, 0 },
1181 /* 0x5f */ { NULL, NULL, 0 },
1182 /* 0x60 */ { NULL, NULL, 0 },
1183 /* 0x61 */ { NULL, NULL, 0 },
1184 /* 0x62 */ { NULL, NULL, 0 },
1185 /* 0x63 */ { NULL, NULL, 0 },
1186 /* 0x64 */ { NULL, NULL, 0 },
1187 /* 0x65 */ { NULL, NULL, 0 },
1188 /* 0x66 */ { NULL, NULL, 0 },
1189 /* 0x67 */ { NULL, NULL, 0 },
1190 /* 0x68 */ { NULL, NULL, 0 },
1191 /* 0x69 */ { NULL, NULL, 0 },
1192 /* 0x6a */ { NULL, NULL, 0 },
1193 /* 0x6b */ { NULL, NULL, 0 },
1194 /* 0x6c */ { NULL, NULL, 0 },
1195 /* 0x6d */ { NULL, NULL, 0 },
1196 /* 0x6e */ { NULL, NULL, 0 },
1197 /* 0x6f */ { NULL, NULL, 0 },
1198 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1199 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1200 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1201 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1202 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1203 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1204 /* 0x76 */ { NULL, NULL, 0 },
1205 /* 0x77 */ { NULL, NULL, 0 },
1206 /* 0x78 */ { NULL, NULL, 0 },
1207 /* 0x79 */ { NULL, NULL, 0 },
1208 /* 0x7a */ { NULL, NULL, 0 },
1209 /* 0x7b */ { NULL, NULL, 0 },
1210 /* 0x7c */ { NULL, NULL, 0 },
1211 /* 0x7d */ { NULL, NULL, 0 },
1212 /* 0x7e */ { NULL, NULL, 0 },
1213 /* 0x7f */ { NULL, NULL, 0 },
1214 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1215 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1216 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1217 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1218 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1219 /* 0x85 */ { NULL, NULL, 0 },
1220 /* 0x86 */ { NULL, NULL, 0 },
1221 /* 0x87 */ { NULL, NULL, 0 },
1222 /* 0x88 */ { NULL, NULL, 0 },
1223 /* 0x89 */ { NULL, NULL, 0 },
1224 /* 0x8a */ { NULL, NULL, 0 },
1225 /* 0x8b */ { NULL, NULL, 0 },
1226 /* 0x8c */ { NULL, NULL, 0 },
1227 /* 0x8d */ { NULL, NULL, 0 },
1228 /* 0x8e */ { NULL, NULL, 0 },
1229 /* 0x8f */ { NULL, NULL, 0 },
1230 /* 0x90 */ { NULL, NULL, 0 },
1231 /* 0x91 */ { NULL, NULL, 0 },
1232 /* 0x92 */ { NULL, NULL, 0 },
1233 /* 0x93 */ { NULL, NULL, 0 },
1234 /* 0x94 */ { NULL, NULL, 0 },
1235 /* 0x95 */ { NULL, NULL, 0 },
1236 /* 0x96 */ { NULL, NULL, 0 },
1237 /* 0x97 */ { NULL, NULL, 0 },
1238 /* 0x98 */ { NULL, NULL, 0 },
1239 /* 0x99 */ { NULL, NULL, 0 },
1240 /* 0x9a */ { NULL, NULL, 0 },
1241 /* 0x9b */ { NULL, NULL, 0 },
1242 /* 0x9c */ { NULL, NULL, 0 },
1243 /* 0x9d */ { NULL, NULL, 0 },
1244 /* 0x9e */ { NULL, NULL, 0 },
1245 /* 0x9f */ { NULL, NULL, 0 },
1246 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1247 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1248 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1249 /* 0xa3 */ { NULL, NULL, 0 },
1250 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1251 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1252 /* 0xa6 */ { NULL, NULL, 0 },
1253 /* 0xa7 */ { NULL, NULL, 0 },
1254 /* 0xa8 */ { NULL, NULL, 0 },
1255 /* 0xa9 */ { NULL, NULL, 0 },
1256 /* 0xaa */ { NULL, NULL, 0 },
1257 /* 0xab */ { NULL, NULL, 0 },
1258 /* 0xac */ { NULL, NULL, 0 },
1259 /* 0xad */ { NULL, NULL, 0 },
1260 /* 0xae */ { NULL, NULL, 0 },
1261 /* 0xaf */ { NULL, NULL, 0 },
1262 /* 0xb0 */ { NULL, NULL, 0 },
1263 /* 0xb1 */ { NULL, NULL, 0 },
1264 /* 0xb2 */ { NULL, NULL, 0 },
1265 /* 0xb3 */ { NULL, NULL, 0 },
1266 /* 0xb4 */ { NULL, NULL, 0 },
1267 /* 0xb5 */ { NULL, NULL, 0 },
1268 /* 0xb6 */ { NULL, NULL, 0 },
1269 /* 0xb7 */ { NULL, NULL, 0 },
1270 /* 0xb8 */ { NULL, NULL, 0 },
1271 /* 0xb9 */ { NULL, NULL, 0 },
1272 /* 0xba */ { NULL, NULL, 0 },
1273 /* 0xbb */ { NULL, NULL, 0 },
1274 /* 0xbc */ { NULL, NULL, 0 },
1275 /* 0xbd */ { NULL, NULL, 0 },
1276 /* 0xbe */ { NULL, NULL, 0 },
1277 /* 0xbf */ { NULL, NULL, 0 },
1278 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1279 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1280 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1281 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1282 /* 0xc4 */ { NULL, NULL, 0 },
1283 /* 0xc5 */ { NULL, NULL, 0 },
1284 /* 0xc6 */ { NULL, NULL, 0 },
1285 /* 0xc7 */ { NULL, NULL, 0 },
1286 /* 0xc8 */ { NULL, NULL, 0 },
1287 /* 0xc9 */ { NULL, NULL, 0 },
1288 /* 0xca */ { NULL, NULL, 0 },
1289 /* 0xcb */ { NULL, NULL, 0 },
1290 /* 0xcc */ { NULL, NULL, 0 },
1291 /* 0xcd */ { NULL, NULL, 0 },
1292 /* 0xce */ { NULL, NULL, 0 },
1293 /* 0xcf */ { NULL, NULL, 0 },
1294 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1295 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1296 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1297 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1298 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1299 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1300 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1301 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1302 /* 0xd8 */ { NULL, NULL, 0 },
1303 /* 0xd9 */ { NULL, NULL, 0 },
1304 /* 0xda */ { NULL, NULL, 0 },
1305 /* 0xdb */ { NULL, NULL, 0 },
1306 /* 0xdc */ { NULL, NULL, 0 },
1307 /* 0xdd */ { NULL, NULL, 0 },
1308 /* 0xde */ { NULL, NULL, 0 },
1309 /* 0xdf */ { NULL, NULL, 0 },
1310 /* 0xe0 */ { NULL, NULL, 0 },
1311 /* 0xe1 */ { NULL, NULL, 0 },
1312 /* 0xe2 */ { NULL, NULL, 0 },
1313 /* 0xe3 */ { NULL, NULL, 0 },
1314 /* 0xe4 */ { NULL, NULL, 0 },
1315 /* 0xe5 */ { NULL, NULL, 0 },
1316 /* 0xe6 */ { NULL, NULL, 0 },
1317 /* 0xe7 */ { NULL, NULL, 0 },
1318 /* 0xe8 */ { NULL, NULL, 0 },
1319 /* 0xe9 */ { NULL, NULL, 0 },
1320 /* 0xea */ { NULL, NULL, 0 },
1321 /* 0xeb */ { NULL, NULL, 0 },
1322 /* 0xec */ { NULL, NULL, 0 },
1323 /* 0xed */ { NULL, NULL, 0 },
1324 /* 0xee */ { NULL, NULL, 0 },
1325 /* 0xef */ { NULL, NULL, 0 },
1326 /* 0xf0 */ { NULL, NULL, 0 },
1327 /* 0xf1 */ { NULL, NULL, 0 },
1328 /* 0xf2 */ { NULL, NULL, 0 },
1329 /* 0xf3 */ { NULL, NULL, 0 },
1330 /* 0xf4 */ { NULL, NULL, 0 },
1331 /* 0xf5 */ { NULL, NULL, 0 },
1332 /* 0xf6 */ { NULL, NULL, 0 },
1333 /* 0xf7 */ { NULL, NULL, 0 },
1334 /* 0xf8 */ { NULL, NULL, 0 },
1335 /* 0xf9 */ { NULL, NULL, 0 },
1336 /* 0xfa */ { NULL, NULL, 0 },
1337 /* 0xfb */ { NULL, NULL, 0 },
1338 /* 0xfc */ { NULL, NULL, 0 },
1339 /* 0xfd */ { NULL, NULL, 0 },
1340 /* 0xfe */ { NULL, NULL, 0 },
1341 /* 0xff */ { NULL, NULL, 0 }
1342
1343 };
1344
1345 /*******************************************************************
1346 allocate and initialize a reply packet
1347 ********************************************************************/
1348
1349 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1350 const char *inbuf, char **outbuf, uint8_t num_words,
1351 uint32_t num_bytes)
1352 {
1353 size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1354
1355 /*
1356 * Protect against integer wrap.
1357 * The SMB layer reply can be up to 0xFFFFFF bytes.
1358 */
1359 if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1360 char *msg;
1361 if (asprintf(&msg, "num_bytes too large: %u",
1362 (unsigned)num_bytes) == -1) {
1363 msg = discard_const_p(char, "num_bytes too large");
1364 }
1365 smb_panic(msg);
1366 }
1367
1368 /*
1369 * Here we include the NBT header for now.
1370 */
1371 *outbuf = talloc_array(mem_ctx, char,
1372 NBT_HDR_SIZE + smb_len);
1373 if (*outbuf == NULL) {
1374 return false;
1375 }
1376
1377 construct_reply_common(req, inbuf, *outbuf);
1378 srv_set_message(*outbuf, num_words, num_bytes, false);
1379 /*
1380 * Zero out the word area, the caller has to take care of the bcc area
1381 * himself
1382 */
1383 if (num_words != 0) {
1384 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1385 }
1386
1387 return true;
1388 }
1389
1390 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1391 {
1392 char *outbuf;
1393 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1394 num_bytes)) {
1395 smb_panic("could not allocate output buffer\n");
1396 }
1397 req->outbuf = (uint8_t *)outbuf;
1398 }
1399
1400
1401 /*******************************************************************
1402 Dump a packet to a file.
1403 ********************************************************************/
1404
1405 static void smb_dump(const char *name, int type, const char *data)
1406 {
1407 size_t len;
1408 int fd, i;
1409 char *fname = NULL;
1410 if (DEBUGLEVEL < 50) {
1411 return;
1412 }
1413
1414 len = smb_len_tcp(data)+4;
1415 for (i=1;i<100;i++) {
1416 fname = talloc_asprintf(talloc_tos(),
1417 "/tmp/%s.%d.%s",
1418 name,
1419 i,
1420 type ? "req" : "resp");
1421 if (fname == NULL) {
1422 return;
1423 }
1424 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1425 if (fd != -1 || errno != EEXIST) break;
1426 TALLOC_FREE(fname);
1427 }
1428 if (fd != -1) {
1429 ssize_t ret = write(fd, data, len);
1430 if (ret != len)
1431 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1432 close(fd);
1433 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1434 }
1435 TALLOC_FREE(fname);
1436 }
1437
1438 /****************************************************************************
1439 Prepare everything for calling the actual request function, and potentially
1440 call the request function via the "new" interface.
1441
1442 Return False if the "legacy" function needs to be called, everything is
1443 prepared.
1444
1445 Return True if we're done.
1446
1447 I know this API sucks, but it is the one with the least code change I could
1448 find.
1449 ****************************************************************************/
1450
1451 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1452 {
1453 int flags;
1454 uint64_t session_tag;
1455 connection_struct *conn = NULL;
1456 struct smbXsrv_connection *xconn = req->xconn;
1457 NTTIME now = timeval_to_nttime(&req->request_time);
1458 struct smbXsrv_session *session = NULL;
1459 NTSTATUS status;
1460
1461 errno = 0;
1462
1463 if (smb_messages[type].fn == NULL) {
1464 DEBUG(0,("Unknown message type %d!\n",type));
1465 smb_dump("Unknown", 1, (const char *)req->inbuf);
1466 reply_unknown_new(req, type);
1467 return NULL;
1468 }
1469
1470 flags = smb_messages[type].flags;
1471
1472 /* In share mode security we must ignore the vuid. */
1473 session_tag = req->vuid;
1474 conn = req->conn;
1475
1476 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1477 (int)getpid(), (unsigned long)conn));
1478
1479 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1480
1481 /* Ensure this value is replaced in the incoming packet. */
1482 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1483
1484 /*
1485 * Ensure the correct username is in current_user_info. This is a
1486 * really ugly bugfix for problems with multiple session_setup_and_X's
1487 * being done and allowing %U and %G substitutions to work correctly.
1488 * There is a reason this code is done here, don't move it unless you
1489 * know what you're doing... :-).
1490 * JRA.
1491 */
1492
1493 /*
1494 * lookup an existing session
1495 *
1496 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1497 * here, the main check is still in change_to_user()
1498 */
1499 status = smb1srv_session_lookup(xconn,
1500 session_tag,
1501 now,
1502 &session);
1503 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1504 switch (type) {
1505 case SMBsesssetupX:
1506 status = NT_STATUS_OK;
1507 break;
1508 default:
1509 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1510 (unsigned long long)session_tag,
1511 (unsigned long long)req->mid));
1512 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1513 return conn;
1514 }
1515 }
1516
1517 if (session_tag != xconn->last_session_id) {
1518 struct user_struct *vuser = NULL;
1519
1520 xconn->last_session_id = session_tag;
1521 if (session) {
1522 vuser = session->compat;
1523 }
1524 if (vuser) {
1525 set_current_user_info(
1526 vuser->session_info->unix_info->sanitized_username,
1527 vuser->session_info->unix_info->unix_name,
1528 vuser->session_info->info->domain_name);
1529 }
1530 }
1531
1532 /* Does this call need to be run as the connected user? */
1533 if (flags & AS_USER) {
1534
1535 /* Does this call need a valid tree connection? */
1536 if (!conn) {
1537 /*
1538 * Amazingly, the error code depends on the command
1539 * (from Samba4).
1540 */
1541 if (type == SMBntcreateX) {
1542 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1543 } else {
1544 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1545 }
1546 return NULL;
1547 }
1548
1549 if (!change_to_user(conn,session_tag)) {
1550 DEBUG(0, ("Error: Could not change to user. Removing "
1551 "deferred open, mid=%llu.\n",
1552 (unsigned long long)req->mid));
1553 reply_force_doserror(req, ERRSRV, ERRbaduid);
1554 return conn;
1555 }
1556
1557 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1558
1559 /* Does it need write permission? */
1560 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1561 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1562 return conn;
1563 }
1564
1565 /* IPC services are limited */
1566 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1567 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1568 return conn;
1569 }
1570 } else {
1571 /* This call needs to be run as root */
1572 change_to_root_user();
1573 }
1574
1575 /* load service specific parameters */
1576 if (conn) {
1577 if (req->encrypted) {
1578 conn->encrypted_tid = true;
1579 /* encrypted required from now on. */
1580 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1581 } else if (ENCRYPTION_REQUIRED(conn)) {
1582 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1583 DEBUG(1,("service[%s] requires encryption"
1584 "%s ACCESS_DENIED. mid=%llu\n",
1585 lp_servicename(talloc_tos(), SNUM(conn)),
1586 smb_fn_name(type),
1587 (unsigned long long)req->mid));
1588 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1589 return conn;
1590 }
1591 }
1592
1593 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1594 (flags & (AS_USER|DO_CHDIR)
1595 ?True:False))) {
1596 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1597 return conn;
1598 }
1599 conn->num_smb_operations++;
1600 }
1601
1602 /*
1603 * Does this protocol need to be run as guest? (Only archane
1604 * messenger service requests have this...)
1605 */
1606 if (flags & AS_GUEST) {
1607 char *raddr;
1608 bool ok;
1609
1610 if (!change_to_guest()) {
1611 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1612 return conn;
1613 }
1614
1615 raddr = tsocket_address_inet_addr_string(xconn->remote_address,
1616 talloc_tos());
1617 if (raddr == NULL) {
1618 reply_nterror(req, NT_STATUS_NO_MEMORY);
1619 return conn;
1620 }
1621
1622 /*
1623 * Haven't we checked this in smbd_process already???
1624 */
1625
1626 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1627 xconn->remote_hostname, raddr);
1628 TALLOC_FREE(raddr);
1629
1630 if (!ok) {
1631 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1632 return conn;
1633 }
1634 }
1635
1636 smb_messages[type].fn(req);
1637 return req->conn;
1638 }
1639
1640 /****************************************************************************
1641 Construct a reply to the incoming packet.
1642 ****************************************************************************/
1643
1644 static void construct_reply(struct smbd_server_connection *sconn,
1645 char *inbuf, int size, size_t unread_bytes,
1646 uint32_t seqnum, bool encrypted,
1647 struct smb_perfcount_data *deferred_pcd)
1648 {
1649 struct smbXsrv_connection *xconn = sconn->conn;
1650 struct smb_request *req;
1651
1652 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1653 smb_panic("could not allocate smb_request");
1654 }
1655
1656 if (!init_smb_request(req, sconn, xconn, (uint8 *)inbuf, unread_bytes,
1657 encrypted, seqnum)) {
1658 exit_server_cleanly("Invalid SMB request");
1659 }
1660
1661 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1662
1663 /* we popped this message off the queue - keep original perf data */
1664 if (deferred_pcd)
1665 req->pcd = *deferred_pcd;
1666 else {
1667 SMB_PERFCOUNT_START(&req->pcd);
1668 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1669 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1670 }
1671
1672 req->conn = switch_message(req->cmd, req);
1673
1674 if (req->outbuf == NULL) {
1675 /*
1676 * Request has suspended itself, will come
1677 * back here.
1678 */
1679 return;
1680 }
1681 if (CVAL(req->outbuf,0) == 0) {
1682 show_msg((char *)req->outbuf);
1683 }
1684 smb_request_done(req);
1685 }
1686
1687 static void construct_reply_chain(struct smbd_server_connection *sconn,
1688 char *inbuf, int size, uint32_t seqnum,
1689 bool encrypted,
1690 struct smb_perfcount_data *deferred_pcd)
1691 {
1692 struct smb_request **reqs = NULL;
1693 struct smb_request *req;
1694 unsigned num_reqs;
1695 bool ok;
1696
1697 ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1698 seqnum, &reqs, &num_reqs);
1699 if (!ok) {
1700 char errbuf[smb_size];
1701 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1702 __LINE__, __FILE__);
1703 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1704 NULL)) {
1705 exit_server_cleanly("construct_reply_chain: "
1706 "srv_send_smb failed.");
1707 }
1708 return;
1709 }
1710
1711 req = reqs[0];
1712 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1713
1714 req->conn = switch_message(req->cmd, req);
1715
1716 if (req->outbuf == NULL) {
1717 /*
1718 * Request has suspended itself, will come
1719 * back here.
1720 */
1721 return;
1722 }
1723 smb_request_done(req);
1724 }
1725
1726 /*
1727 * To be called from an async SMB handler that is potentially chained
1728 * when it is finished for shipping.
1729 */
1730
1731 void smb_request_done(struct smb_request *req)
1732 {
1733 struct smb_request **reqs = NULL;
1734 struct smb_request *first_req;
1735 size_t i, num_reqs, next_index;
1736 NTSTATUS status;
1737
1738 if (req->chain == NULL) {
1739 first_req = req;
1740 goto shipit;
1741 }
1742
1743 reqs = req->chain;
1744 num_reqs = talloc_array_length(reqs);
1745
1746 for (i=0; i<num_reqs; i++) {
1747 if (reqs[i] == req) {
1748 break;
1749 }
1750 }
1751 if (i == num_reqs) {
1752 /*
1753 * Invalid chain, should not happen
1754 */
1755 status = NT_STATUS_INTERNAL_ERROR;
1756 goto error;
1757 }
1758 next_index = i+1;
1759
1760 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1761 struct smb_request *next = reqs[next_index];
1762 struct smbXsrv_tcon *tcon;
1763 NTTIME now = timeval_to_nttime(&req->request_time);
1764
1765 next->vuid = SVAL(req->outbuf, smb_uid);
1766 next->tid = SVAL(req->outbuf, smb_tid);
1767 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1768 now, &tcon);
1769 if (NT_STATUS_IS_OK(status)) {
1770 req->conn = tcon->compat;
1771 } else {
1772 req->conn = NULL;
1773 }
1774 next->chain_fsp = req->chain_fsp;
1775 next->inbuf = req->inbuf;
1776
1777 req = next;
1778 req->conn = switch_message(req->cmd, req);
1779
1780 if (req->outbuf == NULL) {
1781 /*
1782 * Request has suspended itself, will come
1783 * back here.
1784 */
1785 return;
1786 }
1787 next_index += 1;
1788 }
1789
1790 first_req = reqs[0];
1791
1792 for (i=1; i<next_index; i++) {
1793 bool ok;
1794
1795 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1796 if (!ok) {
1797 status = NT_STATUS_INTERNAL_ERROR;
1798 goto error;
1799 }
1800 }
1801
1802 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1803 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1804
1805 /*
1806 * This scary statement intends to set the
1807 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1808 * to the value last_req->outbuf carries
1809 */
1810 SSVAL(first_req->outbuf, smb_flg2,
1811 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1812 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1813
1814 /*
1815 * Transfer the error codes from the subrequest to the main one
1816 */
1817 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1818 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1819
1820 _smb_setlen_large(
1821 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1822
1823 shipit:
1824 if (!srv_send_smb(first_req->sconn,
1825 (char *)first_req->outbuf,
1826 true, first_req->seqnum+1,
1827 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1828 &first_req->pcd)) {
1829 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1830 "failed.");
1831 }
1832 TALLOC_FREE(req); /* non-chained case */
1833 TALLOC_FREE(reqs); /* chained case */
1834 return;
1835
1836 error:
1837 {
1838 char errbuf[smb_size];
1839 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1840 if (!srv_send_smb(req->sconn, errbuf, true,
1841 req->seqnum+1, req->encrypted,
1842 NULL)) {
1843 exit_server_cleanly("construct_reply_chain: "
1844 "srv_send_smb failed.");
1845 }
1846 }
1847 TALLOC_FREE(req); /* non-chained case */
1848 TALLOC_FREE(reqs); /* chained case */
1849 }
1850
1851 /****************************************************************************
1852 Process an smb from the client
1853 ****************************************************************************/
1854 static void process_smb(struct smbXsrv_connection *xconn,
1855 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1856 uint32_t seqnum, bool encrypted,
1857 struct smb_perfcount_data *deferred_pcd)
1858 {
1859 struct smbd_server_connection *sconn = xconn->sconn;
1860 int msg_type = CVAL(inbuf,0);
1861
1862 DO_PROFILE_INC(smb_count);
1863
1864 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1865 smb_len(inbuf) ) );
1866 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1867 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1868
1869 if (msg_type != NBSSmessage) {
1870 /*
1871 * NetBIOS session request, keepalive, etc.
1872 */
1873 reply_special(sconn, (char *)inbuf, nread);
1874 goto done;
1875 }
1876
1877 if (sconn->using_smb2) {
1878 /* At this point we're not really using smb2,
1879 * we make the decision here.. */
1880 if (smbd_is_smb2_header(inbuf, nread)) {
1881 smbd_smb2_first_negprot(xconn, inbuf, nread);
1882 return;
1883 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1884 && CVAL(inbuf, smb_com) != 0x72) {
1885 /* This is a non-negprot SMB1 packet.
1886 Disable SMB2 from now on. */
1887 sconn->using_smb2 = false;
1888 }
1889 }
1890
1891 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1892 * so subtract 4 from it. */
1893 if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1894 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1895 smb_len(inbuf)));
1896
1897 /* special magic for immediate exit */
1898 if ((nread == 9) &&
1899 (IVAL(inbuf, 4) == 0x74697865) &&
1900 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1901 uint8_t exitcode = CVAL(inbuf, 8);
1902 DEBUG(1, ("Exiting immediately with code %d\n",
1903 (int)exitcode));
1904 exit(exitcode);
1905 }
1906
1907 exit_server_cleanly("Non-SMB packet");
1908 }
1909
1910 show_msg((char *)inbuf);
1911
1912 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1913 construct_reply_chain(sconn, (char *)inbuf, nread,
1914 seqnum, encrypted, deferred_pcd);
1915 } else {
1916 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1917 seqnum, encrypted, deferred_pcd);
1918 }
1919
1920 sconn->trans_num++;
1921
1922 done:
1923 sconn->num_requests++;
1924
1925 /* The timeout_processing function isn't run nearly
1926 often enough to implement 'max log size' without
1927 overrunning the size of the file by many megabytes.
1928 This is especially true if we are running at debug
1929 level 10. Checking every 50 SMBs is a nice
1930 tradeoff of performance vs log file size overrun. */
1931
1932 if ((sconn->num_requests % 50) == 0 &&
1933 need_to_check_log_size()) {
1934 change_to_root_user();
1935 check_log_size();
1936 }
1937 }
1938
1939 /****************************************************************************
1940 Return a string containing the function name of a SMB command.
1941 ****************************************************************************/
1942
1943 const char *smb_fn_name(int type)
1944 {
1945 const char *unknown_name = "SMBunknown";
1946
1947 if (smb_messages[type].name == NULL)
1948 return(unknown_name);
1949
1950 return(smb_messages[type].name);
1951 }
1952
1953 /****************************************************************************
1954 Helper functions for contruct_reply.
1955 ****************************************************************************/
1956
1957 void add_to_common_flags2(uint32 v)
1958 {
1959 common_flags2 |= v;
1960 }
1961
1962 void remove_from_common_flags2(uint32 v)
1963 {
1964 common_flags2 &= ~v;
1965 }
1966
1967 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1968 char *outbuf)
1969 {
1970 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1971 uint16_t out_flags2 = common_flags2;
1972
1973 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1974 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1975 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1976
1977 srv_set_message(outbuf,0,0,false);
1978
1979 SCVAL(outbuf, smb_com, req->cmd);
1980 SIVAL(outbuf,smb_rcls,0);
1981 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1982 SSVAL(outbuf,smb_flg2, out_flags2);
1983 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1984 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1985
1986 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1987 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1988 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1989 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1990 }
1991
1992 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1993 {
1994 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1995 }
1996
1997 /**
1998 * @brief Find the smb_cmd offset of the last command pushed
1999 * @param[in] buf The buffer we're building up
2000 * @retval Where can we put our next andx cmd?
2001 *
2002 * While chaining requests, the "next" request we're looking at needs to put
2003 * its SMB_Command before the data the previous request already built up added
2004 * to the chain. Find the offset to the place where we have to put our cmd.
2005 */
2006
2007 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2008 {
2009 uint8_t cmd;
2010 size_t ofs;
2011
2012 cmd = CVAL(buf, smb_com);
2013
2014 if (!is_andx_req(cmd)) {
2015 return false;
2016 }
2017
2018 ofs = smb_vwv0;
2019
2020 while (CVAL(buf, ofs) != 0xff) {
2021
2022 if (!is_andx_req(CVAL(buf, ofs))) {
2023 return false;
2024 }
2025
2026 /*
2027 * ofs is from start of smb header, so add the 4 length
2028 * bytes. The next cmd is right after the wct field.
2029 */
2030 ofs = SVAL(buf, ofs+2) + 4 + 1;
2031
2032 if (ofs+4 >= talloc_get_size(buf)) {
2033 return false;
2034 }
2035 }
2036
2037 *pofs = ofs;
2038 return true;
2039 }
2040
2041 /**
2042 * @brief Do the smb chaining at a buffer level
2043 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
2044 * @param[in] andx_buf Buffer to be appended
2045 */
2046
2047 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2048 {
2049 uint8_t smb_command = CVAL(andx_buf, smb_com);
2050 uint8_t wct = CVAL(andx_buf, smb_wct);
2051 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
2052 uint32_t num_bytes = smb_buflen(andx_buf);
2053 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
2054
2055 uint8_t *outbuf;
2056 size_t old_size, new_size;
2057 size_t ofs;
2058 size_t chain_padding = 0;
2059 size_t andx_cmd_ofs;
2060
2061
2062 old_size = talloc_get_size(*poutbuf);
2063
2064 if ((old_size % 4) != 0) {
2065 /*
2066 * Align the wct field of subsequent requests to a 4-byte
2067 * boundary
2068 */
2069 chain_padding = 4 - (old_size % 4);
2070 }
2071
2072 /*
2073 * After the old request comes the new wct field (1 byte), the vwv's
2074 * and the num_bytes field.
2075 */
2076
2077 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2078 new_size += num_bytes;
2079
2080 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2081 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2082 (unsigned)new_size));
2083 return false;
2084 }
2085
2086 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2087 if (outbuf == NULL) {
2088 DEBUG(0, ("talloc failed\n"));
2089 return false;
2090 }
2091 *poutbuf = outbuf;
2092
2093 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2094 DEBUG(1, ("invalid command chain\n"));
2095 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2096 return false;
2097 }
2098
2099 if (chain_padding != 0) {
2100 memset(outbuf + old_size, 0, chain_padding);
2101 old_size += chain_padding;
2102 }
2103
2104 SCVAL(outbuf, andx_cmd_ofs, smb_command);
2105 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2106
2107 ofs = old_size;
2108
2109 /*
2110 * Push the chained request:
2111 *
2112 * wct field
2113 */
2114
2115 SCVAL(outbuf, ofs, wct);
2116 ofs += 1;
2117
2118 /*
2119 * vwv array
2120 */
2121
2122 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2123
2124 /*
2125 * HACK ALERT
2126 *
2127 * Read&X has an offset into its data buffer at
2128 * vwv[6]. reply_read_andx has no idea anymore that it's
2129 * running from within a chain, so we have to fix up the
2130 * offset here.
2131 *
2132 * Although it looks disgusting at this place, I want to keep
2133 * it here. The alternative would be to push knowledge about
2134 * the andx chain down into read&x again.
2135 */
2136
2137 if (smb_command == SMBreadX) {
2138 uint8_t *bytes_addr;
2139
2140 if (wct < 7) {
2141 /*
2142 * Invalid read&x response
2143 */
2144 return false;
2145 }
2146
2147 bytes_addr = outbuf + ofs /* vwv start */
2148 + sizeof(uint16_t) * wct /* vwv array */
2149 + sizeof(uint16_t); /* bcc */
2150
2151 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2152 bytes_addr - outbuf - 4);
2153 }
2154
2155 ofs += sizeof(uint16_t) * wct;
2156
2157 /*
2158 * bcc (byte count)
2159 */
2160
2161 SSVAL(outbuf, ofs, num_bytes);
2162 ofs += sizeof(uint16_t);
2163
2164 /*
2165 * The bytes field
2166 */
2167
2168 memcpy(outbuf + ofs, bytes, num_bytes);
2169
2170 return true;
2171 }
2172
2173 bool smb1_is_chain(const uint8_t *buf)
2174 {
2175 uint8_t cmd, wct, andx_cmd;
2176
2177 cmd = CVAL(buf, smb_com);
2178 if (!is_andx_req(cmd)) {
2179 return false;
2180 }
2181 wct = CVAL(buf, smb_wct);
2182 if (wct < 2) {
2183 return false;
2184 }
2185 andx_cmd = CVAL(buf, smb_vwv);
2186 return (andx_cmd != 0xFF);
2187 }
2188
2189 bool smb1_walk_chain(const uint8_t *buf,
2190 bool (*fn)(uint8_t cmd,
2191 uint8_t wct, const uint16_t *vwv,
2192 uint16_t num_bytes, const uint8_t *bytes,
2193 void *private_data),
2194 void *private_data)
2195 {
2196 size_t smblen = smb_len(buf);
2197 const char *smb_buf = smb_base(buf);
2198 uint8_t cmd, chain_cmd;
2199 uint8_t wct;
2200 const uint16_t *vwv;
2201 uint16_t num_bytes;
2202 const uint8_t *bytes;
2203
2204 cmd = CVAL(buf, smb_com);
2205 wct = CVAL(buf, smb_wct);
2206 vwv = (const uint16_t *)(buf + smb_vwv);
2207 num_bytes = smb_buflen(buf);
2208 bytes = (const uint8_t *)smb_buf_const(buf);
2209
2210 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2211 return false;
2212 }
2213
2214 if (!is_andx_req(cmd)) {
2215 return true;
2216 }
2217 if (wct < 2) {
2218 return false;
2219 }
2220
2221 chain_cmd = CVAL(vwv, 0);
2222
2223 while (chain_cmd != 0xff) {
2224 uint32_t chain_offset; /* uint32_t to avoid overflow */
2225 size_t length_needed;
2226 ptrdiff_t vwv_offset;
2227
2228 chain_offset = SVAL(vwv+1, 0);
2229
2230 /*
2231 * Check if the client tries to fool us. The chain
2232 * offset needs to point beyond the current request in
2233 * the chain, it needs to strictly grow. Otherwise we
2234 * might be tricked into an endless loop always
2235 * processing the same request over and over again. We
2236 * used to assume that vwv and the byte buffer array
2237 * in a chain are always attached, but OS/2 the
2238 * Write&X/Read&X chain puts the Read&X vwv array
2239 * right behind the Write&X vwv chain. The Write&X bcc
2240 * array is put behind the Read&X vwv array. So now we
2241 * check whether the chain offset points strictly
2242 * behind the previous vwv array. req->buf points
2243 * right after the vwv array of the previous
2244 * request. See
2245 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2246 * more information.
2247 */
2248
2249 vwv_offset = ((const char *)vwv - smb_buf);
2250 if (chain_offset <= vwv_offset) {
2251 return false;
2252 }
2253
2254 /*
2255 * Next check: Make sure the chain offset does not
2256 * point beyond the overall smb request length.
2257 */
2258
2259 length_needed = chain_offset+1; /* wct */
2260 if (length_needed > smblen) {
2261 return false;
2262 }
2263
2264 /*
2265 * Now comes the pointer magic. Goal here is to set up
2266 * vwv and buf correctly again. The chain offset (the
2267 * former vwv[1]) points at the new wct field.
2268 */
2269
2270 wct = CVAL(smb_buf, chain_offset);
2271
2272 if (is_andx_req(chain_cmd) && (wct < 2)) {
2273 return false;
2274 }
2275
2276 /*
2277 * Next consistency check: Make the new vwv array fits
2278 * in the overall smb request.
2279 */
2280
2281 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2282 if (length_needed > smblen) {
2283 return false;
2284 }
2285 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2286
2287 /*
2288 * Now grab the new byte buffer....
2289 */
2290
2291 num_bytes = SVAL(vwv+wct, 0);
2292
2293 /*
2294 * .. and check that it fits.
2295 */
2296
2297 length_needed += num_bytes;
2298 if (length_needed > smblen) {
2299 return false;
2300 }
2301 bytes = (const uint8_t *)(vwv+wct+1);
2302
2303 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2304 return false;
2305 }
2306
2307 if (!is_andx_req(chain_cmd)) {
2308 return true;
2309 }
2310 chain_cmd = CVAL(vwv, 0);
2311 }
2312 return true;
2313 }
2314
2315 static bool smb1_chain_length_cb(uint8_t cmd,
2316 uint8_t wct, const uint16_t *vwv,
2317 uint16_t num_bytes, const uint8_t *bytes,
2318 void *private_data)
2319 {
2320 unsigned *count = (unsigned *)private_data;
2321 *count += 1;
2322 return true;
2323 }
2324
2325 unsigned smb1_chain_length(const uint8_t *buf)
2326 {
2327 unsigned count = 0;
2328
2329 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2330 return 0;
2331 }
2332 return count;
2333 }
2334
2335 struct smb1_parse_chain_state {
2336 TALLOC_CTX *mem_ctx;
2337 const uint8_t *buf;
2338 struct smbd_server_connection *sconn;
2339 struct smbXsrv_connection *xconn;
2340 bool encrypted;
2341 uint32_t seqnum;
2342
2343 struct smb_request **reqs;
2344 unsigned num_reqs;
2345 };
2346
2347 static bool smb1_parse_chain_cb(uint8_t cmd,
2348 uint8_t wct, const uint16_t *vwv,
2349 uint16_t num_bytes, const uint8_t *bytes,
2350 void *private_data)
2351 {
2352 struct smb1_parse_chain_state *state =
2353 (struct smb1_parse_chain_state *)private_data;
2354 struct smb_request **reqs;
2355 struct smb_request *req;
2356 bool ok;
2357
2358 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2359 struct smb_request *, state->num_reqs+1);
2360 if (reqs == NULL) {
2361 return false;
2362 }
2363 state->reqs = reqs;
2364
2365 req = talloc(reqs, struct smb_request);
2366 if (req == NULL) {
2367 return false;
2368 }
2369
2370 ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2371 state->encrypted, state->seqnum);
2372 if (!ok) {
2373 return false;
2374 }
2375 req->cmd = cmd;
2376 req->wct = wct;
2377 req->vwv = vwv;
2378 req->buflen = num_bytes;
2379 req->buf = bytes;
2380
2381 reqs[state->num_reqs] = req;
2382 state->num_reqs += 1;
2383 return true;
2384 }
2385
2386 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2387 struct smbd_server_connection *sconn,
2388 bool encrypted, uint32_t seqnum,
2389 struct smb_request ***reqs, unsigned *num_reqs)
2390 {
2391 struct smbXsrv_connection *xconn = sconn->conn;
2392 struct smb1_parse_chain_state state;
2393 unsigned i;
2394
2395 state.mem_ctx = mem_ctx;
2396 state.buf = buf;
2397 state.sconn = sconn;
2398 state.xconn = xconn;
2399 state.encrypted = encrypted;
2400 state.seqnum = seqnum;
2401 state.reqs = NULL;
2402 state.num_reqs = 0;
2403
2404 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2405 TALLOC_FREE(state.reqs);
2406 return false;
2407 }
2408 for (i=0; i<state.num_reqs; i++) {
2409 state.reqs[i]->chain = state.reqs;
2410 }
2411 *reqs = state.reqs;
2412 *num_reqs = state.num_reqs;
2413 return true;
2414 }
2415
2416 /****************************************************************************
2417 Check if services need reloading.
2418 ****************************************************************************/
2419
2420 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2421 {
2422
2423 if (last_smb_conf_reload_time == 0) {
2424 last_smb_conf_reload_time = t;
2425 }
2426
2427 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2428 reload_services(sconn, conn_snum_used, true);
2429 last_smb_conf_reload_time = t;
2430 }
2431 }
2432
2433 static bool fd_is_readable(int fd)
2434 {
2435 int ret, revents;
2436
2437 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2438
2439 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2440
2441 }
2442
2443 static void smbd_server_connection_write_handler(
2444 struct smbXsrv_connection *xconn)
2445 {
2446 /* TODO: make write nonblocking */
2447 }
2448
2449 static void smbd_server_connection_read_handler(
2450 struct smbXsrv_connection *xconn, int fd)
2451 {
2452 struct smbd_server_connection *sconn = xconn->sconn;
2453 uint8_t *inbuf = NULL;
2454 size_t inbuf_len = 0;
2455 size_t unread_bytes = 0;
2456 bool encrypted = false;
2457 TALLOC_CTX *mem_ctx = talloc_tos();
2458 NTSTATUS status;
2459 uint32_t seqnum;
2460
2461 bool async_echo = lp_async_smb_echo_handler();
2462 bool from_client = false;
2463
2464 if (async_echo) {
2465 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2466 /*
2467 * This is the super-ugly hack to prefer the packets
2468 * forwarded by the echo handler over the ones by the
2469 * client directly
2470 */
2471 fd = xconn->smb1.echo_handler.trusted_fd;
2472 }
2473 }
2474
2475 from_client = (xconn->transport.sock == fd);
2476
2477 if (async_echo && from_client) {
2478 smbd_lock_socket(sconn);
2479
2480 if (!fd_is_readable(fd)) {
2481 DEBUG(10,("the echo listener was faster\n"));
2482 smbd_unlock_socket(sconn);
2483 return;
2484 }
2485 }
2486
2487 /* TODO: make this completely nonblocking */
2488 status = receive_smb_talloc(mem_ctx, sconn, fd,
2489 (char **)(void *)&inbuf,
2490 0, /* timeout */
2491 &unread_bytes,
2492 &encrypted,
2493 &inbuf_len, &seqnum,
2494 !from_client /* trusted channel */);
2495
2496 if (async_echo && from_client) {
2497 smbd_unlock_socket(sconn);
2498 }
2499
2500 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2501 goto process;
2502 }
2503 if (NT_STATUS_IS_ERR(status)) {
2504 exit_server_cleanly("failed to receive smb request");
2505 }
2506 if (!NT_STATUS_IS_OK(status)) {
2507 return;
2508 }
2509
2510 process:
2511 process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2512 seqnum, encrypted, NULL);
2513 }
2514
2515 static void smbd_server_connection_handler(struct tevent_context *ev,
2516 struct tevent_fd *fde,
2517 uint16_t flags,
2518 void *private_data)
2519 {
2520 struct smbXsrv_connection *xconn =
2521 talloc_get_type_abort(private_data,
2522 struct smbXsrv_connection);
2523
2524 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2525 /*
2526 * we're not supposed to do any io
2527 */
2528 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2529 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2530 return;
2531 }
2532
2533 if (flags & TEVENT_FD_WRITE) {
2534 smbd_server_connection_write_handler(xconn);
2535 return;
2536 }
2537 if (flags & TEVENT_FD_READ) {
2538 smbd_server_connection_read_handler(xconn, xconn->transport.sock);
2539 return;
2540 }
2541 }
2542
2543 static void smbd_server_echo_handler(struct tevent_context *ev,
2544 struct tevent_fd *fde,
2545 uint16_t flags,
2546 void *private_data)
2547 {
2548 struct smbXsrv_connection *xconn =
2549 talloc_get_type_abort(private_data,
2550 struct smbXsrv_connection);
2551
2552 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2553 /*
2554 * we're not supposed to do any io
2555 */
2556 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2557 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2558 return;
2559 }
2560
2561 if (flags & TEVENT_FD_WRITE) {
2562 smbd_server_connection_write_handler(xconn);
2563 return;
2564 }
2565 if (flags & TEVENT_FD_READ) {
2566 smbd_server_connection_read_handler(
2567 xconn, xconn->smb1.echo_handler.trusted_fd);
2568 return;
2569 }
2570 }
2571
2572 struct smbd_release_ip_state {
2573 struct smbXsrv_connection *xconn;
2574 struct tevent_immediate *im;
2575 char addr[INET6_ADDRSTRLEN];
2576 };
2577
2578 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2579 struct tevent_immediate *im,
2580 void *private_data)
2581 {
2582 struct smbd_release_ip_state *state =
2583 talloc_get_type_abort(private_data,
2584 struct smbd_release_ip_state);
2585 struct smbXsrv_connection *xconn = state->xconn;
2586 struct smbd_server_connection *sconn = xconn->sconn;
2587
2588 if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2589 /*
2590 * smbd_server_connection_terminate() already triggered ?
2591 */
2592 return;
2593 }
2594
2595 smbd_server_connection_terminate(sconn, "CTDB_SRVID_RELEASE_IP");
2596 }
2597
2598 /****************************************************************************
2599 received when we should release a specific IP
2600 ****************************************************************************/
2601 static bool release_ip(const char *ip, void *priv)
2602 {
2603 struct smbd_release_ip_state *state =
2604 talloc_get_type_abort(priv,
2605 struct smbd_release_ip_state);
2606 struct smbXsrv_connection *xconn = state->xconn;
2607 const char *addr = state->addr;
2608 const char *p = addr;
2609
2610 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2611 /* avoid recursion */
2612 return false;
2613 }
2614
2615 if (strncmp("::ffff:", addr, 7) == 0) {
2616 p = addr + 7;
2617 }
2618
2619 DEBUG(10, ("Got release IP message for %s, "
2620 "our address is %s\n", ip, p));
2621
2622 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2623 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2624 ip));
2625 /*
2626 * With SMB2 we should do a clean disconnect,
2627 * the previous_session_id in the session setup
2628 * will cleanup the old session, tcons and opens.
2629 *
2630 * A clean disconnect is needed in order to support
2631 * durable handles.
2632 *
2633 * Note: typically this is never triggered
2634 * as we got a TCP RST (triggered by ctdb event scripts)
2635 * before we get CTDB_SRVID_RELEASE_IP.
2636 *
2637 * We used to call _exit(1) here, but as this was mostly never
2638 * triggered and has implication on our process model,
2639 * we can just use smbd_server_connection_terminate()
2640 * (also for SMB1).
2641 *
2642 * We don't call smbd_server_connection_terminate() directly
2643 * as we might be called from within ctdbd_migrate(),
2644 * we need to defer our action to the next event loop
2645 */
2646 tevent_schedule_immediate(state->im, xconn->ev_ctx,
2647 smbd_release_ip_immediate, state);
2648
2649 /*
2650 * Make sure we don't get any io on the connection.
2651 */
2652 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2653 return true;
2654 }
2655
2656 return false;
2657 }
2658
2659 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2660 struct sockaddr_storage *srv,
2661 struct sockaddr_storage *clnt)
2662 {
2663 struct smbd_release_ip_state *state;
2664 struct ctdbd_connection *cconn;
2665
2666 cconn = messaging_ctdbd_connection();
2667 if (cconn == NULL) {
2668 return NT_STATUS_NO_MEMORY;
2669 }
2670
2671 state = talloc_zero(xconn, struct smbd_release_ip_state);
2672 if (state == NULL) {
2673 return NT_STATUS_NO_MEMORY;
2674 }
2675 state->xconn = xconn;
2676 state->im = tevent_create_immediate(state);
2677 if (state->im == NULL) {
2678 return NT_STATUS_NO_MEMORY;
2679 }
2680 if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2681 return NT_STATUS_NO_MEMORY;
2682 }
2683
2684 return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2685 }
2686
2687 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2688 void *private_data, uint32_t msg_type,
2689 struct server_id server_id, DATA_BLOB *data)
2690 {
2691 struct smbd_server_connection *sconn = talloc_get_type_abort(
2692 private_data, struct smbd_server_connection);
2693 const char *ip = (char *) data->data;
2694 char *client_ip;
2695
2696 DEBUG(10, ("Got kill request for client IP %s\n", ip));
2697
2698 client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2699 talloc_tos());
2700 if (client_ip == NULL) {
2701 return;
2702 }
2703
2704 if (strequal(ip, client_ip)) {
2705 DEBUG(1, ("Got kill client message for %s - "
2706 "exiting immediately\n", ip));
2707 exit_server_cleanly("Forced disconnect for client");
2708 }
2709
2710 TALLOC_FREE(client_ip);
2711 }
2712
2713 /*
2714 * Send keepalive packets to our client
2715 */
2716 static bool keepalive_fn(const struct timeval *now, void *private_data)
2717 {
2718 struct smbd_server_connection *sconn = talloc_get_type_abort(
2719 private_data, struct smbd_server_connection);
2720 struct smbXsrv_connection *xconn = sconn->conn;
2721 bool ret;
2722
2723 if (sconn->using_smb2) {
2724 /* Don't do keepalives on an SMB2 connection. */
2725 return false;
2726 }
2727
2728 smbd_lock_socket(sconn);
2729 ret = send_keepalive(xconn->transport.sock);
2730 smbd_unlock_socket(sconn);
2731
2732 if (!ret) {
2733 int saved_errno = errno;
2734 /*
2735 * Try and give an error message saying what
2736 * client failed.
2737 */
2738 DEBUG(0, ("send_keepalive failed for client %s. "
2739 "Error %s - exiting\n",
2740 smbXsrv_connection_dbg(xconn),
2741 strerror(saved_errno)));
2742 errno = saved_errno;
2743 return False;
2744 }
2745 return True;
2746 }
2747
2748 /*
2749 * Do the recurring check if we're idle
2750 */
2751 static bool deadtime_fn(const struct timeval *now, void *private_data)
2752 {
2753 struct smbd_server_connection *sconn =
2754 (struct smbd_server_connection *)private_data;
2755
2756 if ((conn_num_open(sconn) == 0)
2757 || (conn_idle_all(sconn, now->tv_sec))) {
2758 DEBUG( 2, ( "Closing idle connection\n" ) );
2759 messaging_send(sconn->msg_ctx,
2760 messaging_server_id(sconn->msg_ctx),
2761 MSG_SHUTDOWN, &data_blob_null);
2762 return False;
2763 }
2764
2765 return True;
2766 }
2767
2768 /*
2769 * Do the recurring log file and smb.conf reload checks.
2770 */
2771
2772 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2773 {
2774 struct smbd_server_connection *sconn = talloc_get_type_abort(
2775 private_data, struct smbd_server_connection);
2776
2777 DEBUG(5, ("housekeeping\n"));
2778
2779 change_to_root_user();
2780
2781 /* update printer queue caches if necessary */
2782 update_monitored_printq_cache(sconn->msg_ctx);
2783
2784 /* check if we need to reload services */
2785 check_reload(sconn, time_mono(NULL));
2786
2787 /*
2788 * Force a log file check.
2789 */
2790 force_check_log_size();
2791 check_log_size();
2792 return true;
2793 }
2794
2795 /*
2796 * Read an smb packet in the echo handler child, giving the parent
2797 * smbd one second to react once the socket becomes readable.
2798 */
2799
2800 struct smbd_echo_read_state {
2801 struct tevent_context *ev;
2802 struct smbd_server_connection *sconn;
2803
2804 char *buf;
2805 size_t buflen;
2806 uint32_t seqnum;
2807 };
2808
2809 static void smbd_echo_read_readable(struct tevent_req *subreq);
2810 static void smbd_echo_read_waited(struct tevent_req *subreq);
2811
2812 static struct tevent_req *smbd_echo_read_send(
2813 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2814 struct smbd_server_connection *sconn)
2815 {
2816 struct tevent_req *req, *subreq;
2817 struct smbd_echo_read_state *state;
2818 struct smbXsrv_connection *xconn = sconn->conn;
2819
2820 req = tevent_req_create(mem_ctx, &state,
2821 struct smbd_echo_read_state);
2822 if (req == NULL) {
2823 return NULL;
2824 }
2825 state->ev = ev;
2826 state->sconn = sconn;
2827
2828 subreq = wait_for_read_send(state, ev, xconn->transport.sock);
2829 if (tevent_req_nomem(subreq, req)) {
2830 return tevent_req_post(req, ev);
2831 }
2832 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2833 return req;
2834 }
2835
2836 static void smbd_echo_read_readable(struct tevent_req *subreq)
2837 {
2838 struct tevent_req *req = tevent_req_callback_data(
2839 subreq, struct tevent_req);
2840 struct smbd_echo_read_state *state = tevent_req_data(
2841 req, struct smbd_echo_read_state);
2842 bool ok;
2843 int err;
2844
2845 ok = wait_for_read_recv(subreq, &err);
2846 TALLOC_FREE(subreq);
2847 if (!ok) {
2848 tevent_req_nterror(req, map_nt_error_from_unix(err));
2849 return;
2850 }
2851
2852 /*
2853 * Give the parent smbd one second to step in
2854 */
2855
2856 subreq = tevent_wakeup_send(
2857 state, state->ev, timeval_current_ofs(1, 0));
2858 if (tevent_req_nomem(subreq, req)) {
2859 return;
2860 }
2861 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2862 }
2863
2864 static void smbd_echo_read_waited(struct tevent_req *subreq)
2865 {
2866 struct tevent_req *req = tevent_req_callback_data(
2867 subreq, struct tevent_req);
2868 struct smbd_echo_read_state *state = tevent_req_data(
2869 req, struct smbd_echo_read_state);
2870 struct smbd_server_connection *sconn = state->sconn;
2871 struct smbXsrv_connection *xconn = sconn->conn;
2872 bool ok;
2873 NTSTATUS status;
2874 size_t unread = 0;
2875 bool encrypted;
2876
2877 ok = tevent_wakeup_recv(subreq);
2878 TALLOC_FREE(subreq);
2879 if (!ok) {
2880 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2881 return;
2882 }
2883
2884 ok = smbd_lock_socket_internal(sconn);
2885 if (!ok) {
2886 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2887 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2888 return;
2889 }
2890
2891 if (!fd_is_readable(xconn->transport.sock)) {
2892 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2893 (int)getpid()));
2894
2895 ok = smbd_unlock_socket_internal(sconn);
2896 if (!ok) {
2897 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2898 DEBUG(1, ("%s: failed to unlock socket\n",
2899 __location__));
2900 return;
2901 }
2902
2903 subreq = wait_for_read_send(state, state->ev,
2904 xconn->transport.sock);
2905 if (tevent_req_nomem(subreq, req)) {
2906 return;
2907 }
2908 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2909 return;
2910 }
2911
2912 status = receive_smb_talloc(state, sconn,
2913 xconn->transport.sock,
2914 &state->buf,
2915 0 /* timeout */,
2916 &unread,
2917 &encrypted,
2918 &state->buflen,
2919 &state->seqnum,
2920 false /* trusted_channel*/);
2921
2922 if (tevent_req_nterror(req, status)) {
2923 tevent_req_nterror(req, status);
2924 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2925 (int)getpid(), nt_errstr(status)));
2926 return;
2927 }
2928
2929 ok = smbd_unlock_socket_internal(sconn);
2930 if (!ok) {
2931 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2932 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2933 return;
2934 }
2935 tevent_req_done(req);
2936 }
2937
2938 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2939 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2940 {
2941 struct smbd_echo_read_state *state = tevent_req_data(
2942 req, struct smbd_echo_read_state);
2943 NTSTATUS status;
2944
2945 if (tevent_req_is_nterror(req, &status)) {
2946 return status;
2947 }
2948 *pbuf = talloc_move(mem_ctx, &state->buf);
2949 *pbuflen = state->buflen;
2950 *pseqnum = state->seqnum;
2951 return NT_STATUS_OK;
2952 }
2953
2954 struct smbd_echo_state {
2955 struct tevent_context *ev;
2956 struct iovec *pending;
2957 struct smbd_server_connection *sconn;
2958 struct smbXsrv_connection *xconn;
2959 int parent_pipe;
2960
2961 struct tevent_fd *parent_fde;
2962
2963 struct tevent_req *write_req;
2964 };
2965
2966 static void smbd_echo_writer_done(struct tevent_req *req);
2967
2968 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2969 {
2970 int num_pending;
2971
2972 if (state->write_req != NULL) {
2973 return;
2974 }
2975
2976 num_pending = talloc_array_length(state->pending);
2977 if (num_pending == 0) {
2978 return;
2979 }
2980
2981 state->write_req = writev_send(state, state->ev, NULL,
2982 state->parent_pipe, false,
2983 state->pending, num_pending);
2984 if (state->write_req == NULL) {
2985 DEBUG(1, ("writev_send failed\n"));
2986 exit(1);
2987 }
2988
2989 talloc_steal(state->write_req, state->pending);
2990 state->pending = NULL;
2991
2992 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2993 state);
2994 }
2995
2996 static void smbd_echo_writer_done(struct tevent_req *req)
2997 {
2998 struct smbd_echo_state *state = tevent_req_callback_data(
2999 req, struct smbd_echo_state);
3000 ssize_t written;
3001 int err;
3002
3003 written = writev_recv(req, &err);
3004 TALLOC_FREE(req);
3005 state->write_req = NULL;
3006 if (written == -1) {
3007 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3008 exit(1);
3009 }
3010 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3011 smbd_echo_activate_writer(state);
3012 }
3013
3014 static bool smbd_echo_reply(struct smbd_echo_state *state,
3015 uint8_t *inbuf, size_t inbuf_len,
3016 uint32_t seqnum)
3017 {
3018 struct smb_request req;
3019 uint16_t num_replies;
3020 char *outbuf;
3021 bool ok;
3022
3023 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3024 DEBUG(10, ("Got netbios keepalive\n"));
3025 /*
3026 * Just swallow it
3027 */
3028 return true;
3029 }
3030
3031 if (inbuf_len < smb_size) {
3032 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3033 return false;
3034 }
3035 if (!valid_smb_header(state->sconn, inbuf)) {
3036 DEBUG(10, ("Got invalid SMB header\n"));
3037 return false;
3038 }
3039
3040 if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3041 seqnum)) {
3042 return false;
3043 }
3044 req.inbuf = inbuf;
3045
3046 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3047 smb_messages[req.cmd].name
3048 ? smb_messages[req.cmd].name : "unknown"));
3049
3050 if (req.cmd != SMBecho) {
3051 return false;
3052 }
3053 if (req.wct < 1) {
3054 return false;
3055 }
3056
3057 num_replies = SVAL(req.vwv+0, 0);
3058 if (num_replies != 1) {
3059 /* Not a Windows "Hey, you're still there?" request */
3060 return false;
3061 }
3062
3063 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
3064 1, req.buflen)) {
3065 DEBUG(10, ("create_outbuf failed\n"));
3066 return false;
3067 }
3068 req.outbuf = (uint8_t *)outbuf;
3069
3070 SSVAL(req.outbuf, smb_vwv0, num_replies);
3071
3072 if (req.buflen > 0) {
3073 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3074 }
3075
3076 ok = srv_send_smb(req.sconn,
3077 (char *)outbuf,
3078 true, seqnum+1,
3079 false, &req.pcd);
3080 TALLOC_FREE(outbuf);
3081 if (!ok) {
3082 exit(1);
3083 }
3084
3085 return true;
3086 }
3087
3088 static void smbd_echo_exit(struct tevent_context *ev,
3089 struct tevent_fd *fde, uint16_t flags,
3090 void *private_data)
3091 {
3092 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3093 exit(0);
3094 }
3095
3096 static void smbd_echo_got_packet(struct tevent_req *req);
3097
3098 static void smbd_echo_loop(struct smbd_server_connection *sconn,
3099 int parent_pipe)
3100 {
3101 struct smbXsrv_connection *xconn = sconn->conn;
3102 struct smbd_echo_state *state;
3103 struct tevent_req *read_req;
3104
3105 state = talloc_zero(sconn, struct smbd_echo_state);
3106 if (state == NULL) {
3107 DEBUG(1, ("talloc failed\n"));
3108 return;
3109 }
3110 state->sconn = sconn;
3111 state->xconn = xconn;
3112 state->parent_pipe = parent_pipe;
3113 state->ev = s3_tevent_context_init(state);
3114 if (state->ev == NULL) {
3115 DEBUG(1, ("tevent_context_init failed\n"));
3116 TALLOC_FREE(state);
3117 return;
3118 }
3119 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3120 TEVENT_FD_READ, smbd_echo_exit,
3121 state);
3122 if (state->parent_fde == NULL) {
3123 DEBUG(1, ("tevent_add_fd failed\n"));
3124 TALLOC_FREE(state);
3125 return;
3126 }
3127
3128 read_req = smbd_echo_read_send(state, state->ev, sconn);
3129 if (read_req == NULL) {
3130 DEBUG(1, ("smbd_echo_read_send failed\n"));
3131 TALLOC_FREE(state);
3132 return;
3133 }
3134 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3135
3136 while (true) {
3137 if (tevent_loop_once(state->ev) == -1) {
3138 DEBUG(1, ("tevent_loop_once failed: %s\n",
3139 strerror(errno)));
3140 break;
3141 }
3142 }
3143 TALLOC_FREE(state);
3144 }
3145
3146 static void smbd_echo_got_packet(struct tevent_req *req)
3147 {
3148 struct smbd_echo_state *state = tevent_req_callback_data(
3149 req, struct smbd_echo_state);
3150 NTSTATUS status;
3151 char *buf = NULL;
3152 size_t buflen = 0;
3153 uint32_t seqnum = 0;
3154 bool reply;
3155
3156 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3157 TALLOC_FREE(req);
3158 if (!NT_STATUS_IS_OK(status)) {
3159 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3160 nt_errstr(status)));
3161 exit(1);
3162 }
3163
3164 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3165 if (!reply) {
3166 size_t num_pending;
3167 struct iovec *tmp;
3168 struct iovec *iov;
3169
3170 num_pending = talloc_array_length(state->pending);
3171 tmp = talloc_realloc(state, state->pending, struct iovec,
3172 num_pending+1);
3173 if (tmp == NULL) {
3174 DEBUG(1, ("talloc_realloc failed\n"));
3175 exit(1);
3176 }
3177 state->pending = tmp;
3178
3179 if (buflen >= smb_size) {
3180 /*
3181 * place the seqnum in the packet so that the main process
3182 * can reply with signing
3183 */
3184 SIVAL(buf, smb_ss_field, seqnum);
3185 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3186 }
3187
3188 iov = &state->pending[num_pending];
3189 iov->iov_base = talloc_move(state->pending, &buf);
3190 iov->iov_len = buflen;
3191
3192 DEBUG(10,("echo_handler[%d]: forward to main\n",
3193 (int)getpid()));
3194 smbd_echo_activate_writer(state);
3195 }
3196
3197 req = smbd_echo_read_send(state, state->ev, state->sconn);
3198 if (req == NULL) {
3199 DEBUG(1, ("smbd_echo_read_send failed\n"));
3200 exit(1);
3201 }
3202 tevent_req_set_callback(req, smbd_echo_got_packet, state);
3203 }
3204
3205
3206 /*
3207 * Handle SMBecho requests in a forked child process
3208 */
3209 bool fork_echo_handler(struct smbd_server_connection *sconn)
3210 {
3211 struct smbXsrv_connection *xconn = sconn->conn;
3212 int listener_pipe[2];
3213 int res;
3214 pid_t child;
3215 bool use_mutex = false;
3216
3217 res = pipe(listener_pipe);
3218 if (res == -1) {
3219 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3220 return false;
3221 }
3222
3223 #ifdef HAVE_ROBUST_MUTEXES
3224 use_mutex = tdb_runtime_check_for_robust_mutexes();
3225
3226 if (use_mutex) {
3227 pthread_mutexattr_t a;
3228
3229 xconn->smb1.echo_handler.socket_mutex =
3230 anonymous_shared_allocate(sizeof(pthread_mutex_t));
3231 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3232 DEBUG(1, ("Could not create mutex shared memory: %s\n",
3233 strerror(errno)));
3234 goto fail;
3235 }
3236
3237 res = pthread_mutexattr_init(&a);
3238 if (res != 0) {
3239 DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3240 strerror(res)));
3241 goto fail;
3242 }
3243 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3244 if (res != 0) {
3245 DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3246 strerror(res)));
3247 pthread_mutexattr_destroy(&a);
3248 goto fail;
3249 }
3250 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3251 if (res != 0) {
3252 DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3253 strerror(res)));
3254 pthread_mutexattr_destroy(&a);
3255 goto fail;
3256 }
3257 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3258 if (res != 0) {
3259 DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3260 "%s\n", strerror(res)));
3261 pthread_mutexattr_destroy(&a);
3262 goto fail;
3263 }
3264 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3265 &a);
3266 pthread_mutexattr_destroy(&a);
3267 if (res != 0) {
3268 DEBUG(1, ("pthread_mutex_init failed: %s\n",
3269 strerror(res)));
3270 goto fail;
3271 }
3272 }
3273 #endif
3274
3275 if (!use_mutex) {
3276 xconn->smb1.echo_handler.socket_lock_fd =
3277 create_unlink_tmp(lp_lock_directory());
3278 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3279 DEBUG(1, ("Could not create lock fd: %s\n",
3280 strerror(errno)));
3281 goto fail;
3282 }
3283 }
3284
3285 child = fork();
3286 if (child == 0) {
3287 NTSTATUS status;
3288
3289 close(listener_pipe[0]);
3290 set_blocking(listener_pipe[1], false);
3291
3292 status = reinit_after_fork(sconn->msg_ctx,
3293 sconn->ev_ctx,
3294 true);
3295 if (!NT_STATUS_IS_OK(status)) {
3296 DEBUG(1, ("reinit_after_fork failed: %s\n",
3297 nt_errstr(status)));
3298 exit(1);
3299 }
3300 smbd_echo_loop(sconn, listener_pipe[1]);
3301 exit(0);
3302 }
3303 close(listener_pipe[1]);
3304 listener_pipe[1] = -1;
3305 xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3306
3307 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3308
3309 /*
3310 * Without smb signing this is the same as the normal smbd
3311 * listener. This needs to change once signing comes in.
3312 */
3313 xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(xconn->ev_ctx,
3314 xconn,
3315 xconn->smb1.echo_handler.trusted_fd,
3316 TEVENT_FD_READ,
3317 smbd_server_echo_handler,
3318 xconn);
3319 if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3320 DEBUG(1, ("event_add_fd failed\n"));
3321 goto fail;
3322 }
3323
3324 return true;
3325
3326 fail:
3327 if (listener_pipe[0] != -1) {
3328 close(listener_pipe[0]);
3329 }
3330 if (listener_pipe[1] != -1) {
3331 close(listener_pipe[1]);
3332 }
3333 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3334 close(xconn->smb1.echo_handler.socket_lock_fd);
3335 }
3336 #ifdef HAVE_ROBUST_MUTEXES
3337 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3338 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3339 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3340 }
3341 #endif
3342 smbd_echo_init(xconn);
3343
3344 return false;
3345 }
3346
3347 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3348 {
3349 while (user) {
3350 if (user->session_info &&
3351 (user->session_info->unix_token->uid == uid)) {
3352 return true;
3353 }
3354 user = user->next;
3355 }
3356 return false;
3357 }
3358
3359 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3360 {
3361 while (user) {
3362 if (user->session_info != NULL) {
3363 int i;
3364 struct security_unix_token *utok;
3365
3366 utok = user->session_info->unix_token;
3367 if (utok->gid == gid) {
3368 return true;
3369 }
3370 for(i=0; i<utok->ngroups; i++) {
3371 if (utok->groups[i] == gid) {
3372 return true;
3373 }
3374 }
3375 }
3376 user = user->next;
3377 }
3378 return false;
3379 }
3380
3381 static bool sid_in_use(const struct user_struct *user,
3382 const struct dom_sid *psid)
3383 {
3384 while (user) {
3385 struct security_token *tok;
3386
3387 if (user->session_info == NULL) {
3388 continue;
3389 }
3390 tok = user->session_info->security_token;
3391 if (tok == NULL) {
3392 /*
3393 * Not sure session_info->security_token can
3394 * ever be NULL. This check might be not
3395 * necessary.
3396 */
3397 continue;
3398 }
3399 if (security_token_has_sid(tok, psid)) {
3400 return true;
3401 }
3402 user = user->next;
3403 }
3404 return false;
3405 }
3406
3407 static bool id_in_use(const struct user_struct *user,
3408 const struct id_cache_ref *id)
3409 {
3410 switch(id->type) {
3411 case UID:
3412 return uid_in_use(user, id->id.uid);
3413 case GID:
3414 return gid_in_use(user, id->id.gid);
3415 case SID:
3416 return sid_in_use(user, &id->id.sid);
3417 default:
3418 break;
3419 }
3420 return false;
3421 }
3422
3423 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3424 void *private_data,
3425 uint32_t msg_type,
3426 struct server_id server_id,
3427 DATA_BLOB* data)
3428 {
3429 const char *msg = (data && data->data)
3430 ? (const char *)data->data : "<NULL>";
3431 struct id_cache_ref id;
3432 struct smbd_server_connection *sconn =
3433 talloc_get_type_abort(private_data,
3434 struct smbd_server_connection);
3435
3436 if (!id_cache_ref_parse(msg, &id)) {
3437 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3438 return;
3439 }
3440
3441 if (id_in_use(sconn->users, &id)) {
3442 exit_server_cleanly(msg);
3443 }
3444 id_cache_delete_from_cache(&id);
3445 }
3446
3447 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3448 enum protocol_types protocol)
3449 {
3450 NTSTATUS status;
3451
3452 set_Protocol(protocol);
3453 conn->protocol = protocol;
3454
3455 if (protocol >= PROTOCOL_SMB2_02) {
3456 status = smb2srv_session_table_init(conn);
3457 if (!NT_STATUS_IS_OK(status)) {
3458 return status;
3459 }
3460
3461 status = smb2srv_open_table_init(conn);
3462 if (!NT_STATUS_IS_OK(status)) {
3463 return status;
3464 }
3465 } else {
3466 status = smb1srv_session_table_init(conn);
3467 if (!NT_STATUS_IS_OK(status)) {
3468 return status;
3469 }
3470
3471 status = smb1srv_tcon_table_init(conn);
3472 if (!NT_STATUS_IS_OK(status)) {
3473 return status;
3474 }
3475
3476 status = smb1srv_open_table_init(conn);
3477 if (!NT_STATUS_IS_OK(status)) {
3478 return status;
3479 }
3480 }
3481
3482 return NT_STATUS_OK;
3483 }
3484
3485 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3486 void *private_data)
3487 {
3488 struct smbXsrv_connection *conn =
3489 talloc_get_type_abort(private_data,
3490 struct smbXsrv_connection);
3491
3492 switch (point) {
3493 case TEVENT_TRACE_BEFORE_WAIT:
3494 /*
3495 * This just removes compiler warning
3496 * without profile support
3497 */
3498 conn->smbd_idle_profstamp = 0;
3499 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3500 break;
3501 case TEVENT_TRACE_AFTER_WAIT:
3502 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3503 break;
3504 #ifdef TEVENT_HAS_LOOP_ONCE_TRACE_POINTS
3505 case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3506 case TEVENT_TRACE_AFTER_LOOP_ONCE:
3507 break;
3508 #endif
3509 }
3510 }
3511
3512 /**
3513 * Create a debug string for the connection
3514 *
3515 * This is allocated to talloc_tos() or a string constant
3516 * in certain corner cases. The returned string should
3517 * hence not be free'd directly but only via the talloc stack.
3518 */
3519 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3520 {
3521 const char *ret;
3522
3523 /*
3524 * TODO: this can be improved later
3525 * maybe including the client guid or more
3526 */
3527 ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3528 if (ret == NULL) {
3529 return "<tsocket_address_string() failed>";
3530 }
3531
3532 return ret;
3533 }
3534
3535 /****************************************************************************
3536 Process commands from the client
3537 ****************************************************************************/
3538
3539 void smbd_process(struct tevent_context *ev_ctx,
3540 struct messaging_context *msg_ctx,
3541 int sock_fd,
3542 bool interactive)
3543 {
3544 TALLOC_CTX *frame = talloc_stackframe();
3545 struct smbXsrv_connection *xconn;
3546 struct smbd_server_connection *sconn;
3547 struct sockaddr_storage ss_srv;
3548 void *sp_srv = (void *)&ss_srv;
3549 struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3550 struct sockaddr_storage ss_clnt;
3551 void *sp_clnt = (void *)&ss_clnt;
3552 struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3553 socklen_t sa_socklen;
3554 struct tsocket_address *local_address = NULL;
3555 struct tsocket_address *remote_address = NULL;
3556 const char *locaddr = NULL;
3557 const char *remaddr = NULL;
3558 char *rhost;
3559 int ret;
3560 int tmp;
3561
3562 xconn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3563 if (xconn == NULL) {
3564 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3565 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3566 }
3567
3568 xconn->ev_ctx = ev_ctx;
3569 xconn->msg_ctx = msg_ctx;
3570 xconn->transport.sock = sock_fd;
3571 smbd_echo_init(xconn);
3572
3573 sconn = talloc_zero(xconn, struct smbd_server_connection);
3574 if (!sconn) {
3575 exit_server("failed to create smbd_server_connection");
3576 }
3577
3578 xconn->sconn = sconn;
3579 sconn->conn = xconn;
3580
3581 /*
3582 * TODO: remove this...:-)
3583 */
3584 global_smbXsrv_connection = xconn;
3585
3586 sconn->ev_ctx = ev_ctx;
3587 sconn->msg_ctx = msg_ctx;
3588
3589 if (!interactive) {
3590 smbd_setup_sig_term_handler(sconn);
3591 smbd_setup_sig_hup_handler(sconn);
3592
3593 if (!serverid_register(messaging_server_id(msg_ctx),
3594 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3595 |FLAG_MSG_DBWRAP
3596 |FLAG_MSG_PRINT_GENERAL)) {
3597 exit_server_cleanly("Could not register myself in "
3598 "serverid.tdb");
3599 }
3600 }
3601
3602 if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3603 /*
3604 * We're not making the decision here,
3605 * we're just allowing the client
3606 * to decide between SMB1 and SMB2
3607 * with the first negprot
3608 * packet.
3609 */
3610 sconn->using_smb2 = true;
3611 }
3612
3613 /* Ensure child is set to blocking mode */
3614 set_blocking(sock_fd,True);
3615
3616 set_socket_options(sock_fd, "SO_KEEPALIVE");
3617 set_socket_options(sock_fd, lp_socket_options());
3618
3619 sa_socklen = sizeof(ss_clnt);
3620 ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3621 if (ret != 0) {
3622 int level = (errno == ENOTCONN)?2:0;
3623 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3624 exit_server_cleanly("getpeername() failed.\n");
3625 }
3626 ret = tsocket_address_bsd_from_sockaddr(sconn,
3627 sa_clnt, sa_socklen,
3628 &remote_address);
3629 if (ret != 0) {
3630 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3631 __location__, strerror(errno)));
3632 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3633 }
3634
3635 sa_socklen = sizeof(ss_srv);
3636 ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3637 if (ret != 0) {
3638 int level = (errno == ENOTCONN)?2:0;
3639 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3640 exit_server_cleanly("getsockname() failed.\n");
3641 }
3642 ret = tsocket_address_bsd_from_sockaddr(sconn,
3643 sa_srv, sa_socklen,
3644 &local_address);
3645 if (ret != 0) {
3646 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3647 __location__, strerror(errno)));
3648 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3649 }
3650
3651 sconn->local_address = local_address;
3652 sconn->remote_address = remote_address;
3653
3654 if (tsocket_address_is_inet(local_address, "ip")) {
3655 locaddr = tsocket_address_inet_addr_string(
3656 sconn->local_address,
3657 talloc_tos());
3658 if (locaddr == NULL) {
3659 DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3660 __location__, strerror(errno)));
3661 exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3662 }
3663 } else {
3664 locaddr = "0.0.0.0";
3665 }
3666
3667 if (tsocket_address_is_inet(remote_address, "ip")) {
3668 remaddr = tsocket_address_inet_addr_string(
3669 sconn->remote_address,
3670 talloc_tos());
3671 if (remaddr == NULL) {
3672 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3673 __location__, strerror(errno)));
3674 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3675 }
3676 } else {
3677 remaddr = "0.0.0.0";
3678 }
3679
3680 /* this is needed so that we get decent entries
3681 in smbstatus for port 445 connects */
3682 set_remote_machine_name(remaddr, false);
3683 reload_services(sconn, conn_snum_used, true);
3684
3685 /*
3686 * Before the first packet, check the global hosts allow/ hosts deny
3687 * parameters before doing any parsing of packets passed to us by the
3688 * client. This prevents attacks on our parsing code from hosts not in
3689 * the hosts allow list.
3690 */
3691
3692 ret = get_remote_hostname(remote_address,
3693 &rhost,
3694 talloc_tos());
3695 if (ret < 0) {
3696 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3697 __location__, strerror(errno)));
3698 exit_server_cleanly("get_remote_hostname failed.\n");
3699 }
3700 if (strequal(rhost, "UNKNOWN")) {
3701 rhost = talloc_strdup(talloc_tos(), remaddr);
3702 }
3703 sconn->remote_hostname = talloc_move(sconn, &rhost);
3704
3705 sub_set_socket_ids(remaddr,
3706 sconn->remote_hostname,
3707 locaddr);
3708
3709 if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3710 sconn->remote_hostname,
3711 remaddr)) {
3712 /*
3713 * send a negative session response "not listening on calling
3714 * name"
3715 */
3716 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3717 DEBUG( 1, ("Connection denied from %s to %s\n",
3718 tsocket_address_string(remote_address, talloc_tos()),
3719 tsocket_address_string(local_address, talloc_tos())));
3720 (void)srv_send_smb(sconn,(char *)buf, false,
3721 0, false, NULL);
3722 exit_server_cleanly("connection denied");
3723 }
3724
3725 DEBUG(10, ("Connection allowed from %s to %s\n",
3726 tsocket_address_string(remote_address, talloc_tos()),
3727 tsocket_address_string(local_address, talloc_tos())));
3728
3729 if (lp_preload_modules()) {
3730 smb_load_modules(lp_preload_modules());
3731 }
3732
3733 smb_perfcount_init();
3734
3735 if (!init_account_policy()) {
3736 exit_server("Could not open account policy tdb.\n");
3737 }
3738
3739 if (*lp_root_directory(talloc_tos())) {
3740 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3741 DEBUG(0,("Failed to change root to %s\n",
3742 lp_root_directory(talloc_tos())));
3743 exit_server("Failed to chroot()");
3744 }
3745 if (chdir("/") == -1) {
3746 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3747 exit_server("Failed to chroot()");
3748 }
3749 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3750 }
3751
3752 if (!srv_init_signing(xconn)) {
3753 exit_server("Failed to init smb_signing");
3754 }
3755
3756 if (!file_init(sconn)) {
3757 exit_server("file_init() failed");
3758 }
3759
3760 /* Setup oplocks */
3761 if (!init_oplocks(sconn))
3762 exit_server("Failed to init oplocks");
3763
3764 /* register our message handlers */
3765 messaging_register(sconn->msg_ctx, sconn,
3766 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3767 messaging_register(sconn->msg_ctx, sconn,
3768 MSG_SMB_CLOSE_FILE, msg_close_file);
3769 messaging_register(sconn->msg_ctx, sconn,
3770 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3771
3772 id_cache_register_msgs(sconn->msg_ctx);
3773 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3774 messaging_register(sconn->msg_ctx, sconn,
3775 ID_CACHE_KILL, smbd_id_cache_kill);
3776
3777 messaging_deregister(sconn->msg_ctx,
3778 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3779 messaging_register(sconn->msg_ctx, sconn,
3780 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3781
3782 messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3783 NULL);
3784 messaging_register(sconn->msg_ctx, sconn,
3785 MSG_SMB_KILL_CLIENT_IP,
3786 msg_kill_client_ip);
3787
3788 messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3789
3790 /*
3791 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3792 * MSGs to all child processes
3793 */
3794 messaging_deregister(sconn->msg_ctx,
3795 MSG_DEBUG, NULL);
3796 messaging_register(sconn->msg_ctx, NULL,
3797 MSG_DEBUG, debug_message);
3798
3799 if ((lp_keepalive() != 0)
3800 && !(event_add_idle(ev_ctx, NULL,
3801 timeval_set(lp_keepalive(), 0),
3802 "keepalive", keepalive_fn,
3803 sconn))) {
3804 DEBUG(0, ("Could not add keepalive event\n"));
3805 exit(1);
3806 }
3807
3808 if (!(event_add_idle(ev_ctx, NULL,
3809 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3810 "deadtime", deadtime_fn, sconn))) {
3811 DEBUG(0, ("Could not add deadtime event\n"));
3812 exit(1);
3813 }
3814
3815 if (!(event_add_idle(ev_ctx, NULL,
3816 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3817 "housekeeping", housekeeping_fn, sconn))) {
3818 DEBUG(0, ("Could not add housekeeping event\n"));
3819 exit(1);
3820 }
3821
3822 if (lp_clustering()) {
3823 /*
3824 * We need to tell ctdb about our client's TCP
3825 * connection, so that for failover ctdbd can send
3826 * tickle acks, triggering a reconnection by the
3827 * client.
3828 */
3829 NTSTATUS status;
3830
3831 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3832 if (!NT_STATUS_IS_OK(status)) {
3833 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3834 nt_errstr(status)));
3835 }
3836 }
3837
3838 tmp = lp_max_xmit();
3839 tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3840 tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3841
3842 xconn->smb1.negprot.max_recv = tmp;
3843
3844 xconn->smb1.sessions.done_sesssetup = false;
3845 xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3846
3847 if (!init_dptrs(sconn)) {
3848 exit_server("init_dptrs() failed");
3849 }
3850
3851 xconn->transport.fde = tevent_add_fd(ev_ctx,
3852 xconn,
3853 sock_fd,
3854 TEVENT_FD_READ,
3855 smbd_server_connection_handler,
3856 xconn);
3857 if (!xconn->transport.fde) {
3858 exit_server("failed to create smbd_server_connection fde");
3859 }
3860
3861 sconn->conn->local_address = sconn->local_address;
3862 sconn->conn->remote_address = sconn->remote_address;
3863 sconn->conn->remote_hostname = sconn->remote_hostname;
3864 sconn->conn->protocol = PROTOCOL_NONE;
3865
3866 TALLOC_FREE(frame);
3867
3868 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, xconn);
3869
3870 while (True) {
3871 frame = talloc_stackframe_pool(8192);
3872
3873 errno = 0;
3874 if (tevent_loop_once(ev_ctx) == -1) {
3875 if (errno != EINTR) {
3876 DEBUG(3, ("tevent_loop_once failed: %s,"
3877 " exiting\n", strerror(errno) ));
3878 break;
3879 }
3880 }
3881
3882 TALLOC_FREE(frame);
3883 }
3884
3885 exit_server_cleanly(NULL);
3886 }
3887
3888 bool req_is_in_chain(const struct smb_request *req)
3889 {
3890 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3891 /*
3892 * We're right now handling a subsequent request, so we must
3893 * be in a chain
3894 */
3895 return true;
3896 }
3897
3898 if (!is_andx_req(req->cmd)) {
3899 return false;
3900 }
3901
3902 if (req->wct < 2) {
3903 /*
3904 * Okay, an illegal request, but definitely not chained :-)
3905 */
3906 return false;
3907 }
3908
3909 return (CVAL(req->vwv+0, 0) != 0xFF);
3910 }
Samba GIT mirror