?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
selftest/knownfail: move some parts to expectedfail.d/ntlm-auth
[Samba.git] / source3 / smbd / smb1_process.c
blobe4f6cdf457819f499bc320bda899a7cad2ff1d4a
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "smbd/smbXsrv_open.h"
27 #include "librpc/gen_ndr/netlogon.h"
28 #include "../lib/async_req/async_sock.h"
29 #include "ctdbd_conn.h"
30 #include "../lib/util/select.h"
31 #include "printing/queue_process.h"
32 #include "system/select.h"
33 #include "passdb.h"
34 #include "auth.h"
35 #include "messages.h"
36 #include "lib/messages_ctdb.h"
37 #include "smbprofile.h"
38 #include "rpc_server/spoolss/srv_spoolss_nt.h"
39 #include "../lib/util/tevent_ntstatus.h"
40 #include "../libcli/security/dom_sid.h"
41 #include "../libcli/security/security_token.h"
42 #include "lib/id_cache.h"
43 #include "lib/util/sys_rw_data.h"
44 #include "system/threads.h"
45 #include "lib/pthreadpool/pthreadpool_tevent.h"
46 #include "util_event.h"
47 #include "libcli/smb/smbXcli_base.h"
48 #include "lib/util/time_basic.h"
49 #include "source3/lib/substitute.h"
50 #include "lib/util/util_process.h"
51
52 /* Internal message queue for deferred opens. */
53 struct pending_message_list {
54 struct pending_message_list *next, *prev;
55 struct timeval request_time; /* When was this first issued? */
56 struct smbd_server_connection *sconn;
57 struct smbXsrv_connection *xconn;
58 struct tevent_timer *te;
59 uint32_t seqnum;
60 bool encrypted;
61 bool processed;
62 DATA_BLOB buf;
63 struct deferred_open_record *open_rec;
64 };
65
66 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
67
68 void smbd_echo_init(struct smbXsrv_connection *xconn)
69 {
70 xconn->smb1.echo_handler.trusted_fd = -1;
71 xconn->smb1.echo_handler.socket_lock_fd = -1;
72 #ifdef HAVE_ROBUST_MUTEXES
73 xconn->smb1.echo_handler.socket_mutex = NULL;
74 #endif
75 }
76
77 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
78 {
79 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
80 return true;
81 }
82
83 #ifdef HAVE_ROBUST_MUTEXES
84 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
85 return true;
86 }
87 #endif
88
89 return false;
90 }
91
92 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
93 {
94 if (!smbd_echo_active(xconn)) {
95 return true;
96 }
97
98 xconn->smb1.echo_handler.ref_count++;
99
100 if (xconn->smb1.echo_handler.ref_count > 1) {
101 return true;
102 }
103
104 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
105
106 #ifdef HAVE_ROBUST_MUTEXES
107 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
108 int ret = EINTR;
109
110 while (ret == EINTR) {
111 ret = pthread_mutex_lock(
112 xconn->smb1.echo_handler.socket_mutex);
113 if (ret == 0) {
114 break;
115 }
116 }
117 if (ret != 0) {
118 DEBUG(1, ("pthread_mutex_lock failed: %s\n",
119 strerror(ret)));
120 return false;
121 }
122 }
123 #endif
124
125 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
126 bool ok;
127
128 do {
129 ok = fcntl_lock(
130 xconn->smb1.echo_handler.socket_lock_fd,
131 F_SETLKW, 0, 0, F_WRLCK);
132 } while (!ok && (errno == EINTR));
133
134 if (!ok) {
135 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
136 return false;
137 }
138 }
139
140 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
141
142 return true;
143 }
144
145 void smbd_lock_socket(struct smbXsrv_connection *xconn)
146 {
147 if (!smbd_lock_socket_internal(xconn)) {
148 exit_server_cleanly("failed to lock socket");
149 }
150 }
151
152 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
153 {
154 if (!smbd_echo_active(xconn)) {
155 return true;
156 }
157
158 xconn->smb1.echo_handler.ref_count--;
159
160 if (xconn->smb1.echo_handler.ref_count > 0) {
161 return true;
162 }
163
164 #ifdef HAVE_ROBUST_MUTEXES
165 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
166 int ret;
167 ret = pthread_mutex_unlock(
168 xconn->smb1.echo_handler.socket_mutex);
169 if (ret != 0) {
170 DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
171 strerror(ret)));
172 return false;
173 }
174 }
175 #endif
176
177 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
178 bool ok;
179
180 do {
181 ok = fcntl_lock(
182 xconn->smb1.echo_handler.socket_lock_fd,
183 F_SETLKW, 0, 0, F_UNLCK);
184 } while (!ok && (errno == EINTR));
185
186 if (!ok) {
187 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
188 return false;
189 }
190 }
191
192 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
193
194 return true;
195 }
196
197 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
198 {
199 if (!smbd_unlock_socket_internal(xconn)) {
200 exit_server_cleanly("failed to unlock socket");
201 }
202 }
203
204 /* Accessor function for smb_read_error for smbd functions. */
205
206 /****************************************************************************
207 Send an smb to a fd.
208 ****************************************************************************/
209
210 bool smb1_srv_send(struct smbXsrv_connection *xconn,
211 char *buffer,
212 bool do_signing,
213 uint32_t seqnum,
214 bool do_encrypt)
215 {
216 size_t len = 0;
217 ssize_t ret;
218 char *buf_out = buffer;
219
220 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
221 /*
222 * we're not supposed to do any io
223 */
224 return true;
225 }
226
227 smbd_lock_socket(xconn);
228
229 if (do_signing) {
230 NTSTATUS status;
231
232 /* Sign the outgoing packet if required. */
233 status = smb1_srv_calculate_sign_mac(xconn, buf_out, seqnum);
234 if (!NT_STATUS_IS_OK(status)) {
235 DBG_ERR("Failed to calculate signing mac: %s\n",
236 nt_errstr(status));
237 return false;
238 }
239 }
240
241 if (do_encrypt) {
242 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
243 if (!NT_STATUS_IS_OK(status)) {
244 DEBUG(0, ("send_smb: SMB encryption failed "
245 "on outgoing packet! Error %s\n",
246 nt_errstr(status) ));
247 ret = -1;
248 goto out;
249 }
250 }
251
252 len = smb_len_large(buf_out) + 4;
253
254 ret = write_data(xconn->transport.sock, buf_out, len);
255 if (ret <= 0) {
256 int saved_errno = errno;
257 /*
258 * Try and give an error message saying what
259 * client failed.
260 */
261 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
262 (int)getpid(), (int)len,
263 smbXsrv_connection_dbg(xconn),
264 (int)ret, strerror(saved_errno)));
265 errno = saved_errno;
266
267 srv_free_enc_buffer(xconn, buf_out);
268 goto out;
269 }
270
271 srv_free_enc_buffer(xconn, buf_out);
272 out:
273 smbd_unlock_socket(xconn);
274 return (ret > 0);
275 }
276
277 /* Socket functions for smbd packet processing. */
278
279 static bool valid_packet_size(size_t len)
280 {
281 /*
282 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
283 * of header. Don't print the error if this fits.... JRA.
284 */
285
286 if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
287 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
288 (unsigned long)len));
289 return false;
290 }
291 return true;
292 }
293
294 /****************************************************************************
295 Attempt a zerocopy writeX read. We know here that len > smb_size-4
296 ****************************************************************************/
297
298 /*
299 * Unfortunately, earlier versions of smbclient/libsmbclient
300 * don't send this "standard" writeX header. I've fixed this
301 * for 3.2 but we'll use the old method with earlier versions.
302 * Windows and CIFSFS at least use this standard size. Not
303 * sure about MacOSX.
304 */
305
306 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
307 (2*14) + /* word count (including bcc) */ \
308 1 /* pad byte */)
309
310 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
311 const char lenbuf[4],
312 struct smbXsrv_connection *xconn,
313 int sock,
314 char **buffer,
315 unsigned int timeout,
316 size_t *p_unread,
317 size_t *len_ret)
318 {
319 /* Size of a WRITEX call (+4 byte len). */
320 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
321 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
322 ssize_t toread;
323 NTSTATUS status;
324
325 memcpy(writeX_header, lenbuf, 4);
326
327 status = read_fd_with_timeout(
328 sock, writeX_header + 4,
329 STANDARD_WRITE_AND_X_HEADER_SIZE,
330 STANDARD_WRITE_AND_X_HEADER_SIZE,
331 timeout, NULL);
332
333 if (!NT_STATUS_IS_OK(status)) {
334 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
335 "error = %s.\n",
336 smbXsrv_connection_dbg(xconn),
337 nt_errstr(status)));
338 return status;
339 }
340
341 /*
342 * Ok - now try and see if this is a possible
343 * valid writeX call.
344 */
345
346 if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
347 /*
348 * If the data offset is beyond what
349 * we've read, drain the extra bytes.
350 */
351 uint16_t doff = SVAL(writeX_header,smb_vwv11);
352 ssize_t newlen;
353
354 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
355 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
356 if (drain_socket(sock, drain) != drain) {
357 smb_panic("receive_smb_raw_talloc_partial_read:"
358 " failed to drain pending bytes");
359 }
360 } else {
361 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
362 }
363
364 /* Spoof down the length and null out the bcc. */
365 set_message_bcc(writeX_header, 0);
366 newlen = smb_len(writeX_header);
367
368 /* Copy the header we've written. */
369
370 *buffer = (char *)talloc_memdup(mem_ctx,
371 writeX_header,
372 sizeof(writeX_header));
373
374 if (*buffer == NULL) {
375 DEBUG(0, ("Could not allocate inbuf of length %d\n",
376 (int)sizeof(writeX_header)));
377 return NT_STATUS_NO_MEMORY;
378 }
379
380 /* Work out the remaining bytes. */
381 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
382 *len_ret = newlen + 4;
383 return NT_STATUS_OK;
384 }
385
386 if (!valid_packet_size(len)) {
387 return NT_STATUS_INVALID_PARAMETER;
388 }
389
390 /*
391 * Not a valid writeX call. Just do the standard
392 * talloc and return.
393 */
394
395 *buffer = talloc_array(mem_ctx, char, len+4);
396
397 if (*buffer == NULL) {
398 DEBUG(0, ("Could not allocate inbuf of length %d\n",
399 (int)len+4));
400 return NT_STATUS_NO_MEMORY;
401 }
402
403 /* Copy in what we already read. */
404 memcpy(*buffer,
405 writeX_header,
406 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
407 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
408
409 if(toread > 0) {
410 status = read_packet_remainder(
411 sock,
412 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
413 timeout, toread);
414
415 if (!NT_STATUS_IS_OK(status)) {
416 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
417 nt_errstr(status)));
418 return status;
419 }
420 }
421
422 *len_ret = len + 4;
423 return NT_STATUS_OK;
424 }
425
426 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
427 struct smbXsrv_connection *xconn,
428 int sock,
429 char **buffer, unsigned int timeout,
430 size_t *p_unread, size_t *plen)
431 {
432 char lenbuf[4];
433 size_t len;
434 int min_recv_size = lp_min_receive_file_size();
435 NTSTATUS status;
436
437 *p_unread = 0;
438
439 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
440 &len);
441 if (!NT_STATUS_IS_OK(status)) {
442 return status;
443 }
444
445 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
446 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
447 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
448 !smb1_srv_is_signing_active(xconn) &&
449 xconn->smb1.echo_handler.trusted_fde == NULL) {
450
451 return receive_smb_raw_talloc_partial_read(
452 mem_ctx, lenbuf, xconn, sock, buffer, timeout,
453 p_unread, plen);
454 }
455
456 if (!valid_packet_size(len)) {
457 return NT_STATUS_INVALID_PARAMETER;
458 }
459
460 /*
461 * The +4 here can't wrap, we've checked the length above already.
462 */
463
464 *buffer = talloc_array(mem_ctx, char, len+4);
465
466 if (*buffer == NULL) {
467 DEBUG(0, ("Could not allocate inbuf of length %d\n",
468 (int)len+4));
469 return NT_STATUS_NO_MEMORY;
470 }
471
472 memcpy(*buffer, lenbuf, sizeof(lenbuf));
473
474 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
475 if (!NT_STATUS_IS_OK(status)) {
476 return status;
477 }
478
479 *plen = len + 4;
480 return NT_STATUS_OK;
481 }
482
483 NTSTATUS smb1_receive_talloc(TALLOC_CTX *mem_ctx,
484 struct smbXsrv_connection *xconn,
485 int sock,
486 char **buffer, unsigned int timeout,
487 size_t *p_unread, bool *p_encrypted,
488 size_t *p_len,
489 uint32_t *seqnum,
490 bool trusted_channel)
491 {
492 size_t len = 0;
493 NTSTATUS status;
494
495 *p_encrypted = false;
496
497 status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
498 p_unread, &len);
499 if (!NT_STATUS_IS_OK(status)) {
500 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
501 ("receive_smb_raw_talloc failed for client %s "
502 "read error = %s.\n",
503 smbXsrv_connection_dbg(xconn),
504 nt_errstr(status)) );
505 return status;
506 }
507
508 if (is_encrypted_packet((uint8_t *)*buffer)) {
509 status = srv_decrypt_buffer(xconn, *buffer);
510 if (!NT_STATUS_IS_OK(status)) {
511 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
512 "incoming packet! Error %s\n",
513 nt_errstr(status) ));
514 return status;
515 }
516 *p_encrypted = true;
517 }
518
519 /* Check the incoming SMB signature. */
520 if (!smb1_srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
521 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
522 "incoming packet!\n"));
523 return NT_STATUS_INVALID_NETWORK_RESPONSE;
524 }
525
526 *p_len = len;
527 return NT_STATUS_OK;
528 }
529
530 /****************************************************************************
531 Function to push a message onto the tail of a linked list of smb messages ready
532 for processing.
533 ****************************************************************************/
534
535 static bool push_queued_message(struct smb_request *req,
536 struct timeval request_time,
537 struct timeval end_time,
538 struct deferred_open_record *open_rec)
539 {
540 int msg_len = smb_len(req->inbuf) + 4;
541 struct pending_message_list *msg;
542
543 msg = talloc_zero(NULL, struct pending_message_list);
544
545 if(msg == NULL) {
546 DEBUG(0,("push_message: malloc fail (1)\n"));
547 return False;
548 }
549 msg->sconn = req->sconn;
550 msg->xconn = req->xconn;
551
552 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
553 if(msg->buf.data == NULL) {
554 DEBUG(0,("push_message: malloc fail (2)\n"));
555 TALLOC_FREE(msg);
556 return False;
557 }
558
559 msg->request_time = request_time;
560 msg->seqnum = req->seqnum;
561 msg->encrypted = req->encrypted;
562 msg->processed = false;
563
564 if (open_rec) {
565 msg->open_rec = talloc_move(msg, &open_rec);
566 }
567
568 #if 0
569 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
570 msg,
571 end_time,
572 smbd_deferred_open_timer,
573 msg);
574 if (!msg->te) {
575 DEBUG(0,("push_message: event_add_timed failed\n"));
576 TALLOC_FREE(msg);
577 return false;
578 }
579 #endif
580
581 DLIST_ADD_END(req->sconn->deferred_open_queue, msg);
582
583 DEBUG(10,("push_message: pushed message length %u on "
584 "deferred_open_queue\n", (unsigned int)msg_len));
585
586 return True;
587 }
588
589 /****************************************************************************
590 Function to push a deferred open smb message onto a linked list of local smb
591 messages ready for processing.
592 ****************************************************************************/
593
594 bool push_deferred_open_message_smb1(struct smb_request *req,
595 struct timeval timeout,
596 struct file_id id,
597 struct deferred_open_record *open_rec)
598 {
599 struct timeval_buf tvbuf;
600 struct timeval end_time;
601
602 if (req->unread_bytes) {
603 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
604 "unread_bytes = %u\n",
605 (unsigned int)req->unread_bytes ));
606 smb_panic("push_deferred_open_message_smb: "
607 "logic error unread_bytes != 0" );
608 }
609
610 end_time = timeval_sum(&req->request_time, &timeout);
611
612 DBG_DEBUG("pushing message len %u mid %"PRIu64" timeout time [%s]\n",
613 (unsigned int) smb_len(req->inbuf)+4,
614 req->mid,
615 timeval_str_buf(&end_time, false, true, &tvbuf));
616
617 return push_queued_message(req, req->request_time, end_time, open_rec);
618 }
619
620 /*
621 * Only allow 5 outstanding trans requests. We're allocating memory, so
622 * prevent a DoS.
623 */
624
625 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
626 {
627 int count = 0;
628 for (; list != NULL; list = list->next) {
629
630 if (list->mid == mid) {
631 return NT_STATUS_INVALID_PARAMETER;
632 }
633
634 count += 1;
635 }
636 if (count > 5) {
637 return NT_STATUS_INSUFFICIENT_RESOURCES;
638 }
639
640 return NT_STATUS_OK;
641 }
642
643 /*
644 These flags determine some of the permissions required to do an operation
645
646 Note that I don't set NEED_WRITE on some write operations because they
647 are used by some brain-dead clients when printing, and I don't want to
648 force write permissions on print services.
649 */
650 #define AS_USER (1<<0)
651 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
652 #define TIME_INIT (1<<2)
653 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
654 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
655 #define DO_CHDIR (1<<6)
656
657 /*
658 define a list of possible SMB messages and their corresponding
659 functions. Any message that has a NULL function is unimplemented -
660 please feel free to contribute implementations!
661 */
662 static const struct smb_message_struct {
663 const char *name;
664 void (*fn)(struct smb_request *req);
665 int flags;
666 } smb_messages[256] = {
667
668 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
669 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
670 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
671 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
672 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
673 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
674 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
675 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
676 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
677 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
678 /* 0x0a */ { "SMBread",reply_read,AS_USER},
679 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
680 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
681 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
682 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
683 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
684 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
685 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
686 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
687 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
688 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
689 /* 0x15 */ { NULL, NULL, 0 },
690 /* 0x16 */ { NULL, NULL, 0 },
691 /* 0x17 */ { NULL, NULL, 0 },
692 /* 0x18 */ { NULL, NULL, 0 },
693 /* 0x19 */ { NULL, NULL, 0 },
694 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
695 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
696 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
697 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
698 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
699 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
700 /* 0x20 */ { "SMBwritec", NULL,0},
701 /* 0x21 */ { NULL, NULL, 0 },
702 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
703 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
704 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
705 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
706 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
707 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
708 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
709 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
710 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
711 /* 0x2b */ { "SMBecho",reply_echo,0},
712 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
713 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
714 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
715 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
716 /* 0x30 */ { NULL, NULL, 0 },
717 /* 0x31 */ { NULL, NULL, 0 },
718 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
719 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
720 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
721 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
722 /* 0x36 */ { NULL, NULL, 0 },
723 /* 0x37 */ { NULL, NULL, 0 },
724 /* 0x38 */ { NULL, NULL, 0 },
725 /* 0x39 */ { NULL, NULL, 0 },
726 /* 0x3a */ { NULL, NULL, 0 },
727 /* 0x3b */ { NULL, NULL, 0 },
728 /* 0x3c */ { NULL, NULL, 0 },
729 /* 0x3d */ { NULL, NULL, 0 },
730 /* 0x3e */ { NULL, NULL, 0 },
731 /* 0x3f */ { NULL, NULL, 0 },
732 /* 0x40 */ { NULL, NULL, 0 },
733 /* 0x41 */ { NULL, NULL, 0 },
734 /* 0x42 */ { NULL, NULL, 0 },
735 /* 0x43 */ { NULL, NULL, 0 },
736 /* 0x44 */ { NULL, NULL, 0 },
737 /* 0x45 */ { NULL, NULL, 0 },
738 /* 0x46 */ { NULL, NULL, 0 },
739 /* 0x47 */ { NULL, NULL, 0 },
740 /* 0x48 */ { NULL, NULL, 0 },
741 /* 0x49 */ { NULL, NULL, 0 },
742 /* 0x4a */ { NULL, NULL, 0 },
743 /* 0x4b */ { NULL, NULL, 0 },
744 /* 0x4c */ { NULL, NULL, 0 },
745 /* 0x4d */ { NULL, NULL, 0 },
746 /* 0x4e */ { NULL, NULL, 0 },
747 /* 0x4f */ { NULL, NULL, 0 },
748 /* 0x50 */ { NULL, NULL, 0 },
749 /* 0x51 */ { NULL, NULL, 0 },
750 /* 0x52 */ { NULL, NULL, 0 },
751 /* 0x53 */ { NULL, NULL, 0 },
752 /* 0x54 */ { NULL, NULL, 0 },
753 /* 0x55 */ { NULL, NULL, 0 },
754 /* 0x56 */ { NULL, NULL, 0 },
755 /* 0x57 */ { NULL, NULL, 0 },
756 /* 0x58 */ { NULL, NULL, 0 },
757 /* 0x59 */ { NULL, NULL, 0 },
758 /* 0x5a */ { NULL, NULL, 0 },
759 /* 0x5b */ { NULL, NULL, 0 },
760 /* 0x5c */ { NULL, NULL, 0 },
761 /* 0x5d */ { NULL, NULL, 0 },
762 /* 0x5e */ { NULL, NULL, 0 },
763 /* 0x5f */ { NULL, NULL, 0 },
764 /* 0x60 */ { NULL, NULL, 0 },
765 /* 0x61 */ { NULL, NULL, 0 },
766 /* 0x62 */ { NULL, NULL, 0 },
767 /* 0x63 */ { NULL, NULL, 0 },
768 /* 0x64 */ { NULL, NULL, 0 },
769 /* 0x65 */ { NULL, NULL, 0 },
770 /* 0x66 */ { NULL, NULL, 0 },
771 /* 0x67 */ { NULL, NULL, 0 },
772 /* 0x68 */ { NULL, NULL, 0 },
773 /* 0x69 */ { NULL, NULL, 0 },
774 /* 0x6a */ { NULL, NULL, 0 },
775 /* 0x6b */ { NULL, NULL, 0 },
776 /* 0x6c */ { NULL, NULL, 0 },
777 /* 0x6d */ { NULL, NULL, 0 },
778 /* 0x6e */ { NULL, NULL, 0 },
779 /* 0x6f */ { NULL, NULL, 0 },
780 /* 0x70 */ { "SMBtcon",reply_tcon,0},
781 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
782 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
783 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
784 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
785 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
786 /* 0x76 */ { NULL, NULL, 0 },
787 /* 0x77 */ { NULL, NULL, 0 },
788 /* 0x78 */ { NULL, NULL, 0 },
789 /* 0x79 */ { NULL, NULL, 0 },
790 /* 0x7a */ { NULL, NULL, 0 },
791 /* 0x7b */ { NULL, NULL, 0 },
792 /* 0x7c */ { NULL, NULL, 0 },
793 /* 0x7d */ { NULL, NULL, 0 },
794 /* 0x7e */ { NULL, NULL, 0 },
795 /* 0x7f */ { NULL, NULL, 0 },
796 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
797 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
798 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
799 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
800 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
801 /* 0x85 */ { NULL, NULL, 0 },
802 /* 0x86 */ { NULL, NULL, 0 },
803 /* 0x87 */ { NULL, NULL, 0 },
804 /* 0x88 */ { NULL, NULL, 0 },
805 /* 0x89 */ { NULL, NULL, 0 },
806 /* 0x8a */ { NULL, NULL, 0 },
807 /* 0x8b */ { NULL, NULL, 0 },
808 /* 0x8c */ { NULL, NULL, 0 },
809 /* 0x8d */ { NULL, NULL, 0 },
810 /* 0x8e */ { NULL, NULL, 0 },
811 /* 0x8f */ { NULL, NULL, 0 },
812 /* 0x90 */ { NULL, NULL, 0 },
813 /* 0x91 */ { NULL, NULL, 0 },
814 /* 0x92 */ { NULL, NULL, 0 },
815 /* 0x93 */ { NULL, NULL, 0 },
816 /* 0x94 */ { NULL, NULL, 0 },
817 /* 0x95 */ { NULL, NULL, 0 },
818 /* 0x96 */ { NULL, NULL, 0 },
819 /* 0x97 */ { NULL, NULL, 0 },
820 /* 0x98 */ { NULL, NULL, 0 },
821 /* 0x99 */ { NULL, NULL, 0 },
822 /* 0x9a */ { NULL, NULL, 0 },
823 /* 0x9b */ { NULL, NULL, 0 },
824 /* 0x9c */ { NULL, NULL, 0 },
825 /* 0x9d */ { NULL, NULL, 0 },
826 /* 0x9e */ { NULL, NULL, 0 },
827 /* 0x9f */ { NULL, NULL, 0 },
828 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
829 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
830 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
831 /* 0xa3 */ { NULL, NULL, 0 },
832 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
833 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
834 /* 0xa6 */ { NULL, NULL, 0 },
835 /* 0xa7 */ { NULL, NULL, 0 },
836 /* 0xa8 */ { NULL, NULL, 0 },
837 /* 0xa9 */ { NULL, NULL, 0 },
838 /* 0xaa */ { NULL, NULL, 0 },
839 /* 0xab */ { NULL, NULL, 0 },
840 /* 0xac */ { NULL, NULL, 0 },
841 /* 0xad */ { NULL, NULL, 0 },
842 /* 0xae */ { NULL, NULL, 0 },
843 /* 0xaf */ { NULL, NULL, 0 },
844 /* 0xb0 */ { NULL, NULL, 0 },
845 /* 0xb1 */ { NULL, NULL, 0 },
846 /* 0xb2 */ { NULL, NULL, 0 },
847 /* 0xb3 */ { NULL, NULL, 0 },
848 /* 0xb4 */ { NULL, NULL, 0 },
849 /* 0xb5 */ { NULL, NULL, 0 },
850 /* 0xb6 */ { NULL, NULL, 0 },
851 /* 0xb7 */ { NULL, NULL, 0 },
852 /* 0xb8 */ { NULL, NULL, 0 },
853 /* 0xb9 */ { NULL, NULL, 0 },
854 /* 0xba */ { NULL, NULL, 0 },
855 /* 0xbb */ { NULL, NULL, 0 },
856 /* 0xbc */ { NULL, NULL, 0 },
857 /* 0xbd */ { NULL, NULL, 0 },
858 /* 0xbe */ { NULL, NULL, 0 },
859 /* 0xbf */ { NULL, NULL, 0 },
860 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
861 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
862 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
863 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
864 /* 0xc4 */ { NULL, NULL, 0 },
865 /* 0xc5 */ { NULL, NULL, 0 },
866 /* 0xc6 */ { NULL, NULL, 0 },
867 /* 0xc7 */ { NULL, NULL, 0 },
868 /* 0xc8 */ { NULL, NULL, 0 },
869 /* 0xc9 */ { NULL, NULL, 0 },
870 /* 0xca */ { NULL, NULL, 0 },
871 /* 0xcb */ { NULL, NULL, 0 },
872 /* 0xcc */ { NULL, NULL, 0 },
873 /* 0xcd */ { NULL, NULL, 0 },
874 /* 0xce */ { NULL, NULL, 0 },
875 /* 0xcf */ { NULL, NULL, 0 },
876 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
877 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
878 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
879 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
880 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
881 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
882 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
883 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
884 /* 0xd8 */ { NULL, NULL, 0 },
885 /* 0xd9 */ { NULL, NULL, 0 },
886 /* 0xda */ { NULL, NULL, 0 },
887 /* 0xdb */ { NULL, NULL, 0 },
888 /* 0xdc */ { NULL, NULL, 0 },
889 /* 0xdd */ { NULL, NULL, 0 },
890 /* 0xde */ { NULL, NULL, 0 },
891 /* 0xdf */ { NULL, NULL, 0 },
892 /* 0xe0 */ { NULL, NULL, 0 },
893 /* 0xe1 */ { NULL, NULL, 0 },
894 /* 0xe2 */ { NULL, NULL, 0 },
895 /* 0xe3 */ { NULL, NULL, 0 },
896 /* 0xe4 */ { NULL, NULL, 0 },
897 /* 0xe5 */ { NULL, NULL, 0 },
898 /* 0xe6 */ { NULL, NULL, 0 },
899 /* 0xe7 */ { NULL, NULL, 0 },
900 /* 0xe8 */ { NULL, NULL, 0 },
901 /* 0xe9 */ { NULL, NULL, 0 },
902 /* 0xea */ { NULL, NULL, 0 },
903 /* 0xeb */ { NULL, NULL, 0 },
904 /* 0xec */ { NULL, NULL, 0 },
905 /* 0xed */ { NULL, NULL, 0 },
906 /* 0xee */ { NULL, NULL, 0 },
907 /* 0xef */ { NULL, NULL, 0 },
908 /* 0xf0 */ { NULL, NULL, 0 },
909 /* 0xf1 */ { NULL, NULL, 0 },
910 /* 0xf2 */ { NULL, NULL, 0 },
911 /* 0xf3 */ { NULL, NULL, 0 },
912 /* 0xf4 */ { NULL, NULL, 0 },
913 /* 0xf5 */ { NULL, NULL, 0 },
914 /* 0xf6 */ { NULL, NULL, 0 },
915 /* 0xf7 */ { NULL, NULL, 0 },
916 /* 0xf8 */ { NULL, NULL, 0 },
917 /* 0xf9 */ { NULL, NULL, 0 },
918 /* 0xfa */ { NULL, NULL, 0 },
919 /* 0xfb */ { NULL, NULL, 0 },
920 /* 0xfc */ { NULL, NULL, 0 },
921 /* 0xfd */ { NULL, NULL, 0 },
922 /* 0xfe */ { NULL, NULL, 0 },
923 /* 0xff */ { NULL, NULL, 0 }
924
925 };
926
927
928 /*******************************************************************
929 Dump a packet to a file.
930 ********************************************************************/
931
932 static void smb_dump(const char *name, int type, const char *data)
933 {
934 size_t len;
935 int fd, i;
936 char *fname = NULL;
937 if (DEBUGLEVEL < 50) {
938 return;
939 }
940
941 len = smb_len_tcp(data)+4;
942 for (i=1;i<100;i++) {
943 fname = talloc_asprintf(talloc_tos(),
944 "/tmp/%s.%d.%s",
945 name,
946 i,
947 type ? "req" : "resp");
948 if (fname == NULL) {
949 return;
950 }
951 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
952 if (fd != -1 || errno != EEXIST) break;
953 TALLOC_FREE(fname);
954 }
955 if (fd != -1) {
956 ssize_t ret = write(fd, data, len);
957 if (ret != len)
958 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
959 close(fd);
960 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
961 }
962 TALLOC_FREE(fname);
963 }
964
965 static void smb1srv_update_crypto_flags(struct smbXsrv_session *session,
966 struct smb_request *req,
967 uint8_t type,
968 bool *update_session_globalp,
969 bool *update_tcon_globalp)
970 {
971 connection_struct *conn = req->conn;
972 struct smbXsrv_tcon *tcon = conn ? conn->tcon : NULL;
973 uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
974 uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
975 bool update_session = false;
976 bool update_tcon = false;
977
978 if (req->encrypted) {
979 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
980 }
981
982 if (smb1_srv_is_signing_active(req->xconn)) {
983 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
984 } else if ((type == SMBecho) || (type == SMBsesssetupX)) {
985 /*
986 * echo can be unsigned. Session setup except final
987 * session setup response too
988 */
989 sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
990 }
991
992 update_session |= smbXsrv_set_crypto_flag(
993 &session->global->encryption_flags, encrypt_flag);
994 update_session |= smbXsrv_set_crypto_flag(
995 &session->global->signing_flags, sign_flag);
996
997 if (tcon) {
998 update_tcon |= smbXsrv_set_crypto_flag(
999 &tcon->global->encryption_flags, encrypt_flag);
1000 update_tcon |= smbXsrv_set_crypto_flag(
1001 &tcon->global->signing_flags, sign_flag);
1002 }
1003
1004 if (update_session) {
1005 session->global->channels[0].encryption_cipher = SMB_ENCRYPTION_GSSAPI;
1006 }
1007
1008 *update_session_globalp = update_session;
1009 *update_tcon_globalp = update_tcon;
1010 return;
1011 }
1012
1013 static void set_current_case_sensitive(connection_struct *conn, uint16_t flags)
1014 {
1015 int snum;
1016 enum remote_arch_types ra_type;
1017
1018 SMB_ASSERT(conn != NULL);
1019 SMB_ASSERT(!conn->sconn->using_smb2);
1020
1021 snum = SNUM(conn);
1022
1023 /*
1024 * Obey the client case sensitivity requests - only for clients that
1025 * support it. */
1026 switch (lp_case_sensitive(snum)) {
1027 case Auto:
1028 /*
1029 * We need this ugliness due to DOS/Win9x clients that lie
1030 * about case insensitivity. */
1031 ra_type = get_remote_arch();
1032 if ((ra_type != RA_SAMBA) && (ra_type != RA_CIFSFS)) {
1033 /*
1034 * Client can't support per-packet case sensitive
1035 * pathnames. */
1036 conn->case_sensitive = false;
1037 } else {
1038 conn->case_sensitive =
1039 !(flags & FLAG_CASELESS_PATHNAMES);
1040 }
1041 break;
1042 case True:
1043 conn->case_sensitive = true;
1044 break;
1045 default:
1046 conn->case_sensitive = false;
1047 break;
1048 }
1049 }
1050
1051 /****************************************************************************
1052 Prepare everything for calling the actual request function, and potentially
1053 call the request function via the "new" interface.
1054
1055 Return False if the "legacy" function needs to be called, everything is
1056 prepared.
1057
1058 Return True if we're done.
1059
1060 I know this API sucks, but it is the one with the least code change I could
1061 find.
1062 ****************************************************************************/
1063
1064 static connection_struct *switch_message(uint8_t type, struct smb_request *req)
1065 {
1066 const struct loadparm_substitution *lp_sub =
1067 loadparm_s3_global_substitution();
1068 int flags;
1069 uint64_t session_tag;
1070 connection_struct *conn = NULL;
1071 struct smbXsrv_connection *xconn = req->xconn;
1072 NTTIME now = timeval_to_nttime(&req->request_time);
1073 struct smbXsrv_session *session = NULL;
1074 NTSTATUS status;
1075
1076 errno = 0;
1077
1078 if (!xconn->smb1.negprot.done) {
1079 switch (type) {
1080 /*
1081 * Without a negprot the request must
1082 * either be a negprot, or one of the
1083 * evil old SMB mailslot messaging types.
1084 */
1085 case SMBnegprot:
1086 case SMBsendstrt:
1087 case SMBsendend:
1088 case SMBsendtxt:
1089 break;
1090 default:
1091 exit_server_cleanly("The first request "
1092 "should be a negprot");
1093 }
1094 }
1095
1096 if (smb_messages[type].fn == NULL) {
1097 DEBUG(0,("Unknown message type %d!\n",type));
1098 smb_dump("Unknown", 1, (const char *)req->inbuf);
1099 reply_unknown_new(req, type);
1100 return NULL;
1101 }
1102
1103 flags = smb_messages[type].flags;
1104
1105 /* In share mode security we must ignore the vuid. */
1106 session_tag = req->vuid;
1107 conn = req->conn;
1108
1109 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1110 (int)getpid(), (unsigned long)conn));
1111
1112 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1113
1114 /* Ensure this value is replaced in the incoming packet. */
1115 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1116
1117 /*
1118 * Ensure the correct username is in current_user_info. This is a
1119 * really ugly bugfix for problems with multiple session_setup_and_X's
1120 * being done and allowing %U and %G substitutions to work correctly.
1121 * There is a reason this code is done here, don't move it unless you
1122 * know what you're doing... :-).
1123 * JRA.
1124 */
1125
1126 /*
1127 * lookup an existing session
1128 *
1129 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1130 * here, the main check is still in change_to_user()
1131 */
1132 status = smb1srv_session_lookup(xconn,
1133 session_tag,
1134 now,
1135 &session);
1136 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1137 switch (type) {
1138 case SMBsesssetupX:
1139 status = NT_STATUS_OK;
1140 break;
1141 default:
1142 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1143 (unsigned long long)session_tag,
1144 (unsigned long long)req->mid));
1145 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1146 return conn;
1147 }
1148 }
1149
1150 if (session != NULL &&
1151 session->global->auth_session_info != NULL &&
1152 !(flags & AS_USER))
1153 {
1154 /*
1155 * change_to_user() implies set_current_user_info()
1156 * and chdir_connect_service().
1157 *
1158 * So we only call set_current_user_info if
1159 * we don't have AS_USER specified.
1160 */
1161 set_current_user_info(
1162 session->global->auth_session_info->unix_info->sanitized_username,
1163 session->global->auth_session_info->unix_info->unix_name,
1164 session->global->auth_session_info->info->domain_name);
1165 }
1166
1167 /* Does this call need to be run as the connected user? */
1168 if (flags & AS_USER) {
1169
1170 /* Does this call need a valid tree connection? */
1171 if (!conn) {
1172 /*
1173 * Amazingly, the error code depends on the command
1174 * (from Samba4).
1175 */
1176 if (type == SMBntcreateX) {
1177 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1178 } else {
1179 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1180 }
1181 return NULL;
1182 }
1183
1184 set_current_case_sensitive(conn, SVAL(req->inbuf,smb_flg));
1185
1186 /*
1187 * change_to_user() implies set_current_user_info()
1188 * and chdir_connect_service().
1189 */
1190 if (!change_to_user_and_service(conn,session_tag)) {
1191 DEBUG(0, ("Error: Could not change to user. Removing "
1192 "deferred open, mid=%llu.\n",
1193 (unsigned long long)req->mid));
1194 reply_force_doserror(req, ERRSRV, ERRbaduid);
1195 return conn;
1196 }
1197
1198 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1199
1200 /* Does it need write permission? */
1201 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1202 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1203 return conn;
1204 }
1205
1206 /* IPC services are limited */
1207 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1208 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1209 return conn;
1210 }
1211 } else if (flags & AS_GUEST) {
1212 /*
1213 * Does this protocol need to be run as guest? (Only archane
1214 * messenger service requests have this...)
1215 */
1216 if (!change_to_guest()) {
1217 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1218 return conn;
1219 }
1220 } else {
1221 /* This call needs to be run as root */
1222 change_to_root_user();
1223 }
1224
1225 /* load service specific parameters */
1226 if (conn) {
1227 if (req->encrypted) {
1228 conn->encrypted_tid = true;
1229 /* encrypted required from now on. */
1230 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1231 } else if (ENCRYPTION_REQUIRED(conn)) {
1232 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1233 DEBUG(1,("service[%s] requires encryption"
1234 "%s ACCESS_DENIED. mid=%llu\n",
1235 lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
1236 smb_fn_name(type),
1237 (unsigned long long)req->mid));
1238 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1239 return conn;
1240 }
1241 }
1242
1243 if (flags & DO_CHDIR) {
1244 bool ok;
1245
1246 ok = chdir_current_service(conn);
1247 if (!ok) {
1248 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1249 return conn;
1250 }
1251 }
1252 conn->num_smb_operations++;
1253 }
1254
1255 /*
1256 * Update encryption and signing state tracking flags that are
1257 * used by smbstatus to display signing and encryption status.
1258 */
1259 if (session != NULL) {
1260 bool update_session_global = false;
1261 bool update_tcon_global = false;
1262
1263 req->session = session;
1264
1265 smb1srv_update_crypto_flags(session, req, type,
1266 &update_session_global,
1267 &update_tcon_global);
1268
1269 if (update_session_global) {
1270 status = smbXsrv_session_update(session);
1271 if (!NT_STATUS_IS_OK(status)) {
1272 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1273 return conn;
1274 }
1275 }
1276
1277 if (update_tcon_global) {
1278 status = smbXsrv_tcon_update(req->conn->tcon);
1279 if (!NT_STATUS_IS_OK(status)) {
1280 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1281 return conn;
1282 }
1283 }
1284 }
1285
1286 smb_messages[type].fn(req);
1287 return req->conn;
1288 }
1289
1290 /****************************************************************************
1291 Construct a reply to the incoming packet.
1292 ****************************************************************************/
1293
1294 void construct_reply(struct smbXsrv_connection *xconn,
1295 char *inbuf,
1296 int size,
1297 size_t unread_bytes,
1298 uint32_t seqnum,
1299 bool encrypted)
1300 {
1301 struct smbd_server_connection *sconn = xconn->client->sconn;
1302 struct smb_request *req;
1303
1304 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1305 smb_panic("could not allocate smb_request");
1306 }
1307
1308 if (!init_smb1_request(req, sconn, xconn, (uint8_t *)inbuf, unread_bytes,
1309 encrypted, seqnum)) {
1310 exit_server_cleanly("Invalid SMB request");
1311 }
1312
1313 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1314
1315 req->conn = switch_message(req->cmd, req);
1316
1317 if (req->outbuf == NULL) {
1318 /*
1319 * Request has suspended itself, will come
1320 * back here.
1321 */
1322 return;
1323 }
1324 if (CVAL(req->outbuf,0) == 0) {
1325 show_msg((char *)req->outbuf);
1326 }
1327 smb_request_done(req);
1328 }
1329
1330 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1331 char *inbuf,
1332 int size,
1333 uint32_t seqnum,
1334 bool encrypted)
1335 {
1336 struct smb_request **reqs = NULL;
1337 struct smb_request *req;
1338 unsigned num_reqs;
1339 bool ok;
1340
1341 ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted,
1342 seqnum, &reqs, &num_reqs);
1343 if (!ok) {
1344 char errbuf[smb_size];
1345 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1346 __LINE__, __FILE__);
1347 if (!smb1_srv_send(xconn, errbuf, true, seqnum, encrypted)) {
1348 exit_server_cleanly("construct_reply_chain: "
1349 "smb1_srv_send failed.");
1350 }
1351 return;
1352 }
1353
1354 req = reqs[0];
1355 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1356
1357 req->conn = switch_message(req->cmd, req);
1358
1359 if (req->outbuf == NULL) {
1360 /*
1361 * Request has suspended itself, will come
1362 * back here.
1363 */
1364 return;
1365 }
1366 smb_request_done(req);
1367 }
1368
1369 /*
1370 * To be called from an async SMB handler that is potentially chained
1371 * when it is finished for shipping.
1372 */
1373
1374 void smb_request_done(struct smb_request *req)
1375 {
1376 struct smb_request **reqs = NULL;
1377 struct smb_request *first_req;
1378 size_t i, num_reqs, next_index;
1379 NTSTATUS status;
1380
1381 if (req->chain == NULL) {
1382 first_req = req;
1383 goto shipit;
1384 }
1385
1386 reqs = req->chain;
1387 num_reqs = talloc_array_length(reqs);
1388
1389 for (i=0; i<num_reqs; i++) {
1390 if (reqs[i] == req) {
1391 break;
1392 }
1393 }
1394 if (i == num_reqs) {
1395 /*
1396 * Invalid chain, should not happen
1397 */
1398 status = NT_STATUS_INTERNAL_ERROR;
1399 goto error;
1400 }
1401 next_index = i+1;
1402
1403 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1404 struct smb_request *next = reqs[next_index];
1405 struct smbXsrv_tcon *tcon;
1406 NTTIME now = timeval_to_nttime(&req->request_time);
1407
1408 next->vuid = SVAL(req->outbuf, smb_uid);
1409 next->tid = SVAL(req->outbuf, smb_tid);
1410 status = smb1srv_tcon_lookup(req->xconn, next->tid,
1411 now, &tcon);
1412
1413 if (NT_STATUS_IS_OK(status)) {
1414 next->conn = tcon->compat;
1415 } else {
1416 next->conn = NULL;
1417 }
1418 next->chain_fsp = req->chain_fsp;
1419 next->inbuf = req->inbuf;
1420
1421 req = next;
1422 req->conn = switch_message(req->cmd, req);
1423
1424 if (req->outbuf == NULL) {
1425 /*
1426 * Request has suspended itself, will come
1427 * back here.
1428 */
1429 return;
1430 }
1431 next_index += 1;
1432 }
1433
1434 first_req = reqs[0];
1435
1436 for (i=1; i<next_index; i++) {
1437 bool ok;
1438
1439 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1440 if (!ok) {
1441 status = NT_STATUS_INTERNAL_ERROR;
1442 goto error;
1443 }
1444 }
1445
1446 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1447 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1448
1449 /*
1450 * This scary statement intends to set the
1451 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1452 * to the value last_req->outbuf carries
1453 */
1454 SSVAL(first_req->outbuf, smb_flg2,
1455 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1456 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1457
1458 /*
1459 * Transfer the error codes from the subrequest to the main one
1460 */
1461 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1462 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1463
1464 _smb_setlen_large(
1465 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1466
1467 shipit:
1468 if (!smb1_srv_send(first_req->xconn,
1469 (char *)first_req->outbuf,
1470 true,
1471 first_req->seqnum + 1,
1472 IS_CONN_ENCRYPTED(req->conn) ||
1473 first_req->encrypted)) {
1474 exit_server_cleanly("construct_reply_chain: smb1_srv_send "
1475 "failed.");
1476 }
1477 TALLOC_FREE(req); /* non-chained case */
1478 TALLOC_FREE(reqs); /* chained case */
1479 return;
1480
1481 error:
1482 {
1483 char errbuf[smb_size];
1484 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1485 if (!smb1_srv_send(req->xconn,
1486 errbuf,
1487 true,
1488 req->seqnum + 1,
1489 req->encrypted)) {
1490 exit_server_cleanly("construct_reply_chain: "
1491 "smb1_srv_send failed.");
1492 }
1493 }
1494 TALLOC_FREE(req); /* non-chained case */
1495 TALLOC_FREE(reqs); /* chained case */
1496 }
1497
1498 /****************************************************************************
1499 Process an smb from the client
1500 ****************************************************************************/
1501
1502 void process_smb1(struct smbXsrv_connection *xconn,
1503 uint8_t *inbuf,
1504 size_t nread,
1505 size_t unread_bytes,
1506 uint32_t seqnum,
1507 bool encrypted)
1508 {
1509 struct smbd_server_connection *sconn = xconn->client->sconn;
1510
1511 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1512 * so subtract 4 from it. */
1513 if ((nread < (smb_size - 4)) || !valid_smb1_header(inbuf)) {
1514 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1515 smb_len(inbuf)));
1516
1517 /* special magic for immediate exit */
1518 if ((nread == 9) &&
1519 (IVAL(inbuf, 4) == SMB_SUICIDE_PACKET) &&
1520 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1521 uint8_t exitcode = CVAL(inbuf, 8);
1522 DBG_WARNING("SUICIDE: Exiting immediately with code %d\n",
1523 (int)exitcode);
1524 exit(exitcode);
1525 }
1526
1527 exit_server_cleanly("Non-SMB packet");
1528 }
1529
1530 show_msg((char *)inbuf);
1531
1532 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1533 construct_reply_chain(xconn,
1534 (char *)inbuf,
1535 nread,
1536 seqnum,
1537 encrypted);
1538 } else {
1539 construct_reply(xconn,
1540 (char *)inbuf,
1541 nread,
1542 unread_bytes,
1543 seqnum,
1544 encrypted);
1545 }
1546
1547 sconn->trans_num++;
1548 }
1549
1550 /****************************************************************************
1551 Return a string containing the function name of a SMB command.
1552 ****************************************************************************/
1553
1554 const char *smb_fn_name(int type)
1555 {
1556 const char *unknown_name = "SMBunknown";
1557
1558 if (smb_messages[type].name == NULL)
1559 return(unknown_name);
1560
1561 return(smb_messages[type].name);
1562 }
1563
1564 /****************************************************************************
1565 Helper functions for contruct_reply.
1566 ****************************************************************************/
1567
1568 void add_to_common_flags2(uint32_t v)
1569 {
1570 common_flags2 |= v;
1571 }
1572
1573 void remove_from_common_flags2(uint32_t v)
1574 {
1575 common_flags2 &= ~v;
1576 }
1577
1578 /**
1579 * @brief Find the smb_cmd offset of the last command pushed
1580 * @param[in] buf The buffer we're building up
1581 * @retval Where can we put our next andx cmd?
1582 *
1583 * While chaining requests, the "next" request we're looking at needs to put
1584 * its SMB_Command before the data the previous request already built up added
1585 * to the chain. Find the offset to the place where we have to put our cmd.
1586 */
1587
1588 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1589 {
1590 uint8_t cmd;
1591 size_t ofs;
1592
1593 cmd = CVAL(buf, smb_com);
1594
1595 if (!smb1cli_is_andx_req(cmd)) {
1596 return false;
1597 }
1598
1599 ofs = smb_vwv0;
1600
1601 while (CVAL(buf, ofs) != 0xff) {
1602
1603 if (!smb1cli_is_andx_req(CVAL(buf, ofs))) {
1604 return false;
1605 }
1606
1607 /*
1608 * ofs is from start of smb header, so add the 4 length
1609 * bytes. The next cmd is right after the wct field.
1610 */
1611 ofs = SVAL(buf, ofs+2) + 4 + 1;
1612
1613 if (ofs+4 >= talloc_get_size(buf)) {
1614 return false;
1615 }
1616 }
1617
1618 *pofs = ofs;
1619 return true;
1620 }
1621
1622 /**
1623 * @brief Do the smb chaining at a buffer level
1624 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1625 * @param[in] andx_buf Buffer to be appended
1626 */
1627
1628 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1629 {
1630 uint8_t smb_command = CVAL(andx_buf, smb_com);
1631 uint8_t wct = CVAL(andx_buf, smb_wct);
1632 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1633 uint32_t num_bytes = smb_buflen(andx_buf);
1634 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1635
1636 uint8_t *outbuf;
1637 size_t old_size, new_size;
1638 size_t ofs;
1639 size_t chain_padding = 0;
1640 size_t andx_cmd_ofs;
1641
1642
1643 old_size = talloc_get_size(*poutbuf);
1644
1645 if ((old_size % 4) != 0) {
1646 /*
1647 * Align the wct field of subsequent requests to a 4-byte
1648 * boundary
1649 */
1650 chain_padding = 4 - (old_size % 4);
1651 }
1652
1653 /*
1654 * After the old request comes the new wct field (1 byte), the vwv's
1655 * and the num_bytes field.
1656 */
1657
1658 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1659 new_size += num_bytes;
1660
1661 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1662 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
1663 (unsigned)new_size));
1664 return false;
1665 }
1666
1667 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1668 if (outbuf == NULL) {
1669 DEBUG(0, ("talloc failed\n"));
1670 return false;
1671 }
1672 *poutbuf = outbuf;
1673
1674 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1675 DEBUG(1, ("invalid command chain\n"));
1676 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
1677 return false;
1678 }
1679
1680 if (chain_padding != 0) {
1681 memset(outbuf + old_size, 0, chain_padding);
1682 old_size += chain_padding;
1683 }
1684
1685 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1686 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1687
1688 ofs = old_size;
1689
1690 /*
1691 * Push the chained request:
1692 *
1693 * wct field
1694 */
1695
1696 SCVAL(outbuf, ofs, wct);
1697 ofs += 1;
1698
1699 /*
1700 * vwv array
1701 */
1702
1703 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1704
1705 /*
1706 * HACK ALERT
1707 *
1708 * Read&X has an offset into its data buffer at
1709 * vwv[6]. reply_read_andx has no idea anymore that it's
1710 * running from within a chain, so we have to fix up the
1711 * offset here.
1712 *
1713 * Although it looks disgusting at this place, I want to keep
1714 * it here. The alternative would be to push knowledge about
1715 * the andx chain down into read&x again.
1716 */
1717
1718 if (smb_command == SMBreadX) {
1719 uint8_t *bytes_addr;
1720
1721 if (wct < 7) {
1722 /*
1723 * Invalid read&x response
1724 */
1725 return false;
1726 }
1727
1728 bytes_addr = outbuf + ofs /* vwv start */
1729 + sizeof(uint16_t) * wct /* vwv array */
1730 + sizeof(uint16_t) /* bcc */
1731 + 1; /* padding byte */
1732
1733 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
1734 bytes_addr - outbuf - 4);
1735 }
1736
1737 ofs += sizeof(uint16_t) * wct;
1738
1739 /*
1740 * bcc (byte count)
1741 */
1742
1743 SSVAL(outbuf, ofs, num_bytes);
1744 ofs += sizeof(uint16_t);
1745
1746 /*
1747 * The bytes field
1748 */
1749
1750 memcpy(outbuf + ofs, bytes, num_bytes);
1751
1752 return true;
1753 }
1754
1755 bool smb1_is_chain(const uint8_t *buf)
1756 {
1757 uint8_t cmd, wct, andx_cmd;
1758
1759 cmd = CVAL(buf, smb_com);
1760 if (!smb1cli_is_andx_req(cmd)) {
1761 return false;
1762 }
1763 wct = CVAL(buf, smb_wct);
1764 if (wct < 2) {
1765 return false;
1766 }
1767 andx_cmd = CVAL(buf, smb_vwv);
1768 return (andx_cmd != 0xFF);
1769 }
1770
1771 bool smb1_walk_chain(const uint8_t *buf,
1772 bool (*fn)(uint8_t cmd,
1773 uint8_t wct, const uint16_t *vwv,
1774 uint16_t num_bytes, const uint8_t *bytes,
1775 void *private_data),
1776 void *private_data)
1777 {
1778 size_t smblen = smb_len(buf);
1779 const char *smb_buf = smb_base(buf);
1780 uint8_t cmd, chain_cmd;
1781 uint8_t wct;
1782 const uint16_t *vwv;
1783 uint16_t num_bytes;
1784 const uint8_t *bytes;
1785
1786 cmd = CVAL(buf, smb_com);
1787 wct = CVAL(buf, smb_wct);
1788 vwv = (const uint16_t *)(buf + smb_vwv);
1789 num_bytes = smb_buflen(buf);
1790 bytes = (const uint8_t *)smb_buf_const(buf);
1791
1792 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
1793 return false;
1794 }
1795
1796 if (!smb1cli_is_andx_req(cmd)) {
1797 return true;
1798 }
1799 if (wct < 2) {
1800 return false;
1801 }
1802
1803 chain_cmd = CVAL(vwv, 0);
1804
1805 while (chain_cmd != 0xff) {
1806 uint32_t chain_offset; /* uint32_t to avoid overflow */
1807 size_t length_needed;
1808 ptrdiff_t vwv_offset;
1809
1810 chain_offset = SVAL(vwv+1, 0);
1811
1812 /*
1813 * Check if the client tries to fool us. The chain
1814 * offset needs to point beyond the current request in
1815 * the chain, it needs to strictly grow. Otherwise we
1816 * might be tricked into an endless loop always
1817 * processing the same request over and over again. We
1818 * used to assume that vwv and the byte buffer array
1819 * in a chain are always attached, but OS/2 the
1820 * Write&X/Read&X chain puts the Read&X vwv array
1821 * right behind the Write&X vwv chain. The Write&X bcc
1822 * array is put behind the Read&X vwv array. So now we
1823 * check whether the chain offset points strictly
1824 * behind the previous vwv array. req->buf points
1825 * right after the vwv array of the previous
1826 * request. See
1827 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
1828 * more information.
1829 */
1830
1831 vwv_offset = ((const char *)vwv - smb_buf);
1832 if (chain_offset <= vwv_offset) {
1833 return false;
1834 }
1835
1836 /*
1837 * Next check: Make sure the chain offset does not
1838 * point beyond the overall smb request length.
1839 */
1840
1841 length_needed = chain_offset+1; /* wct */
1842 if (length_needed > smblen) {
1843 return false;
1844 }
1845
1846 /*
1847 * Now comes the pointer magic. Goal here is to set up
1848 * vwv and buf correctly again. The chain offset (the
1849 * former vwv[1]) points at the new wct field.
1850 */
1851
1852 wct = CVAL(smb_buf, chain_offset);
1853
1854 if (smb1cli_is_andx_req(chain_cmd) && (wct < 2)) {
1855 return false;
1856 }
1857
1858 /*
1859 * Next consistency check: Make the new vwv array fits
1860 * in the overall smb request.
1861 */
1862
1863 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1864 if (length_needed > smblen) {
1865 return false;
1866 }
1867 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
1868
1869 /*
1870 * Now grab the new byte buffer....
1871 */
1872
1873 num_bytes = SVAL(vwv+wct, 0);
1874
1875 /*
1876 * .. and check that it fits.
1877 */
1878
1879 length_needed += num_bytes;
1880 if (length_needed > smblen) {
1881 return false;
1882 }
1883 bytes = (const uint8_t *)(vwv+wct+1);
1884
1885 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
1886 return false;
1887 }
1888
1889 if (!smb1cli_is_andx_req(chain_cmd)) {
1890 return true;
1891 }
1892 chain_cmd = CVAL(vwv, 0);
1893 }
1894 return true;
1895 }
1896
1897 static bool smb1_chain_length_cb(uint8_t cmd,
1898 uint8_t wct, const uint16_t *vwv,
1899 uint16_t num_bytes, const uint8_t *bytes,
1900 void *private_data)
1901 {
1902 unsigned *count = (unsigned *)private_data;
1903 *count += 1;
1904 return true;
1905 }
1906
1907 unsigned smb1_chain_length(const uint8_t *buf)
1908 {
1909 unsigned count = 0;
1910
1911 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
1912 return 0;
1913 }
1914 return count;
1915 }
1916
1917 struct smb1_parse_chain_state {
1918 TALLOC_CTX *mem_ctx;
1919 const uint8_t *buf;
1920 struct smbd_server_connection *sconn;
1921 struct smbXsrv_connection *xconn;
1922 bool encrypted;
1923 uint32_t seqnum;
1924
1925 struct smb_request **reqs;
1926 unsigned num_reqs;
1927 };
1928
1929 static bool smb1_parse_chain_cb(uint8_t cmd,
1930 uint8_t wct, const uint16_t *vwv,
1931 uint16_t num_bytes, const uint8_t *bytes,
1932 void *private_data)
1933 {
1934 struct smb1_parse_chain_state *state =
1935 (struct smb1_parse_chain_state *)private_data;
1936 struct smb_request **reqs;
1937 struct smb_request *req;
1938 bool ok;
1939
1940 reqs = talloc_realloc(state->mem_ctx, state->reqs,
1941 struct smb_request *, state->num_reqs+1);
1942 if (reqs == NULL) {
1943 return false;
1944 }
1945 state->reqs = reqs;
1946
1947 req = talloc(reqs, struct smb_request);
1948 if (req == NULL) {
1949 return false;
1950 }
1951
1952 ok = init_smb1_request(req, state->sconn, state->xconn, state->buf, 0,
1953 state->encrypted, state->seqnum);
1954 if (!ok) {
1955 return false;
1956 }
1957 req->cmd = cmd;
1958 req->wct = wct;
1959 req->vwv = vwv;
1960 req->buflen = num_bytes;
1961 req->buf = bytes;
1962
1963 reqs[state->num_reqs] = req;
1964 state->num_reqs += 1;
1965 return true;
1966 }
1967
1968 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
1969 struct smbXsrv_connection *xconn,
1970 bool encrypted, uint32_t seqnum,
1971 struct smb_request ***reqs, unsigned *num_reqs)
1972 {
1973 struct smbd_server_connection *sconn = NULL;
1974 struct smb1_parse_chain_state state;
1975 unsigned i;
1976
1977 if (xconn != NULL) {
1978 sconn = xconn->client->sconn;
1979 }
1980
1981 state.mem_ctx = mem_ctx;
1982 state.buf = buf;
1983 state.sconn = sconn;
1984 state.xconn = xconn;
1985 state.encrypted = encrypted;
1986 state.seqnum = seqnum;
1987 state.reqs = NULL;
1988 state.num_reqs = 0;
1989
1990 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
1991 TALLOC_FREE(state.reqs);
1992 return false;
1993 }
1994 for (i=0; i<state.num_reqs; i++) {
1995 state.reqs[i]->chain = state.reqs;
1996 }
1997 *reqs = state.reqs;
1998 *num_reqs = state.num_reqs;
1999 return true;
2000 }
2001
2002 static bool fd_is_readable(int fd)
2003 {
2004 int ret, revents;
2005
2006 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2007
2008 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2009
2010 }
2011
2012 static void smbd_server_connection_write_handler(
2013 struct smbXsrv_connection *xconn)
2014 {
2015 /* TODO: make write nonblocking */
2016 }
2017
2018 void smbd_smb1_server_connection_read_handler(struct smbXsrv_connection *xconn,
2019 int fd)
2020 {
2021 uint8_t *inbuf = NULL;
2022 size_t inbuf_len = 0;
2023 size_t unread_bytes = 0;
2024 bool encrypted = false;
2025 TALLOC_CTX *mem_ctx = talloc_tos();
2026 NTSTATUS status;
2027 uint32_t seqnum;
2028
2029 bool async_echo = lp_async_smb_echo_handler();
2030 bool from_client = false;
2031
2032 if (async_echo) {
2033 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2034 /*
2035 * This is the super-ugly hack to prefer the packets
2036 * forwarded by the echo handler over the ones by the
2037 * client directly
2038 */
2039 fd = xconn->smb1.echo_handler.trusted_fd;
2040 }
2041 }
2042
2043 from_client = (xconn->transport.sock == fd);
2044
2045 if (async_echo && from_client) {
2046 smbd_lock_socket(xconn);
2047
2048 if (!fd_is_readable(fd)) {
2049 DEBUG(10,("the echo listener was faster\n"));
2050 smbd_unlock_socket(xconn);
2051 return;
2052 }
2053 }
2054
2055 /* TODO: make this completely nonblocking */
2056 status = receive_smb_talloc(mem_ctx, xconn, fd,
2057 (char **)(void *)&inbuf,
2058 0, /* timeout */
2059 &unread_bytes,
2060 &encrypted,
2061 &inbuf_len, &seqnum,
2062 !from_client /* trusted channel */);
2063
2064 if (async_echo && from_client) {
2065 smbd_unlock_socket(xconn);
2066 }
2067
2068 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2069 goto process;
2070 }
2071 if (NT_STATUS_IS_ERR(status)) {
2072 exit_server_cleanly("failed to receive smb request");
2073 }
2074 if (!NT_STATUS_IS_OK(status)) {
2075 return;
2076 }
2077
2078 process:
2079 process_smb(xconn, inbuf, inbuf_len, unread_bytes, seqnum, encrypted);
2080 }
2081
2082 static void smbd_server_echo_handler(struct tevent_context *ev,
2083 struct tevent_fd *fde,
2084 uint16_t flags,
2085 void *private_data)
2086 {
2087 struct smbXsrv_connection *xconn =
2088 talloc_get_type_abort(private_data,
2089 struct smbXsrv_connection);
2090
2091 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2092 /*
2093 * we're not supposed to do any io
2094 */
2095 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2096 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2097 return;
2098 }
2099
2100 if (flags & TEVENT_FD_WRITE) {
2101 smbd_server_connection_write_handler(xconn);
2102 return;
2103 }
2104 if (flags & TEVENT_FD_READ) {
2105 smbd_smb1_server_connection_read_handler(
2106 xconn, xconn->smb1.echo_handler.trusted_fd);
2107 return;
2108 }
2109 }
2110
2111 /*
2112 * Send keepalive packets to our client
2113 */
2114 bool keepalive_fn(const struct timeval *now, void *private_data)
2115 {
2116 struct smbd_server_connection *sconn = talloc_get_type_abort(
2117 private_data, struct smbd_server_connection);
2118 struct smbXsrv_connection *xconn = NULL;
2119 bool ret;
2120
2121 if (sconn->using_smb2) {
2122 /* Don't do keepalives on an SMB2 connection. */
2123 return false;
2124 }
2125
2126 /*
2127 * With SMB1 we only have 1 connection
2128 */
2129 xconn = sconn->client->connections;
2130 smbd_lock_socket(xconn);
2131 ret = send_keepalive(xconn->transport.sock);
2132 smbd_unlock_socket(xconn);
2133
2134 if (!ret) {
2135 int saved_errno = errno;
2136 /*
2137 * Try and give an error message saying what
2138 * client failed.
2139 */
2140 DEBUG(0, ("send_keepalive failed for client %s. "
2141 "Error %s - exiting\n",
2142 smbXsrv_connection_dbg(xconn),
2143 strerror(saved_errno)));
2144 errno = saved_errno;
2145 return False;
2146 }
2147 return True;
2148 }
2149
2150 /*
2151 * Read an smb packet in the echo handler child, giving the parent
2152 * smbd one second to react once the socket becomes readable.
2153 */
2154
2155 struct smbd_echo_read_state {
2156 struct tevent_context *ev;
2157 struct smbXsrv_connection *xconn;
2158
2159 char *buf;
2160 size_t buflen;
2161 uint32_t seqnum;
2162 };
2163
2164 static void smbd_echo_read_readable(struct tevent_req *subreq);
2165 static void smbd_echo_read_waited(struct tevent_req *subreq);
2166
2167 static struct tevent_req *smbd_echo_read_send(
2168 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2169 struct smbXsrv_connection *xconn)
2170 {
2171 struct tevent_req *req, *subreq;
2172 struct smbd_echo_read_state *state;
2173
2174 req = tevent_req_create(mem_ctx, &state,
2175 struct smbd_echo_read_state);
2176 if (req == NULL) {
2177 return NULL;
2178 }
2179 state->ev = ev;
2180 state->xconn = xconn;
2181
2182 subreq = wait_for_read_send(state, ev, xconn->transport.sock, false);
2183 if (tevent_req_nomem(subreq, req)) {
2184 return tevent_req_post(req, ev);
2185 }
2186 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2187 return req;
2188 }
2189
2190 static void smbd_echo_read_readable(struct tevent_req *subreq)
2191 {
2192 struct tevent_req *req = tevent_req_callback_data(
2193 subreq, struct tevent_req);
2194 struct smbd_echo_read_state *state = tevent_req_data(
2195 req, struct smbd_echo_read_state);
2196 bool ok;
2197 int err;
2198
2199 ok = wait_for_read_recv(subreq, &err);
2200 TALLOC_FREE(subreq);
2201 if (!ok) {
2202 tevent_req_nterror(req, map_nt_error_from_unix(err));
2203 return;
2204 }
2205
2206 /*
2207 * Give the parent smbd one second to step in
2208 */
2209
2210 subreq = tevent_wakeup_send(
2211 state, state->ev, timeval_current_ofs(1, 0));
2212 if (tevent_req_nomem(subreq, req)) {
2213 return;
2214 }
2215 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2216 }
2217
2218 static void smbd_echo_read_waited(struct tevent_req *subreq)
2219 {
2220 struct tevent_req *req = tevent_req_callback_data(
2221 subreq, struct tevent_req);
2222 struct smbd_echo_read_state *state = tevent_req_data(
2223 req, struct smbd_echo_read_state);
2224 struct smbXsrv_connection *xconn = state->xconn;
2225 bool ok;
2226 NTSTATUS status;
2227 size_t unread = 0;
2228 bool encrypted;
2229
2230 ok = tevent_wakeup_recv(subreq);
2231 TALLOC_FREE(subreq);
2232 if (!ok) {
2233 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2234 return;
2235 }
2236
2237 ok = smbd_lock_socket_internal(xconn);
2238 if (!ok) {
2239 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2240 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2241 return;
2242 }
2243
2244 if (!fd_is_readable(xconn->transport.sock)) {
2245 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2246 (int)getpid()));
2247
2248 ok = smbd_unlock_socket_internal(xconn);
2249 if (!ok) {
2250 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2251 DEBUG(1, ("%s: failed to unlock socket\n",
2252 __location__));
2253 return;
2254 }
2255
2256 subreq = wait_for_read_send(state, state->ev,
2257 xconn->transport.sock, false);
2258 if (tevent_req_nomem(subreq, req)) {
2259 return;
2260 }
2261 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2262 return;
2263 }
2264
2265 status = receive_smb_talloc(state, xconn,
2266 xconn->transport.sock,
2267 &state->buf,
2268 0 /* timeout */,
2269 &unread,
2270 &encrypted,
2271 &state->buflen,
2272 &state->seqnum,
2273 false /* trusted_channel*/);
2274
2275 if (tevent_req_nterror(req, status)) {
2276 tevent_req_nterror(req, status);
2277 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2278 (int)getpid(), nt_errstr(status)));
2279 return;
2280 }
2281
2282 ok = smbd_unlock_socket_internal(xconn);
2283 if (!ok) {
2284 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2285 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2286 return;
2287 }
2288 tevent_req_done(req);
2289 }
2290
2291 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2292 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2293 {
2294 struct smbd_echo_read_state *state = tevent_req_data(
2295 req, struct smbd_echo_read_state);
2296 NTSTATUS status;
2297
2298 if (tevent_req_is_nterror(req, &status)) {
2299 return status;
2300 }
2301 *pbuf = talloc_move(mem_ctx, &state->buf);
2302 *pbuflen = state->buflen;
2303 *pseqnum = state->seqnum;
2304 return NT_STATUS_OK;
2305 }
2306
2307 struct smbd_echo_state {
2308 struct tevent_context *ev;
2309 struct iovec *pending;
2310 struct smbd_server_connection *sconn;
2311 struct smbXsrv_connection *xconn;
2312 int parent_pipe;
2313
2314 struct tevent_fd *parent_fde;
2315
2316 struct tevent_req *write_req;
2317 };
2318
2319 static void smbd_echo_writer_done(struct tevent_req *req);
2320
2321 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2322 {
2323 int num_pending;
2324
2325 if (state->write_req != NULL) {
2326 return;
2327 }
2328
2329 num_pending = talloc_array_length(state->pending);
2330 if (num_pending == 0) {
2331 return;
2332 }
2333
2334 state->write_req = writev_send(state, state->ev, NULL,
2335 state->parent_pipe, false,
2336 state->pending, num_pending);
2337 if (state->write_req == NULL) {
2338 DEBUG(1, ("writev_send failed\n"));
2339 exit(1);
2340 }
2341
2342 talloc_steal(state->write_req, state->pending);
2343 state->pending = NULL;
2344
2345 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2346 state);
2347 }
2348
2349 static void smbd_echo_writer_done(struct tevent_req *req)
2350 {
2351 struct smbd_echo_state *state = tevent_req_callback_data(
2352 req, struct smbd_echo_state);
2353 ssize_t written;
2354 int err;
2355
2356 written = writev_recv(req, &err);
2357 TALLOC_FREE(req);
2358 state->write_req = NULL;
2359 if (written == -1) {
2360 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2361 exit(1);
2362 }
2363 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2364 smbd_echo_activate_writer(state);
2365 }
2366
2367 static bool smbd_echo_reply(struct smbd_echo_state *state,
2368 uint8_t *inbuf, size_t inbuf_len,
2369 uint32_t seqnum)
2370 {
2371 struct smb_request req;
2372 uint16_t num_replies;
2373 char *outbuf;
2374 bool ok;
2375
2376 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2377 DEBUG(10, ("Got netbios keepalive\n"));
2378 /*
2379 * Just swallow it
2380 */
2381 return true;
2382 }
2383
2384 if (inbuf_len < smb_size) {
2385 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2386 return false;
2387 }
2388 if (!valid_smb1_header(inbuf)) {
2389 DEBUG(10, ("Got invalid SMB header\n"));
2390 return false;
2391 }
2392
2393 if (!init_smb1_request(&req, state->sconn, state->xconn, inbuf, 0, false,
2394 seqnum)) {
2395 return false;
2396 }
2397 req.inbuf = inbuf;
2398
2399 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2400 smb_fn_name(req.cmd)));
2401
2402 if (req.cmd != SMBecho) {
2403 return false;
2404 }
2405 if (req.wct < 1) {
2406 return false;
2407 }
2408
2409 num_replies = SVAL(req.vwv+0, 0);
2410 if (num_replies != 1) {
2411 /* Not a Windows "Hey, you're still there?" request */
2412 return false;
2413 }
2414
2415 if (!create_smb1_outbuf(talloc_tos(), &req, req.inbuf, &outbuf,
2416 1, req.buflen)) {
2417 DEBUG(10, ("create_smb1_outbuf failed\n"));
2418 return false;
2419 }
2420 req.outbuf = (uint8_t *)outbuf;
2421
2422 SSVAL(req.outbuf, smb_vwv0, num_replies);
2423
2424 if (req.buflen > 0) {
2425 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2426 }
2427
2428 ok = smb1_srv_send(req.xconn, (char *)outbuf, true, seqnum + 1, false);
2429 TALLOC_FREE(outbuf);
2430 if (!ok) {
2431 exit(1);
2432 }
2433
2434 return true;
2435 }
2436
2437 static void smbd_echo_exit(struct tevent_context *ev,
2438 struct tevent_fd *fde, uint16_t flags,
2439 void *private_data)
2440 {
2441 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2442 exit(0);
2443 }
2444
2445 static void smbd_echo_got_packet(struct tevent_req *req);
2446
2447 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
2448 int parent_pipe)
2449 {
2450 struct smbd_echo_state *state;
2451 struct tevent_req *read_req;
2452
2453 state = talloc_zero(xconn, struct smbd_echo_state);
2454 if (state == NULL) {
2455 DEBUG(1, ("talloc failed\n"));
2456 return;
2457 }
2458 state->xconn = xconn;
2459 state->parent_pipe = parent_pipe;
2460 state->ev = samba_tevent_context_init(state);
2461 if (state->ev == NULL) {
2462 DEBUG(1, ("samba_tevent_context_init failed\n"));
2463 TALLOC_FREE(state);
2464 return;
2465 }
2466 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2467 TEVENT_FD_READ, smbd_echo_exit,
2468 state);
2469 if (state->parent_fde == NULL) {
2470 DEBUG(1, ("tevent_add_fd failed\n"));
2471 TALLOC_FREE(state);
2472 return;
2473 }
2474
2475 read_req = smbd_echo_read_send(state, state->ev, xconn);
2476 if (read_req == NULL) {
2477 DEBUG(1, ("smbd_echo_read_send failed\n"));
2478 TALLOC_FREE(state);
2479 return;
2480 }
2481 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2482
2483 while (true) {
2484 if (tevent_loop_once(state->ev) == -1) {
2485 DEBUG(1, ("tevent_loop_once failed: %s\n",
2486 strerror(errno)));
2487 break;
2488 }
2489 }
2490 TALLOC_FREE(state);
2491 }
2492
2493 static void smbd_echo_got_packet(struct tevent_req *req)
2494 {
2495 struct smbd_echo_state *state = tevent_req_callback_data(
2496 req, struct smbd_echo_state);
2497 NTSTATUS status;
2498 char *buf = NULL;
2499 size_t buflen = 0;
2500 uint32_t seqnum = 0;
2501 bool reply;
2502
2503 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2504 TALLOC_FREE(req);
2505 if (!NT_STATUS_IS_OK(status)) {
2506 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2507 nt_errstr(status)));
2508 exit(1);
2509 }
2510
2511 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2512 if (!reply) {
2513 size_t num_pending;
2514 struct iovec *tmp;
2515 struct iovec *iov;
2516
2517 num_pending = talloc_array_length(state->pending);
2518 tmp = talloc_realloc(state, state->pending, struct iovec,
2519 num_pending+1);
2520 if (tmp == NULL) {
2521 DEBUG(1, ("talloc_realloc failed\n"));
2522 exit(1);
2523 }
2524 state->pending = tmp;
2525
2526 if (buflen >= smb_size) {
2527 /*
2528 * place the seqnum in the packet so that the main process
2529 * can reply with signing
2530 */
2531 SIVAL(buf, smb_ss_field, seqnum);
2532 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2533 }
2534
2535 iov = &state->pending[num_pending];
2536 iov->iov_base = talloc_move(state->pending, &buf);
2537 iov->iov_len = buflen;
2538
2539 DEBUG(10,("echo_handler[%d]: forward to main\n",
2540 (int)getpid()));
2541 smbd_echo_activate_writer(state);
2542 }
2543
2544 req = smbd_echo_read_send(state, state->ev, state->xconn);
2545 if (req == NULL) {
2546 DEBUG(1, ("smbd_echo_read_send failed\n"));
2547 exit(1);
2548 }
2549 tevent_req_set_callback(req, smbd_echo_got_packet, state);
2550 }
2551
2552
2553 /*
2554 * Handle SMBecho requests in a forked child process
2555 */
2556 bool fork_echo_handler(struct smbXsrv_connection *xconn)
2557 {
2558 int listener_pipe[2];
2559 int res;
2560 pid_t child;
2561 bool use_mutex = false;
2562
2563 res = pipe(listener_pipe);
2564 if (res == -1) {
2565 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2566 return false;
2567 }
2568
2569 #ifdef HAVE_ROBUST_MUTEXES
2570 use_mutex = tdb_runtime_check_for_robust_mutexes();
2571
2572 if (use_mutex) {
2573 pthread_mutexattr_t a;
2574
2575 xconn->smb1.echo_handler.socket_mutex =
2576 anonymous_shared_allocate(sizeof(pthread_mutex_t));
2577 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
2578 DEBUG(1, ("Could not create mutex shared memory: %s\n",
2579 strerror(errno)));
2580 goto fail;
2581 }
2582
2583 res = pthread_mutexattr_init(&a);
2584 if (res != 0) {
2585 DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
2586 strerror(res)));
2587 goto fail;
2588 }
2589 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
2590 if (res != 0) {
2591 DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
2592 strerror(res)));
2593 pthread_mutexattr_destroy(&a);
2594 goto fail;
2595 }
2596 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
2597 if (res != 0) {
2598 DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
2599 strerror(res)));
2600 pthread_mutexattr_destroy(&a);
2601 goto fail;
2602 }
2603 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
2604 if (res != 0) {
2605 DEBUG(1, ("pthread_mutexattr_setrobust failed: "
2606 "%s\n", strerror(res)));
2607 pthread_mutexattr_destroy(&a);
2608 goto fail;
2609 }
2610 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
2611 &a);
2612 pthread_mutexattr_destroy(&a);
2613 if (res != 0) {
2614 DEBUG(1, ("pthread_mutex_init failed: %s\n",
2615 strerror(res)));
2616 goto fail;
2617 }
2618 }
2619 #endif
2620
2621 if (!use_mutex) {
2622 xconn->smb1.echo_handler.socket_lock_fd =
2623 create_unlink_tmp(lp_lock_directory());
2624 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
2625 DEBUG(1, ("Could not create lock fd: %s\n",
2626 strerror(errno)));
2627 goto fail;
2628 }
2629 }
2630
2631 child = fork();
2632 if (child == 0) {
2633 NTSTATUS status;
2634
2635 close(listener_pipe[0]);
2636 set_blocking(listener_pipe[1], false);
2637
2638 status = smbd_reinit_after_fork(xconn->client->msg_ctx,
2639 xconn->client->raw_ev_ctx,
2640 true);
2641 if (!NT_STATUS_IS_OK(status)) {
2642 DEBUG(1, ("reinit_after_fork failed: %s\n",
2643 nt_errstr(status)));
2644 exit(1);
2645 }
2646 process_set_title("smbd-echo", "echo handler");
2647 initialize_password_db(true, xconn->client->raw_ev_ctx);
2648 smbd_echo_loop(xconn, listener_pipe[1]);
2649 exit(0);
2650 }
2651 close(listener_pipe[1]);
2652 listener_pipe[1] = -1;
2653 xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2654
2655 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
2656
2657 /*
2658 * Without smb signing this is the same as the normal smbd
2659 * listener. This needs to change once signing comes in.
2660 */
2661 xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(
2662 xconn->client->raw_ev_ctx,
2663 xconn,
2664 xconn->smb1.echo_handler.trusted_fd,
2665 TEVENT_FD_READ,
2666 smbd_server_echo_handler,
2667 xconn);
2668 if (xconn->smb1.echo_handler.trusted_fde == NULL) {
2669 DEBUG(1, ("event_add_fd failed\n"));
2670 goto fail;
2671 }
2672
2673 return true;
2674
2675 fail:
2676 if (listener_pipe[0] != -1) {
2677 close(listener_pipe[0]);
2678 }
2679 if (listener_pipe[1] != -1) {
2680 close(listener_pipe[1]);
2681 }
2682 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
2683 close(xconn->smb1.echo_handler.socket_lock_fd);
2684 }
2685 #ifdef HAVE_ROBUST_MUTEXES
2686 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
2687 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
2688 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
2689 }
2690 #endif
2691 smbd_echo_init(xconn);
2692
2693 return false;
2694 }
2695
2696 bool req_is_in_chain(const struct smb_request *req)
2697 {
2698 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
2699 /*
2700 * We're right now handling a subsequent request, so we must
2701 * be in a chain
2702 */
2703 return true;
2704 }
2705
2706 if (!smb1cli_is_andx_req(req->cmd)) {
2707 return false;
2708 }
2709
2710 if (req->wct < 2) {
2711 /*
2712 * Okay, an illegal request, but definitely not chained :-)
2713 */
2714 return false;
2715 }
2716
2717 return (CVAL(req->vwv+0, 0) != 0xFF);
2718 }
Samba GIT mirror