2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/globals.h"
23 #include "../librpc/gen_ndr/srv_dfs.h"
24 #include "../librpc/gen_ndr/srv_dssetup.h"
25 #include "../librpc/gen_ndr/srv_echo.h"
26 #include "../librpc/gen_ndr/srv_eventlog.h"
27 #include "../librpc/gen_ndr/srv_initshutdown.h"
28 #include "../librpc/gen_ndr/srv_lsa.h"
29 #include "../librpc/gen_ndr/srv_netlogon.h"
30 #include "../librpc/gen_ndr/srv_ntsvcs.h"
31 #include "../librpc/gen_ndr/srv_samr.h"
32 #include "../librpc/gen_ndr/srv_spoolss.h"
33 #include "../librpc/gen_ndr/srv_srvsvc.h"
34 #include "../librpc/gen_ndr/srv_svcctl.h"
35 #include "../librpc/gen_ndr/srv_winreg.h"
36 #include "../librpc/gen_ndr/srv_wkssvc.h"
38 extern bool global_machine_password_needs_changing
;
40 static void construct_reply_common(struct smb_request
*req
, const char *inbuf
,
43 /* Accessor function for smb_read_error for smbd functions. */
45 /****************************************************************************
47 ****************************************************************************/
49 bool srv_send_smb(int fd
, char *buffer
,
50 bool do_signing
, uint32_t seqnum
,
52 struct smb_perfcount_data
*pcd
)
57 char *buf_out
= buffer
;
60 /* Sign the outgoing packet if required. */
61 srv_calculate_sign_mac(smbd_server_conn
, buf_out
, seqnum
);
65 NTSTATUS status
= srv_encrypt_buffer(buffer
, &buf_out
);
66 if (!NT_STATUS_IS_OK(status
)) {
67 DEBUG(0, ("send_smb: SMB encryption failed "
68 "on outgoing packet! Error %s\n",
74 len
= smb_len(buf_out
) + 4;
76 ret
= write_data(fd
,buf_out
+nwritten
,len
- nwritten
);
78 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
79 (int)len
,(int)ret
, strerror(errno
) ));
80 srv_free_enc_buffer(buf_out
);
84 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd
, len
);
85 srv_free_enc_buffer(buf_out
);
87 SMB_PERFCOUNT_END(pcd
);
91 /*******************************************************************
92 Setup the word count and byte count for a smb message.
93 ********************************************************************/
95 int srv_set_message(char *buf
,
100 if (zero
&& (num_words
|| num_bytes
)) {
101 memset(buf
+ smb_size
,'\0',num_words
*2 + num_bytes
);
103 SCVAL(buf
,smb_wct
,num_words
);
104 SSVAL(buf
,smb_vwv
+ num_words
*SIZEOFWORD
,num_bytes
);
105 smb_setlen(buf
,(smb_size
+ num_words
*2 + num_bytes
- 4));
106 return (smb_size
+ num_words
*2 + num_bytes
);
109 static bool valid_smb_header(const uint8_t *inbuf
)
111 if (is_encrypted_packet(inbuf
)) {
115 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
116 * but it just looks weird to call strncmp for this one.
118 return (IVAL(smb_base(inbuf
), 0) == 0x424D53FF);
121 /* Socket functions for smbd packet processing. */
123 static bool valid_packet_size(size_t len
)
126 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
127 * of header. Don't print the error if this fits.... JRA.
130 if (len
> (BUFFER_SIZE
+ LARGE_WRITEX_HDR_SIZE
)) {
131 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
132 (unsigned long)len
));
138 static NTSTATUS
read_packet_remainder(int fd
, char *buffer
,
139 unsigned int timeout
, ssize_t len
)
145 return read_fd_with_timeout(fd
, buffer
, len
, len
, timeout
, NULL
);
148 /****************************************************************************
149 Attempt a zerocopy writeX read. We know here that len > smb_size-4
150 ****************************************************************************/
153 * Unfortunately, earlier versions of smbclient/libsmbclient
154 * don't send this "standard" writeX header. I've fixed this
155 * for 3.2 but we'll use the old method with earlier versions.
156 * Windows and CIFSFS at least use this standard size. Not
160 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
161 (2*14) + /* word count (including bcc) */ \
164 static NTSTATUS
receive_smb_raw_talloc_partial_read(TALLOC_CTX
*mem_ctx
,
165 const char lenbuf
[4],
166 int fd
, char **buffer
,
167 unsigned int timeout
,
171 /* Size of a WRITEX call (+4 byte len). */
172 char writeX_header
[4 + STANDARD_WRITE_AND_X_HEADER_SIZE
];
173 ssize_t len
= smb_len_large(lenbuf
); /* Could be a UNIX large writeX. */
177 memcpy(writeX_header
, lenbuf
, 4);
179 status
= read_fd_with_timeout(
180 fd
, writeX_header
+ 4,
181 STANDARD_WRITE_AND_X_HEADER_SIZE
,
182 STANDARD_WRITE_AND_X_HEADER_SIZE
,
185 if (!NT_STATUS_IS_OK(status
)) {
190 * Ok - now try and see if this is a possible
194 if (is_valid_writeX_buffer((uint8_t *)writeX_header
)) {
196 * If the data offset is beyond what
197 * we've read, drain the extra bytes.
199 uint16_t doff
= SVAL(writeX_header
,smb_vwv11
);
202 if (doff
> STANDARD_WRITE_AND_X_HEADER_SIZE
) {
203 size_t drain
= doff
- STANDARD_WRITE_AND_X_HEADER_SIZE
;
204 if (drain_socket(smbd_server_fd(), drain
) != drain
) {
205 smb_panic("receive_smb_raw_talloc_partial_read:"
206 " failed to drain pending bytes");
209 doff
= STANDARD_WRITE_AND_X_HEADER_SIZE
;
212 /* Spoof down the length and null out the bcc. */
213 set_message_bcc(writeX_header
, 0);
214 newlen
= smb_len(writeX_header
);
216 /* Copy the header we've written. */
218 *buffer
= (char *)TALLOC_MEMDUP(mem_ctx
,
220 sizeof(writeX_header
));
222 if (*buffer
== NULL
) {
223 DEBUG(0, ("Could not allocate inbuf of length %d\n",
224 (int)sizeof(writeX_header
)));
225 return NT_STATUS_NO_MEMORY
;
228 /* Work out the remaining bytes. */
229 *p_unread
= len
- STANDARD_WRITE_AND_X_HEADER_SIZE
;
230 *len_ret
= newlen
+ 4;
234 if (!valid_packet_size(len
)) {
235 return NT_STATUS_INVALID_PARAMETER
;
239 * Not a valid writeX call. Just do the standard
243 *buffer
= TALLOC_ARRAY(mem_ctx
, char, len
+4);
245 if (*buffer
== NULL
) {
246 DEBUG(0, ("Could not allocate inbuf of length %d\n",
248 return NT_STATUS_NO_MEMORY
;
251 /* Copy in what we already read. */
254 4 + STANDARD_WRITE_AND_X_HEADER_SIZE
);
255 toread
= len
- STANDARD_WRITE_AND_X_HEADER_SIZE
;
258 status
= read_packet_remainder(
259 fd
, (*buffer
) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE
,
262 if (!NT_STATUS_IS_OK(status
)) {
263 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
273 static NTSTATUS
receive_smb_raw_talloc(TALLOC_CTX
*mem_ctx
, int fd
,
274 char **buffer
, unsigned int timeout
,
275 size_t *p_unread
, size_t *plen
)
279 int min_recv_size
= lp_min_receive_file_size();
284 status
= read_smb_length_return_keepalive(fd
, lenbuf
, timeout
, &len
);
285 if (!NT_STATUS_IS_OK(status
)) {
286 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status
)));
290 if (CVAL(lenbuf
,0) == 0 && min_recv_size
&&
291 (smb_len_large(lenbuf
) > /* Could be a UNIX large writeX. */
292 (min_recv_size
+ STANDARD_WRITE_AND_X_HEADER_SIZE
)) &&
293 !srv_is_signing_active(smbd_server_conn
)) {
295 return receive_smb_raw_talloc_partial_read(
296 mem_ctx
, lenbuf
, fd
, buffer
, timeout
, p_unread
, plen
);
299 if (!valid_packet_size(len
)) {
300 return NT_STATUS_INVALID_PARAMETER
;
304 * The +4 here can't wrap, we've checked the length above already.
307 *buffer
= TALLOC_ARRAY(mem_ctx
, char, len
+4);
309 if (*buffer
== NULL
) {
310 DEBUG(0, ("Could not allocate inbuf of length %d\n",
312 return NT_STATUS_NO_MEMORY
;
315 memcpy(*buffer
, lenbuf
, sizeof(lenbuf
));
317 status
= read_packet_remainder(fd
, (*buffer
)+4, timeout
, len
);
318 if (!NT_STATUS_IS_OK(status
)) {
326 static NTSTATUS
receive_smb_talloc(TALLOC_CTX
*mem_ctx
, int fd
,
327 char **buffer
, unsigned int timeout
,
328 size_t *p_unread
, bool *p_encrypted
,
335 *p_encrypted
= false;
337 status
= receive_smb_raw_talloc(mem_ctx
, fd
, buffer
, timeout
,
339 if (!NT_STATUS_IS_OK(status
)) {
343 if (is_encrypted_packet((uint8_t *)*buffer
)) {
344 status
= srv_decrypt_buffer(*buffer
);
345 if (!NT_STATUS_IS_OK(status
)) {
346 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
347 "incoming packet! Error %s\n",
348 nt_errstr(status
) ));
354 /* Check the incoming SMB signature. */
355 if (!srv_check_sign_mac(smbd_server_conn
, *buffer
, seqnum
)) {
356 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
357 "incoming packet!\n"));
358 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
366 * Initialize a struct smb_request from an inbuf
369 void init_smb_request(struct smb_request
*req
,
374 struct smbd_server_connection
*sconn
= smbd_server_conn
;
375 size_t req_size
= smb_len(inbuf
) + 4;
376 /* Ensure we have at least smb_size bytes. */
377 if (req_size
< smb_size
) {
378 DEBUG(0,("init_smb_request: invalid request size %u\n",
379 (unsigned int)req_size
));
380 exit_server_cleanly("Invalid SMB request");
382 req
->cmd
= CVAL(inbuf
, smb_com
);
383 req
->flags2
= SVAL(inbuf
, smb_flg2
);
384 req
->smbpid
= SVAL(inbuf
, smb_pid
);
385 req
->mid
= SVAL(inbuf
, smb_mid
);
387 req
->vuid
= SVAL(inbuf
, smb_uid
);
388 req
->tid
= SVAL(inbuf
, smb_tid
);
389 req
->wct
= CVAL(inbuf
, smb_wct
);
390 req
->vwv
= (uint16_t *)(inbuf
+smb_vwv
);
391 req
->buflen
= smb_buflen(inbuf
);
392 req
->buf
= (const uint8_t *)smb_buf(inbuf
);
393 req
->unread_bytes
= unread_bytes
;
394 req
->encrypted
= encrypted
;
395 req
->conn
= conn_find(sconn
,req
->tid
);
396 req
->chain_fsp
= NULL
;
397 req
->chain_outbuf
= NULL
;
399 smb_init_perfcount_data(&req
->pcd
);
401 /* Ensure we have at least wct words and 2 bytes of bcc. */
402 if (smb_size
+ req
->wct
*2 > req_size
) {
403 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
404 (unsigned int)req
->wct
,
405 (unsigned int)req_size
));
406 exit_server_cleanly("Invalid SMB request");
408 /* Ensure bcc is correct. */
409 if (((uint8
*)smb_buf(inbuf
)) + req
->buflen
> inbuf
+ req_size
) {
410 DEBUG(0,("init_smb_request: invalid bcc number %u "
411 "(wct = %u, size %u)\n",
412 (unsigned int)req
->buflen
,
413 (unsigned int)req
->wct
,
414 (unsigned int)req_size
));
415 exit_server_cleanly("Invalid SMB request");
421 static void process_smb(struct smbd_server_connection
*conn
,
422 uint8_t *inbuf
, size_t nread
, size_t unread_bytes
,
423 uint32_t seqnum
, bool encrypted
,
424 struct smb_perfcount_data
*deferred_pcd
);
426 static void smbd_deferred_open_timer(struct event_context
*ev
,
427 struct timed_event
*te
,
428 struct timeval _tval
,
431 struct pending_message_list
*msg
= talloc_get_type(private_data
,
432 struct pending_message_list
);
433 TALLOC_CTX
*mem_ctx
= talloc_tos();
434 uint16_t mid
= SVAL(msg
->buf
.data
,smb_mid
);
437 inbuf
= (uint8_t *)talloc_memdup(mem_ctx
, msg
->buf
.data
,
440 exit_server("smbd_deferred_open_timer: talloc failed\n");
444 /* We leave this message on the queue so the open code can
445 know this is a retry. */
446 DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
447 (unsigned int)mid
));
449 /* Mark the message as processed so this is not
450 * re-processed in error. */
451 msg
->processed
= true;
453 process_smb(smbd_server_conn
, inbuf
,
455 msg
->seqnum
, msg
->encrypted
, &msg
->pcd
);
457 /* If it's still there and was processed, remove it. */
458 msg
= get_open_deferred_message(mid
);
459 if (msg
&& msg
->processed
) {
460 remove_deferred_open_smb_message(mid
);
464 /****************************************************************************
465 Function to push a message onto the tail of a linked list of smb messages ready
467 ****************************************************************************/
469 static bool push_queued_message(struct smb_request
*req
,
470 struct timeval request_time
,
471 struct timeval end_time
,
472 char *private_data
, size_t private_len
)
474 int msg_len
= smb_len(req
->inbuf
) + 4;
475 struct pending_message_list
*msg
;
477 msg
= TALLOC_ZERO_P(NULL
, struct pending_message_list
);
480 DEBUG(0,("push_message: malloc fail (1)\n"));
484 msg
->buf
= data_blob_talloc(msg
, req
->inbuf
, msg_len
);
485 if(msg
->buf
.data
== NULL
) {
486 DEBUG(0,("push_message: malloc fail (2)\n"));
491 msg
->request_time
= request_time
;
492 msg
->seqnum
= req
->seqnum
;
493 msg
->encrypted
= req
->encrypted
;
494 msg
->processed
= false;
495 SMB_PERFCOUNT_DEFER_OP(&req
->pcd
, &msg
->pcd
);
498 msg
->private_data
= data_blob_talloc(msg
, private_data
,
500 if (msg
->private_data
.data
== NULL
) {
501 DEBUG(0,("push_message: malloc fail (3)\n"));
507 msg
->te
= event_add_timed(smbd_event_context(),
510 smbd_deferred_open_timer
,
513 DEBUG(0,("push_message: event_add_timed failed\n"));
518 DLIST_ADD_END(deferred_open_queue
, msg
, struct pending_message_list
*);
520 DEBUG(10,("push_message: pushed message length %u on "
521 "deferred_open_queue\n", (unsigned int)msg_len
));
526 /****************************************************************************
527 Function to delete a sharing violation open message by mid.
528 ****************************************************************************/
530 void remove_deferred_open_smb_message(uint16 mid
)
532 struct pending_message_list
*pml
;
534 for (pml
= deferred_open_queue
; pml
; pml
= pml
->next
) {
535 if (mid
== SVAL(pml
->buf
.data
,smb_mid
)) {
536 DEBUG(10,("remove_deferred_open_smb_message: "
537 "deleting mid %u len %u\n",
539 (unsigned int)pml
->buf
.length
));
540 DLIST_REMOVE(deferred_open_queue
, pml
);
547 /****************************************************************************
548 Move a sharing violation open retry message to the front of the list and
549 schedule it for immediate processing.
550 ****************************************************************************/
552 void schedule_deferred_open_smb_message(uint16 mid
)
554 struct pending_message_list
*pml
;
557 for (pml
= deferred_open_queue
; pml
; pml
= pml
->next
) {
558 uint16 msg_mid
= SVAL(pml
->buf
.data
,smb_mid
);
560 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i
++,
561 (unsigned int)msg_mid
));
563 if (mid
== msg_mid
) {
564 struct timed_event
*te
;
566 if (pml
->processed
) {
567 /* A processed message should not be
569 DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR "
570 "message mid %u was already processed\n",
575 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
578 te
= event_add_timed(smbd_event_context(),
581 smbd_deferred_open_timer
,
584 DEBUG(10,("schedule_deferred_open_smb_message: "
585 "event_add_timed() failed, skipping mid %u\n",
589 TALLOC_FREE(pml
->te
);
591 DLIST_PROMOTE(deferred_open_queue
, pml
);
596 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
600 /****************************************************************************
601 Return true if this mid is on the deferred queue and was not yet processed.
602 ****************************************************************************/
604 bool open_was_deferred(uint16 mid
)
606 struct pending_message_list
*pml
;
608 for (pml
= deferred_open_queue
; pml
; pml
= pml
->next
) {
609 if (SVAL(pml
->buf
.data
,smb_mid
) == mid
&& !pml
->processed
) {
616 /****************************************************************************
617 Return the message queued by this mid.
618 ****************************************************************************/
620 struct pending_message_list
*get_open_deferred_message(uint16 mid
)
622 struct pending_message_list
*pml
;
624 for (pml
= deferred_open_queue
; pml
; pml
= pml
->next
) {
625 if (SVAL(pml
->buf
.data
,smb_mid
) == mid
) {
632 /****************************************************************************
633 Function to push a deferred open smb message onto a linked list of local smb
634 messages ready for processing.
635 ****************************************************************************/
637 bool push_deferred_smb_message(struct smb_request
*req
,
638 struct timeval request_time
,
639 struct timeval timeout
,
640 char *private_data
, size_t priv_len
)
642 struct timeval end_time
;
644 if (req
->unread_bytes
) {
645 DEBUG(0,("push_deferred_smb_message: logic error ! "
646 "unread_bytes = %u\n",
647 (unsigned int)req
->unread_bytes
));
648 smb_panic("push_deferred_smb_message: "
649 "logic error unread_bytes != 0" );
652 end_time
= timeval_sum(&request_time
, &timeout
);
654 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
655 "timeout time [%u.%06u]\n",
656 (unsigned int) smb_len(req
->inbuf
)+4, (unsigned int)req
->mid
,
657 (unsigned int)end_time
.tv_sec
,
658 (unsigned int)end_time
.tv_usec
));
660 return push_queued_message(req
, request_time
, end_time
,
661 private_data
, priv_len
);
665 struct timed_event
*te
;
666 struct timeval interval
;
668 bool (*handler
)(const struct timeval
*now
, void *private_data
);
672 static void smbd_idle_event_handler(struct event_context
*ctx
,
673 struct timed_event
*te
,
677 struct idle_event
*event
=
678 talloc_get_type_abort(private_data
, struct idle_event
);
680 TALLOC_FREE(event
->te
);
682 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
683 event
->name
, event
->te
));
685 if (!event
->handler(&now
, event
->private_data
)) {
686 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
687 event
->name
, event
->te
));
688 /* Don't repeat, delete ourselves */
693 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
694 event
->name
, event
->te
));
696 event
->te
= event_add_timed(ctx
, event
,
697 timeval_sum(&now
, &event
->interval
),
698 smbd_idle_event_handler
, event
);
700 /* We can't do much but fail here. */
701 SMB_ASSERT(event
->te
!= NULL
);
704 struct idle_event
*event_add_idle(struct event_context
*event_ctx
,
706 struct timeval interval
,
708 bool (*handler
)(const struct timeval
*now
,
712 struct idle_event
*result
;
713 struct timeval now
= timeval_current();
715 result
= TALLOC_P(mem_ctx
, struct idle_event
);
716 if (result
== NULL
) {
717 DEBUG(0, ("talloc failed\n"));
721 result
->interval
= interval
;
722 result
->handler
= handler
;
723 result
->private_data
= private_data
;
725 if (!(result
->name
= talloc_asprintf(result
, "idle_evt(%s)", name
))) {
726 DEBUG(0, ("talloc failed\n"));
731 result
->te
= event_add_timed(event_ctx
, result
,
732 timeval_sum(&now
, &interval
),
733 smbd_idle_event_handler
, result
);
734 if (result
->te
== NULL
) {
735 DEBUG(0, ("event_add_timed failed\n"));
740 DEBUG(10,("event_add_idle: %s %p\n", result
->name
, result
->te
));
744 static void smbd_sig_term_handler(struct tevent_context
*ev
,
745 struct tevent_signal
*se
,
751 exit_server_cleanly("termination signal");
754 void smbd_setup_sig_term_handler(void)
756 struct tevent_signal
*se
;
758 se
= tevent_add_signal(smbd_event_context(),
759 smbd_event_context(),
761 smbd_sig_term_handler
,
764 exit_server("failed to setup SIGTERM handler");
768 static void smbd_sig_hup_handler(struct tevent_context
*ev
,
769 struct tevent_signal
*se
,
775 change_to_root_user();
776 DEBUG(1,("Reloading services after SIGHUP\n"));
777 reload_services(False
);
780 void smbd_setup_sig_hup_handler(void)
782 struct tevent_signal
*se
;
784 se
= tevent_add_signal(smbd_event_context(),
785 smbd_event_context(),
787 smbd_sig_hup_handler
,
790 exit_server("failed to setup SIGHUP handler");
794 static NTSTATUS
smbd_server_connection_loop_once(struct smbd_server_connection
*conn
)
801 to
.tv_sec
= SMBD_SELECT_TIMEOUT
;
805 * Setup the select fd sets.
812 * Are there any timed events waiting ? If so, ensure we don't
813 * select for longer than it would take to wait for them.
820 event_add_to_select_args(smbd_event_context(), &now
,
821 &r_fds
, &w_fds
, &to
, &maxfd
);
824 /* Process a signal and timed events now... */
825 if (run_events(smbd_event_context(), 0, NULL
, NULL
)) {
826 return NT_STATUS_RETRY
;
831 START_PROFILE(smbd_idle
);
833 selrtn
= sys_select(maxfd
+1,&r_fds
,&w_fds
,NULL
,&to
);
836 END_PROFILE(smbd_idle
);
840 if (run_events(smbd_event_context(), selrtn
, &r_fds
, &w_fds
)) {
841 return NT_STATUS_RETRY
;
846 /* something is wrong. Maybe the socket is dead? */
847 return map_nt_error_from_unix(errno
);
850 /* Did we timeout ? */
852 return NT_STATUS_RETRY
;
855 /* should not be reached */
856 return NT_STATUS_INTERNAL_ERROR
;
860 * Only allow 5 outstanding trans requests. We're allocating memory, so
864 NTSTATUS
allow_new_trans(struct trans_state
*list
, int mid
)
867 for (; list
!= NULL
; list
= list
->next
) {
869 if (list
->mid
== mid
) {
870 return NT_STATUS_INVALID_PARAMETER
;
876 return NT_STATUS_INSUFFICIENT_RESOURCES
;
883 These flags determine some of the permissions required to do an operation
885 Note that I don't set NEED_WRITE on some write operations because they
886 are used by some brain-dead clients when printing, and I don't want to
887 force write permissions on print services.
889 #define AS_USER (1<<0)
890 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
891 #define TIME_INIT (1<<2)
892 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
893 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
894 #define DO_CHDIR (1<<6)
897 define a list of possible SMB messages and their corresponding
898 functions. Any message that has a NULL function is unimplemented -
899 please feel free to contribute implementations!
901 static const struct smb_message_struct
{
903 void (*fn
)(struct smb_request
*req
);
905 } smb_messages
[256] = {
907 /* 0x00 */ { "SMBmkdir",reply_mkdir
,AS_USER
| NEED_WRITE
},
908 /* 0x01 */ { "SMBrmdir",reply_rmdir
,AS_USER
| NEED_WRITE
},
909 /* 0x02 */ { "SMBopen",reply_open
,AS_USER
},
910 /* 0x03 */ { "SMBcreate",reply_mknew
,AS_USER
},
911 /* 0x04 */ { "SMBclose",reply_close
,AS_USER
| CAN_IPC
},
912 /* 0x05 */ { "SMBflush",reply_flush
,AS_USER
},
913 /* 0x06 */ { "SMBunlink",reply_unlink
,AS_USER
| NEED_WRITE
},
914 /* 0x07 */ { "SMBmv",reply_mv
,AS_USER
| NEED_WRITE
},
915 /* 0x08 */ { "SMBgetatr",reply_getatr
,AS_USER
},
916 /* 0x09 */ { "SMBsetatr",reply_setatr
,AS_USER
| NEED_WRITE
},
917 /* 0x0a */ { "SMBread",reply_read
,AS_USER
},
918 /* 0x0b */ { "SMBwrite",reply_write
,AS_USER
| CAN_IPC
},
919 /* 0x0c */ { "SMBlock",reply_lock
,AS_USER
},
920 /* 0x0d */ { "SMBunlock",reply_unlock
,AS_USER
},
921 /* 0x0e */ { "SMBctemp",reply_ctemp
,AS_USER
},
922 /* 0x0f */ { "SMBmknew",reply_mknew
,AS_USER
},
923 /* 0x10 */ { "SMBcheckpath",reply_checkpath
,AS_USER
},
924 /* 0x11 */ { "SMBexit",reply_exit
,DO_CHDIR
},
925 /* 0x12 */ { "SMBlseek",reply_lseek
,AS_USER
},
926 /* 0x13 */ { "SMBlockread",reply_lockread
,AS_USER
},
927 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock
,AS_USER
},
928 /* 0x15 */ { NULL
, NULL
, 0 },
929 /* 0x16 */ { NULL
, NULL
, 0 },
930 /* 0x17 */ { NULL
, NULL
, 0 },
931 /* 0x18 */ { NULL
, NULL
, 0 },
932 /* 0x19 */ { NULL
, NULL
, 0 },
933 /* 0x1a */ { "SMBreadbraw",reply_readbraw
,AS_USER
},
934 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx
,AS_USER
},
935 /* 0x1c */ { "SMBreadBs",reply_readbs
,AS_USER
},
936 /* 0x1d */ { "SMBwritebraw",reply_writebraw
,AS_USER
},
937 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx
,AS_USER
},
938 /* 0x1f */ { "SMBwriteBs",reply_writebs
,AS_USER
},
939 /* 0x20 */ { "SMBwritec", NULL
,0},
940 /* 0x21 */ { NULL
, NULL
, 0 },
941 /* 0x22 */ { "SMBsetattrE",reply_setattrE
,AS_USER
| NEED_WRITE
},
942 /* 0x23 */ { "SMBgetattrE",reply_getattrE
,AS_USER
},
943 /* 0x24 */ { "SMBlockingX",reply_lockingX
,AS_USER
},
944 /* 0x25 */ { "SMBtrans",reply_trans
,AS_USER
| CAN_IPC
},
945 /* 0x26 */ { "SMBtranss",reply_transs
,AS_USER
| CAN_IPC
},
946 /* 0x27 */ { "SMBioctl",reply_ioctl
,0},
947 /* 0x28 */ { "SMBioctls", NULL
,AS_USER
},
948 /* 0x29 */ { "SMBcopy",reply_copy
,AS_USER
| NEED_WRITE
},
949 /* 0x2a */ { "SMBmove", NULL
,AS_USER
| NEED_WRITE
},
950 /* 0x2b */ { "SMBecho",reply_echo
,0},
951 /* 0x2c */ { "SMBwriteclose",reply_writeclose
,AS_USER
},
952 /* 0x2d */ { "SMBopenX",reply_open_and_X
,AS_USER
| CAN_IPC
},
953 /* 0x2e */ { "SMBreadX",reply_read_and_X
,AS_USER
| CAN_IPC
},
954 /* 0x2f */ { "SMBwriteX",reply_write_and_X
,AS_USER
| CAN_IPC
},
955 /* 0x30 */ { NULL
, NULL
, 0 },
956 /* 0x31 */ { NULL
, NULL
, 0 },
957 /* 0x32 */ { "SMBtrans2",reply_trans2
, AS_USER
| CAN_IPC
},
958 /* 0x33 */ { "SMBtranss2",reply_transs2
, AS_USER
| CAN_IPC
},
959 /* 0x34 */ { "SMBfindclose",reply_findclose
,AS_USER
},
960 /* 0x35 */ { "SMBfindnclose",reply_findnclose
,AS_USER
},
961 /* 0x36 */ { NULL
, NULL
, 0 },
962 /* 0x37 */ { NULL
, NULL
, 0 },
963 /* 0x38 */ { NULL
, NULL
, 0 },
964 /* 0x39 */ { NULL
, NULL
, 0 },
965 /* 0x3a */ { NULL
, NULL
, 0 },
966 /* 0x3b */ { NULL
, NULL
, 0 },
967 /* 0x3c */ { NULL
, NULL
, 0 },
968 /* 0x3d */ { NULL
, NULL
, 0 },
969 /* 0x3e */ { NULL
, NULL
, 0 },
970 /* 0x3f */ { NULL
, NULL
, 0 },
971 /* 0x40 */ { NULL
, NULL
, 0 },
972 /* 0x41 */ { NULL
, NULL
, 0 },
973 /* 0x42 */ { NULL
, NULL
, 0 },
974 /* 0x43 */ { NULL
, NULL
, 0 },
975 /* 0x44 */ { NULL
, NULL
, 0 },
976 /* 0x45 */ { NULL
, NULL
, 0 },
977 /* 0x46 */ { NULL
, NULL
, 0 },
978 /* 0x47 */ { NULL
, NULL
, 0 },
979 /* 0x48 */ { NULL
, NULL
, 0 },
980 /* 0x49 */ { NULL
, NULL
, 0 },
981 /* 0x4a */ { NULL
, NULL
, 0 },
982 /* 0x4b */ { NULL
, NULL
, 0 },
983 /* 0x4c */ { NULL
, NULL
, 0 },
984 /* 0x4d */ { NULL
, NULL
, 0 },
985 /* 0x4e */ { NULL
, NULL
, 0 },
986 /* 0x4f */ { NULL
, NULL
, 0 },
987 /* 0x50 */ { NULL
, NULL
, 0 },
988 /* 0x51 */ { NULL
, NULL
, 0 },
989 /* 0x52 */ { NULL
, NULL
, 0 },
990 /* 0x53 */ { NULL
, NULL
, 0 },
991 /* 0x54 */ { NULL
, NULL
, 0 },
992 /* 0x55 */ { NULL
, NULL
, 0 },
993 /* 0x56 */ { NULL
, NULL
, 0 },
994 /* 0x57 */ { NULL
, NULL
, 0 },
995 /* 0x58 */ { NULL
, NULL
, 0 },
996 /* 0x59 */ { NULL
, NULL
, 0 },
997 /* 0x5a */ { NULL
, NULL
, 0 },
998 /* 0x5b */ { NULL
, NULL
, 0 },
999 /* 0x5c */ { NULL
, NULL
, 0 },
1000 /* 0x5d */ { NULL
, NULL
, 0 },
1001 /* 0x5e */ { NULL
, NULL
, 0 },
1002 /* 0x5f */ { NULL
, NULL
, 0 },
1003 /* 0x60 */ { NULL
, NULL
, 0 },
1004 /* 0x61 */ { NULL
, NULL
, 0 },
1005 /* 0x62 */ { NULL
, NULL
, 0 },
1006 /* 0x63 */ { NULL
, NULL
, 0 },
1007 /* 0x64 */ { NULL
, NULL
, 0 },
1008 /* 0x65 */ { NULL
, NULL
, 0 },
1009 /* 0x66 */ { NULL
, NULL
, 0 },
1010 /* 0x67 */ { NULL
, NULL
, 0 },
1011 /* 0x68 */ { NULL
, NULL
, 0 },
1012 /* 0x69 */ { NULL
, NULL
, 0 },
1013 /* 0x6a */ { NULL
, NULL
, 0 },
1014 /* 0x6b */ { NULL
, NULL
, 0 },
1015 /* 0x6c */ { NULL
, NULL
, 0 },
1016 /* 0x6d */ { NULL
, NULL
, 0 },
1017 /* 0x6e */ { NULL
, NULL
, 0 },
1018 /* 0x6f */ { NULL
, NULL
, 0 },
1019 /* 0x70 */ { "SMBtcon",reply_tcon
,0},
1020 /* 0x71 */ { "SMBtdis",reply_tdis
,DO_CHDIR
},
1021 /* 0x72 */ { "SMBnegprot",reply_negprot
,0},
1022 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X
,0},
1023 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX
, 0}, /* ulogoff doesn't give a valid TID */
1024 /* 0x75 */ { "SMBtconX",reply_tcon_and_X
,0},
1025 /* 0x76 */ { NULL
, NULL
, 0 },
1026 /* 0x77 */ { NULL
, NULL
, 0 },
1027 /* 0x78 */ { NULL
, NULL
, 0 },
1028 /* 0x79 */ { NULL
, NULL
, 0 },
1029 /* 0x7a */ { NULL
, NULL
, 0 },
1030 /* 0x7b */ { NULL
, NULL
, 0 },
1031 /* 0x7c */ { NULL
, NULL
, 0 },
1032 /* 0x7d */ { NULL
, NULL
, 0 },
1033 /* 0x7e */ { NULL
, NULL
, 0 },
1034 /* 0x7f */ { NULL
, NULL
, 0 },
1035 /* 0x80 */ { "SMBdskattr",reply_dskattr
,AS_USER
},
1036 /* 0x81 */ { "SMBsearch",reply_search
,AS_USER
},
1037 /* 0x82 */ { "SMBffirst",reply_search
,AS_USER
},
1038 /* 0x83 */ { "SMBfunique",reply_search
,AS_USER
},
1039 /* 0x84 */ { "SMBfclose",reply_fclose
,AS_USER
},
1040 /* 0x85 */ { NULL
, NULL
, 0 },
1041 /* 0x86 */ { NULL
, NULL
, 0 },
1042 /* 0x87 */ { NULL
, NULL
, 0 },
1043 /* 0x88 */ { NULL
, NULL
, 0 },
1044 /* 0x89 */ { NULL
, NULL
, 0 },
1045 /* 0x8a */ { NULL
, NULL
, 0 },
1046 /* 0x8b */ { NULL
, NULL
, 0 },
1047 /* 0x8c */ { NULL
, NULL
, 0 },
1048 /* 0x8d */ { NULL
, NULL
, 0 },
1049 /* 0x8e */ { NULL
, NULL
, 0 },
1050 /* 0x8f */ { NULL
, NULL
, 0 },
1051 /* 0x90 */ { NULL
, NULL
, 0 },
1052 /* 0x91 */ { NULL
, NULL
, 0 },
1053 /* 0x92 */ { NULL
, NULL
, 0 },
1054 /* 0x93 */ { NULL
, NULL
, 0 },
1055 /* 0x94 */ { NULL
, NULL
, 0 },
1056 /* 0x95 */ { NULL
, NULL
, 0 },
1057 /* 0x96 */ { NULL
, NULL
, 0 },
1058 /* 0x97 */ { NULL
, NULL
, 0 },
1059 /* 0x98 */ { NULL
, NULL
, 0 },
1060 /* 0x99 */ { NULL
, NULL
, 0 },
1061 /* 0x9a */ { NULL
, NULL
, 0 },
1062 /* 0x9b */ { NULL
, NULL
, 0 },
1063 /* 0x9c */ { NULL
, NULL
, 0 },
1064 /* 0x9d */ { NULL
, NULL
, 0 },
1065 /* 0x9e */ { NULL
, NULL
, 0 },
1066 /* 0x9f */ { NULL
, NULL
, 0 },
1067 /* 0xa0 */ { "SMBnttrans",reply_nttrans
, AS_USER
| CAN_IPC
},
1068 /* 0xa1 */ { "SMBnttranss",reply_nttranss
, AS_USER
| CAN_IPC
},
1069 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X
, AS_USER
| CAN_IPC
},
1070 /* 0xa3 */ { NULL
, NULL
, 0 },
1071 /* 0xa4 */ { "SMBntcancel",reply_ntcancel
, 0 },
1072 /* 0xa5 */ { "SMBntrename",reply_ntrename
, AS_USER
| NEED_WRITE
},
1073 /* 0xa6 */ { NULL
, NULL
, 0 },
1074 /* 0xa7 */ { NULL
, NULL
, 0 },
1075 /* 0xa8 */ { NULL
, NULL
, 0 },
1076 /* 0xa9 */ { NULL
, NULL
, 0 },
1077 /* 0xaa */ { NULL
, NULL
, 0 },
1078 /* 0xab */ { NULL
, NULL
, 0 },
1079 /* 0xac */ { NULL
, NULL
, 0 },
1080 /* 0xad */ { NULL
, NULL
, 0 },
1081 /* 0xae */ { NULL
, NULL
, 0 },
1082 /* 0xaf */ { NULL
, NULL
, 0 },
1083 /* 0xb0 */ { NULL
, NULL
, 0 },
1084 /* 0xb1 */ { NULL
, NULL
, 0 },
1085 /* 0xb2 */ { NULL
, NULL
, 0 },
1086 /* 0xb3 */ { NULL
, NULL
, 0 },
1087 /* 0xb4 */ { NULL
, NULL
, 0 },
1088 /* 0xb5 */ { NULL
, NULL
, 0 },
1089 /* 0xb6 */ { NULL
, NULL
, 0 },
1090 /* 0xb7 */ { NULL
, NULL
, 0 },
1091 /* 0xb8 */ { NULL
, NULL
, 0 },
1092 /* 0xb9 */ { NULL
, NULL
, 0 },
1093 /* 0xba */ { NULL
, NULL
, 0 },
1094 /* 0xbb */ { NULL
, NULL
, 0 },
1095 /* 0xbc */ { NULL
, NULL
, 0 },
1096 /* 0xbd */ { NULL
, NULL
, 0 },
1097 /* 0xbe */ { NULL
, NULL
, 0 },
1098 /* 0xbf */ { NULL
, NULL
, 0 },
1099 /* 0xc0 */ { "SMBsplopen",reply_printopen
,AS_USER
},
1100 /* 0xc1 */ { "SMBsplwr",reply_printwrite
,AS_USER
},
1101 /* 0xc2 */ { "SMBsplclose",reply_printclose
,AS_USER
},
1102 /* 0xc3 */ { "SMBsplretq",reply_printqueue
,AS_USER
},
1103 /* 0xc4 */ { NULL
, NULL
, 0 },
1104 /* 0xc5 */ { NULL
, NULL
, 0 },
1105 /* 0xc6 */ { NULL
, NULL
, 0 },
1106 /* 0xc7 */ { NULL
, NULL
, 0 },
1107 /* 0xc8 */ { NULL
, NULL
, 0 },
1108 /* 0xc9 */ { NULL
, NULL
, 0 },
1109 /* 0xca */ { NULL
, NULL
, 0 },
1110 /* 0xcb */ { NULL
, NULL
, 0 },
1111 /* 0xcc */ { NULL
, NULL
, 0 },
1112 /* 0xcd */ { NULL
, NULL
, 0 },
1113 /* 0xce */ { NULL
, NULL
, 0 },
1114 /* 0xcf */ { NULL
, NULL
, 0 },
1115 /* 0xd0 */ { "SMBsends",reply_sends
,AS_GUEST
},
1116 /* 0xd1 */ { "SMBsendb", NULL
,AS_GUEST
},
1117 /* 0xd2 */ { "SMBfwdname", NULL
,AS_GUEST
},
1118 /* 0xd3 */ { "SMBcancelf", NULL
,AS_GUEST
},
1119 /* 0xd4 */ { "SMBgetmac", NULL
,AS_GUEST
},
1120 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt
,AS_GUEST
},
1121 /* 0xd6 */ { "SMBsendend",reply_sendend
,AS_GUEST
},
1122 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt
,AS_GUEST
},
1123 /* 0xd8 */ { NULL
, NULL
, 0 },
1124 /* 0xd9 */ { NULL
, NULL
, 0 },
1125 /* 0xda */ { NULL
, NULL
, 0 },
1126 /* 0xdb */ { NULL
, NULL
, 0 },
1127 /* 0xdc */ { NULL
, NULL
, 0 },
1128 /* 0xdd */ { NULL
, NULL
, 0 },
1129 /* 0xde */ { NULL
, NULL
, 0 },
1130 /* 0xdf */ { NULL
, NULL
, 0 },
1131 /* 0xe0 */ { NULL
, NULL
, 0 },
1132 /* 0xe1 */ { NULL
, NULL
, 0 },
1133 /* 0xe2 */ { NULL
, NULL
, 0 },
1134 /* 0xe3 */ { NULL
, NULL
, 0 },
1135 /* 0xe4 */ { NULL
, NULL
, 0 },
1136 /* 0xe5 */ { NULL
, NULL
, 0 },
1137 /* 0xe6 */ { NULL
, NULL
, 0 },
1138 /* 0xe7 */ { NULL
, NULL
, 0 },
1139 /* 0xe8 */ { NULL
, NULL
, 0 },
1140 /* 0xe9 */ { NULL
, NULL
, 0 },
1141 /* 0xea */ { NULL
, NULL
, 0 },
1142 /* 0xeb */ { NULL
, NULL
, 0 },
1143 /* 0xec */ { NULL
, NULL
, 0 },
1144 /* 0xed */ { NULL
, NULL
, 0 },
1145 /* 0xee */ { NULL
, NULL
, 0 },
1146 /* 0xef */ { NULL
, NULL
, 0 },
1147 /* 0xf0 */ { NULL
, NULL
, 0 },
1148 /* 0xf1 */ { NULL
, NULL
, 0 },
1149 /* 0xf2 */ { NULL
, NULL
, 0 },
1150 /* 0xf3 */ { NULL
, NULL
, 0 },
1151 /* 0xf4 */ { NULL
, NULL
, 0 },
1152 /* 0xf5 */ { NULL
, NULL
, 0 },
1153 /* 0xf6 */ { NULL
, NULL
, 0 },
1154 /* 0xf7 */ { NULL
, NULL
, 0 },
1155 /* 0xf8 */ { NULL
, NULL
, 0 },
1156 /* 0xf9 */ { NULL
, NULL
, 0 },
1157 /* 0xfa */ { NULL
, NULL
, 0 },
1158 /* 0xfb */ { NULL
, NULL
, 0 },
1159 /* 0xfc */ { NULL
, NULL
, 0 },
1160 /* 0xfd */ { NULL
, NULL
, 0 },
1161 /* 0xfe */ { NULL
, NULL
, 0 },
1162 /* 0xff */ { NULL
, NULL
, 0 }
1166 /*******************************************************************
1167 allocate and initialize a reply packet
1168 ********************************************************************/
1170 static bool create_outbuf(TALLOC_CTX
*mem_ctx
, struct smb_request
*req
,
1171 const char *inbuf
, char **outbuf
, uint8_t num_words
,
1175 * Protect against integer wrap
1177 if ((num_bytes
> 0xffffff)
1178 || ((num_bytes
+ smb_size
+ num_words
*2) > 0xffffff)) {
1180 if (asprintf(&msg
, "num_bytes too large: %u",
1181 (unsigned)num_bytes
) == -1) {
1182 msg
= CONST_DISCARD(char *, "num_bytes too large");
1187 *outbuf
= TALLOC_ARRAY(mem_ctx
, char,
1188 smb_size
+ num_words
*2 + num_bytes
);
1189 if (*outbuf
== NULL
) {
1193 construct_reply_common(req
, inbuf
, *outbuf
);
1194 srv_set_message(*outbuf
, num_words
, num_bytes
, false);
1196 * Zero out the word area, the caller has to take care of the bcc area
1199 if (num_words
!= 0) {
1200 memset(*outbuf
+ smb_vwv0
, 0, num_words
*2);
1206 void reply_outbuf(struct smb_request
*req
, uint8 num_words
, uint32 num_bytes
)
1209 if (!create_outbuf(req
, req
, (char *)req
->inbuf
, &outbuf
, num_words
,
1211 smb_panic("could not allocate output buffer\n");
1213 req
->outbuf
= (uint8_t *)outbuf
;
1217 /*******************************************************************
1218 Dump a packet to a file.
1219 ********************************************************************/
1221 static void smb_dump(const char *name
, int type
, const char *data
, ssize_t len
)
1225 if (DEBUGLEVEL
< 50) {
1229 if (len
< 4) len
= smb_len(data
)+4;
1230 for (i
=1;i
<100;i
++) {
1231 if (asprintf(&fname
, "/tmp/%s.%d.%s", name
, i
,
1232 type
? "req" : "resp") == -1) {
1235 fd
= open(fname
, O_WRONLY
|O_CREAT
|O_EXCL
, 0644);
1236 if (fd
!= -1 || errno
!= EEXIST
) break;
1239 ssize_t ret
= write(fd
, data
, len
);
1241 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret
));
1243 DEBUG(0,("created %s len %lu\n", fname
, (unsigned long)len
));
1248 /****************************************************************************
1249 Prepare everything for calling the actual request function, and potentially
1250 call the request function via the "new" interface.
1252 Return False if the "legacy" function needs to be called, everything is
1255 Return True if we're done.
1257 I know this API sucks, but it is the one with the least code change I could
1259 ****************************************************************************/
1261 static connection_struct
*switch_message(uint8 type
, struct smb_request
*req
, int size
)
1265 connection_struct
*conn
= NULL
;
1266 struct smbd_server_connection
*sconn
= smbd_server_conn
;
1270 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1271 * so subtract 4 from it. */
1272 if (!valid_smb_header(req
->inbuf
)
1273 || (size
< (smb_size
- 4))) {
1274 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1275 smb_len(req
->inbuf
)));
1276 exit_server_cleanly("Non-SMB packet");
1279 if (smb_messages
[type
].fn
== NULL
) {
1280 DEBUG(0,("Unknown message type %d!\n",type
));
1281 smb_dump("Unknown", 1, (char *)req
->inbuf
, size
);
1282 reply_unknown_new(req
, type
);
1286 flags
= smb_messages
[type
].flags
;
1288 /* In share mode security we must ignore the vuid. */
1289 session_tag
= (lp_security() == SEC_SHARE
)
1290 ? UID_FIELD_INVALID
: req
->vuid
;
1293 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type
),
1294 (int)sys_getpid(), (unsigned long)conn
));
1296 smb_dump(smb_fn_name(type
), 1, (char *)req
->inbuf
, size
);
1298 /* Ensure this value is replaced in the incoming packet. */
1299 SSVAL(req
->inbuf
,smb_uid
,session_tag
);
1302 * Ensure the correct username is in current_user_info. This is a
1303 * really ugly bugfix for problems with multiple session_setup_and_X's
1304 * being done and allowing %U and %G substitutions to work correctly.
1305 * There is a reason this code is done here, don't move it unless you
1306 * know what you're doing... :-).
1310 if (session_tag
!= sconn
->smb1
.sessions
.last_session_tag
) {
1311 user_struct
*vuser
= NULL
;
1313 sconn
->smb1
.sessions
.last_session_tag
= session_tag
;
1314 if(session_tag
!= UID_FIELD_INVALID
) {
1315 vuser
= get_valid_user_struct(sconn
, session_tag
);
1317 set_current_user_info(
1318 vuser
->server_info
->sanitized_username
,
1319 vuser
->server_info
->unix_name
,
1320 pdb_get_domain(vuser
->server_info
1326 /* Does this call need to be run as the connected user? */
1327 if (flags
& AS_USER
) {
1329 /* Does this call need a valid tree connection? */
1332 * Amazingly, the error code depends on the command
1335 if (type
== SMBntcreateX
) {
1336 reply_nterror(req
, NT_STATUS_INVALID_HANDLE
);
1338 reply_nterror(req
, NT_STATUS_NETWORK_NAME_DELETED
);
1343 if (!change_to_user(conn
,session_tag
)) {
1344 DEBUG(0, ("Error: Could not change to user. Removing "
1345 "deferred open, mid=%d.\n", req
->mid
));
1346 reply_force_doserror(req
, ERRSRV
, ERRbaduid
);
1350 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1352 /* Does it need write permission? */
1353 if ((flags
& NEED_WRITE
) && !CAN_WRITE(conn
)) {
1354 reply_nterror(req
, NT_STATUS_MEDIA_WRITE_PROTECTED
);
1358 /* IPC services are limited */
1359 if (IS_IPC(conn
) && !(flags
& CAN_IPC
)) {
1360 reply_nterror(req
, NT_STATUS_ACCESS_DENIED
);
1364 /* This call needs to be run as root */
1365 change_to_root_user();
1368 /* load service specific parameters */
1370 if (req
->encrypted
) {
1371 conn
->encrypted_tid
= true;
1372 /* encrypted required from now on. */
1373 conn
->encrypt_level
= Required
;
1374 } else if (ENCRYPTION_REQUIRED(conn
)) {
1375 if (req
->cmd
!= SMBtrans2
&& req
->cmd
!= SMBtranss2
) {
1376 exit_server_cleanly("encryption required "
1382 if (!set_current_service(conn
,SVAL(req
->inbuf
,smb_flg
),
1383 (flags
& (AS_USER
|DO_CHDIR
)
1385 reply_nterror(req
, NT_STATUS_ACCESS_DENIED
);
1388 conn
->num_smb_operations
++;
1391 /* does this protocol need to be run as guest? */
1392 if ((flags
& AS_GUEST
)
1393 && (!change_to_guest() ||
1394 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1395 lp_hostsdeny(-1)))) {
1396 reply_nterror(req
, NT_STATUS_ACCESS_DENIED
);
1400 smb_messages
[type
].fn(req
);
1404 /****************************************************************************
1405 Construct a reply to the incoming packet.
1406 ****************************************************************************/
1408 static void construct_reply(char *inbuf
, int size
, size_t unread_bytes
,
1409 uint32_t seqnum
, bool encrypted
,
1410 struct smb_perfcount_data
*deferred_pcd
)
1412 connection_struct
*conn
;
1413 struct smb_request
*req
;
1415 if (!(req
= talloc(talloc_tos(), struct smb_request
))) {
1416 smb_panic("could not allocate smb_request");
1419 init_smb_request(req
, (uint8
*)inbuf
, unread_bytes
, encrypted
);
1420 req
->inbuf
= (uint8_t *)talloc_move(req
, &inbuf
);
1421 req
->seqnum
= seqnum
;
1423 /* we popped this message off the queue - keep original perf data */
1425 req
->pcd
= *deferred_pcd
;
1427 SMB_PERFCOUNT_START(&req
->pcd
);
1428 SMB_PERFCOUNT_SET_OP(&req
->pcd
, req
->cmd
);
1429 SMB_PERFCOUNT_SET_MSGLEN_IN(&req
->pcd
, size
);
1432 conn
= switch_message(req
->cmd
, req
, size
);
1434 if (req
->unread_bytes
) {
1435 /* writeX failed. drain socket. */
1436 if (drain_socket(smbd_server_fd(), req
->unread_bytes
) !=
1437 req
->unread_bytes
) {
1438 smb_panic("failed to drain pending bytes");
1440 req
->unread_bytes
= 0;
1448 if (req
->outbuf
== NULL
) {
1452 if (CVAL(req
->outbuf
,0) == 0) {
1453 show_msg((char *)req
->outbuf
);
1456 if (!srv_send_smb(smbd_server_fd(),
1457 (char *)req
->outbuf
,
1458 true, req
->seqnum
+1,
1459 IS_CONN_ENCRYPTED(conn
)||req
->encrypted
,
1461 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1469 /****************************************************************************
1470 Process an smb from the client
1471 ****************************************************************************/
1472 static void process_smb(struct smbd_server_connection
*conn
,
1473 uint8_t *inbuf
, size_t nread
, size_t unread_bytes
,
1474 uint32_t seqnum
, bool encrypted
,
1475 struct smb_perfcount_data
*deferred_pcd
)
1477 int msg_type
= CVAL(inbuf
,0);
1479 DO_PROFILE_INC(smb_count
);
1481 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type
,
1483 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num
,
1485 (unsigned int)unread_bytes
));
1487 if (msg_type
!= 0) {
1489 * NetBIOS session request, keepalive, etc.
1491 reply_special((char *)inbuf
, nread
);
1495 if (smbd_server_conn
->allow_smb2
) {
1496 if (smbd_is_smb2_header(inbuf
, nread
)) {
1497 smbd_smb2_first_negprot(smbd_server_conn
, inbuf
, nread
);
1500 smbd_server_conn
->allow_smb2
= false;
1503 show_msg((char *)inbuf
);
1505 construct_reply((char *)inbuf
,nread
,unread_bytes
,seqnum
,encrypted
,deferred_pcd
);
1509 conn
->smb1
.num_requests
++;
1511 /* The timeout_processing function isn't run nearly
1512 often enough to implement 'max log size' without
1513 overrunning the size of the file by many megabytes.
1514 This is especially true if we are running at debug
1515 level 10. Checking every 50 SMBs is a nice
1516 tradeoff of performance vs log file size overrun. */
1518 if ((conn
->smb1
.num_requests
% 50) == 0 &&
1519 need_to_check_log_size()) {
1520 change_to_root_user();
1525 /****************************************************************************
1526 Return a string containing the function name of a SMB command.
1527 ****************************************************************************/
1529 const char *smb_fn_name(int type
)
1531 const char *unknown_name
= "SMBunknown";
1533 if (smb_messages
[type
].name
== NULL
)
1534 return(unknown_name
);
1536 return(smb_messages
[type
].name
);
1539 /****************************************************************************
1540 Helper functions for contruct_reply.
1541 ****************************************************************************/
1543 void add_to_common_flags2(uint32 v
)
1548 void remove_from_common_flags2(uint32 v
)
1550 common_flags2
&= ~v
;
1553 static void construct_reply_common(struct smb_request
*req
, const char *inbuf
,
1556 srv_set_message(outbuf
,0,0,false);
1558 SCVAL(outbuf
, smb_com
, req
->cmd
);
1559 SIVAL(outbuf
,smb_rcls
,0);
1560 SCVAL(outbuf
,smb_flg
, FLAG_REPLY
| (CVAL(inbuf
,smb_flg
) & FLAG_CASELESS_PATHNAMES
));
1561 SSVAL(outbuf
,smb_flg2
,
1562 (SVAL(inbuf
,smb_flg2
) & FLAGS2_UNICODE_STRINGS
) |
1564 memset(outbuf
+smb_pidhigh
,'\0',(smb_tid
-smb_pidhigh
));
1566 SSVAL(outbuf
,smb_tid
,SVAL(inbuf
,smb_tid
));
1567 SSVAL(outbuf
,smb_pid
,SVAL(inbuf
,smb_pid
));
1568 SSVAL(outbuf
,smb_uid
,SVAL(inbuf
,smb_uid
));
1569 SSVAL(outbuf
,smb_mid
,SVAL(inbuf
,smb_mid
));
1572 void construct_reply_common_req(struct smb_request
*req
, char *outbuf
)
1574 construct_reply_common(req
, (char *)req
->inbuf
, outbuf
);
1578 * How many bytes have we already accumulated up to the current wct field
1582 size_t req_wct_ofs(struct smb_request
*req
)
1586 if (req
->chain_outbuf
== NULL
) {
1589 buf_size
= talloc_get_size(req
->chain_outbuf
);
1590 if ((buf_size
% 4) != 0) {
1591 buf_size
+= (4 - (buf_size
% 4));
1593 return buf_size
- 4;
1597 * Hack around reply_nterror & friends not being aware of chained requests,
1598 * generating illegal (i.e. wct==0) chain replies.
1601 static void fixup_chain_error_packet(struct smb_request
*req
)
1603 uint8_t *outbuf
= req
->outbuf
;
1605 reply_outbuf(req
, 2, 0);
1606 memcpy(req
->outbuf
, outbuf
, smb_wct
);
1607 TALLOC_FREE(outbuf
);
1608 SCVAL(req
->outbuf
, smb_vwv0
, 0xff);
1612 * @brief Find the smb_cmd offset of the last command pushed
1613 * @param[in] buf The buffer we're building up
1614 * @retval Where can we put our next andx cmd?
1616 * While chaining requests, the "next" request we're looking at needs to put
1617 * its SMB_Command before the data the previous request already built up added
1618 * to the chain. Find the offset to the place where we have to put our cmd.
1621 static bool find_andx_cmd_ofs(uint8_t *buf
, size_t *pofs
)
1626 cmd
= CVAL(buf
, smb_com
);
1628 SMB_ASSERT(is_andx_req(cmd
));
1632 while (CVAL(buf
, ofs
) != 0xff) {
1634 if (!is_andx_req(CVAL(buf
, ofs
))) {
1639 * ofs is from start of smb header, so add the 4 length
1640 * bytes. The next cmd is right after the wct field.
1642 ofs
= SVAL(buf
, ofs
+2) + 4 + 1;
1644 SMB_ASSERT(ofs
+4 < talloc_get_size(buf
));
1652 * @brief Do the smb chaining at a buffer level
1653 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1654 * @param[in] smb_command The command that we want to issue
1655 * @param[in] wct How many words?
1656 * @param[in] vwv The words, already in network order
1657 * @param[in] bytes_alignment How shall we align "bytes"?
1658 * @param[in] num_bytes How many bytes?
1659 * @param[in] bytes The data the request ships
1661 * smb_splice_chain() adds the vwv and bytes to the request already present in
1665 static bool smb_splice_chain(uint8_t **poutbuf
, uint8_t smb_command
,
1666 uint8_t wct
, const uint16_t *vwv
,
1667 size_t bytes_alignment
,
1668 uint32_t num_bytes
, const uint8_t *bytes
)
1671 size_t old_size
, new_size
;
1673 size_t chain_padding
= 0;
1674 size_t bytes_padding
= 0;
1677 old_size
= talloc_get_size(*poutbuf
);
1680 * old_size == smb_wct means we're pushing the first request in for
1684 first_request
= (old_size
== smb_wct
);
1686 if (!first_request
&& ((old_size
% 4) != 0)) {
1688 * Align the wct field of subsequent requests to a 4-byte
1691 chain_padding
= 4 - (old_size
% 4);
1695 * After the old request comes the new wct field (1 byte), the vwv's
1696 * and the num_bytes field. After at we might need to align the bytes
1697 * given to us to "bytes_alignment", increasing the num_bytes value.
1700 new_size
= old_size
+ chain_padding
+ 1 + wct
* sizeof(uint16_t) + 2;
1702 if ((bytes_alignment
!= 0) && ((new_size
% bytes_alignment
) != 0)) {
1703 bytes_padding
= bytes_alignment
- (new_size
% bytes_alignment
);
1706 new_size
+= bytes_padding
+ num_bytes
;
1708 if ((smb_command
!= SMBwriteX
) && (new_size
> 0xffff)) {
1709 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1710 (unsigned)new_size
));
1714 outbuf
= TALLOC_REALLOC_ARRAY(NULL
, *poutbuf
, uint8_t, new_size
);
1715 if (outbuf
== NULL
) {
1716 DEBUG(0, ("talloc failed\n"));
1721 if (first_request
) {
1722 SCVAL(outbuf
, smb_com
, smb_command
);
1724 size_t andx_cmd_ofs
;
1726 if (!find_andx_cmd_ofs(outbuf
, &andx_cmd_ofs
)) {
1727 DEBUG(1, ("invalid command chain\n"));
1728 *poutbuf
= TALLOC_REALLOC_ARRAY(
1729 NULL
, *poutbuf
, uint8_t, old_size
);
1733 if (chain_padding
!= 0) {
1734 memset(outbuf
+ old_size
, 0, chain_padding
);
1735 old_size
+= chain_padding
;
1738 SCVAL(outbuf
, andx_cmd_ofs
, smb_command
);
1739 SSVAL(outbuf
, andx_cmd_ofs
+ 2, old_size
- 4);
1745 * Push the chained request:
1750 SCVAL(outbuf
, ofs
, wct
);
1757 memcpy(outbuf
+ ofs
, vwv
, sizeof(uint16_t) * wct
);
1758 ofs
+= sizeof(uint16_t) * wct
;
1764 SSVAL(outbuf
, ofs
, num_bytes
+ bytes_padding
);
1765 ofs
+= sizeof(uint16_t);
1771 if (bytes_padding
!= 0) {
1772 memset(outbuf
+ ofs
, 0, bytes_padding
);
1773 ofs
+= bytes_padding
;
1780 memcpy(outbuf
+ ofs
, bytes
, num_bytes
);
1785 /****************************************************************************
1786 Construct a chained reply and add it to the already made reply
1787 ****************************************************************************/
1789 void chain_reply(struct smb_request
*req
)
1791 size_t smblen
= smb_len(req
->inbuf
);
1792 size_t already_used
, length_needed
;
1794 uint32_t chain_offset
; /* uint32_t to avoid overflow */
1801 if (IVAL(req
->outbuf
, smb_rcls
) != 0) {
1802 fixup_chain_error_packet(req
);
1806 * Any of the AndX requests and replies have at least a wct of
1807 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1808 * beginning of the SMB header to the next wct field.
1810 * None of the AndX requests put anything valuable in vwv[0] and [1],
1811 * so we can overwrite it here to form the chain.
1814 if ((req
->wct
< 2) || (CVAL(req
->outbuf
, smb_wct
) < 2)) {
1815 if (req
->chain_outbuf
== NULL
) {
1816 req
->chain_outbuf
= TALLOC_REALLOC_ARRAY(
1817 req
, req
->outbuf
, uint8_t,
1818 smb_len(req
->outbuf
) + 4);
1819 if (req
->chain_outbuf
== NULL
) {
1820 smb_panic("talloc failed");
1828 * Here we assume that this is the end of the chain. For that we need
1829 * to set "next command" to 0xff and the offset to 0. If we later find
1830 * more commands in the chain, this will be overwritten again.
1833 SCVAL(req
->outbuf
, smb_vwv0
, 0xff);
1834 SCVAL(req
->outbuf
, smb_vwv0
+1, 0);
1835 SSVAL(req
->outbuf
, smb_vwv1
, 0);
1837 if (req
->chain_outbuf
== NULL
) {
1839 * In req->chain_outbuf we collect all the replies. Start the
1840 * chain by copying in the first reply.
1842 * We do the realloc because later on we depend on
1843 * talloc_get_size to determine the length of
1844 * chain_outbuf. The reply_xxx routines might have
1845 * over-allocated (reply_pipe_read_and_X used to be such an
1848 req
->chain_outbuf
= TALLOC_REALLOC_ARRAY(
1849 req
, req
->outbuf
, uint8_t, smb_len(req
->outbuf
) + 4);
1850 if (req
->chain_outbuf
== NULL
) {
1851 smb_panic("talloc failed");
1856 * Update smb headers where subsequent chained commands
1857 * may have updated them.
1859 SCVAL(req
->chain_outbuf
, smb_tid
, CVAL(req
->outbuf
, smb_tid
));
1860 SCVAL(req
->chain_outbuf
, smb_uid
, CVAL(req
->outbuf
, smb_uid
));
1862 if (!smb_splice_chain(&req
->chain_outbuf
,
1863 CVAL(req
->outbuf
, smb_com
),
1864 CVAL(req
->outbuf
, smb_wct
),
1865 (uint16_t *)(req
->outbuf
+ smb_vwv
),
1866 0, smb_buflen(req
->outbuf
),
1867 (uint8_t *)smb_buf(req
->outbuf
))) {
1870 TALLOC_FREE(req
->outbuf
);
1874 * We use the old request's vwv field to grab the next chained command
1875 * and offset into the chained fields.
1878 chain_cmd
= CVAL(req
->vwv
+0, 0);
1879 chain_offset
= SVAL(req
->vwv
+1, 0);
1881 if (chain_cmd
== 0xff) {
1883 * End of chain, no more requests from the client. So ship the
1886 smb_setlen((char *)(req
->chain_outbuf
),
1887 talloc_get_size(req
->chain_outbuf
) - 4);
1889 if (!srv_send_smb(smbd_server_fd(), (char *)req
->chain_outbuf
,
1890 true, req
->seqnum
+1,
1891 IS_CONN_ENCRYPTED(req
->conn
)
1894 exit_server_cleanly("chain_reply: srv_send_smb "
1897 TALLOC_FREE(req
->chain_outbuf
);
1902 /* add a new perfcounter for this element of chain */
1903 SMB_PERFCOUNT_ADD(&req
->pcd
);
1904 SMB_PERFCOUNT_SET_OP(&req
->pcd
, chain_cmd
);
1905 SMB_PERFCOUNT_SET_MSGLEN_IN(&req
->pcd
, smblen
);
1908 * Check if the client tries to fool us. The request so far uses the
1909 * space to the end of the byte buffer in the request just
1910 * processed. The chain_offset can't point into that area. If that was
1911 * the case, we could end up with an endless processing of the chain,
1912 * we would always handle the same request.
1915 already_used
= PTR_DIFF(req
->buf
+req
->buflen
, smb_base(req
->inbuf
));
1916 if (chain_offset
< already_used
) {
1921 * Next check: Make sure the chain offset does not point beyond the
1922 * overall smb request length.
1925 length_needed
= chain_offset
+1; /* wct */
1926 if (length_needed
> smblen
) {
1931 * Now comes the pointer magic. Goal here is to set up req->vwv and
1932 * req->buf correctly again to be able to call the subsequent
1933 * switch_message(). The chain offset (the former vwv[1]) points at
1934 * the new wct field.
1937 wct
= CVAL(smb_base(req
->inbuf
), chain_offset
);
1940 * Next consistency check: Make the new vwv array fits in the overall
1944 length_needed
+= (wct
+1)*sizeof(uint16_t); /* vwv+buflen */
1945 if (length_needed
> smblen
) {
1948 vwv
= (uint16_t *)(smb_base(req
->inbuf
) + chain_offset
+ 1);
1951 * Now grab the new byte buffer....
1954 buflen
= SVAL(vwv
+wct
, 0);
1957 * .. and check that it fits.
1960 length_needed
+= buflen
;
1961 if (length_needed
> smblen
) {
1964 buf
= (uint8_t *)(vwv
+wct
+1);
1966 req
->cmd
= chain_cmd
;
1969 req
->buflen
= buflen
;
1972 switch_message(chain_cmd
, req
, smblen
);
1974 if (req
->outbuf
== NULL
) {
1976 * This happens if the chained command has suspended itself or
1977 * if it has called srv_send_smb() itself.
1983 * We end up here if the chained command was not itself chained or
1984 * suspended, but for example a close() command. We now need to splice
1985 * the chained commands' outbuf into the already built up chain_outbuf
1986 * and ship the result.
1992 * We end up here if there's any error in the chain syntax. Report a
1993 * DOS error, just like Windows does.
1995 reply_force_doserror(req
, ERRSRV
, ERRerror
);
1996 fixup_chain_error_packet(req
);
2000 * This scary statement intends to set the
2001 * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2002 * to the value req->outbuf carries
2004 SSVAL(req
->chain_outbuf
, smb_flg2
,
2005 (SVAL(req
->chain_outbuf
, smb_flg2
) & ~FLAGS2_32_BIT_ERROR_CODES
)
2006 | (SVAL(req
->outbuf
, smb_flg2
) & FLAGS2_32_BIT_ERROR_CODES
));
2009 * Transfer the error codes from the subrequest to the main one
2011 SSVAL(req
->chain_outbuf
, smb_rcls
, SVAL(req
->outbuf
, smb_rcls
));
2012 SSVAL(req
->chain_outbuf
, smb_err
, SVAL(req
->outbuf
, smb_err
));
2014 if (!smb_splice_chain(&req
->chain_outbuf
,
2015 CVAL(req
->outbuf
, smb_com
),
2016 CVAL(req
->outbuf
, smb_wct
),
2017 (uint16_t *)(req
->outbuf
+ smb_vwv
),
2018 0, smb_buflen(req
->outbuf
),
2019 (uint8_t *)smb_buf(req
->outbuf
))) {
2020 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2022 TALLOC_FREE(req
->outbuf
);
2024 smb_setlen((char *)(req
->chain_outbuf
),
2025 talloc_get_size(req
->chain_outbuf
) - 4);
2027 show_msg((char *)(req
->chain_outbuf
));
2029 if (!srv_send_smb(smbd_server_fd(), (char *)req
->chain_outbuf
,
2030 true, req
->seqnum
+1,
2031 IS_CONN_ENCRYPTED(req
->conn
)||req
->encrypted
,
2033 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2035 TALLOC_FREE(req
->chain_outbuf
);
2039 /****************************************************************************
2040 Check if services need reloading.
2041 ****************************************************************************/
2043 void check_reload(time_t t
)
2045 time_t printcap_cache_time
= (time_t)lp_printcap_cache_time();
2047 if(last_smb_conf_reload_time
== 0) {
2048 last_smb_conf_reload_time
= t
;
2049 /* Our printing subsystem might not be ready at smbd start up.
2050 Then no printer is available till the first printers check
2051 is performed. A lower initial interval circumvents this. */
2052 if ( printcap_cache_time
> 60 )
2053 last_printer_reload_time
= t
- printcap_cache_time
+ 60;
2055 last_printer_reload_time
= t
;
2058 if (mypid
!= getpid()) { /* First time or fork happened meanwhile */
2059 /* randomize over 60 second the printcap reload to avoid all
2060 * process hitting cupsd at the same time */
2061 int time_range
= 60;
2063 last_printer_reload_time
+= random() % time_range
;
2067 if (t
>= last_smb_conf_reload_time
+SMBD_RELOAD_CHECK
) {
2068 reload_services(True
);
2069 last_smb_conf_reload_time
= t
;
2072 /* 'printcap cache time = 0' disable the feature */
2074 if ( printcap_cache_time
!= 0 )
2076 /* see if it's time to reload or if the clock has been set back */
2078 if ( (t
>= last_printer_reload_time
+printcap_cache_time
)
2079 || (t
-last_printer_reload_time
< 0) )
2081 DEBUG( 3,( "Printcap cache time expired.\n"));
2083 last_printer_reload_time
= t
;
2088 static void smbd_server_connection_write_handler(struct smbd_server_connection
*conn
)
2090 /* TODO: make write nonblocking */
2093 static void smbd_server_connection_read_handler(struct smbd_server_connection
*conn
)
2095 uint8_t *inbuf
= NULL
;
2096 size_t inbuf_len
= 0;
2097 size_t unread_bytes
= 0;
2098 bool encrypted
= false;
2099 TALLOC_CTX
*mem_ctx
= talloc_tos();
2103 /* TODO: make this completely nonblocking */
2105 status
= receive_smb_talloc(mem_ctx
, smbd_server_fd(),
2106 (char **)(void *)&inbuf
,
2110 &inbuf_len
, &seqnum
);
2111 if (NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
)) {
2114 if (NT_STATUS_IS_ERR(status
)) {
2115 exit_server_cleanly("failed to receive smb request");
2117 if (!NT_STATUS_IS_OK(status
)) {
2122 process_smb(conn
, inbuf
, inbuf_len
, unread_bytes
,
2123 seqnum
, encrypted
, NULL
);
2126 static void smbd_server_connection_handler(struct event_context
*ev
,
2127 struct fd_event
*fde
,
2131 struct smbd_server_connection
*conn
= talloc_get_type(private_data
,
2132 struct smbd_server_connection
);
2134 if (flags
& EVENT_FD_WRITE
) {
2135 smbd_server_connection_write_handler(conn
);
2136 } else if (flags
& EVENT_FD_READ
) {
2137 smbd_server_connection_read_handler(conn
);
2142 /****************************************************************************
2143 received when we should release a specific IP
2144 ****************************************************************************/
2145 static void release_ip(const char *ip
, void *priv
)
2147 char addr
[INET6_ADDRSTRLEN
];
2150 client_socket_addr(get_client_fd(),addr
,sizeof(addr
));
2152 if (strncmp("::ffff:", addr
, 7) == 0) {
2156 if ((strcmp(p
, ip
) == 0) || ((p
!= addr
) && strcmp(addr
, ip
) == 0)) {
2157 /* we can't afford to do a clean exit - that involves
2158 database writes, which would potentially mean we
2159 are still running after the failover has finished -
2160 we have to get rid of this process ID straight
2162 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2164 /* note we must exit with non-zero status so the unclean handler gets
2165 called in the parent, so that the brl database is tickled */
2170 static void msg_release_ip(struct messaging_context
*msg_ctx
, void *private_data
,
2171 uint32_t msg_type
, struct server_id server_id
, DATA_BLOB
*data
)
2173 release_ip((char *)data
->data
, NULL
);
2176 #ifdef CLUSTER_SUPPORT
2177 static int client_get_tcp_info(struct sockaddr_storage
*server
,
2178 struct sockaddr_storage
*client
)
2181 if (server_fd
== -1) {
2184 length
= sizeof(*server
);
2185 if (getsockname(server_fd
, (struct sockaddr
*)server
, &length
) != 0) {
2188 length
= sizeof(*client
);
2189 if (getpeername(server_fd
, (struct sockaddr
*)client
, &length
) != 0) {
2197 * Send keepalive packets to our client
2199 static bool keepalive_fn(const struct timeval
*now
, void *private_data
)
2201 if (!send_keepalive(smbd_server_fd())) {
2202 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2209 * Do the recurring check if we're idle
2211 static bool deadtime_fn(const struct timeval
*now
, void *private_data
)
2213 struct smbd_server_connection
*sconn
= smbd_server_conn
;
2214 if ((conn_num_open(sconn
) == 0)
2215 || (conn_idle_all(sconn
, now
->tv_sec
))) {
2216 DEBUG( 2, ( "Closing idle connection\n" ) );
2217 messaging_send(smbd_messaging_context(), procid_self(),
2218 MSG_SHUTDOWN
, &data_blob_null
);
2226 * Do the recurring log file and smb.conf reload checks.
2229 static bool housekeeping_fn(const struct timeval
*now
, void *private_data
)
2231 change_to_root_user();
2233 /* update printer queue caches if necessary */
2234 update_monitored_printq_cache();
2236 /* check if we need to reload services */
2237 check_reload(time(NULL
));
2239 /* Change machine password if neccessary. */
2240 attempt_machine_password_change();
2243 * Force a log file check.
2245 force_check_log_size();
2250 /****************************************************************************
2251 Process commands from the client
2252 ****************************************************************************/
2254 void smbd_process(void)
2256 TALLOC_CTX
*frame
= talloc_stackframe();
2257 char remaddr
[INET6_ADDRSTRLEN
];
2259 if (lp_maxprotocol() == PROTOCOL_SMB2
&&
2260 lp_security() != SEC_SHARE
) {
2261 smbd_server_conn
->allow_smb2
= true;
2264 /* Ensure child is set to blocking mode */
2265 set_blocking(smbd_server_fd(),True
);
2267 set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2268 set_socket_options(smbd_server_fd(), lp_socket_options());
2270 /* this is needed so that we get decent entries
2271 in smbstatus for port 445 connects */
2272 set_remote_machine_name(get_peer_addr(smbd_server_fd(),
2276 reload_services(true);
2279 * Before the first packet, check the global hosts allow/ hosts deny
2280 * parameters before doing any parsing of packets passed to us by the
2281 * client. This prevents attacks on our parsing code from hosts not in
2282 * the hosts allow list.
2285 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2286 lp_hostsdeny(-1))) {
2287 char addr
[INET6_ADDRSTRLEN
];
2290 * send a negative session response "not listening on calling
2293 unsigned char buf
[5] = {0x83, 0, 0, 1, 0x81};
2294 DEBUG( 1, ("Connection denied from %s\n",
2295 client_addr(get_client_fd(),addr
,sizeof(addr
)) ) );
2296 (void)srv_send_smb(smbd_server_fd(),(char *)buf
, false,
2298 exit_server_cleanly("connection denied");
2305 smb_perfcount_init();
2307 if (!init_account_policy()) {
2308 exit_server("Could not open account policy tdb.\n");
2311 if (*lp_rootdir()) {
2312 if (chroot(lp_rootdir()) != 0) {
2313 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2314 exit_server("Failed to chroot()");
2316 if (chdir("/") == -1) {
2317 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2318 exit_server("Failed to chroot()");
2320 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2323 if (!srv_init_signing(smbd_server_conn
)) {
2324 exit_server("Failed to init smb_signing");
2328 if (!init_oplocks(smbd_messaging_context()))
2329 exit_server("Failed to init oplocks");
2331 /* Setup aio signal handler. */
2332 initialize_async_io_handler();
2334 /* register our message handlers */
2335 messaging_register(smbd_messaging_context(), NULL
,
2336 MSG_SMB_FORCE_TDIS
, msg_force_tdis
);
2337 messaging_register(smbd_messaging_context(), NULL
,
2338 MSG_SMB_RELEASE_IP
, msg_release_ip
);
2339 messaging_register(smbd_messaging_context(), NULL
,
2340 MSG_SMB_CLOSE_FILE
, msg_close_file
);
2343 * Use the default MSG_DEBUG handler to avoid rebroadcasting
2344 * MSGs to all child processes
2346 messaging_deregister(smbd_messaging_context(),
2348 messaging_register(smbd_messaging_context(), NULL
,
2349 MSG_DEBUG
, debug_message
);
2351 if ((lp_keepalive() != 0)
2352 && !(event_add_idle(smbd_event_context(), NULL
,
2353 timeval_set(lp_keepalive(), 0),
2354 "keepalive", keepalive_fn
,
2356 DEBUG(0, ("Could not add keepalive event\n"));
2360 if (!(event_add_idle(smbd_event_context(), NULL
,
2361 timeval_set(IDLE_CLOSED_TIMEOUT
, 0),
2362 "deadtime", deadtime_fn
, NULL
))) {
2363 DEBUG(0, ("Could not add deadtime event\n"));
2367 if (!(event_add_idle(smbd_event_context(), NULL
,
2368 timeval_set(SMBD_SELECT_TIMEOUT
, 0),
2369 "housekeeping", housekeeping_fn
, NULL
))) {
2370 DEBUG(0, ("Could not add housekeeping event\n"));
2374 #ifdef CLUSTER_SUPPORT
2376 if (lp_clustering()) {
2378 * We need to tell ctdb about our client's TCP
2379 * connection, so that for failover ctdbd can send
2380 * tickle acks, triggering a reconnection by the
2384 struct sockaddr_storage srv
, clnt
;
2386 if (client_get_tcp_info(&srv
, &clnt
) == 0) {
2390 status
= ctdbd_register_ips(
2391 messaging_ctdbd_connection(),
2392 &srv
, &clnt
, release_ip
, NULL
);
2394 if (!NT_STATUS_IS_OK(status
)) {
2395 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
2396 nt_errstr(status
)));
2400 DEBUG(0,("Unable to get tcp info for "
2401 "CTDB_CONTROL_TCP_CLIENT: %s\n",
2408 smbd_server_conn
->nbt
.got_session
= false;
2410 smbd_server_conn
->smb1
.negprot
.max_recv
= MIN(lp_maxxmit(),BUFFER_SIZE
);
2412 smbd_server_conn
->smb1
.sessions
.done_sesssetup
= false;
2413 smbd_server_conn
->smb1
.sessions
.max_send
= BUFFER_SIZE
;
2414 smbd_server_conn
->smb1
.sessions
.last_session_tag
= UID_FIELD_INVALID
;
2415 /* users from session setup */
2416 smbd_server_conn
->smb1
.sessions
.session_userlist
= NULL
;
2417 /* workgroup from session setup. */
2418 smbd_server_conn
->smb1
.sessions
.session_workgroup
= NULL
;
2419 /* this holds info on user ids that are already validated for this VC */
2420 smbd_server_conn
->smb1
.sessions
.validated_users
= NULL
;
2421 smbd_server_conn
->smb1
.sessions
.next_vuid
= VUID_OFFSET
;
2422 smbd_server_conn
->smb1
.sessions
.num_validated_vuids
= 0;
2423 #ifdef HAVE_NETGROUP
2424 smbd_server_conn
->smb1
.sessions
.my_yp_domain
= NULL
;
2427 conn_init(smbd_server_conn
);
2428 if (!init_dptrs(smbd_server_conn
)) {
2429 exit_server("init_dptrs() failed");
2432 smbd_server_conn
->smb1
.fde
= event_add_fd(smbd_event_context(),
2436 smbd_server_connection_handler
,
2438 if (!smbd_server_conn
->smb1
.fde
) {
2439 exit_server("failed to create smbd_server_connection fde");
2447 frame
= talloc_stackframe_pool(8192);
2451 status
= smbd_server_connection_loop_once(smbd_server_conn
);
2452 if (!NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
) &&
2453 !NT_STATUS_IS_OK(status
)) {
2454 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2455 " exiting\n", nt_errstr(status
)));
2462 exit_server_cleanly(NULL
);
2465 bool req_is_in_chain(struct smb_request
*req
)
2467 if (req
->vwv
!= (uint16_t *)(req
->inbuf
+smb_vwv
)) {
2469 * We're right now handling a subsequent request, so we must
2475 if (!is_andx_req(req
->cmd
)) {
2481 * Okay, an illegal request, but definitely not chained :-)
2486 return (CVAL(req
->vwv
+0, 0) != 0xFF);