?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd react on message that client should be disconnected
[Samba.git] / source3 / smbd / process.c
blob7d9f76719276e2fc6cca294ff83a1004aaec952c
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39 #include "../libcli/security/dom_sid.h"
40 #include "../libcli/security/security_token.h"
41 #include "lib/id_cache.h"
42 #include "serverid.h"
43
44 /* Internal message queue for deferred opens. */
45 struct pending_message_list {
46 struct pending_message_list *next, *prev;
47 struct timeval request_time; /* When was this first issued? */
48 struct smbd_server_connection *sconn;
49 struct tevent_timer *te;
50 struct smb_perfcount_data pcd;
51 uint32_t seqnum;
52 bool encrypted;
53 bool processed;
54 DATA_BLOB buf;
55 DATA_BLOB private_data;
56 };
57
58 static void construct_reply_common(struct smb_request *req, const char *inbuf,
59 char *outbuf);
60 static struct pending_message_list *get_deferred_open_message_smb(
61 struct smbd_server_connection *sconn, uint64_t mid);
62 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
63
64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
65 {
66 bool ok;
67
68 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
69 return true;
70 }
71
72 sconn->smb1.echo_handler.ref_count++;
73
74 if (sconn->smb1.echo_handler.ref_count > 1) {
75 return true;
76 }
77
78 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
79
80 do {
81 ok = fcntl_lock(
82 sconn->smb1.echo_handler.socket_lock_fd,
83 F_SETLKW, 0, 0, F_WRLCK);
84 } while (!ok && (errno == EINTR));
85
86 if (!ok) {
87 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
88 return false;
89 }
90
91 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
92
93 return true;
94 }
95
96 void smbd_lock_socket(struct smbd_server_connection *sconn)
97 {
98 if (!smbd_lock_socket_internal(sconn)) {
99 exit_server_cleanly("failed to lock socket");
100 }
101 }
102
103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
104 {
105 bool ok;
106
107 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
108 return true;
109 }
110
111 sconn->smb1.echo_handler.ref_count--;
112
113 if (sconn->smb1.echo_handler.ref_count > 0) {
114 return true;
115 }
116
117 do {
118 ok = fcntl_lock(
119 sconn->smb1.echo_handler.socket_lock_fd,
120 F_SETLKW, 0, 0, F_UNLCK);
121 } while (!ok && (errno == EINTR));
122
123 if (!ok) {
124 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
125 return false;
126 }
127
128 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
129
130 return true;
131 }
132
133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
134 {
135 if (!smbd_unlock_socket_internal(sconn)) {
136 exit_server_cleanly("failed to unlock socket");
137 }
138 }
139
140 /* Accessor function for smb_read_error for smbd functions. */
141
142 /****************************************************************************
143 Send an smb to a fd.
144 ****************************************************************************/
145
146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
147 bool do_signing, uint32_t seqnum,
148 bool do_encrypt,
149 struct smb_perfcount_data *pcd)
150 {
151 size_t len = 0;
152 ssize_t ret;
153 char *buf_out = buffer;
154
155 smbd_lock_socket(sconn);
156
157 if (do_signing) {
158 /* Sign the outgoing packet if required. */
159 srv_calculate_sign_mac(sconn, buf_out, seqnum);
160 }
161
162 if (do_encrypt) {
163 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
164 if (!NT_STATUS_IS_OK(status)) {
165 DEBUG(0, ("send_smb: SMB encryption failed "
166 "on outgoing packet! Error %s\n",
167 nt_errstr(status) ));
168 ret = -1;
169 goto out;
170 }
171 }
172
173 len = smb_len_large(buf_out) + 4;
174
175 ret = write_data(sconn->sock, buf_out, len);
176 if (ret <= 0) {
177
178 char addr[INET6_ADDRSTRLEN];
179 /*
180 * Try and give an error message saying what
181 * client failed.
182 */
183 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
184 (int)getpid(), (int)len,
185 get_peer_addr(sconn->sock, addr, sizeof(addr)),
186 (int)ret, strerror(errno) ));
187
188 srv_free_enc_buffer(sconn, buf_out);
189 goto out;
190 }
191
192 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
193 srv_free_enc_buffer(sconn, buf_out);
194 out:
195 SMB_PERFCOUNT_END(pcd);
196
197 smbd_unlock_socket(sconn);
198 return (ret > 0);
199 }
200
201 /*******************************************************************
202 Setup the word count and byte count for a smb message.
203 ********************************************************************/
204
205 int srv_set_message(char *buf,
206 int num_words,
207 int num_bytes,
208 bool zero)
209 {
210 if (zero && (num_words || num_bytes)) {
211 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
212 }
213 SCVAL(buf,smb_wct,num_words);
214 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
215 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
216 return (smb_size + num_words*2 + num_bytes);
217 }
218
219 static bool valid_smb_header(struct smbd_server_connection *sconn,
220 const uint8_t *inbuf)
221 {
222 if (is_encrypted_packet(sconn, inbuf)) {
223 return true;
224 }
225 /*
226 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
227 * but it just looks weird to call strncmp for this one.
228 */
229 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
230 }
231
232 /* Socket functions for smbd packet processing. */
233
234 static bool valid_packet_size(size_t len)
235 {
236 /*
237 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
238 * of header. Don't print the error if this fits.... JRA.
239 */
240
241 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
242 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
243 (unsigned long)len));
244 return false;
245 }
246 return true;
247 }
248
249 static NTSTATUS read_packet_remainder(int fd, char *buffer,
250 unsigned int timeout, ssize_t len)
251 {
252 NTSTATUS status;
253
254 if (len <= 0) {
255 return NT_STATUS_OK;
256 }
257
258 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
259 if (!NT_STATUS_IS_OK(status)) {
260 char addr[INET6_ADDRSTRLEN];
261 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
262 "error = %s.\n",
263 get_peer_addr(fd, addr, sizeof(addr)),
264 nt_errstr(status)));
265 }
266 return status;
267 }
268
269 /****************************************************************************
270 Attempt a zerocopy writeX read. We know here that len > smb_size-4
271 ****************************************************************************/
272
273 /*
274 * Unfortunately, earlier versions of smbclient/libsmbclient
275 * don't send this "standard" writeX header. I've fixed this
276 * for 3.2 but we'll use the old method with earlier versions.
277 * Windows and CIFSFS at least use this standard size. Not
278 * sure about MacOSX.
279 */
280
281 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
282 (2*14) + /* word count (including bcc) */ \
283 1 /* pad byte */)
284
285 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
286 const char lenbuf[4],
287 struct smbd_server_connection *sconn,
288 int sock,
289 char **buffer,
290 unsigned int timeout,
291 size_t *p_unread,
292 size_t *len_ret)
293 {
294 /* Size of a WRITEX call (+4 byte len). */
295 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
296 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
297 ssize_t toread;
298 NTSTATUS status;
299
300 memcpy(writeX_header, lenbuf, 4);
301
302 status = read_fd_with_timeout(
303 sock, writeX_header + 4,
304 STANDARD_WRITE_AND_X_HEADER_SIZE,
305 STANDARD_WRITE_AND_X_HEADER_SIZE,
306 timeout, NULL);
307
308 if (!NT_STATUS_IS_OK(status)) {
309 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
310 "error = %s.\n",
311 tsocket_address_string(sconn->remote_address,
312 talloc_tos()),
313 nt_errstr(status)));
314 return status;
315 }
316
317 /*
318 * Ok - now try and see if this is a possible
319 * valid writeX call.
320 */
321
322 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
323 /*
324 * If the data offset is beyond what
325 * we've read, drain the extra bytes.
326 */
327 uint16_t doff = SVAL(writeX_header,smb_vwv11);
328 ssize_t newlen;
329
330 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
331 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
332 if (drain_socket(sock, drain) != drain) {
333 smb_panic("receive_smb_raw_talloc_partial_read:"
334 " failed to drain pending bytes");
335 }
336 } else {
337 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
338 }
339
340 /* Spoof down the length and null out the bcc. */
341 set_message_bcc(writeX_header, 0);
342 newlen = smb_len(writeX_header);
343
344 /* Copy the header we've written. */
345
346 *buffer = (char *)talloc_memdup(mem_ctx,
347 writeX_header,
348 sizeof(writeX_header));
349
350 if (*buffer == NULL) {
351 DEBUG(0, ("Could not allocate inbuf of length %d\n",
352 (int)sizeof(writeX_header)));
353 return NT_STATUS_NO_MEMORY;
354 }
355
356 /* Work out the remaining bytes. */
357 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
358 *len_ret = newlen + 4;
359 return NT_STATUS_OK;
360 }
361
362 if (!valid_packet_size(len)) {
363 return NT_STATUS_INVALID_PARAMETER;
364 }
365
366 /*
367 * Not a valid writeX call. Just do the standard
368 * talloc and return.
369 */
370
371 *buffer = talloc_array(mem_ctx, char, len+4);
372
373 if (*buffer == NULL) {
374 DEBUG(0, ("Could not allocate inbuf of length %d\n",
375 (int)len+4));
376 return NT_STATUS_NO_MEMORY;
377 }
378
379 /* Copy in what we already read. */
380 memcpy(*buffer,
381 writeX_header,
382 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
383 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
384
385 if(toread > 0) {
386 status = read_packet_remainder(
387 sock,
388 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
389 timeout, toread);
390
391 if (!NT_STATUS_IS_OK(status)) {
392 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
393 nt_errstr(status)));
394 return status;
395 }
396 }
397
398 *len_ret = len + 4;
399 return NT_STATUS_OK;
400 }
401
402 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
403 struct smbd_server_connection *sconn,
404 int sock,
405 char **buffer, unsigned int timeout,
406 size_t *p_unread, size_t *plen)
407 {
408 char lenbuf[4];
409 size_t len;
410 int min_recv_size = lp_min_receive_file_size();
411 NTSTATUS status;
412
413 *p_unread = 0;
414
415 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
416 &len);
417 if (!NT_STATUS_IS_OK(status)) {
418 return status;
419 }
420
421 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
422 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
423 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
424 !srv_is_signing_active(sconn) &&
425 sconn->smb1.echo_handler.trusted_fde == NULL) {
426
427 return receive_smb_raw_talloc_partial_read(
428 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
429 p_unread, plen);
430 }
431
432 if (!valid_packet_size(len)) {
433 return NT_STATUS_INVALID_PARAMETER;
434 }
435
436 /*
437 * The +4 here can't wrap, we've checked the length above already.
438 */
439
440 *buffer = talloc_array(mem_ctx, char, len+4);
441
442 if (*buffer == NULL) {
443 DEBUG(0, ("Could not allocate inbuf of length %d\n",
444 (int)len+4));
445 return NT_STATUS_NO_MEMORY;
446 }
447
448 memcpy(*buffer, lenbuf, sizeof(lenbuf));
449
450 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
451 if (!NT_STATUS_IS_OK(status)) {
452 return status;
453 }
454
455 *plen = len + 4;
456 return NT_STATUS_OK;
457 }
458
459 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
460 struct smbd_server_connection *sconn,
461 int sock,
462 char **buffer, unsigned int timeout,
463 size_t *p_unread, bool *p_encrypted,
464 size_t *p_len,
465 uint32_t *seqnum,
466 bool trusted_channel)
467 {
468 size_t len = 0;
469 NTSTATUS status;
470
471 *p_encrypted = false;
472
473 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
474 p_unread, &len);
475 if (!NT_STATUS_IS_OK(status)) {
476 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
477 ("receive_smb_raw_talloc failed for client %s "
478 "read error = %s.\n",
479 tsocket_address_string(sconn->remote_address,
480 talloc_tos()),
481 nt_errstr(status)) );
482 return status;
483 }
484
485 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
486 status = srv_decrypt_buffer(sconn, *buffer);
487 if (!NT_STATUS_IS_OK(status)) {
488 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
489 "incoming packet! Error %s\n",
490 nt_errstr(status) ));
491 return status;
492 }
493 *p_encrypted = true;
494 }
495
496 /* Check the incoming SMB signature. */
497 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
498 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
499 "incoming packet!\n"));
500 return NT_STATUS_INVALID_NETWORK_RESPONSE;
501 }
502
503 *p_len = len;
504 return NT_STATUS_OK;
505 }
506
507 /*
508 * Initialize a struct smb_request from an inbuf
509 */
510
511 static bool init_smb_request(struct smb_request *req,
512 struct smbd_server_connection *sconn,
513 const uint8 *inbuf,
514 size_t unread_bytes, bool encrypted,
515 uint32_t seqnum)
516 {
517 struct smbXsrv_tcon *tcon;
518 NTSTATUS status;
519 NTTIME now;
520 size_t req_size = smb_len(inbuf) + 4;
521
522 /* Ensure we have at least smb_size bytes. */
523 if (req_size < smb_size) {
524 DEBUG(0,("init_smb_request: invalid request size %u\n",
525 (unsigned int)req_size ));
526 return false;
527 }
528
529 req->request_time = timeval_current();
530 now = timeval_to_nttime(&req->request_time);
531
532 req->cmd = CVAL(inbuf, smb_com);
533 req->flags2 = SVAL(inbuf, smb_flg2);
534 req->smbpid = SVAL(inbuf, smb_pid);
535 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
536 req->seqnum = seqnum;
537 req->vuid = SVAL(inbuf, smb_uid);
538 req->tid = SVAL(inbuf, smb_tid);
539 req->wct = CVAL(inbuf, smb_wct);
540 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
541 req->buflen = smb_buflen(inbuf);
542 req->buf = (const uint8_t *)smb_buf_const(inbuf);
543 req->unread_bytes = unread_bytes;
544 req->encrypted = encrypted;
545 req->sconn = sconn;
546 status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
547 if (NT_STATUS_IS_OK(status)) {
548 req->conn = tcon->compat;
549 } else {
550 req->conn = NULL;
551 }
552 req->chain_fsp = NULL;
553 req->smb2req = NULL;
554 req->priv_paths = NULL;
555 req->chain = NULL;
556 smb_init_perfcount_data(&req->pcd);
557
558 /* Ensure we have at least wct words and 2 bytes of bcc. */
559 if (smb_size + req->wct*2 > req_size) {
560 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
561 (unsigned int)req->wct,
562 (unsigned int)req_size));
563 return false;
564 }
565 /* Ensure bcc is correct. */
566 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
567 DEBUG(0,("init_smb_request: invalid bcc number %u "
568 "(wct = %u, size %u)\n",
569 (unsigned int)req->buflen,
570 (unsigned int)req->wct,
571 (unsigned int)req_size));
572 return false;
573 }
574
575 req->outbuf = NULL;
576 return true;
577 }
578
579 static void process_smb(struct smbd_server_connection *conn,
580 uint8_t *inbuf, size_t nread, size_t unread_bytes,
581 uint32_t seqnum, bool encrypted,
582 struct smb_perfcount_data *deferred_pcd);
583
584 static void smbd_deferred_open_timer(struct tevent_context *ev,
585 struct tevent_timer *te,
586 struct timeval _tval,
587 void *private_data)
588 {
589 struct pending_message_list *msg = talloc_get_type(private_data,
590 struct pending_message_list);
591 struct smbd_server_connection *sconn = msg->sconn;
592 TALLOC_CTX *mem_ctx = talloc_tos();
593 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
594 uint8_t *inbuf;
595
596 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
597 msg->buf.length);
598 if (inbuf == NULL) {
599 exit_server("smbd_deferred_open_timer: talloc failed\n");
600 return;
601 }
602
603 /* We leave this message on the queue so the open code can
604 know this is a retry. */
605 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
606 (unsigned long long)mid ));
607
608 /* Mark the message as processed so this is not
609 * re-processed in error. */
610 msg->processed = true;
611
612 process_smb(sconn, inbuf,
613 msg->buf.length, 0,
614 msg->seqnum, msg->encrypted, &msg->pcd);
615
616 /* If it's still there and was processed, remove it. */
617 msg = get_deferred_open_message_smb(sconn, mid);
618 if (msg && msg->processed) {
619 remove_deferred_open_message_smb(sconn, mid);
620 }
621 }
622
623 /****************************************************************************
624 Function to push a message onto the tail of a linked list of smb messages ready
625 for processing.
626 ****************************************************************************/
627
628 static bool push_queued_message(struct smb_request *req,
629 struct timeval request_time,
630 struct timeval end_time,
631 char *private_data, size_t private_len)
632 {
633 int msg_len = smb_len(req->inbuf) + 4;
634 struct pending_message_list *msg;
635
636 msg = talloc_zero(NULL, struct pending_message_list);
637
638 if(msg == NULL) {
639 DEBUG(0,("push_message: malloc fail (1)\n"));
640 return False;
641 }
642 msg->sconn = req->sconn;
643
644 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
645 if(msg->buf.data == NULL) {
646 DEBUG(0,("push_message: malloc fail (2)\n"));
647 TALLOC_FREE(msg);
648 return False;
649 }
650
651 msg->request_time = request_time;
652 msg->seqnum = req->seqnum;
653 msg->encrypted = req->encrypted;
654 msg->processed = false;
655 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
656
657 if (private_data) {
658 msg->private_data = data_blob_talloc(msg, private_data,
659 private_len);
660 if (msg->private_data.data == NULL) {
661 DEBUG(0,("push_message: malloc fail (3)\n"));
662 TALLOC_FREE(msg);
663 return False;
664 }
665 }
666
667 #if 0
668 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
669 msg,
670 end_time,
671 smbd_deferred_open_timer,
672 msg);
673 if (!msg->te) {
674 DEBUG(0,("push_message: event_add_timed failed\n"));
675 TALLOC_FREE(msg);
676 return false;
677 }
678 #endif
679
680 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
681 struct pending_message_list *);
682
683 DEBUG(10,("push_message: pushed message length %u on "
684 "deferred_open_queue\n", (unsigned int)msg_len));
685
686 return True;
687 }
688
689 /****************************************************************************
690 Function to delete a sharing violation open message by mid.
691 ****************************************************************************/
692
693 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
694 uint64_t mid)
695 {
696 struct pending_message_list *pml;
697
698 if (sconn->using_smb2) {
699 remove_deferred_open_message_smb2(sconn, mid);
700 return;
701 }
702
703 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
704 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
705 DEBUG(10,("remove_deferred_open_message_smb: "
706 "deleting mid %llu len %u\n",
707 (unsigned long long)mid,
708 (unsigned int)pml->buf.length ));
709 DLIST_REMOVE(sconn->deferred_open_queue, pml);
710 TALLOC_FREE(pml);
711 return;
712 }
713 }
714 }
715
716 /****************************************************************************
717 Move a sharing violation open retry message to the front of the list and
718 schedule it for immediate processing.
719 ****************************************************************************/
720
721 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
722 uint64_t mid)
723 {
724 struct pending_message_list *pml;
725 int i = 0;
726
727 if (sconn->using_smb2) {
728 return schedule_deferred_open_message_smb2(sconn, mid);
729 }
730
731 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
732 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
733
734 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
735 "msg_mid = %llu\n",
736 i++,
737 (unsigned long long)msg_mid ));
738
739 if (mid == msg_mid) {
740 struct tevent_timer *te;
741
742 if (pml->processed) {
743 /* A processed message should not be
744 * rescheduled. */
745 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
746 "message mid %llu was already processed\n",
747 (unsigned long long)msg_mid ));
748 continue;
749 }
750
751 DEBUG(10,("schedule_deferred_open_message_smb: "
752 "scheduling mid %llu\n",
753 (unsigned long long)mid ));
754
755 te = tevent_add_timer(pml->sconn->ev_ctx,
756 pml,
757 timeval_zero(),
758 smbd_deferred_open_timer,
759 pml);
760 if (!te) {
761 DEBUG(10,("schedule_deferred_open_message_smb: "
762 "event_add_timed() failed, "
763 "skipping mid %llu\n",
764 (unsigned long long)msg_mid ));
765 }
766
767 TALLOC_FREE(pml->te);
768 pml->te = te;
769 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
770 return true;
771 }
772 }
773
774 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
775 "find message mid %llu\n",
776 (unsigned long long)mid ));
777
778 return false;
779 }
780
781 /****************************************************************************
782 Return true if this mid is on the deferred queue and was not yet processed.
783 ****************************************************************************/
784
785 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
786 {
787 struct pending_message_list *pml;
788
789 if (sconn->using_smb2) {
790 return open_was_deferred_smb2(sconn, mid);
791 }
792
793 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
794 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
795 return True;
796 }
797 }
798 return False;
799 }
800
801 /****************************************************************************
802 Return the message queued by this mid.
803 ****************************************************************************/
804
805 static struct pending_message_list *get_deferred_open_message_smb(
806 struct smbd_server_connection *sconn, uint64_t mid)
807 {
808 struct pending_message_list *pml;
809
810 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
811 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
812 return pml;
813 }
814 }
815 return NULL;
816 }
817
818 /****************************************************************************
819 Get the state data queued by this mid.
820 ****************************************************************************/
821
822 bool get_deferred_open_message_state(struct smb_request *smbreq,
823 struct timeval *p_request_time,
824 void **pp_state)
825 {
826 struct pending_message_list *pml;
827
828 if (smbreq->sconn->using_smb2) {
829 return get_deferred_open_message_state_smb2(smbreq->smb2req,
830 p_request_time,
831 pp_state);
832 }
833
834 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
835 if (!pml) {
836 return false;
837 }
838 if (p_request_time) {
839 *p_request_time = pml->request_time;
840 }
841 if (pp_state) {
842 *pp_state = (void *)pml->private_data.data;
843 }
844 return true;
845 }
846
847 /****************************************************************************
848 Function to push a deferred open smb message onto a linked list of local smb
849 messages ready for processing.
850 ****************************************************************************/
851
852 bool push_deferred_open_message_smb(struct smb_request *req,
853 struct timeval request_time,
854 struct timeval timeout,
855 struct file_id id,
856 char *private_data, size_t priv_len)
857 {
858 struct timeval end_time;
859
860 if (req->smb2req) {
861 return push_deferred_open_message_smb2(req->smb2req,
862 request_time,
863 timeout,
864 id,
865 private_data,
866 priv_len);
867 }
868
869 if (req->unread_bytes) {
870 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
871 "unread_bytes = %u\n",
872 (unsigned int)req->unread_bytes ));
873 smb_panic("push_deferred_open_message_smb: "
874 "logic error unread_bytes != 0" );
875 }
876
877 end_time = timeval_sum(&request_time, &timeout);
878
879 DEBUG(10,("push_deferred_open_message_smb: pushing message "
880 "len %u mid %llu timeout time [%u.%06u]\n",
881 (unsigned int) smb_len(req->inbuf)+4,
882 (unsigned long long)req->mid,
883 (unsigned int)end_time.tv_sec,
884 (unsigned int)end_time.tv_usec));
885
886 return push_queued_message(req, request_time, end_time,
887 private_data, priv_len);
888 }
889
890 static void smbd_sig_term_handler(struct tevent_context *ev,
891 struct tevent_signal *se,
892 int signum,
893 int count,
894 void *siginfo,
895 void *private_data)
896 {
897 exit_server_cleanly("termination signal");
898 }
899
900 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
901 {
902 struct tevent_signal *se;
903
904 se = tevent_add_signal(sconn->ev_ctx,
905 sconn,
906 SIGTERM, 0,
907 smbd_sig_term_handler,
908 sconn);
909 if (!se) {
910 exit_server("failed to setup SIGTERM handler");
911 }
912 }
913
914 static void smbd_sig_hup_handler(struct tevent_context *ev,
915 struct tevent_signal *se,
916 int signum,
917 int count,
918 void *siginfo,
919 void *private_data)
920 {
921 struct smbd_server_connection *sconn =
922 talloc_get_type_abort(private_data,
923 struct smbd_server_connection);
924
925 change_to_root_user();
926 DEBUG(1,("Reloading services after SIGHUP\n"));
927 reload_services(sconn, conn_snum_used, false);
928 }
929
930 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
931 {
932 struct tevent_signal *se;
933
934 se = tevent_add_signal(sconn->ev_ctx,
935 sconn,
936 SIGHUP, 0,
937 smbd_sig_hup_handler,
938 sconn);
939 if (!se) {
940 exit_server("failed to setup SIGHUP handler");
941 }
942 }
943
944 static void smbd_conf_updated(struct messaging_context *msg,
945 void *private_data,
946 uint32_t msg_type,
947 struct server_id server_id,
948 DATA_BLOB *data)
949 {
950 struct smbd_server_connection *sconn =
951 talloc_get_type_abort(private_data,
952 struct smbd_server_connection);
953
954 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
955 "updated. Reloading.\n"));
956 change_to_root_user();
957 reload_services(sconn, conn_snum_used, false);
958 }
959
960 /*
961 * Only allow 5 outstanding trans requests. We're allocating memory, so
962 * prevent a DoS.
963 */
964
965 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
966 {
967 int count = 0;
968 for (; list != NULL; list = list->next) {
969
970 if (list->mid == mid) {
971 return NT_STATUS_INVALID_PARAMETER;
972 }
973
974 count += 1;
975 }
976 if (count > 5) {
977 return NT_STATUS_INSUFFICIENT_RESOURCES;
978 }
979
980 return NT_STATUS_OK;
981 }
982
983 /*
984 These flags determine some of the permissions required to do an operation
985
986 Note that I don't set NEED_WRITE on some write operations because they
987 are used by some brain-dead clients when printing, and I don't want to
988 force write permissions on print services.
989 */
990 #define AS_USER (1<<0)
991 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
992 #define TIME_INIT (1<<2)
993 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
994 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
995 #define DO_CHDIR (1<<6)
996
997 /*
998 define a list of possible SMB messages and their corresponding
999 functions. Any message that has a NULL function is unimplemented -
1000 please feel free to contribute implementations!
1001 */
1002 static const struct smb_message_struct {
1003 const char *name;
1004 void (*fn)(struct smb_request *req);
1005 int flags;
1006 } smb_messages[256] = {
1007
1008 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1009 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1010 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1011 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1012 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1013 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1014 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1015 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1016 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1017 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1018 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1019 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1020 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1021 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1022 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1023 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1024 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1025 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1026 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1027 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1028 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1029 /* 0x15 */ { NULL, NULL, 0 },
1030 /* 0x16 */ { NULL, NULL, 0 },
1031 /* 0x17 */ { NULL, NULL, 0 },
1032 /* 0x18 */ { NULL, NULL, 0 },
1033 /* 0x19 */ { NULL, NULL, 0 },
1034 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1035 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1036 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1037 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1038 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1039 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1040 /* 0x20 */ { "SMBwritec", NULL,0},
1041 /* 0x21 */ { NULL, NULL, 0 },
1042 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1043 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1044 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1045 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1046 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1047 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1048 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1049 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1050 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1051 /* 0x2b */ { "SMBecho",reply_echo,0},
1052 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1053 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1054 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1055 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1056 /* 0x30 */ { NULL, NULL, 0 },
1057 /* 0x31 */ { NULL, NULL, 0 },
1058 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1059 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1060 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1061 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1062 /* 0x36 */ { NULL, NULL, 0 },
1063 /* 0x37 */ { NULL, NULL, 0 },
1064 /* 0x38 */ { NULL, NULL, 0 },
1065 /* 0x39 */ { NULL, NULL, 0 },
1066 /* 0x3a */ { NULL, NULL, 0 },
1067 /* 0x3b */ { NULL, NULL, 0 },
1068 /* 0x3c */ { NULL, NULL, 0 },
1069 /* 0x3d */ { NULL, NULL, 0 },
1070 /* 0x3e */ { NULL, NULL, 0 },
1071 /* 0x3f */ { NULL, NULL, 0 },
1072 /* 0x40 */ { NULL, NULL, 0 },
1073 /* 0x41 */ { NULL, NULL, 0 },
1074 /* 0x42 */ { NULL, NULL, 0 },
1075 /* 0x43 */ { NULL, NULL, 0 },
1076 /* 0x44 */ { NULL, NULL, 0 },
1077 /* 0x45 */ { NULL, NULL, 0 },
1078 /* 0x46 */ { NULL, NULL, 0 },
1079 /* 0x47 */ { NULL, NULL, 0 },
1080 /* 0x48 */ { NULL, NULL, 0 },
1081 /* 0x49 */ { NULL, NULL, 0 },
1082 /* 0x4a */ { NULL, NULL, 0 },
1083 /* 0x4b */ { NULL, NULL, 0 },
1084 /* 0x4c */ { NULL, NULL, 0 },
1085 /* 0x4d */ { NULL, NULL, 0 },
1086 /* 0x4e */ { NULL, NULL, 0 },
1087 /* 0x4f */ { NULL, NULL, 0 },
1088 /* 0x50 */ { NULL, NULL, 0 },
1089 /* 0x51 */ { NULL, NULL, 0 },
1090 /* 0x52 */ { NULL, NULL, 0 },
1091 /* 0x53 */ { NULL, NULL, 0 },
1092 /* 0x54 */ { NULL, NULL, 0 },
1093 /* 0x55 */ { NULL, NULL, 0 },
1094 /* 0x56 */ { NULL, NULL, 0 },
1095 /* 0x57 */ { NULL, NULL, 0 },
1096 /* 0x58 */ { NULL, NULL, 0 },
1097 /* 0x59 */ { NULL, NULL, 0 },
1098 /* 0x5a */ { NULL, NULL, 0 },
1099 /* 0x5b */ { NULL, NULL, 0 },
1100 /* 0x5c */ { NULL, NULL, 0 },
1101 /* 0x5d */ { NULL, NULL, 0 },
1102 /* 0x5e */ { NULL, NULL, 0 },
1103 /* 0x5f */ { NULL, NULL, 0 },
1104 /* 0x60 */ { NULL, NULL, 0 },
1105 /* 0x61 */ { NULL, NULL, 0 },
1106 /* 0x62 */ { NULL, NULL, 0 },
1107 /* 0x63 */ { NULL, NULL, 0 },
1108 /* 0x64 */ { NULL, NULL, 0 },
1109 /* 0x65 */ { NULL, NULL, 0 },
1110 /* 0x66 */ { NULL, NULL, 0 },
1111 /* 0x67 */ { NULL, NULL, 0 },
1112 /* 0x68 */ { NULL, NULL, 0 },
1113 /* 0x69 */ { NULL, NULL, 0 },
1114 /* 0x6a */ { NULL, NULL, 0 },
1115 /* 0x6b */ { NULL, NULL, 0 },
1116 /* 0x6c */ { NULL, NULL, 0 },
1117 /* 0x6d */ { NULL, NULL, 0 },
1118 /* 0x6e */ { NULL, NULL, 0 },
1119 /* 0x6f */ { NULL, NULL, 0 },
1120 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1121 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1122 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1123 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1124 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1125 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1126 /* 0x76 */ { NULL, NULL, 0 },
1127 /* 0x77 */ { NULL, NULL, 0 },
1128 /* 0x78 */ { NULL, NULL, 0 },
1129 /* 0x79 */ { NULL, NULL, 0 },
1130 /* 0x7a */ { NULL, NULL, 0 },
1131 /* 0x7b */ { NULL, NULL, 0 },
1132 /* 0x7c */ { NULL, NULL, 0 },
1133 /* 0x7d */ { NULL, NULL, 0 },
1134 /* 0x7e */ { NULL, NULL, 0 },
1135 /* 0x7f */ { NULL, NULL, 0 },
1136 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1137 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1138 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1139 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1140 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1141 /* 0x85 */ { NULL, NULL, 0 },
1142 /* 0x86 */ { NULL, NULL, 0 },
1143 /* 0x87 */ { NULL, NULL, 0 },
1144 /* 0x88 */ { NULL, NULL, 0 },
1145 /* 0x89 */ { NULL, NULL, 0 },
1146 /* 0x8a */ { NULL, NULL, 0 },
1147 /* 0x8b */ { NULL, NULL, 0 },
1148 /* 0x8c */ { NULL, NULL, 0 },
1149 /* 0x8d */ { NULL, NULL, 0 },
1150 /* 0x8e */ { NULL, NULL, 0 },
1151 /* 0x8f */ { NULL, NULL, 0 },
1152 /* 0x90 */ { NULL, NULL, 0 },
1153 /* 0x91 */ { NULL, NULL, 0 },
1154 /* 0x92 */ { NULL, NULL, 0 },
1155 /* 0x93 */ { NULL, NULL, 0 },
1156 /* 0x94 */ { NULL, NULL, 0 },
1157 /* 0x95 */ { NULL, NULL, 0 },
1158 /* 0x96 */ { NULL, NULL, 0 },
1159 /* 0x97 */ { NULL, NULL, 0 },
1160 /* 0x98 */ { NULL, NULL, 0 },
1161 /* 0x99 */ { NULL, NULL, 0 },
1162 /* 0x9a */ { NULL, NULL, 0 },
1163 /* 0x9b */ { NULL, NULL, 0 },
1164 /* 0x9c */ { NULL, NULL, 0 },
1165 /* 0x9d */ { NULL, NULL, 0 },
1166 /* 0x9e */ { NULL, NULL, 0 },
1167 /* 0x9f */ { NULL, NULL, 0 },
1168 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1169 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1170 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1171 /* 0xa3 */ { NULL, NULL, 0 },
1172 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1173 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1174 /* 0xa6 */ { NULL, NULL, 0 },
1175 /* 0xa7 */ { NULL, NULL, 0 },
1176 /* 0xa8 */ { NULL, NULL, 0 },
1177 /* 0xa9 */ { NULL, NULL, 0 },
1178 /* 0xaa */ { NULL, NULL, 0 },
1179 /* 0xab */ { NULL, NULL, 0 },
1180 /* 0xac */ { NULL, NULL, 0 },
1181 /* 0xad */ { NULL, NULL, 0 },
1182 /* 0xae */ { NULL, NULL, 0 },
1183 /* 0xaf */ { NULL, NULL, 0 },
1184 /* 0xb0 */ { NULL, NULL, 0 },
1185 /* 0xb1 */ { NULL, NULL, 0 },
1186 /* 0xb2 */ { NULL, NULL, 0 },
1187 /* 0xb3 */ { NULL, NULL, 0 },
1188 /* 0xb4 */ { NULL, NULL, 0 },
1189 /* 0xb5 */ { NULL, NULL, 0 },
1190 /* 0xb6 */ { NULL, NULL, 0 },
1191 /* 0xb7 */ { NULL, NULL, 0 },
1192 /* 0xb8 */ { NULL, NULL, 0 },
1193 /* 0xb9 */ { NULL, NULL, 0 },
1194 /* 0xba */ { NULL, NULL, 0 },
1195 /* 0xbb */ { NULL, NULL, 0 },
1196 /* 0xbc */ { NULL, NULL, 0 },
1197 /* 0xbd */ { NULL, NULL, 0 },
1198 /* 0xbe */ { NULL, NULL, 0 },
1199 /* 0xbf */ { NULL, NULL, 0 },
1200 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1201 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1202 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1203 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1204 /* 0xc4 */ { NULL, NULL, 0 },
1205 /* 0xc5 */ { NULL, NULL, 0 },
1206 /* 0xc6 */ { NULL, NULL, 0 },
1207 /* 0xc7 */ { NULL, NULL, 0 },
1208 /* 0xc8 */ { NULL, NULL, 0 },
1209 /* 0xc9 */ { NULL, NULL, 0 },
1210 /* 0xca */ { NULL, NULL, 0 },
1211 /* 0xcb */ { NULL, NULL, 0 },
1212 /* 0xcc */ { NULL, NULL, 0 },
1213 /* 0xcd */ { NULL, NULL, 0 },
1214 /* 0xce */ { NULL, NULL, 0 },
1215 /* 0xcf */ { NULL, NULL, 0 },
1216 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1217 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1218 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1219 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1220 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1221 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1222 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1223 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1224 /* 0xd8 */ { NULL, NULL, 0 },
1225 /* 0xd9 */ { NULL, NULL, 0 },
1226 /* 0xda */ { NULL, NULL, 0 },
1227 /* 0xdb */ { NULL, NULL, 0 },
1228 /* 0xdc */ { NULL, NULL, 0 },
1229 /* 0xdd */ { NULL, NULL, 0 },
1230 /* 0xde */ { NULL, NULL, 0 },
1231 /* 0xdf */ { NULL, NULL, 0 },
1232 /* 0xe0 */ { NULL, NULL, 0 },
1233 /* 0xe1 */ { NULL, NULL, 0 },
1234 /* 0xe2 */ { NULL, NULL, 0 },
1235 /* 0xe3 */ { NULL, NULL, 0 },
1236 /* 0xe4 */ { NULL, NULL, 0 },
1237 /* 0xe5 */ { NULL, NULL, 0 },
1238 /* 0xe6 */ { NULL, NULL, 0 },
1239 /* 0xe7 */ { NULL, NULL, 0 },
1240 /* 0xe8 */ { NULL, NULL, 0 },
1241 /* 0xe9 */ { NULL, NULL, 0 },
1242 /* 0xea */ { NULL, NULL, 0 },
1243 /* 0xeb */ { NULL, NULL, 0 },
1244 /* 0xec */ { NULL, NULL, 0 },
1245 /* 0xed */ { NULL, NULL, 0 },
1246 /* 0xee */ { NULL, NULL, 0 },
1247 /* 0xef */ { NULL, NULL, 0 },
1248 /* 0xf0 */ { NULL, NULL, 0 },
1249 /* 0xf1 */ { NULL, NULL, 0 },
1250 /* 0xf2 */ { NULL, NULL, 0 },
1251 /* 0xf3 */ { NULL, NULL, 0 },
1252 /* 0xf4 */ { NULL, NULL, 0 },
1253 /* 0xf5 */ { NULL, NULL, 0 },
1254 /* 0xf6 */ { NULL, NULL, 0 },
1255 /* 0xf7 */ { NULL, NULL, 0 },
1256 /* 0xf8 */ { NULL, NULL, 0 },
1257 /* 0xf9 */ { NULL, NULL, 0 },
1258 /* 0xfa */ { NULL, NULL, 0 },
1259 /* 0xfb */ { NULL, NULL, 0 },
1260 /* 0xfc */ { NULL, NULL, 0 },
1261 /* 0xfd */ { NULL, NULL, 0 },
1262 /* 0xfe */ { NULL, NULL, 0 },
1263 /* 0xff */ { NULL, NULL, 0 }
1264
1265 };
1266
1267 /*******************************************************************
1268 allocate and initialize a reply packet
1269 ********************************************************************/
1270
1271 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1272 const char *inbuf, char **outbuf, uint8_t num_words,
1273 uint32_t num_bytes)
1274 {
1275 size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1276
1277 /*
1278 * Protect against integer wrap.
1279 * The SMB layer reply can be up to 0xFFFFFF bytes.
1280 */
1281 if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1282 char *msg;
1283 if (asprintf(&msg, "num_bytes too large: %u",
1284 (unsigned)num_bytes) == -1) {
1285 msg = discard_const_p(char, "num_bytes too large");
1286 }
1287 smb_panic(msg);
1288 }
1289
1290 /*
1291 * Here we include the NBT header for now.
1292 */
1293 *outbuf = talloc_array(mem_ctx, char,
1294 NBT_HDR_SIZE + smb_len);
1295 if (*outbuf == NULL) {
1296 return false;
1297 }
1298
1299 construct_reply_common(req, inbuf, *outbuf);
1300 srv_set_message(*outbuf, num_words, num_bytes, false);
1301 /*
1302 * Zero out the word area, the caller has to take care of the bcc area
1303 * himself
1304 */
1305 if (num_words != 0) {
1306 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1307 }
1308
1309 return true;
1310 }
1311
1312 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1313 {
1314 char *outbuf;
1315 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1316 num_bytes)) {
1317 smb_panic("could not allocate output buffer\n");
1318 }
1319 req->outbuf = (uint8_t *)outbuf;
1320 }
1321
1322
1323 /*******************************************************************
1324 Dump a packet to a file.
1325 ********************************************************************/
1326
1327 static void smb_dump(const char *name, int type, const char *data)
1328 {
1329 size_t len;
1330 int fd, i;
1331 char *fname = NULL;
1332 if (DEBUGLEVEL < 50) {
1333 return;
1334 }
1335
1336 len = smb_len_tcp(data)+4;
1337 for (i=1;i<100;i++) {
1338 fname = talloc_asprintf(talloc_tos(),
1339 "/tmp/%s.%d.%s",
1340 name,
1341 i,
1342 type ? "req" : "resp");
1343 if (fname == NULL) {
1344 return;
1345 }
1346 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1347 if (fd != -1 || errno != EEXIST) break;
1348 TALLOC_FREE(fname);
1349 }
1350 if (fd != -1) {
1351 ssize_t ret = write(fd, data, len);
1352 if (ret != len)
1353 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1354 close(fd);
1355 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1356 }
1357 TALLOC_FREE(fname);
1358 }
1359
1360 /****************************************************************************
1361 Prepare everything for calling the actual request function, and potentially
1362 call the request function via the "new" interface.
1363
1364 Return False if the "legacy" function needs to be called, everything is
1365 prepared.
1366
1367 Return True if we're done.
1368
1369 I know this API sucks, but it is the one with the least code change I could
1370 find.
1371 ****************************************************************************/
1372
1373 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1374 {
1375 int flags;
1376 uint64_t session_tag;
1377 connection_struct *conn = NULL;
1378 struct smbd_server_connection *sconn = req->sconn;
1379 NTTIME now = timeval_to_nttime(&req->request_time);
1380 struct smbXsrv_session *session = NULL;
1381 NTSTATUS status;
1382
1383 errno = 0;
1384
1385 if (smb_messages[type].fn == NULL) {
1386 DEBUG(0,("Unknown message type %d!\n",type));
1387 smb_dump("Unknown", 1, (const char *)req->inbuf);
1388 reply_unknown_new(req, type);
1389 return NULL;
1390 }
1391
1392 flags = smb_messages[type].flags;
1393
1394 /* In share mode security we must ignore the vuid. */
1395 session_tag = req->vuid;
1396 conn = req->conn;
1397
1398 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1399 (int)getpid(), (unsigned long)conn));
1400
1401 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1402
1403 /* Ensure this value is replaced in the incoming packet. */
1404 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1405
1406 /*
1407 * Ensure the correct username is in current_user_info. This is a
1408 * really ugly bugfix for problems with multiple session_setup_and_X's
1409 * being done and allowing %U and %G substitutions to work correctly.
1410 * There is a reason this code is done here, don't move it unless you
1411 * know what you're doing... :-).
1412 * JRA.
1413 */
1414
1415 /*
1416 * lookup an existing session
1417 *
1418 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1419 * here, the main check is still in change_to_user()
1420 */
1421 status = smb1srv_session_lookup(sconn->conn,
1422 session_tag,
1423 now,
1424 &session);
1425 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1426 switch (type) {
1427 case SMBsesssetupX:
1428 status = NT_STATUS_OK;
1429 break;
1430 default:
1431 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1432 (unsigned long long)session_tag,
1433 (unsigned long long)req->mid));
1434 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1435 return conn;
1436 }
1437 }
1438
1439 if (session_tag != sconn->conn->last_session_id) {
1440 struct user_struct *vuser = NULL;
1441
1442 sconn->conn->last_session_id = session_tag;
1443 if (session) {
1444 vuser = session->compat;
1445 }
1446 if (vuser) {
1447 set_current_user_info(
1448 vuser->session_info->unix_info->sanitized_username,
1449 vuser->session_info->unix_info->unix_name,
1450 vuser->session_info->info->domain_name);
1451 }
1452 }
1453
1454 /* Does this call need to be run as the connected user? */
1455 if (flags & AS_USER) {
1456
1457 /* Does this call need a valid tree connection? */
1458 if (!conn) {
1459 /*
1460 * Amazingly, the error code depends on the command
1461 * (from Samba4).
1462 */
1463 if (type == SMBntcreateX) {
1464 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1465 } else {
1466 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1467 }
1468 return NULL;
1469 }
1470
1471 if (!change_to_user(conn,session_tag)) {
1472 DEBUG(0, ("Error: Could not change to user. Removing "
1473 "deferred open, mid=%llu.\n",
1474 (unsigned long long)req->mid));
1475 reply_force_doserror(req, ERRSRV, ERRbaduid);
1476 return conn;
1477 }
1478
1479 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1480
1481 /* Does it need write permission? */
1482 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1483 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1484 return conn;
1485 }
1486
1487 /* IPC services are limited */
1488 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1489 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1490 return conn;
1491 }
1492 } else {
1493 /* This call needs to be run as root */
1494 change_to_root_user();
1495 }
1496
1497 /* load service specific parameters */
1498 if (conn) {
1499 if (req->encrypted) {
1500 conn->encrypted_tid = true;
1501 /* encrypted required from now on. */
1502 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1503 } else if (ENCRYPTION_REQUIRED(conn)) {
1504 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1505 DEBUG(1,("service[%s] requires encryption"
1506 "%s ACCESS_DENIED. mid=%llu\n",
1507 lp_servicename(talloc_tos(), SNUM(conn)),
1508 smb_fn_name(type),
1509 (unsigned long long)req->mid));
1510 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1511 return conn;
1512 }
1513 }
1514
1515 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1516 (flags & (AS_USER|DO_CHDIR)
1517 ?True:False))) {
1518 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1519 return conn;
1520 }
1521 conn->num_smb_operations++;
1522 }
1523
1524 /*
1525 * Does this protocol need to be run as guest? (Only archane
1526 * messenger service requests have this...)
1527 */
1528 if (flags & AS_GUEST) {
1529 char *raddr;
1530 bool ok;
1531
1532 if (!change_to_guest()) {
1533 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1534 return conn;
1535 }
1536
1537 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1538 talloc_tos());
1539 if (raddr == NULL) {
1540 reply_nterror(req, NT_STATUS_NO_MEMORY);
1541 return conn;
1542 }
1543
1544 /*
1545 * Haven't we checked this in smbd_process already???
1546 */
1547
1548 ok = allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1549 sconn->remote_hostname, raddr);
1550 TALLOC_FREE(raddr);
1551
1552 if (!ok) {
1553 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1554 return conn;
1555 }
1556 }
1557
1558 smb_messages[type].fn(req);
1559 return req->conn;
1560 }
1561
1562 /****************************************************************************
1563 Construct a reply to the incoming packet.
1564 ****************************************************************************/
1565
1566 static void construct_reply(struct smbd_server_connection *sconn,
1567 char *inbuf, int size, size_t unread_bytes,
1568 uint32_t seqnum, bool encrypted,
1569 struct smb_perfcount_data *deferred_pcd)
1570 {
1571 connection_struct *conn;
1572 struct smb_request *req;
1573
1574 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1575 smb_panic("could not allocate smb_request");
1576 }
1577
1578 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1579 encrypted, seqnum)) {
1580 exit_server_cleanly("Invalid SMB request");
1581 }
1582
1583 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1584
1585 /* we popped this message off the queue - keep original perf data */
1586 if (deferred_pcd)
1587 req->pcd = *deferred_pcd;
1588 else {
1589 SMB_PERFCOUNT_START(&req->pcd);
1590 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1591 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1592 }
1593
1594 conn = switch_message(req->cmd, req);
1595
1596 if (req->outbuf == NULL) {
1597 return;
1598 }
1599
1600 if (CVAL(req->outbuf,0) == 0) {
1601 show_msg((char *)req->outbuf);
1602 }
1603
1604 if (!srv_send_smb(req->sconn,
1605 (char *)req->outbuf,
1606 true, req->seqnum+1,
1607 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1608 &req->pcd)) {
1609 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1610 }
1611
1612 TALLOC_FREE(req);
1613
1614 return;
1615 }
1616
1617 static void construct_reply_chain(struct smbd_server_connection *sconn,
1618 char *inbuf, int size, uint32_t seqnum,
1619 bool encrypted,
1620 struct smb_perfcount_data *deferred_pcd)
1621 {
1622 struct smb_request **reqs = NULL;
1623 struct smb_request *req;
1624 unsigned num_reqs;
1625 bool ok;
1626
1627 ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1628 seqnum, &reqs, &num_reqs);
1629 if (!ok) {
1630 char errbuf[smb_size];
1631 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1632 __LINE__, __FILE__);
1633 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1634 NULL)) {
1635 exit_server_cleanly("construct_reply_chain: "
1636 "srv_send_smb failed.");
1637 }
1638 return;
1639 }
1640
1641 req = reqs[0];
1642 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1643
1644 req->conn = switch_message(req->cmd, req);
1645
1646 if (req->outbuf == NULL) {
1647 /*
1648 * Request has suspended itself, will come
1649 * back here.
1650 */
1651 return;
1652 }
1653 smb_request_done(req);
1654 }
1655
1656 /*
1657 * To be called from an async SMB handler that is potentially chained
1658 * when it is finished for shipping.
1659 */
1660
1661 void smb_request_done(struct smb_request *req)
1662 {
1663 struct smb_request **reqs = NULL;
1664 struct smb_request *first_req;
1665 size_t i, num_reqs, next_index;
1666 NTSTATUS status;
1667
1668 if (req->chain == NULL) {
1669 first_req = req;
1670 goto shipit;
1671 }
1672
1673 reqs = req->chain;
1674 num_reqs = talloc_array_length(reqs);
1675
1676 for (i=0; i<num_reqs; i++) {
1677 if (reqs[i] == req) {
1678 break;
1679 }
1680 }
1681 if (i == num_reqs) {
1682 /*
1683 * Invalid chain, should not happen
1684 */
1685 status = NT_STATUS_INTERNAL_ERROR;
1686 goto error;
1687 }
1688 next_index = i+1;
1689
1690 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1691 struct smb_request *next = reqs[next_index];
1692 struct smbXsrv_tcon *tcon;
1693 NTTIME now = timeval_to_nttime(&req->request_time);
1694
1695 next->vuid = SVAL(req->outbuf, smb_uid);
1696 next->tid = SVAL(req->outbuf, smb_tid);
1697 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1698 now, &tcon);
1699 if (NT_STATUS_IS_OK(status)) {
1700 req->conn = tcon->compat;
1701 } else {
1702 req->conn = NULL;
1703 }
1704 next->chain_fsp = req->chain_fsp;
1705 next->inbuf = req->inbuf;
1706
1707 req = next;
1708 req->conn = switch_message(req->cmd, req);
1709
1710 if (req->outbuf == NULL) {
1711 /*
1712 * Request has suspended itself, will come
1713 * back here.
1714 */
1715 return;
1716 }
1717 next_index += 1;
1718 }
1719
1720 first_req = reqs[0];
1721
1722 for (i=1; i<next_index; i++) {
1723 bool ok;
1724
1725 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1726 if (!ok) {
1727 status = NT_STATUS_INTERNAL_ERROR;
1728 goto error;
1729 }
1730 }
1731
1732 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1733 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1734
1735 /*
1736 * This scary statement intends to set the
1737 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1738 * to the value last_req->outbuf carries
1739 */
1740 SSVAL(first_req->outbuf, smb_flg2,
1741 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1742 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1743
1744 /*
1745 * Transfer the error codes from the subrequest to the main one
1746 */
1747 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1748 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1749
1750 _smb_setlen_large(
1751 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1752
1753 shipit:
1754 if (!srv_send_smb(first_req->sconn,
1755 (char *)first_req->outbuf,
1756 true, first_req->seqnum+1,
1757 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1758 &first_req->pcd)) {
1759 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1760 "failed.");
1761 }
1762 TALLOC_FREE(req); /* non-chained case */
1763 TALLOC_FREE(reqs); /* chained case */
1764 return;
1765
1766 error:
1767 {
1768 char errbuf[smb_size];
1769 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1770 if (!srv_send_smb(req->sconn, errbuf, true,
1771 req->seqnum+1, req->encrypted,
1772 NULL)) {
1773 exit_server_cleanly("construct_reply_chain: "
1774 "srv_send_smb failed.");
1775 }
1776 }
1777 TALLOC_FREE(req); /* non-chained case */
1778 TALLOC_FREE(reqs); /* chained case */
1779 }
1780
1781 /****************************************************************************
1782 Process an smb from the client
1783 ****************************************************************************/
1784 static void process_smb(struct smbd_server_connection *sconn,
1785 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1786 uint32_t seqnum, bool encrypted,
1787 struct smb_perfcount_data *deferred_pcd)
1788 {
1789 int msg_type = CVAL(inbuf,0);
1790
1791 DO_PROFILE_INC(smb_count);
1792
1793 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1794 smb_len(inbuf) ) );
1795 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1796 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1797
1798 if (msg_type != NBSSmessage) {
1799 /*
1800 * NetBIOS session request, keepalive, etc.
1801 */
1802 reply_special(sconn, (char *)inbuf, nread);
1803 goto done;
1804 }
1805
1806 if (sconn->using_smb2) {
1807 /* At this point we're not really using smb2,
1808 * we make the decision here.. */
1809 if (smbd_is_smb2_header(inbuf, nread)) {
1810 smbd_smb2_first_negprot(sconn, inbuf, nread);
1811 return;
1812 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1813 && CVAL(inbuf, smb_com) != 0x72) {
1814 /* This is a non-negprot SMB1 packet.
1815 Disable SMB2 from now on. */
1816 sconn->using_smb2 = false;
1817 }
1818 }
1819
1820 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1821 * so subtract 4 from it. */
1822 if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1823 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1824 smb_len(inbuf)));
1825
1826 /* special magic for immediate exit */
1827 if ((nread == 9) &&
1828 (IVAL(inbuf, 4) == 0x74697865) &&
1829 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1830 uint8_t exitcode = CVAL(inbuf, 8);
1831 DEBUG(1, ("Exiting immediately with code %d\n",
1832 (int)exitcode));
1833 exit(exitcode);
1834 }
1835
1836 exit_server_cleanly("Non-SMB packet");
1837 }
1838
1839 show_msg((char *)inbuf);
1840
1841 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1842 construct_reply_chain(sconn, (char *)inbuf, nread,
1843 seqnum, encrypted, deferred_pcd);
1844 } else {
1845 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1846 seqnum, encrypted, deferred_pcd);
1847 }
1848
1849 sconn->trans_num++;
1850
1851 done:
1852 sconn->num_requests++;
1853
1854 /* The timeout_processing function isn't run nearly
1855 often enough to implement 'max log size' without
1856 overrunning the size of the file by many megabytes.
1857 This is especially true if we are running at debug
1858 level 10. Checking every 50 SMBs is a nice
1859 tradeoff of performance vs log file size overrun. */
1860
1861 if ((sconn->num_requests % 50) == 0 &&
1862 need_to_check_log_size()) {
1863 change_to_root_user();
1864 check_log_size();
1865 }
1866 }
1867
1868 /****************************************************************************
1869 Return a string containing the function name of a SMB command.
1870 ****************************************************************************/
1871
1872 const char *smb_fn_name(int type)
1873 {
1874 const char *unknown_name = "SMBunknown";
1875
1876 if (smb_messages[type].name == NULL)
1877 return(unknown_name);
1878
1879 return(smb_messages[type].name);
1880 }
1881
1882 /****************************************************************************
1883 Helper functions for contruct_reply.
1884 ****************************************************************************/
1885
1886 void add_to_common_flags2(uint32 v)
1887 {
1888 common_flags2 |= v;
1889 }
1890
1891 void remove_from_common_flags2(uint32 v)
1892 {
1893 common_flags2 &= ~v;
1894 }
1895
1896 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1897 char *outbuf)
1898 {
1899 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1900 uint16_t out_flags2 = common_flags2;
1901
1902 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1903 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1904 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1905
1906 srv_set_message(outbuf,0,0,false);
1907
1908 SCVAL(outbuf, smb_com, req->cmd);
1909 SIVAL(outbuf,smb_rcls,0);
1910 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1911 SSVAL(outbuf,smb_flg2, out_flags2);
1912 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1913 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1914
1915 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1916 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1917 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1918 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1919 }
1920
1921 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1922 {
1923 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1924 }
1925
1926 /**
1927 * @brief Find the smb_cmd offset of the last command pushed
1928 * @param[in] buf The buffer we're building up
1929 * @retval Where can we put our next andx cmd?
1930 *
1931 * While chaining requests, the "next" request we're looking at needs to put
1932 * its SMB_Command before the data the previous request already built up added
1933 * to the chain. Find the offset to the place where we have to put our cmd.
1934 */
1935
1936 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1937 {
1938 uint8_t cmd;
1939 size_t ofs;
1940
1941 cmd = CVAL(buf, smb_com);
1942
1943 if (!is_andx_req(cmd)) {
1944 return false;
1945 }
1946
1947 ofs = smb_vwv0;
1948
1949 while (CVAL(buf, ofs) != 0xff) {
1950
1951 if (!is_andx_req(CVAL(buf, ofs))) {
1952 return false;
1953 }
1954
1955 /*
1956 * ofs is from start of smb header, so add the 4 length
1957 * bytes. The next cmd is right after the wct field.
1958 */
1959 ofs = SVAL(buf, ofs+2) + 4 + 1;
1960
1961 if (ofs+4 >= talloc_get_size(buf)) {
1962 return false;
1963 }
1964 }
1965
1966 *pofs = ofs;
1967 return true;
1968 }
1969
1970 /**
1971 * @brief Do the smb chaining at a buffer level
1972 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1973 * @param[in] andx_buf Buffer to be appended
1974 */
1975
1976 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1977 {
1978 uint8_t smb_command = CVAL(andx_buf, smb_com);
1979 uint8_t wct = CVAL(andx_buf, smb_wct);
1980 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1981 uint32_t num_bytes = smb_buflen(andx_buf);
1982 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1983
1984 uint8_t *outbuf;
1985 size_t old_size, new_size;
1986 size_t ofs;
1987 size_t chain_padding = 0;
1988 size_t andx_cmd_ofs;
1989
1990
1991 old_size = talloc_get_size(*poutbuf);
1992
1993 if ((old_size % 4) != 0) {
1994 /*
1995 * Align the wct field of subsequent requests to a 4-byte
1996 * boundary
1997 */
1998 chain_padding = 4 - (old_size % 4);
1999 }
2000
2001 /*
2002 * After the old request comes the new wct field (1 byte), the vwv's
2003 * and the num_bytes field.
2004 */
2005
2006 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2007 new_size += num_bytes;
2008
2009 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2010 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2011 (unsigned)new_size));
2012 return false;
2013 }
2014
2015 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2016 if (outbuf == NULL) {
2017 DEBUG(0, ("talloc failed\n"));
2018 return false;
2019 }
2020 *poutbuf = outbuf;
2021
2022 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2023 DEBUG(1, ("invalid command chain\n"));
2024 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2025 return false;
2026 }
2027
2028 if (chain_padding != 0) {
2029 memset(outbuf + old_size, 0, chain_padding);
2030 old_size += chain_padding;
2031 }
2032
2033 SCVAL(outbuf, andx_cmd_ofs, smb_command);
2034 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2035
2036 ofs = old_size;
2037
2038 /*
2039 * Push the chained request:
2040 *
2041 * wct field
2042 */
2043
2044 SCVAL(outbuf, ofs, wct);
2045 ofs += 1;
2046
2047 /*
2048 * vwv array
2049 */
2050
2051 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2052
2053 /*
2054 * HACK ALERT
2055 *
2056 * Read&X has an offset into its data buffer at
2057 * vwv[6]. reply_read_andx has no idea anymore that it's
2058 * running from within a chain, so we have to fix up the
2059 * offset here.
2060 *
2061 * Although it looks disgusting at this place, I want to keep
2062 * it here. The alternative would be to push knowledge about
2063 * the andx chain down into read&x again.
2064 */
2065
2066 if (smb_command == SMBreadX) {
2067 uint8_t *bytes_addr;
2068
2069 if (wct < 7) {
2070 /*
2071 * Invalid read&x response
2072 */
2073 return false;
2074 }
2075
2076 bytes_addr = outbuf + ofs /* vwv start */
2077 + sizeof(uint16_t) * wct /* vwv array */
2078 + sizeof(uint16_t); /* bcc */
2079
2080 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2081 bytes_addr - outbuf - 4);
2082 }
2083
2084 ofs += sizeof(uint16_t) * wct;
2085
2086 /*
2087 * bcc (byte count)
2088 */
2089
2090 SSVAL(outbuf, ofs, num_bytes);
2091 ofs += sizeof(uint16_t);
2092
2093 /*
2094 * The bytes field
2095 */
2096
2097 memcpy(outbuf + ofs, bytes, num_bytes);
2098
2099 return true;
2100 }
2101
2102 bool smb1_is_chain(const uint8_t *buf)
2103 {
2104 uint8_t cmd, wct, andx_cmd;
2105
2106 cmd = CVAL(buf, smb_com);
2107 if (!is_andx_req(cmd)) {
2108 return false;
2109 }
2110 wct = CVAL(buf, smb_wct);
2111 if (wct < 2) {
2112 return false;
2113 }
2114 andx_cmd = CVAL(buf, smb_vwv);
2115 return (andx_cmd != 0xFF);
2116 }
2117
2118 bool smb1_walk_chain(const uint8_t *buf,
2119 bool (*fn)(uint8_t cmd,
2120 uint8_t wct, const uint16_t *vwv,
2121 uint16_t num_bytes, const uint8_t *bytes,
2122 void *private_data),
2123 void *private_data)
2124 {
2125 size_t smblen = smb_len(buf);
2126 const char *smb_buf = smb_base(buf);
2127 uint8_t cmd, chain_cmd;
2128 uint8_t wct;
2129 const uint16_t *vwv;
2130 uint16_t num_bytes;
2131 const uint8_t *bytes;
2132
2133 cmd = CVAL(buf, smb_com);
2134 wct = CVAL(buf, smb_wct);
2135 vwv = (const uint16_t *)(buf + smb_vwv);
2136 num_bytes = smb_buflen(buf);
2137 bytes = (const uint8_t *)smb_buf_const(buf);
2138
2139 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2140 return false;
2141 }
2142
2143 if (!is_andx_req(cmd)) {
2144 return true;
2145 }
2146 if (wct < 2) {
2147 return false;
2148 }
2149
2150 chain_cmd = CVAL(vwv, 0);
2151
2152 while (chain_cmd != 0xff) {
2153 uint32_t chain_offset; /* uint32_t to avoid overflow */
2154 size_t length_needed;
2155 ptrdiff_t vwv_offset;
2156
2157 chain_offset = SVAL(vwv+1, 0);
2158
2159 /*
2160 * Check if the client tries to fool us. The chain
2161 * offset needs to point beyond the current request in
2162 * the chain, it needs to strictly grow. Otherwise we
2163 * might be tricked into an endless loop always
2164 * processing the same request over and over again. We
2165 * used to assume that vwv and the byte buffer array
2166 * in a chain are always attached, but OS/2 the
2167 * Write&X/Read&X chain puts the Read&X vwv array
2168 * right behind the Write&X vwv chain. The Write&X bcc
2169 * array is put behind the Read&X vwv array. So now we
2170 * check whether the chain offset points strictly
2171 * behind the previous vwv array. req->buf points
2172 * right after the vwv array of the previous
2173 * request. See
2174 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2175 * more information.
2176 */
2177
2178 vwv_offset = ((const char *)vwv - smb_buf);
2179 if (chain_offset <= vwv_offset) {
2180 return false;
2181 }
2182
2183 /*
2184 * Next check: Make sure the chain offset does not
2185 * point beyond the overall smb request length.
2186 */
2187
2188 length_needed = chain_offset+1; /* wct */
2189 if (length_needed > smblen) {
2190 return false;
2191 }
2192
2193 /*
2194 * Now comes the pointer magic. Goal here is to set up
2195 * vwv and buf correctly again. The chain offset (the
2196 * former vwv[1]) points at the new wct field.
2197 */
2198
2199 wct = CVAL(smb_buf, chain_offset);
2200
2201 if (is_andx_req(chain_cmd) && (wct < 2)) {
2202 return false;
2203 }
2204
2205 /*
2206 * Next consistency check: Make the new vwv array fits
2207 * in the overall smb request.
2208 */
2209
2210 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2211 if (length_needed > smblen) {
2212 return false;
2213 }
2214 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2215
2216 /*
2217 * Now grab the new byte buffer....
2218 */
2219
2220 num_bytes = SVAL(vwv+wct, 0);
2221
2222 /*
2223 * .. and check that it fits.
2224 */
2225
2226 length_needed += num_bytes;
2227 if (length_needed > smblen) {
2228 return false;
2229 }
2230 bytes = (const uint8_t *)(vwv+wct+1);
2231
2232 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2233 return false;
2234 }
2235
2236 if (!is_andx_req(chain_cmd)) {
2237 return true;
2238 }
2239 chain_cmd = CVAL(vwv, 0);
2240 }
2241 return true;
2242 }
2243
2244 static bool smb1_chain_length_cb(uint8_t cmd,
2245 uint8_t wct, const uint16_t *vwv,
2246 uint16_t num_bytes, const uint8_t *bytes,
2247 void *private_data)
2248 {
2249 unsigned *count = (unsigned *)private_data;
2250 *count += 1;
2251 return true;
2252 }
2253
2254 unsigned smb1_chain_length(const uint8_t *buf)
2255 {
2256 unsigned count = 0;
2257
2258 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2259 return 0;
2260 }
2261 return count;
2262 }
2263
2264 struct smb1_parse_chain_state {
2265 TALLOC_CTX *mem_ctx;
2266 const uint8_t *buf;
2267 struct smbd_server_connection *sconn;
2268 bool encrypted;
2269 uint32_t seqnum;
2270
2271 struct smb_request **reqs;
2272 unsigned num_reqs;
2273 };
2274
2275 static bool smb1_parse_chain_cb(uint8_t cmd,
2276 uint8_t wct, const uint16_t *vwv,
2277 uint16_t num_bytes, const uint8_t *bytes,
2278 void *private_data)
2279 {
2280 struct smb1_parse_chain_state *state =
2281 (struct smb1_parse_chain_state *)private_data;
2282 struct smb_request **reqs;
2283 struct smb_request *req;
2284 bool ok;
2285
2286 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2287 struct smb_request *, state->num_reqs+1);
2288 if (reqs == NULL) {
2289 return false;
2290 }
2291 state->reqs = reqs;
2292
2293 req = talloc(reqs, struct smb_request);
2294 if (req == NULL) {
2295 return false;
2296 }
2297
2298 ok = init_smb_request(req, state->sconn, state->buf, 0,
2299 state->encrypted, state->seqnum);
2300 if (!ok) {
2301 return false;
2302 }
2303 req->cmd = cmd;
2304 req->wct = wct;
2305 req->vwv = vwv;
2306 req->buflen = num_bytes;
2307 req->buf = bytes;
2308
2309 reqs[state->num_reqs] = req;
2310 state->num_reqs += 1;
2311 return true;
2312 }
2313
2314 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2315 struct smbd_server_connection *sconn,
2316 bool encrypted, uint32_t seqnum,
2317 struct smb_request ***reqs, unsigned *num_reqs)
2318 {
2319 struct smb1_parse_chain_state state;
2320 unsigned i;
2321
2322 state.mem_ctx = mem_ctx;
2323 state.buf = buf;
2324 state.sconn = sconn;
2325 state.encrypted = encrypted;
2326 state.seqnum = seqnum;
2327 state.reqs = NULL;
2328 state.num_reqs = 0;
2329
2330 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2331 TALLOC_FREE(state.reqs);
2332 return false;
2333 }
2334 for (i=0; i<state.num_reqs; i++) {
2335 state.reqs[i]->chain = state.reqs;
2336 }
2337 *reqs = state.reqs;
2338 *num_reqs = state.num_reqs;
2339 return true;
2340 }
2341
2342 /****************************************************************************
2343 Check if services need reloading.
2344 ****************************************************************************/
2345
2346 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2347 {
2348
2349 if (last_smb_conf_reload_time == 0) {
2350 last_smb_conf_reload_time = t;
2351 }
2352
2353 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2354 reload_services(sconn, conn_snum_used, true);
2355 last_smb_conf_reload_time = t;
2356 }
2357 }
2358
2359 static bool fd_is_readable(int fd)
2360 {
2361 int ret, revents;
2362
2363 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2364
2365 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2366
2367 }
2368
2369 static void smbd_server_connection_write_handler(
2370 struct smbd_server_connection *sconn)
2371 {
2372 /* TODO: make write nonblocking */
2373 }
2374
2375 static void smbd_server_connection_read_handler(
2376 struct smbd_server_connection *sconn, int fd)
2377 {
2378 uint8_t *inbuf = NULL;
2379 size_t inbuf_len = 0;
2380 size_t unread_bytes = 0;
2381 bool encrypted = false;
2382 TALLOC_CTX *mem_ctx = talloc_tos();
2383 NTSTATUS status;
2384 uint32_t seqnum;
2385
2386 bool from_client;
2387
2388 if (lp_async_smb_echo_handler()
2389 && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2390 /*
2391 * This is the super-ugly hack to prefer the packets
2392 * forwarded by the echo handler over the ones by the
2393 * client directly
2394 */
2395 fd = sconn->smb1.echo_handler.trusted_fd;
2396 }
2397
2398 from_client = (sconn->sock == fd);
2399
2400 if (from_client) {
2401 smbd_lock_socket(sconn);
2402
2403 if (!fd_is_readable(fd)) {
2404 DEBUG(10,("the echo listener was faster\n"));
2405 smbd_unlock_socket(sconn);
2406 return;
2407 }
2408 }
2409
2410 /* TODO: make this completely nonblocking */
2411 status = receive_smb_talloc(mem_ctx, sconn, fd,
2412 (char **)(void *)&inbuf,
2413 0, /* timeout */
2414 &unread_bytes,
2415 &encrypted,
2416 &inbuf_len, &seqnum,
2417 !from_client /* trusted channel */);
2418
2419 if (from_client) {
2420 smbd_unlock_socket(sconn);
2421 }
2422
2423 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2424 goto process;
2425 }
2426 if (NT_STATUS_IS_ERR(status)) {
2427 exit_server_cleanly("failed to receive smb request");
2428 }
2429 if (!NT_STATUS_IS_OK(status)) {
2430 return;
2431 }
2432
2433 process:
2434 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2435 seqnum, encrypted, NULL);
2436 }
2437
2438 static void smbd_server_connection_handler(struct tevent_context *ev,
2439 struct tevent_fd *fde,
2440 uint16_t flags,
2441 void *private_data)
2442 {
2443 struct smbd_server_connection *conn = talloc_get_type(private_data,
2444 struct smbd_server_connection);
2445
2446 if (flags & TEVENT_FD_WRITE) {
2447 smbd_server_connection_write_handler(conn);
2448 return;
2449 }
2450 if (flags & TEVENT_FD_READ) {
2451 smbd_server_connection_read_handler(conn, conn->sock);
2452 return;
2453 }
2454 }
2455
2456 static void smbd_server_echo_handler(struct tevent_context *ev,
2457 struct tevent_fd *fde,
2458 uint16_t flags,
2459 void *private_data)
2460 {
2461 struct smbd_server_connection *conn = talloc_get_type(private_data,
2462 struct smbd_server_connection);
2463
2464 if (flags & TEVENT_FD_WRITE) {
2465 smbd_server_connection_write_handler(conn);
2466 return;
2467 }
2468 if (flags & TEVENT_FD_READ) {
2469 smbd_server_connection_read_handler(
2470 conn, conn->smb1.echo_handler.trusted_fd);
2471 return;
2472 }
2473 }
2474
2475 #ifdef CLUSTER_SUPPORT
2476
2477 struct smbd_release_ip_state {
2478 struct smbd_server_connection *sconn;
2479 char addr[INET6_ADDRSTRLEN];
2480 };
2481
2482 /****************************************************************************
2483 received when we should release a specific IP
2484 ****************************************************************************/
2485 static void release_ip(const char *ip, void *priv)
2486 {
2487 struct smbd_release_ip_state *state =
2488 talloc_get_type_abort(priv,
2489 struct smbd_release_ip_state);
2490 const char *addr = state->addr;
2491 const char *p = addr;
2492
2493 if (strncmp("::ffff:", addr, 7) == 0) {
2494 p = addr + 7;
2495 }
2496
2497 DEBUG(10, ("Got release IP message for %s, "
2498 "our address is %s\n", ip, p));
2499
2500 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2501 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2502 ip));
2503 /*
2504 * With SMB2 we should do a clean disconnect,
2505 * the previous_session_id in the session setup
2506 * will cleanup the old session, tcons and opens.
2507 *
2508 * A clean disconnect is needed in order to support
2509 * durable handles.
2510 *
2511 * Note: typically this is never triggered
2512 * as we got a TCP RST (triggered by ctdb event scripts)
2513 * before we get CTDB_SRVID_RELEASE_IP.
2514 *
2515 * We used to call _exit(1) here, but as this was mostly never
2516 * triggered and has implication on our process model,
2517 * we can just use smbd_server_connection_terminate()
2518 * (also for SMB1).
2519 */
2520 smbd_server_connection_terminate(state->sconn,
2521 "CTDB_SRVID_RELEASE_IP");
2522 return;
2523 }
2524 }
2525
2526 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2527 struct sockaddr_storage *srv,
2528 struct sockaddr_storage *clnt)
2529 {
2530 struct smbd_release_ip_state *state;
2531 struct ctdbd_connection *cconn;
2532
2533 cconn = messaging_ctdbd_connection();
2534 if (cconn == NULL) {
2535 return NT_STATUS_NO_MEMORY;
2536 }
2537
2538 state = talloc_zero(sconn, struct smbd_release_ip_state);
2539 if (state == NULL) {
2540 return NT_STATUS_NO_MEMORY;
2541 }
2542 state->sconn = sconn;
2543 if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2544 return NT_STATUS_NO_MEMORY;
2545 }
2546
2547 return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2548 }
2549
2550 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2551 struct sockaddr_storage *client)
2552 {
2553 socklen_t length;
2554 length = sizeof(*server);
2555 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2556 return -1;
2557 }
2558 length = sizeof(*client);
2559 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2560 return -1;
2561 }
2562 return 0;
2563 }
2564 #endif
2565
2566 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2567 void *private_data, uint32_t msg_type,
2568 struct server_id server_id, DATA_BLOB *data)
2569 {
2570 struct smbd_server_connection *sconn = talloc_get_type_abort(
2571 private_data, struct smbd_server_connection);
2572 const char *ip = (char *) data->data;
2573 char *client_ip;
2574
2575 DEBUG(10, ("Got kill request for client IP %s\n", ip));
2576
2577 client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2578 talloc_tos());
2579 if (client_ip == NULL) {
2580 return;
2581 }
2582
2583 if (strequal(ip, client_ip)) {
2584 DEBUG(1, ("Got kill client message for %s - "
2585 "exiting immediately\n", ip));
2586 exit_server_cleanly("Forced disconnect for client");
2587 }
2588
2589 TALLOC_FREE(client_ip);
2590 }
2591
2592 /*
2593 * Send keepalive packets to our client
2594 */
2595 static bool keepalive_fn(const struct timeval *now, void *private_data)
2596 {
2597 struct smbd_server_connection *sconn = talloc_get_type_abort(
2598 private_data, struct smbd_server_connection);
2599 bool ret;
2600
2601 if (sconn->using_smb2) {
2602 /* Don't do keepalives on an SMB2 connection. */
2603 return false;
2604 }
2605
2606 smbd_lock_socket(sconn);
2607 ret = send_keepalive(sconn->sock);
2608 smbd_unlock_socket(sconn);
2609
2610 if (!ret) {
2611 char addr[INET6_ADDRSTRLEN];
2612 /*
2613 * Try and give an error message saying what
2614 * client failed.
2615 */
2616 DEBUG(0, ("send_keepalive failed for client %s. "
2617 "Error %s - exiting\n",
2618 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2619 strerror(errno)));
2620 return False;
2621 }
2622 return True;
2623 }
2624
2625 /*
2626 * Do the recurring check if we're idle
2627 */
2628 static bool deadtime_fn(const struct timeval *now, void *private_data)
2629 {
2630 struct smbd_server_connection *sconn =
2631 (struct smbd_server_connection *)private_data;
2632
2633 if ((conn_num_open(sconn) == 0)
2634 || (conn_idle_all(sconn, now->tv_sec))) {
2635 DEBUG( 2, ( "Closing idle connection\n" ) );
2636 messaging_send(sconn->msg_ctx,
2637 messaging_server_id(sconn->msg_ctx),
2638 MSG_SHUTDOWN, &data_blob_null);
2639 return False;
2640 }
2641
2642 return True;
2643 }
2644
2645 /*
2646 * Do the recurring log file and smb.conf reload checks.
2647 */
2648
2649 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2650 {
2651 struct smbd_server_connection *sconn = talloc_get_type_abort(
2652 private_data, struct smbd_server_connection);
2653
2654 DEBUG(5, ("housekeeping\n"));
2655
2656 change_to_root_user();
2657
2658 /* update printer queue caches if necessary */
2659 update_monitored_printq_cache(sconn->msg_ctx);
2660
2661 /* check if we need to reload services */
2662 check_reload(sconn, time_mono(NULL));
2663
2664 /*
2665 * Force a log file check.
2666 */
2667 force_check_log_size();
2668 check_log_size();
2669 return true;
2670 }
2671
2672 /*
2673 * Read an smb packet in the echo handler child, giving the parent
2674 * smbd one second to react once the socket becomes readable.
2675 */
2676
2677 struct smbd_echo_read_state {
2678 struct tevent_context *ev;
2679 struct smbd_server_connection *sconn;
2680
2681 char *buf;
2682 size_t buflen;
2683 uint32_t seqnum;
2684 };
2685
2686 static void smbd_echo_read_readable(struct tevent_req *subreq);
2687 static void smbd_echo_read_waited(struct tevent_req *subreq);
2688
2689 static struct tevent_req *smbd_echo_read_send(
2690 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2691 struct smbd_server_connection *sconn)
2692 {
2693 struct tevent_req *req, *subreq;
2694 struct smbd_echo_read_state *state;
2695
2696 req = tevent_req_create(mem_ctx, &state,
2697 struct smbd_echo_read_state);
2698 if (req == NULL) {
2699 return NULL;
2700 }
2701 state->ev = ev;
2702 state->sconn = sconn;
2703
2704 subreq = wait_for_read_send(state, ev, sconn->sock);
2705 if (tevent_req_nomem(subreq, req)) {
2706 return tevent_req_post(req, ev);
2707 }
2708 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2709 return req;
2710 }
2711
2712 static void smbd_echo_read_readable(struct tevent_req *subreq)
2713 {
2714 struct tevent_req *req = tevent_req_callback_data(
2715 subreq, struct tevent_req);
2716 struct smbd_echo_read_state *state = tevent_req_data(
2717 req, struct smbd_echo_read_state);
2718 bool ok;
2719 int err;
2720
2721 ok = wait_for_read_recv(subreq, &err);
2722 TALLOC_FREE(subreq);
2723 if (!ok) {
2724 tevent_req_nterror(req, map_nt_error_from_unix(err));
2725 return;
2726 }
2727
2728 /*
2729 * Give the parent smbd one second to step in
2730 */
2731
2732 subreq = tevent_wakeup_send(
2733 state, state->ev, timeval_current_ofs(1, 0));
2734 if (tevent_req_nomem(subreq, req)) {
2735 return;
2736 }
2737 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2738 }
2739
2740 static void smbd_echo_read_waited(struct tevent_req *subreq)
2741 {
2742 struct tevent_req *req = tevent_req_callback_data(
2743 subreq, struct tevent_req);
2744 struct smbd_echo_read_state *state = tevent_req_data(
2745 req, struct smbd_echo_read_state);
2746 struct smbd_server_connection *sconn = state->sconn;
2747 bool ok;
2748 NTSTATUS status;
2749 size_t unread = 0;
2750 bool encrypted;
2751
2752 ok = tevent_wakeup_recv(subreq);
2753 TALLOC_FREE(subreq);
2754 if (!ok) {
2755 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2756 return;
2757 }
2758
2759 ok = smbd_lock_socket_internal(sconn);
2760 if (!ok) {
2761 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2762 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2763 return;
2764 }
2765
2766 if (!fd_is_readable(sconn->sock)) {
2767 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2768 (int)getpid()));
2769
2770 ok = smbd_unlock_socket_internal(sconn);
2771 if (!ok) {
2772 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2773 DEBUG(1, ("%s: failed to unlock socket\n",
2774 __location__));
2775 return;
2776 }
2777
2778 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2779 if (tevent_req_nomem(subreq, req)) {
2780 return;
2781 }
2782 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2783 return;
2784 }
2785
2786 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2787 0 /* timeout */,
2788 &unread,
2789 &encrypted,
2790 &state->buflen,
2791 &state->seqnum,
2792 false /* trusted_channel*/);
2793
2794 if (tevent_req_nterror(req, status)) {
2795 tevent_req_nterror(req, status);
2796 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2797 (int)getpid(), nt_errstr(status)));
2798 return;
2799 }
2800
2801 ok = smbd_unlock_socket_internal(sconn);
2802 if (!ok) {
2803 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2804 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2805 return;
2806 }
2807 tevent_req_done(req);
2808 }
2809
2810 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2811 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2812 {
2813 struct smbd_echo_read_state *state = tevent_req_data(
2814 req, struct smbd_echo_read_state);
2815 NTSTATUS status;
2816
2817 if (tevent_req_is_nterror(req, &status)) {
2818 return status;
2819 }
2820 *pbuf = talloc_move(mem_ctx, &state->buf);
2821 *pbuflen = state->buflen;
2822 *pseqnum = state->seqnum;
2823 return NT_STATUS_OK;
2824 }
2825
2826 struct smbd_echo_state {
2827 struct tevent_context *ev;
2828 struct iovec *pending;
2829 struct smbd_server_connection *sconn;
2830 int parent_pipe;
2831
2832 struct tevent_fd *parent_fde;
2833
2834 struct tevent_req *write_req;
2835 };
2836
2837 static void smbd_echo_writer_done(struct tevent_req *req);
2838
2839 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2840 {
2841 int num_pending;
2842
2843 if (state->write_req != NULL) {
2844 return;
2845 }
2846
2847 num_pending = talloc_array_length(state->pending);
2848 if (num_pending == 0) {
2849 return;
2850 }
2851
2852 state->write_req = writev_send(state, state->ev, NULL,
2853 state->parent_pipe, false,
2854 state->pending, num_pending);
2855 if (state->write_req == NULL) {
2856 DEBUG(1, ("writev_send failed\n"));
2857 exit(1);
2858 }
2859
2860 talloc_steal(state->write_req, state->pending);
2861 state->pending = NULL;
2862
2863 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2864 state);
2865 }
2866
2867 static void smbd_echo_writer_done(struct tevent_req *req)
2868 {
2869 struct smbd_echo_state *state = tevent_req_callback_data(
2870 req, struct smbd_echo_state);
2871 ssize_t written;
2872 int err;
2873
2874 written = writev_recv(req, &err);
2875 TALLOC_FREE(req);
2876 state->write_req = NULL;
2877 if (written == -1) {
2878 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2879 exit(1);
2880 }
2881 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2882 smbd_echo_activate_writer(state);
2883 }
2884
2885 static bool smbd_echo_reply(struct smbd_echo_state *state,
2886 uint8_t *inbuf, size_t inbuf_len,
2887 uint32_t seqnum)
2888 {
2889 struct smb_request req;
2890 uint16_t num_replies;
2891 char *outbuf;
2892 bool ok;
2893
2894 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2895 DEBUG(10, ("Got netbios keepalive\n"));
2896 /*
2897 * Just swallow it
2898 */
2899 return true;
2900 }
2901
2902 if (inbuf_len < smb_size) {
2903 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2904 return false;
2905 }
2906 if (!valid_smb_header(state->sconn, inbuf)) {
2907 DEBUG(10, ("Got invalid SMB header\n"));
2908 return false;
2909 }
2910
2911 if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2912 seqnum)) {
2913 return false;
2914 }
2915 req.inbuf = inbuf;
2916
2917 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2918 smb_messages[req.cmd].name
2919 ? smb_messages[req.cmd].name : "unknown"));
2920
2921 if (req.cmd != SMBecho) {
2922 return false;
2923 }
2924 if (req.wct < 1) {
2925 return false;
2926 }
2927
2928 num_replies = SVAL(req.vwv+0, 0);
2929 if (num_replies != 1) {
2930 /* Not a Windows "Hey, you're still there?" request */
2931 return false;
2932 }
2933
2934 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2935 1, req.buflen)) {
2936 DEBUG(10, ("create_outbuf failed\n"));
2937 return false;
2938 }
2939 req.outbuf = (uint8_t *)outbuf;
2940
2941 SSVAL(req.outbuf, smb_vwv0, num_replies);
2942
2943 if (req.buflen > 0) {
2944 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2945 }
2946
2947 ok = srv_send_smb(req.sconn,
2948 (char *)outbuf,
2949 true, seqnum+1,
2950 false, &req.pcd);
2951 TALLOC_FREE(outbuf);
2952 if (!ok) {
2953 exit(1);
2954 }
2955
2956 return true;
2957 }
2958
2959 static void smbd_echo_exit(struct tevent_context *ev,
2960 struct tevent_fd *fde, uint16_t flags,
2961 void *private_data)
2962 {
2963 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2964 exit(0);
2965 }
2966
2967 static void smbd_echo_got_packet(struct tevent_req *req);
2968
2969 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2970 int parent_pipe)
2971 {
2972 struct smbd_echo_state *state;
2973 struct tevent_req *read_req;
2974
2975 state = talloc_zero(sconn, struct smbd_echo_state);
2976 if (state == NULL) {
2977 DEBUG(1, ("talloc failed\n"));
2978 return;
2979 }
2980 state->sconn = sconn;
2981 state->parent_pipe = parent_pipe;
2982 state->ev = s3_tevent_context_init(state);
2983 if (state->ev == NULL) {
2984 DEBUG(1, ("tevent_context_init failed\n"));
2985 TALLOC_FREE(state);
2986 return;
2987 }
2988 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2989 TEVENT_FD_READ, smbd_echo_exit,
2990 state);
2991 if (state->parent_fde == NULL) {
2992 DEBUG(1, ("tevent_add_fd failed\n"));
2993 TALLOC_FREE(state);
2994 return;
2995 }
2996
2997 read_req = smbd_echo_read_send(state, state->ev, sconn);
2998 if (read_req == NULL) {
2999 DEBUG(1, ("smbd_echo_read_send failed\n"));
3000 TALLOC_FREE(state);
3001 return;
3002 }
3003 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3004
3005 while (true) {
3006 if (tevent_loop_once(state->ev) == -1) {
3007 DEBUG(1, ("tevent_loop_once failed: %s\n",
3008 strerror(errno)));
3009 break;
3010 }
3011 }
3012 TALLOC_FREE(state);
3013 }
3014
3015 static void smbd_echo_got_packet(struct tevent_req *req)
3016 {
3017 struct smbd_echo_state *state = tevent_req_callback_data(
3018 req, struct smbd_echo_state);
3019 NTSTATUS status;
3020 char *buf = NULL;
3021 size_t buflen = 0;
3022 uint32_t seqnum = 0;
3023 bool reply;
3024
3025 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3026 TALLOC_FREE(req);
3027 if (!NT_STATUS_IS_OK(status)) {
3028 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3029 nt_errstr(status)));
3030 exit(1);
3031 }
3032
3033 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3034 if (!reply) {
3035 size_t num_pending;
3036 struct iovec *tmp;
3037 struct iovec *iov;
3038
3039 num_pending = talloc_array_length(state->pending);
3040 tmp = talloc_realloc(state, state->pending, struct iovec,
3041 num_pending+1);
3042 if (tmp == NULL) {
3043 DEBUG(1, ("talloc_realloc failed\n"));
3044 exit(1);
3045 }
3046 state->pending = tmp;
3047
3048 if (buflen >= smb_size) {
3049 /*
3050 * place the seqnum in the packet so that the main process
3051 * can reply with signing
3052 */
3053 SIVAL(buf, smb_ss_field, seqnum);
3054 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3055 }
3056
3057 iov = &state->pending[num_pending];
3058 iov->iov_base = talloc_move(state->pending, &buf);
3059 iov->iov_len = buflen;
3060
3061 DEBUG(10,("echo_handler[%d]: forward to main\n",
3062 (int)getpid()));
3063 smbd_echo_activate_writer(state);
3064 }
3065
3066 req = smbd_echo_read_send(state, state->ev, state->sconn);
3067 if (req == NULL) {
3068 DEBUG(1, ("smbd_echo_read_send failed\n"));
3069 exit(1);
3070 }
3071 tevent_req_set_callback(req, smbd_echo_got_packet, state);
3072 }
3073
3074
3075 /*
3076 * Handle SMBecho requests in a forked child process
3077 */
3078 bool fork_echo_handler(struct smbd_server_connection *sconn)
3079 {
3080 int listener_pipe[2];
3081 int res;
3082 pid_t child;
3083
3084 res = pipe(listener_pipe);
3085 if (res == -1) {
3086 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3087 return false;
3088 }
3089 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
3090 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3091 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
3092 goto fail;
3093 }
3094
3095 child = fork();
3096 if (child == 0) {
3097 NTSTATUS status;
3098
3099 close(listener_pipe[0]);
3100 set_blocking(listener_pipe[1], false);
3101
3102 status = reinit_after_fork(sconn->msg_ctx,
3103 sconn->ev_ctx,
3104 true);
3105 if (!NT_STATUS_IS_OK(status)) {
3106 DEBUG(1, ("reinit_after_fork failed: %s\n",
3107 nt_errstr(status)));
3108 exit(1);
3109 }
3110 smbd_echo_loop(sconn, listener_pipe[1]);
3111 exit(0);
3112 }
3113 close(listener_pipe[1]);
3114 listener_pipe[1] = -1;
3115 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3116
3117 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3118
3119 /*
3120 * Without smb signing this is the same as the normal smbd
3121 * listener. This needs to change once signing comes in.
3122 */
3123 sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3124 sconn,
3125 sconn->smb1.echo_handler.trusted_fd,
3126 TEVENT_FD_READ,
3127 smbd_server_echo_handler,
3128 sconn);
3129 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3130 DEBUG(1, ("event_add_fd failed\n"));
3131 goto fail;
3132 }
3133
3134 return true;
3135
3136 fail:
3137 if (listener_pipe[0] != -1) {
3138 close(listener_pipe[0]);
3139 }
3140 if (listener_pipe[1] != -1) {
3141 close(listener_pipe[1]);
3142 }
3143 sconn->smb1.echo_handler.trusted_fd = -1;
3144 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3145 close(sconn->smb1.echo_handler.socket_lock_fd);
3146 }
3147 sconn->smb1.echo_handler.trusted_fd = -1;
3148 sconn->smb1.echo_handler.socket_lock_fd = -1;
3149 return false;
3150 }
3151
3152 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3153 {
3154 while (user) {
3155 if (user->session_info &&
3156 (user->session_info->unix_token->uid == uid)) {
3157 return true;
3158 }
3159 user = user->next;
3160 }
3161 return false;
3162 }
3163
3164 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3165 {
3166 while (user) {
3167 if (user->session_info != NULL) {
3168 int i;
3169 struct security_unix_token *utok;
3170
3171 utok = user->session_info->unix_token;
3172 if (utok->gid == gid) {
3173 return true;
3174 }
3175 for(i=0; i<utok->ngroups; i++) {
3176 if (utok->groups[i] == gid) {
3177 return true;
3178 }
3179 }
3180 }
3181 user = user->next;
3182 }
3183 return false;
3184 }
3185
3186 static bool sid_in_use(const struct user_struct *user,
3187 const struct dom_sid *psid)
3188 {
3189 while (user) {
3190 struct security_token *tok;
3191
3192 if (user->session_info == NULL) {
3193 continue;
3194 }
3195 tok = user->session_info->security_token;
3196 if (tok == NULL) {
3197 /*
3198 * Not sure session_info->security_token can
3199 * ever be NULL. This check might be not
3200 * necessary.
3201 */
3202 continue;
3203 }
3204 if (security_token_has_sid(tok, psid)) {
3205 return true;
3206 }
3207 user = user->next;
3208 }
3209 return false;
3210 }
3211
3212 static bool id_in_use(const struct user_struct *user,
3213 const struct id_cache_ref *id)
3214 {
3215 switch(id->type) {
3216 case UID:
3217 return uid_in_use(user, id->id.uid);
3218 case GID:
3219 return gid_in_use(user, id->id.gid);
3220 case SID:
3221 return sid_in_use(user, &id->id.sid);
3222 default:
3223 break;
3224 }
3225 return false;
3226 }
3227
3228 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3229 void *private_data,
3230 uint32_t msg_type,
3231 struct server_id server_id,
3232 DATA_BLOB* data)
3233 {
3234 const char *msg = (data && data->data)
3235 ? (const char *)data->data : "<NULL>";
3236 struct id_cache_ref id;
3237 struct smbd_server_connection *sconn =
3238 talloc_get_type_abort(private_data,
3239 struct smbd_server_connection);
3240
3241 if (!id_cache_ref_parse(msg, &id)) {
3242 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3243 return;
3244 }
3245
3246 if (id_in_use(sconn->users, &id)) {
3247 exit_server_cleanly(msg);
3248 }
3249 id_cache_delete_from_cache(&id);
3250 }
3251
3252 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3253 enum protocol_types protocol)
3254 {
3255 NTSTATUS status;
3256
3257 set_Protocol(protocol);
3258 conn->protocol = protocol;
3259
3260 if (protocol >= PROTOCOL_SMB2_02) {
3261 status = smb2srv_session_table_init(conn);
3262 if (!NT_STATUS_IS_OK(status)) {
3263 return status;
3264 }
3265
3266 status = smb2srv_open_table_init(conn);
3267 if (!NT_STATUS_IS_OK(status)) {
3268 return status;
3269 }
3270 } else {
3271 status = smb1srv_session_table_init(conn);
3272 if (!NT_STATUS_IS_OK(status)) {
3273 return status;
3274 }
3275
3276 status = smb1srv_tcon_table_init(conn);
3277 if (!NT_STATUS_IS_OK(status)) {
3278 return status;
3279 }
3280
3281 status = smb1srv_open_table_init(conn);
3282 if (!NT_STATUS_IS_OK(status)) {
3283 return status;
3284 }
3285 }
3286
3287 return NT_STATUS_OK;
3288 }
3289
3290 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3291 void *private_data)
3292 {
3293 struct smbXsrv_connection *conn =
3294 talloc_get_type_abort(private_data,
3295 struct smbXsrv_connection);
3296
3297 switch (point) {
3298 case TEVENT_TRACE_BEFORE_WAIT:
3299 /*
3300 * This just removes compiler warning
3301 * without profile support
3302 */
3303 conn->smbd_idle_profstamp = 0;
3304 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3305 break;
3306 case TEVENT_TRACE_AFTER_WAIT:
3307 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3308 break;
3309 }
3310 }
3311
3312 /****************************************************************************
3313 Process commands from the client
3314 ****************************************************************************/
3315
3316 void smbd_process(struct tevent_context *ev_ctx,
3317 struct messaging_context *msg_ctx,
3318 int sock_fd,
3319 bool interactive)
3320 {
3321 TALLOC_CTX *frame = talloc_stackframe();
3322 struct smbXsrv_connection *conn;
3323 struct smbd_server_connection *sconn;
3324 struct sockaddr_storage ss;
3325 struct sockaddr *sa = NULL;
3326 socklen_t sa_socklen;
3327 struct tsocket_address *local_address = NULL;
3328 struct tsocket_address *remote_address = NULL;
3329 const char *locaddr = NULL;
3330 const char *remaddr = NULL;
3331 char *rhost;
3332 int ret;
3333
3334 conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3335 if (conn == NULL) {
3336 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3337 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3338 }
3339
3340 conn->ev_ctx = ev_ctx;
3341 conn->msg_ctx = msg_ctx;
3342
3343 sconn = talloc_zero(conn, struct smbd_server_connection);
3344 if (!sconn) {
3345 exit_server("failed to create smbd_server_connection");
3346 }
3347
3348 conn->sconn = sconn;
3349 sconn->conn = conn;
3350
3351 /*
3352 * TODO: remove this...:-)
3353 */
3354 global_smbXsrv_connection = conn;
3355
3356 sconn->ev_ctx = ev_ctx;
3357 sconn->msg_ctx = msg_ctx;
3358 sconn->sock = sock_fd;
3359 sconn->smb1.echo_handler.trusted_fd = -1;
3360 sconn->smb1.echo_handler.socket_lock_fd = -1;
3361
3362 if (!interactive) {
3363 smbd_setup_sig_term_handler(sconn);
3364 smbd_setup_sig_hup_handler(sconn);
3365
3366 if (!serverid_register(messaging_server_id(msg_ctx),
3367 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3368 |FLAG_MSG_DBWRAP
3369 |FLAG_MSG_PRINT_GENERAL)) {
3370 exit_server_cleanly("Could not register myself in "
3371 "serverid.tdb");
3372 }
3373 }
3374
3375 if (lp_srv_maxprotocol() >= PROTOCOL_SMB2_02) {
3376 /*
3377 * We're not making the decision here,
3378 * we're just allowing the client
3379 * to decide between SMB1 and SMB2
3380 * with the first negprot
3381 * packet.
3382 */
3383 sconn->using_smb2 = true;
3384 }
3385
3386 /* Ensure child is set to blocking mode */
3387 set_blocking(sconn->sock,True);
3388
3389 set_socket_options(sconn->sock, "SO_KEEPALIVE");
3390 set_socket_options(sconn->sock, lp_socket_options());
3391
3392 sa = (struct sockaddr *)(void *)&ss;
3393 sa_socklen = sizeof(ss);
3394 ret = getpeername(sconn->sock, sa, &sa_socklen);
3395 if (ret != 0) {
3396 int level = (errno == ENOTCONN)?2:0;
3397 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3398 exit_server_cleanly("getpeername() failed.\n");
3399 }
3400 ret = tsocket_address_bsd_from_sockaddr(sconn,
3401 sa, sa_socklen,
3402 &remote_address);
3403 if (ret != 0) {
3404 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3405 __location__, strerror(errno)));
3406 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3407 }
3408
3409 sa = (struct sockaddr *)(void *)&ss;
3410 sa_socklen = sizeof(ss);
3411 ret = getsockname(sconn->sock, sa, &sa_socklen);
3412 if (ret != 0) {
3413 int level = (errno == ENOTCONN)?2:0;
3414 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3415 exit_server_cleanly("getsockname() failed.\n");
3416 }
3417 ret = tsocket_address_bsd_from_sockaddr(sconn,
3418 sa, sa_socklen,
3419 &local_address);
3420 if (ret != 0) {
3421 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3422 __location__, strerror(errno)));
3423 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3424 }
3425
3426 sconn->local_address = local_address;
3427 sconn->remote_address = remote_address;
3428
3429 if (tsocket_address_is_inet(local_address, "ip")) {
3430 locaddr = tsocket_address_inet_addr_string(
3431 sconn->local_address,
3432 talloc_tos());
3433 if (locaddr == NULL) {
3434 DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3435 __location__, strerror(errno)));
3436 exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3437 }
3438 } else {
3439 locaddr = "0.0.0.0";
3440 }
3441
3442 if (tsocket_address_is_inet(remote_address, "ip")) {
3443 remaddr = tsocket_address_inet_addr_string(
3444 sconn->remote_address,
3445 talloc_tos());
3446 if (remaddr == NULL) {
3447 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3448 __location__, strerror(errno)));
3449 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3450 }
3451 } else {
3452 remaddr = "0.0.0.0";
3453 }
3454
3455 /* this is needed so that we get decent entries
3456 in smbstatus for port 445 connects */
3457 set_remote_machine_name(remaddr, false);
3458 reload_services(sconn, conn_snum_used, true);
3459
3460 /*
3461 * Before the first packet, check the global hosts allow/ hosts deny
3462 * parameters before doing any parsing of packets passed to us by the
3463 * client. This prevents attacks on our parsing code from hosts not in
3464 * the hosts allow list.
3465 */
3466
3467 ret = get_remote_hostname(remote_address,
3468 &rhost,
3469 talloc_tos());
3470 if (ret < 0) {
3471 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3472 __location__, strerror(errno)));
3473 exit_server_cleanly("get_remote_hostname failed.\n");
3474 }
3475 if (strequal(rhost, "UNKNOWN")) {
3476 rhost = talloc_strdup(talloc_tos(), remaddr);
3477 }
3478 sconn->remote_hostname = talloc_move(sconn, &rhost);
3479
3480 sub_set_socket_ids(remaddr,
3481 sconn->remote_hostname,
3482 locaddr);
3483
3484 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3485 sconn->remote_hostname,
3486 remaddr)) {
3487 /*
3488 * send a negative session response "not listening on calling
3489 * name"
3490 */
3491 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3492 DEBUG( 1, ("Connection denied from %s to %s\n",
3493 tsocket_address_string(remote_address, talloc_tos()),
3494 tsocket_address_string(local_address, talloc_tos())));
3495 (void)srv_send_smb(sconn,(char *)buf, false,
3496 0, false, NULL);
3497 exit_server_cleanly("connection denied");
3498 }
3499
3500 DEBUG(10, ("Connection allowed from %s to %s\n",
3501 tsocket_address_string(remote_address, talloc_tos()),
3502 tsocket_address_string(local_address, talloc_tos())));
3503
3504 if (lp_preload_modules()) {
3505 smb_load_modules(lp_preload_modules());
3506 }
3507
3508 smb_perfcount_init();
3509
3510 if (!init_account_policy()) {
3511 exit_server("Could not open account policy tdb.\n");
3512 }
3513
3514 if (*lp_rootdir(talloc_tos())) {
3515 if (chroot(lp_rootdir(talloc_tos())) != 0) {
3516 DEBUG(0,("Failed to change root to %s\n",
3517 lp_rootdir(talloc_tos())));
3518 exit_server("Failed to chroot()");
3519 }
3520 if (chdir("/") == -1) {
3521 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir(talloc_tos())));
3522 exit_server("Failed to chroot()");
3523 }
3524 DEBUG(0,("Changed root to %s\n", lp_rootdir(talloc_tos())));
3525 }
3526
3527 if (!srv_init_signing(sconn)) {
3528 exit_server("Failed to init smb_signing");
3529 }
3530
3531 if (!file_init(sconn)) {
3532 exit_server("file_init() failed");
3533 }
3534
3535 /* Setup oplocks */
3536 if (!init_oplocks(sconn))
3537 exit_server("Failed to init oplocks");
3538
3539 /* register our message handlers */
3540 messaging_register(sconn->msg_ctx, sconn,
3541 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3542 messaging_register(sconn->msg_ctx, sconn,
3543 MSG_SMB_CLOSE_FILE, msg_close_file);
3544 messaging_register(sconn->msg_ctx, sconn,
3545 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3546
3547 id_cache_register_msgs(sconn->msg_ctx);
3548 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3549 messaging_register(sconn->msg_ctx, sconn,
3550 ID_CACHE_KILL, smbd_id_cache_kill);
3551
3552 messaging_deregister(sconn->msg_ctx,
3553 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3554 messaging_register(sconn->msg_ctx, sconn,
3555 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3556
3557 messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3558 NULL);
3559 messaging_register(sconn->msg_ctx, sconn,
3560 MSG_SMB_KILL_CLIENT_IP,
3561 msg_kill_client_ip);
3562
3563 /*
3564 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3565 * MSGs to all child processes
3566 */
3567 messaging_deregister(sconn->msg_ctx,
3568 MSG_DEBUG, NULL);
3569 messaging_register(sconn->msg_ctx, NULL,
3570 MSG_DEBUG, debug_message);
3571
3572 if ((lp_keepalive() != 0)
3573 && !(event_add_idle(ev_ctx, NULL,
3574 timeval_set(lp_keepalive(), 0),
3575 "keepalive", keepalive_fn,
3576 sconn))) {
3577 DEBUG(0, ("Could not add keepalive event\n"));
3578 exit(1);
3579 }
3580
3581 if (!(event_add_idle(ev_ctx, NULL,
3582 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3583 "deadtime", deadtime_fn, sconn))) {
3584 DEBUG(0, ("Could not add deadtime event\n"));
3585 exit(1);
3586 }
3587
3588 if (!(event_add_idle(ev_ctx, NULL,
3589 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3590 "housekeeping", housekeeping_fn, sconn))) {
3591 DEBUG(0, ("Could not add housekeeping event\n"));
3592 exit(1);
3593 }
3594
3595 #ifdef CLUSTER_SUPPORT
3596
3597 if (lp_clustering()) {
3598 /*
3599 * We need to tell ctdb about our client's TCP
3600 * connection, so that for failover ctdbd can send
3601 * tickle acks, triggering a reconnection by the
3602 * client.
3603 */
3604
3605 struct sockaddr_storage srv, clnt;
3606
3607 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3608 NTSTATUS status;
3609 status = smbd_register_ips(sconn, &srv, &clnt);
3610 if (!NT_STATUS_IS_OK(status)) {
3611 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3612 nt_errstr(status)));
3613 }
3614 } else {
3615 int level = (errno == ENOTCONN)?2:0;
3616 DEBUG(level,("Unable to get tcp info for "
3617 "smbd_register_ips: %s\n",
3618 strerror(errno)));
3619 exit_server_cleanly("client_get_tcp_info() failed.\n");
3620 }
3621 }
3622
3623 #endif
3624
3625 sconn->nbt.got_session = false;
3626
3627 sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
3628
3629 sconn->smb1.sessions.done_sesssetup = false;
3630 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3631
3632 if (!init_dptrs(sconn)) {
3633 exit_server("init_dptrs() failed");
3634 }
3635
3636 sconn->smb1.fde = tevent_add_fd(ev_ctx,
3637 sconn,
3638 sconn->sock,
3639 TEVENT_FD_READ,
3640 smbd_server_connection_handler,
3641 sconn);
3642 if (!sconn->smb1.fde) {
3643 exit_server("failed to create smbd_server_connection fde");
3644 }
3645
3646 sconn->conn->local_address = sconn->local_address;
3647 sconn->conn->remote_address = sconn->remote_address;
3648 sconn->conn->remote_hostname = sconn->remote_hostname;
3649 sconn->conn->protocol = PROTOCOL_NONE;
3650
3651 TALLOC_FREE(frame);
3652
3653 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3654
3655 while (True) {
3656 frame = talloc_stackframe_pool(8192);
3657
3658 errno = 0;
3659 if (tevent_loop_once(ev_ctx) == -1) {
3660 if (errno != EINTR) {
3661 DEBUG(3, ("tevent_loop_once failed: %s,"
3662 " exiting\n", strerror(errno) ));
3663 break;
3664 }
3665 }
3666
3667 TALLOC_FREE(frame);
3668 }
3669
3670 exit_server_cleanly(NULL);
3671 }
3672
3673 bool req_is_in_chain(const struct smb_request *req)
3674 {
3675 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3676 /*
3677 * We're right now handling a subsequent request, so we must
3678 * be in a chain
3679 */
3680 return true;
3681 }
3682
3683 if (!is_andx_req(req->cmd)) {
3684 return false;
3685 }
3686
3687 if (req->wct < 2) {
3688 /*
3689 * Okay, an illegal request, but definitely not chained :-)
3690 */
3691 return false;
3692 }
3693
3694 return (CVAL(req->vwv+0, 0) != 0xFF);
3695 }
Samba GIT mirror