?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
VERSION: Disable git snapshots for the 4.1.4 release.
[Samba.git] / source3 / smbd / process.c
blob706d701e13c1fdf44ca366cbd984a98ea11ad43c
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39 #include "../libcli/security/dom_sid.h"
40 #include "../libcli/security/security_token.h"
41 #include "lib/id_cache.h"
42 #include "serverid.h"
43
44 /* Internal message queue for deferred opens. */
45 struct pending_message_list {
46 struct pending_message_list *next, *prev;
47 struct timeval request_time; /* When was this first issued? */
48 struct smbd_server_connection *sconn;
49 struct tevent_timer *te;
50 struct smb_perfcount_data pcd;
51 uint32_t seqnum;
52 bool encrypted;
53 bool processed;
54 DATA_BLOB buf;
55 DATA_BLOB private_data;
56 };
57
58 static void construct_reply_common(struct smb_request *req, const char *inbuf,
59 char *outbuf);
60 static struct pending_message_list *get_deferred_open_message_smb(
61 struct smbd_server_connection *sconn, uint64_t mid);
62 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
63
64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
65 {
66 bool ok;
67
68 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
69 return true;
70 }
71
72 sconn->smb1.echo_handler.ref_count++;
73
74 if (sconn->smb1.echo_handler.ref_count > 1) {
75 return true;
76 }
77
78 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
79
80 do {
81 ok = fcntl_lock(
82 sconn->smb1.echo_handler.socket_lock_fd,
83 F_SETLKW, 0, 0, F_WRLCK);
84 } while (!ok && (errno == EINTR));
85
86 if (!ok) {
87 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
88 return false;
89 }
90
91 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
92
93 return true;
94 }
95
96 void smbd_lock_socket(struct smbd_server_connection *sconn)
97 {
98 if (!smbd_lock_socket_internal(sconn)) {
99 exit_server_cleanly("failed to lock socket");
100 }
101 }
102
103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
104 {
105 bool ok;
106
107 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
108 return true;
109 }
110
111 sconn->smb1.echo_handler.ref_count--;
112
113 if (sconn->smb1.echo_handler.ref_count > 0) {
114 return true;
115 }
116
117 do {
118 ok = fcntl_lock(
119 sconn->smb1.echo_handler.socket_lock_fd,
120 F_SETLKW, 0, 0, F_UNLCK);
121 } while (!ok && (errno == EINTR));
122
123 if (!ok) {
124 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
125 return false;
126 }
127
128 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
129
130 return true;
131 }
132
133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
134 {
135 if (!smbd_unlock_socket_internal(sconn)) {
136 exit_server_cleanly("failed to unlock socket");
137 }
138 }
139
140 /* Accessor function for smb_read_error for smbd functions. */
141
142 /****************************************************************************
143 Send an smb to a fd.
144 ****************************************************************************/
145
146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
147 bool do_signing, uint32_t seqnum,
148 bool do_encrypt,
149 struct smb_perfcount_data *pcd)
150 {
151 size_t len = 0;
152 ssize_t ret;
153 char *buf_out = buffer;
154
155 smbd_lock_socket(sconn);
156
157 if (do_signing) {
158 /* Sign the outgoing packet if required. */
159 srv_calculate_sign_mac(sconn, buf_out, seqnum);
160 }
161
162 if (do_encrypt) {
163 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
164 if (!NT_STATUS_IS_OK(status)) {
165 DEBUG(0, ("send_smb: SMB encryption failed "
166 "on outgoing packet! Error %s\n",
167 nt_errstr(status) ));
168 goto out;
169 }
170 }
171
172 len = smb_len_large(buf_out) + 4;
173
174 ret = write_data(sconn->sock, buf_out, len);
175 if (ret <= 0) {
176
177 char addr[INET6_ADDRSTRLEN];
178 /*
179 * Try and give an error message saying what
180 * client failed.
181 */
182 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
183 (int)getpid(), (int)len,
184 get_peer_addr(sconn->sock, addr, sizeof(addr)),
185 (int)ret, strerror(errno) ));
186
187 srv_free_enc_buffer(sconn, buf_out);
188 goto out;
189 }
190
191 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
192 srv_free_enc_buffer(sconn, buf_out);
193 out:
194 SMB_PERFCOUNT_END(pcd);
195
196 smbd_unlock_socket(sconn);
197 return true;
198 }
199
200 /*******************************************************************
201 Setup the word count and byte count for a smb message.
202 ********************************************************************/
203
204 int srv_set_message(char *buf,
205 int num_words,
206 int num_bytes,
207 bool zero)
208 {
209 if (zero && (num_words || num_bytes)) {
210 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
211 }
212 SCVAL(buf,smb_wct,num_words);
213 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
214 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
215 return (smb_size + num_words*2 + num_bytes);
216 }
217
218 static bool valid_smb_header(struct smbd_server_connection *sconn,
219 const uint8_t *inbuf)
220 {
221 if (is_encrypted_packet(sconn, inbuf)) {
222 return true;
223 }
224 /*
225 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
226 * but it just looks weird to call strncmp for this one.
227 */
228 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
229 }
230
231 /* Socket functions for smbd packet processing. */
232
233 static bool valid_packet_size(size_t len)
234 {
235 /*
236 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
237 * of header. Don't print the error if this fits.... JRA.
238 */
239
240 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
241 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
242 (unsigned long)len));
243 return false;
244 }
245 return true;
246 }
247
248 static NTSTATUS read_packet_remainder(int fd, char *buffer,
249 unsigned int timeout, ssize_t len)
250 {
251 NTSTATUS status;
252
253 if (len <= 0) {
254 return NT_STATUS_OK;
255 }
256
257 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
258 if (!NT_STATUS_IS_OK(status)) {
259 char addr[INET6_ADDRSTRLEN];
260 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
261 "error = %s.\n",
262 get_peer_addr(fd, addr, sizeof(addr)),
263 nt_errstr(status)));
264 }
265 return status;
266 }
267
268 /****************************************************************************
269 Attempt a zerocopy writeX read. We know here that len > smb_size-4
270 ****************************************************************************/
271
272 /*
273 * Unfortunately, earlier versions of smbclient/libsmbclient
274 * don't send this "standard" writeX header. I've fixed this
275 * for 3.2 but we'll use the old method with earlier versions.
276 * Windows and CIFSFS at least use this standard size. Not
277 * sure about MacOSX.
278 */
279
280 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
281 (2*14) + /* word count (including bcc) */ \
282 1 /* pad byte */)
283
284 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
285 const char lenbuf[4],
286 struct smbd_server_connection *sconn,
287 int sock,
288 char **buffer,
289 unsigned int timeout,
290 size_t *p_unread,
291 size_t *len_ret)
292 {
293 /* Size of a WRITEX call (+4 byte len). */
294 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
295 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
296 ssize_t toread;
297 NTSTATUS status;
298
299 memcpy(writeX_header, lenbuf, 4);
300
301 status = read_fd_with_timeout(
302 sock, writeX_header + 4,
303 STANDARD_WRITE_AND_X_HEADER_SIZE,
304 STANDARD_WRITE_AND_X_HEADER_SIZE,
305 timeout, NULL);
306
307 if (!NT_STATUS_IS_OK(status)) {
308 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
309 "error = %s.\n",
310 tsocket_address_string(sconn->remote_address,
311 talloc_tos()),
312 nt_errstr(status)));
313 return status;
314 }
315
316 /*
317 * Ok - now try and see if this is a possible
318 * valid writeX call.
319 */
320
321 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
322 /*
323 * If the data offset is beyond what
324 * we've read, drain the extra bytes.
325 */
326 uint16_t doff = SVAL(writeX_header,smb_vwv11);
327 ssize_t newlen;
328
329 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
330 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
331 if (drain_socket(sock, drain) != drain) {
332 smb_panic("receive_smb_raw_talloc_partial_read:"
333 " failed to drain pending bytes");
334 }
335 } else {
336 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
337 }
338
339 /* Spoof down the length and null out the bcc. */
340 set_message_bcc(writeX_header, 0);
341 newlen = smb_len(writeX_header);
342
343 /* Copy the header we've written. */
344
345 *buffer = (char *)talloc_memdup(mem_ctx,
346 writeX_header,
347 sizeof(writeX_header));
348
349 if (*buffer == NULL) {
350 DEBUG(0, ("Could not allocate inbuf of length %d\n",
351 (int)sizeof(writeX_header)));
352 return NT_STATUS_NO_MEMORY;
353 }
354
355 /* Work out the remaining bytes. */
356 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
357 *len_ret = newlen + 4;
358 return NT_STATUS_OK;
359 }
360
361 if (!valid_packet_size(len)) {
362 return NT_STATUS_INVALID_PARAMETER;
363 }
364
365 /*
366 * Not a valid writeX call. Just do the standard
367 * talloc and return.
368 */
369
370 *buffer = talloc_array(mem_ctx, char, len+4);
371
372 if (*buffer == NULL) {
373 DEBUG(0, ("Could not allocate inbuf of length %d\n",
374 (int)len+4));
375 return NT_STATUS_NO_MEMORY;
376 }
377
378 /* Copy in what we already read. */
379 memcpy(*buffer,
380 writeX_header,
381 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
382 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
383
384 if(toread > 0) {
385 status = read_packet_remainder(
386 sock,
387 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
388 timeout, toread);
389
390 if (!NT_STATUS_IS_OK(status)) {
391 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
392 nt_errstr(status)));
393 return status;
394 }
395 }
396
397 *len_ret = len + 4;
398 return NT_STATUS_OK;
399 }
400
401 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
402 struct smbd_server_connection *sconn,
403 int sock,
404 char **buffer, unsigned int timeout,
405 size_t *p_unread, size_t *plen)
406 {
407 char lenbuf[4];
408 size_t len;
409 int min_recv_size = lp_min_receive_file_size();
410 NTSTATUS status;
411
412 *p_unread = 0;
413
414 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
415 &len);
416 if (!NT_STATUS_IS_OK(status)) {
417 return status;
418 }
419
420 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
421 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
422 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
423 !srv_is_signing_active(sconn) &&
424 sconn->smb1.echo_handler.trusted_fde == NULL) {
425
426 return receive_smb_raw_talloc_partial_read(
427 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
428 p_unread, plen);
429 }
430
431 if (!valid_packet_size(len)) {
432 return NT_STATUS_INVALID_PARAMETER;
433 }
434
435 /*
436 * The +4 here can't wrap, we've checked the length above already.
437 */
438
439 *buffer = talloc_array(mem_ctx, char, len+4);
440
441 if (*buffer == NULL) {
442 DEBUG(0, ("Could not allocate inbuf of length %d\n",
443 (int)len+4));
444 return NT_STATUS_NO_MEMORY;
445 }
446
447 memcpy(*buffer, lenbuf, sizeof(lenbuf));
448
449 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
450 if (!NT_STATUS_IS_OK(status)) {
451 return status;
452 }
453
454 *plen = len + 4;
455 return NT_STATUS_OK;
456 }
457
458 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
459 struct smbd_server_connection *sconn,
460 int sock,
461 char **buffer, unsigned int timeout,
462 size_t *p_unread, bool *p_encrypted,
463 size_t *p_len,
464 uint32_t *seqnum,
465 bool trusted_channel)
466 {
467 size_t len = 0;
468 NTSTATUS status;
469
470 *p_encrypted = false;
471
472 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
473 p_unread, &len);
474 if (!NT_STATUS_IS_OK(status)) {
475 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
476 ("receive_smb_raw_talloc failed for client %s "
477 "read error = %s.\n",
478 tsocket_address_string(sconn->remote_address,
479 talloc_tos()),
480 nt_errstr(status)) );
481 return status;
482 }
483
484 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
485 status = srv_decrypt_buffer(sconn, *buffer);
486 if (!NT_STATUS_IS_OK(status)) {
487 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
488 "incoming packet! Error %s\n",
489 nt_errstr(status) ));
490 return status;
491 }
492 *p_encrypted = true;
493 }
494
495 /* Check the incoming SMB signature. */
496 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
497 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
498 "incoming packet!\n"));
499 return NT_STATUS_INVALID_NETWORK_RESPONSE;
500 }
501
502 *p_len = len;
503 return NT_STATUS_OK;
504 }
505
506 /*
507 * Initialize a struct smb_request from an inbuf
508 */
509
510 static bool init_smb_request(struct smb_request *req,
511 struct smbd_server_connection *sconn,
512 const uint8 *inbuf,
513 size_t unread_bytes, bool encrypted,
514 uint32_t seqnum)
515 {
516 struct smbXsrv_tcon *tcon;
517 NTSTATUS status;
518 NTTIME now;
519 size_t req_size = smb_len(inbuf) + 4;
520
521 /* Ensure we have at least smb_size bytes. */
522 if (req_size < smb_size) {
523 DEBUG(0,("init_smb_request: invalid request size %u\n",
524 (unsigned int)req_size ));
525 return false;
526 }
527
528 req->request_time = timeval_current();
529 now = timeval_to_nttime(&req->request_time);
530
531 req->cmd = CVAL(inbuf, smb_com);
532 req->flags2 = SVAL(inbuf, smb_flg2);
533 req->smbpid = SVAL(inbuf, smb_pid);
534 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
535 req->seqnum = seqnum;
536 req->vuid = SVAL(inbuf, smb_uid);
537 req->tid = SVAL(inbuf, smb_tid);
538 req->wct = CVAL(inbuf, smb_wct);
539 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
540 req->buflen = smb_buflen(inbuf);
541 req->buf = (const uint8_t *)smb_buf_const(inbuf);
542 req->unread_bytes = unread_bytes;
543 req->encrypted = encrypted;
544 req->sconn = sconn;
545 status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
546 if (NT_STATUS_IS_OK(status)) {
547 req->conn = tcon->compat;
548 } else {
549 req->conn = NULL;
550 }
551 req->chain_fsp = NULL;
552 req->smb2req = NULL;
553 req->priv_paths = NULL;
554 req->chain = NULL;
555 smb_init_perfcount_data(&req->pcd);
556
557 /* Ensure we have at least wct words and 2 bytes of bcc. */
558 if (smb_size + req->wct*2 > req_size) {
559 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
560 (unsigned int)req->wct,
561 (unsigned int)req_size));
562 return false;
563 }
564 /* Ensure bcc is correct. */
565 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
566 DEBUG(0,("init_smb_request: invalid bcc number %u "
567 "(wct = %u, size %u)\n",
568 (unsigned int)req->buflen,
569 (unsigned int)req->wct,
570 (unsigned int)req_size));
571 return false;
572 }
573
574 req->outbuf = NULL;
575 return true;
576 }
577
578 static void process_smb(struct smbd_server_connection *conn,
579 uint8_t *inbuf, size_t nread, size_t unread_bytes,
580 uint32_t seqnum, bool encrypted,
581 struct smb_perfcount_data *deferred_pcd);
582
583 static void smbd_deferred_open_timer(struct tevent_context *ev,
584 struct tevent_timer *te,
585 struct timeval _tval,
586 void *private_data)
587 {
588 struct pending_message_list *msg = talloc_get_type(private_data,
589 struct pending_message_list);
590 struct smbd_server_connection *sconn = msg->sconn;
591 TALLOC_CTX *mem_ctx = talloc_tos();
592 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
593 uint8_t *inbuf;
594
595 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
596 msg->buf.length);
597 if (inbuf == NULL) {
598 exit_server("smbd_deferred_open_timer: talloc failed\n");
599 return;
600 }
601
602 /* We leave this message on the queue so the open code can
603 know this is a retry. */
604 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
605 (unsigned long long)mid ));
606
607 /* Mark the message as processed so this is not
608 * re-processed in error. */
609 msg->processed = true;
610
611 process_smb(sconn, inbuf,
612 msg->buf.length, 0,
613 msg->seqnum, msg->encrypted, &msg->pcd);
614
615 /* If it's still there and was processed, remove it. */
616 msg = get_deferred_open_message_smb(sconn, mid);
617 if (msg && msg->processed) {
618 remove_deferred_open_message_smb(sconn, mid);
619 }
620 }
621
622 /****************************************************************************
623 Function to push a message onto the tail of a linked list of smb messages ready
624 for processing.
625 ****************************************************************************/
626
627 static bool push_queued_message(struct smb_request *req,
628 struct timeval request_time,
629 struct timeval end_time,
630 char *private_data, size_t private_len)
631 {
632 int msg_len = smb_len(req->inbuf) + 4;
633 struct pending_message_list *msg;
634
635 msg = talloc_zero(NULL, struct pending_message_list);
636
637 if(msg == NULL) {
638 DEBUG(0,("push_message: malloc fail (1)\n"));
639 return False;
640 }
641 msg->sconn = req->sconn;
642
643 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
644 if(msg->buf.data == NULL) {
645 DEBUG(0,("push_message: malloc fail (2)\n"));
646 TALLOC_FREE(msg);
647 return False;
648 }
649
650 msg->request_time = request_time;
651 msg->seqnum = req->seqnum;
652 msg->encrypted = req->encrypted;
653 msg->processed = false;
654 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
655
656 if (private_data) {
657 msg->private_data = data_blob_talloc(msg, private_data,
658 private_len);
659 if (msg->private_data.data == NULL) {
660 DEBUG(0,("push_message: malloc fail (3)\n"));
661 TALLOC_FREE(msg);
662 return False;
663 }
664 }
665
666 #if 0
667 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
668 msg,
669 end_time,
670 smbd_deferred_open_timer,
671 msg);
672 if (!msg->te) {
673 DEBUG(0,("push_message: event_add_timed failed\n"));
674 TALLOC_FREE(msg);
675 return false;
676 }
677 #endif
678
679 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
680 struct pending_message_list *);
681
682 DEBUG(10,("push_message: pushed message length %u on "
683 "deferred_open_queue\n", (unsigned int)msg_len));
684
685 return True;
686 }
687
688 /****************************************************************************
689 Function to delete a sharing violation open message by mid.
690 ****************************************************************************/
691
692 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
693 uint64_t mid)
694 {
695 struct pending_message_list *pml;
696
697 if (sconn->using_smb2) {
698 remove_deferred_open_message_smb2(sconn, mid);
699 return;
700 }
701
702 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
703 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
704 DEBUG(10,("remove_deferred_open_message_smb: "
705 "deleting mid %llu len %u\n",
706 (unsigned long long)mid,
707 (unsigned int)pml->buf.length ));
708 DLIST_REMOVE(sconn->deferred_open_queue, pml);
709 TALLOC_FREE(pml);
710 return;
711 }
712 }
713 }
714
715 /****************************************************************************
716 Move a sharing violation open retry message to the front of the list and
717 schedule it for immediate processing.
718 ****************************************************************************/
719
720 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
721 uint64_t mid)
722 {
723 struct pending_message_list *pml;
724 int i = 0;
725
726 if (sconn->using_smb2) {
727 return schedule_deferred_open_message_smb2(sconn, mid);
728 }
729
730 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
731 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
732
733 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
734 "msg_mid = %llu\n",
735 i++,
736 (unsigned long long)msg_mid ));
737
738 if (mid == msg_mid) {
739 struct tevent_timer *te;
740
741 if (pml->processed) {
742 /* A processed message should not be
743 * rescheduled. */
744 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
745 "message mid %llu was already processed\n",
746 (unsigned long long)msg_mid ));
747 continue;
748 }
749
750 DEBUG(10,("schedule_deferred_open_message_smb: "
751 "scheduling mid %llu\n",
752 (unsigned long long)mid ));
753
754 te = tevent_add_timer(pml->sconn->ev_ctx,
755 pml,
756 timeval_zero(),
757 smbd_deferred_open_timer,
758 pml);
759 if (!te) {
760 DEBUG(10,("schedule_deferred_open_message_smb: "
761 "event_add_timed() failed, "
762 "skipping mid %llu\n",
763 (unsigned long long)msg_mid ));
764 }
765
766 TALLOC_FREE(pml->te);
767 pml->te = te;
768 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
769 return true;
770 }
771 }
772
773 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
774 "find message mid %llu\n",
775 (unsigned long long)mid ));
776
777 return false;
778 }
779
780 /****************************************************************************
781 Return true if this mid is on the deferred queue and was not yet processed.
782 ****************************************************************************/
783
784 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
785 {
786 struct pending_message_list *pml;
787
788 if (sconn->using_smb2) {
789 return open_was_deferred_smb2(sconn, mid);
790 }
791
792 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
793 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
794 return True;
795 }
796 }
797 return False;
798 }
799
800 /****************************************************************************
801 Return the message queued by this mid.
802 ****************************************************************************/
803
804 static struct pending_message_list *get_deferred_open_message_smb(
805 struct smbd_server_connection *sconn, uint64_t mid)
806 {
807 struct pending_message_list *pml;
808
809 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
810 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
811 return pml;
812 }
813 }
814 return NULL;
815 }
816
817 /****************************************************************************
818 Get the state data queued by this mid.
819 ****************************************************************************/
820
821 bool get_deferred_open_message_state(struct smb_request *smbreq,
822 struct timeval *p_request_time,
823 void **pp_state)
824 {
825 struct pending_message_list *pml;
826
827 if (smbreq->sconn->using_smb2) {
828 return get_deferred_open_message_state_smb2(smbreq->smb2req,
829 p_request_time,
830 pp_state);
831 }
832
833 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
834 if (!pml) {
835 return false;
836 }
837 if (p_request_time) {
838 *p_request_time = pml->request_time;
839 }
840 if (pp_state) {
841 *pp_state = (void *)pml->private_data.data;
842 }
843 return true;
844 }
845
846 /****************************************************************************
847 Function to push a deferred open smb message onto a linked list of local smb
848 messages ready for processing.
849 ****************************************************************************/
850
851 bool push_deferred_open_message_smb(struct smb_request *req,
852 struct timeval request_time,
853 struct timeval timeout,
854 struct file_id id,
855 char *private_data, size_t priv_len)
856 {
857 struct timeval end_time;
858
859 if (req->smb2req) {
860 return push_deferred_open_message_smb2(req->smb2req,
861 request_time,
862 timeout,
863 id,
864 private_data,
865 priv_len);
866 }
867
868 if (req->unread_bytes) {
869 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
870 "unread_bytes = %u\n",
871 (unsigned int)req->unread_bytes ));
872 smb_panic("push_deferred_open_message_smb: "
873 "logic error unread_bytes != 0" );
874 }
875
876 end_time = timeval_sum(&request_time, &timeout);
877
878 DEBUG(10,("push_deferred_open_message_smb: pushing message "
879 "len %u mid %llu timeout time [%u.%06u]\n",
880 (unsigned int) smb_len(req->inbuf)+4,
881 (unsigned long long)req->mid,
882 (unsigned int)end_time.tv_sec,
883 (unsigned int)end_time.tv_usec));
884
885 return push_queued_message(req, request_time, end_time,
886 private_data, priv_len);
887 }
888
889 static void smbd_sig_term_handler(struct tevent_context *ev,
890 struct tevent_signal *se,
891 int signum,
892 int count,
893 void *siginfo,
894 void *private_data)
895 {
896 exit_server_cleanly("termination signal");
897 }
898
899 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
900 {
901 struct tevent_signal *se;
902
903 se = tevent_add_signal(sconn->ev_ctx,
904 sconn,
905 SIGTERM, 0,
906 smbd_sig_term_handler,
907 sconn);
908 if (!se) {
909 exit_server("failed to setup SIGTERM handler");
910 }
911 }
912
913 static void smbd_sig_hup_handler(struct tevent_context *ev,
914 struct tevent_signal *se,
915 int signum,
916 int count,
917 void *siginfo,
918 void *private_data)
919 {
920 struct smbd_server_connection *sconn =
921 talloc_get_type_abort(private_data,
922 struct smbd_server_connection);
923
924 change_to_root_user();
925 DEBUG(1,("Reloading services after SIGHUP\n"));
926 reload_services(sconn, conn_snum_used, false);
927 }
928
929 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
930 {
931 struct tevent_signal *se;
932
933 se = tevent_add_signal(sconn->ev_ctx,
934 sconn,
935 SIGHUP, 0,
936 smbd_sig_hup_handler,
937 sconn);
938 if (!se) {
939 exit_server("failed to setup SIGHUP handler");
940 }
941 }
942
943 static void smbd_conf_updated(struct messaging_context *msg,
944 void *private_data,
945 uint32_t msg_type,
946 struct server_id server_id,
947 DATA_BLOB *data)
948 {
949 struct smbd_server_connection *sconn =
950 talloc_get_type_abort(private_data,
951 struct smbd_server_connection);
952
953 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
954 "updated. Reloading.\n"));
955 change_to_root_user();
956 reload_services(sconn, conn_snum_used, false);
957 }
958
959 /*
960 * Only allow 5 outstanding trans requests. We're allocating memory, so
961 * prevent a DoS.
962 */
963
964 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
965 {
966 int count = 0;
967 for (; list != NULL; list = list->next) {
968
969 if (list->mid == mid) {
970 return NT_STATUS_INVALID_PARAMETER;
971 }
972
973 count += 1;
974 }
975 if (count > 5) {
976 return NT_STATUS_INSUFFICIENT_RESOURCES;
977 }
978
979 return NT_STATUS_OK;
980 }
981
982 /*
983 These flags determine some of the permissions required to do an operation
984
985 Note that I don't set NEED_WRITE on some write operations because they
986 are used by some brain-dead clients when printing, and I don't want to
987 force write permissions on print services.
988 */
989 #define AS_USER (1<<0)
990 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
991 #define TIME_INIT (1<<2)
992 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
993 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
994 #define DO_CHDIR (1<<6)
995
996 /*
997 define a list of possible SMB messages and their corresponding
998 functions. Any message that has a NULL function is unimplemented -
999 please feel free to contribute implementations!
1000 */
1001 static const struct smb_message_struct {
1002 const char *name;
1003 void (*fn)(struct smb_request *req);
1004 int flags;
1005 } smb_messages[256] = {
1006
1007 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1008 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1009 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1010 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1011 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1012 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1013 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1014 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1015 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1016 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1017 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1018 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1019 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1020 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1021 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1022 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1023 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1024 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1025 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1026 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1027 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1028 /* 0x15 */ { NULL, NULL, 0 },
1029 /* 0x16 */ { NULL, NULL, 0 },
1030 /* 0x17 */ { NULL, NULL, 0 },
1031 /* 0x18 */ { NULL, NULL, 0 },
1032 /* 0x19 */ { NULL, NULL, 0 },
1033 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1034 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1035 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1036 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1037 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1038 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1039 /* 0x20 */ { "SMBwritec", NULL,0},
1040 /* 0x21 */ { NULL, NULL, 0 },
1041 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1042 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1043 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1044 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1045 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1046 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1047 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1048 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1049 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1050 /* 0x2b */ { "SMBecho",reply_echo,0},
1051 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1052 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1053 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1054 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1055 /* 0x30 */ { NULL, NULL, 0 },
1056 /* 0x31 */ { NULL, NULL, 0 },
1057 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1058 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1059 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1060 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1061 /* 0x36 */ { NULL, NULL, 0 },
1062 /* 0x37 */ { NULL, NULL, 0 },
1063 /* 0x38 */ { NULL, NULL, 0 },
1064 /* 0x39 */ { NULL, NULL, 0 },
1065 /* 0x3a */ { NULL, NULL, 0 },
1066 /* 0x3b */ { NULL, NULL, 0 },
1067 /* 0x3c */ { NULL, NULL, 0 },
1068 /* 0x3d */ { NULL, NULL, 0 },
1069 /* 0x3e */ { NULL, NULL, 0 },
1070 /* 0x3f */ { NULL, NULL, 0 },
1071 /* 0x40 */ { NULL, NULL, 0 },
1072 /* 0x41 */ { NULL, NULL, 0 },
1073 /* 0x42 */ { NULL, NULL, 0 },
1074 /* 0x43 */ { NULL, NULL, 0 },
1075 /* 0x44 */ { NULL, NULL, 0 },
1076 /* 0x45 */ { NULL, NULL, 0 },
1077 /* 0x46 */ { NULL, NULL, 0 },
1078 /* 0x47 */ { NULL, NULL, 0 },
1079 /* 0x48 */ { NULL, NULL, 0 },
1080 /* 0x49 */ { NULL, NULL, 0 },
1081 /* 0x4a */ { NULL, NULL, 0 },
1082 /* 0x4b */ { NULL, NULL, 0 },
1083 /* 0x4c */ { NULL, NULL, 0 },
1084 /* 0x4d */ { NULL, NULL, 0 },
1085 /* 0x4e */ { NULL, NULL, 0 },
1086 /* 0x4f */ { NULL, NULL, 0 },
1087 /* 0x50 */ { NULL, NULL, 0 },
1088 /* 0x51 */ { NULL, NULL, 0 },
1089 /* 0x52 */ { NULL, NULL, 0 },
1090 /* 0x53 */ { NULL, NULL, 0 },
1091 /* 0x54 */ { NULL, NULL, 0 },
1092 /* 0x55 */ { NULL, NULL, 0 },
1093 /* 0x56 */ { NULL, NULL, 0 },
1094 /* 0x57 */ { NULL, NULL, 0 },
1095 /* 0x58 */ { NULL, NULL, 0 },
1096 /* 0x59 */ { NULL, NULL, 0 },
1097 /* 0x5a */ { NULL, NULL, 0 },
1098 /* 0x5b */ { NULL, NULL, 0 },
1099 /* 0x5c */ { NULL, NULL, 0 },
1100 /* 0x5d */ { NULL, NULL, 0 },
1101 /* 0x5e */ { NULL, NULL, 0 },
1102 /* 0x5f */ { NULL, NULL, 0 },
1103 /* 0x60 */ { NULL, NULL, 0 },
1104 /* 0x61 */ { NULL, NULL, 0 },
1105 /* 0x62 */ { NULL, NULL, 0 },
1106 /* 0x63 */ { NULL, NULL, 0 },
1107 /* 0x64 */ { NULL, NULL, 0 },
1108 /* 0x65 */ { NULL, NULL, 0 },
1109 /* 0x66 */ { NULL, NULL, 0 },
1110 /* 0x67 */ { NULL, NULL, 0 },
1111 /* 0x68 */ { NULL, NULL, 0 },
1112 /* 0x69 */ { NULL, NULL, 0 },
1113 /* 0x6a */ { NULL, NULL, 0 },
1114 /* 0x6b */ { NULL, NULL, 0 },
1115 /* 0x6c */ { NULL, NULL, 0 },
1116 /* 0x6d */ { NULL, NULL, 0 },
1117 /* 0x6e */ { NULL, NULL, 0 },
1118 /* 0x6f */ { NULL, NULL, 0 },
1119 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1120 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1121 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1122 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1123 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1124 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1125 /* 0x76 */ { NULL, NULL, 0 },
1126 /* 0x77 */ { NULL, NULL, 0 },
1127 /* 0x78 */ { NULL, NULL, 0 },
1128 /* 0x79 */ { NULL, NULL, 0 },
1129 /* 0x7a */ { NULL, NULL, 0 },
1130 /* 0x7b */ { NULL, NULL, 0 },
1131 /* 0x7c */ { NULL, NULL, 0 },
1132 /* 0x7d */ { NULL, NULL, 0 },
1133 /* 0x7e */ { NULL, NULL, 0 },
1134 /* 0x7f */ { NULL, NULL, 0 },
1135 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1136 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1137 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1138 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1139 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1140 /* 0x85 */ { NULL, NULL, 0 },
1141 /* 0x86 */ { NULL, NULL, 0 },
1142 /* 0x87 */ { NULL, NULL, 0 },
1143 /* 0x88 */ { NULL, NULL, 0 },
1144 /* 0x89 */ { NULL, NULL, 0 },
1145 /* 0x8a */ { NULL, NULL, 0 },
1146 /* 0x8b */ { NULL, NULL, 0 },
1147 /* 0x8c */ { NULL, NULL, 0 },
1148 /* 0x8d */ { NULL, NULL, 0 },
1149 /* 0x8e */ { NULL, NULL, 0 },
1150 /* 0x8f */ { NULL, NULL, 0 },
1151 /* 0x90 */ { NULL, NULL, 0 },
1152 /* 0x91 */ { NULL, NULL, 0 },
1153 /* 0x92 */ { NULL, NULL, 0 },
1154 /* 0x93 */ { NULL, NULL, 0 },
1155 /* 0x94 */ { NULL, NULL, 0 },
1156 /* 0x95 */ { NULL, NULL, 0 },
1157 /* 0x96 */ { NULL, NULL, 0 },
1158 /* 0x97 */ { NULL, NULL, 0 },
1159 /* 0x98 */ { NULL, NULL, 0 },
1160 /* 0x99 */ { NULL, NULL, 0 },
1161 /* 0x9a */ { NULL, NULL, 0 },
1162 /* 0x9b */ { NULL, NULL, 0 },
1163 /* 0x9c */ { NULL, NULL, 0 },
1164 /* 0x9d */ { NULL, NULL, 0 },
1165 /* 0x9e */ { NULL, NULL, 0 },
1166 /* 0x9f */ { NULL, NULL, 0 },
1167 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1168 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1169 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1170 /* 0xa3 */ { NULL, NULL, 0 },
1171 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1172 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1173 /* 0xa6 */ { NULL, NULL, 0 },
1174 /* 0xa7 */ { NULL, NULL, 0 },
1175 /* 0xa8 */ { NULL, NULL, 0 },
1176 /* 0xa9 */ { NULL, NULL, 0 },
1177 /* 0xaa */ { NULL, NULL, 0 },
1178 /* 0xab */ { NULL, NULL, 0 },
1179 /* 0xac */ { NULL, NULL, 0 },
1180 /* 0xad */ { NULL, NULL, 0 },
1181 /* 0xae */ { NULL, NULL, 0 },
1182 /* 0xaf */ { NULL, NULL, 0 },
1183 /* 0xb0 */ { NULL, NULL, 0 },
1184 /* 0xb1 */ { NULL, NULL, 0 },
1185 /* 0xb2 */ { NULL, NULL, 0 },
1186 /* 0xb3 */ { NULL, NULL, 0 },
1187 /* 0xb4 */ { NULL, NULL, 0 },
1188 /* 0xb5 */ { NULL, NULL, 0 },
1189 /* 0xb6 */ { NULL, NULL, 0 },
1190 /* 0xb7 */ { NULL, NULL, 0 },
1191 /* 0xb8 */ { NULL, NULL, 0 },
1192 /* 0xb9 */ { NULL, NULL, 0 },
1193 /* 0xba */ { NULL, NULL, 0 },
1194 /* 0xbb */ { NULL, NULL, 0 },
1195 /* 0xbc */ { NULL, NULL, 0 },
1196 /* 0xbd */ { NULL, NULL, 0 },
1197 /* 0xbe */ { NULL, NULL, 0 },
1198 /* 0xbf */ { NULL, NULL, 0 },
1199 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1200 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1201 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1202 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1203 /* 0xc4 */ { NULL, NULL, 0 },
1204 /* 0xc5 */ { NULL, NULL, 0 },
1205 /* 0xc6 */ { NULL, NULL, 0 },
1206 /* 0xc7 */ { NULL, NULL, 0 },
1207 /* 0xc8 */ { NULL, NULL, 0 },
1208 /* 0xc9 */ { NULL, NULL, 0 },
1209 /* 0xca */ { NULL, NULL, 0 },
1210 /* 0xcb */ { NULL, NULL, 0 },
1211 /* 0xcc */ { NULL, NULL, 0 },
1212 /* 0xcd */ { NULL, NULL, 0 },
1213 /* 0xce */ { NULL, NULL, 0 },
1214 /* 0xcf */ { NULL, NULL, 0 },
1215 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1216 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1217 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1218 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1219 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1220 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1221 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1222 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1223 /* 0xd8 */ { NULL, NULL, 0 },
1224 /* 0xd9 */ { NULL, NULL, 0 },
1225 /* 0xda */ { NULL, NULL, 0 },
1226 /* 0xdb */ { NULL, NULL, 0 },
1227 /* 0xdc */ { NULL, NULL, 0 },
1228 /* 0xdd */ { NULL, NULL, 0 },
1229 /* 0xde */ { NULL, NULL, 0 },
1230 /* 0xdf */ { NULL, NULL, 0 },
1231 /* 0xe0 */ { NULL, NULL, 0 },
1232 /* 0xe1 */ { NULL, NULL, 0 },
1233 /* 0xe2 */ { NULL, NULL, 0 },
1234 /* 0xe3 */ { NULL, NULL, 0 },
1235 /* 0xe4 */ { NULL, NULL, 0 },
1236 /* 0xe5 */ { NULL, NULL, 0 },
1237 /* 0xe6 */ { NULL, NULL, 0 },
1238 /* 0xe7 */ { NULL, NULL, 0 },
1239 /* 0xe8 */ { NULL, NULL, 0 },
1240 /* 0xe9 */ { NULL, NULL, 0 },
1241 /* 0xea */ { NULL, NULL, 0 },
1242 /* 0xeb */ { NULL, NULL, 0 },
1243 /* 0xec */ { NULL, NULL, 0 },
1244 /* 0xed */ { NULL, NULL, 0 },
1245 /* 0xee */ { NULL, NULL, 0 },
1246 /* 0xef */ { NULL, NULL, 0 },
1247 /* 0xf0 */ { NULL, NULL, 0 },
1248 /* 0xf1 */ { NULL, NULL, 0 },
1249 /* 0xf2 */ { NULL, NULL, 0 },
1250 /* 0xf3 */ { NULL, NULL, 0 },
1251 /* 0xf4 */ { NULL, NULL, 0 },
1252 /* 0xf5 */ { NULL, NULL, 0 },
1253 /* 0xf6 */ { NULL, NULL, 0 },
1254 /* 0xf7 */ { NULL, NULL, 0 },
1255 /* 0xf8 */ { NULL, NULL, 0 },
1256 /* 0xf9 */ { NULL, NULL, 0 },
1257 /* 0xfa */ { NULL, NULL, 0 },
1258 /* 0xfb */ { NULL, NULL, 0 },
1259 /* 0xfc */ { NULL, NULL, 0 },
1260 /* 0xfd */ { NULL, NULL, 0 },
1261 /* 0xfe */ { NULL, NULL, 0 },
1262 /* 0xff */ { NULL, NULL, 0 }
1263
1264 };
1265
1266 /*******************************************************************
1267 allocate and initialize a reply packet
1268 ********************************************************************/
1269
1270 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1271 const char *inbuf, char **outbuf, uint8_t num_words,
1272 uint32_t num_bytes)
1273 {
1274 size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1275
1276 /*
1277 * Protect against integer wrap.
1278 * The SMB layer reply can be up to 0xFFFFFF bytes.
1279 */
1280 if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1281 char *msg;
1282 if (asprintf(&msg, "num_bytes too large: %u",
1283 (unsigned)num_bytes) == -1) {
1284 msg = discard_const_p(char, "num_bytes too large");
1285 }
1286 smb_panic(msg);
1287 }
1288
1289 /*
1290 * Here we include the NBT header for now.
1291 */
1292 *outbuf = talloc_array(mem_ctx, char,
1293 NBT_HDR_SIZE + smb_len);
1294 if (*outbuf == NULL) {
1295 return false;
1296 }
1297
1298 construct_reply_common(req, inbuf, *outbuf);
1299 srv_set_message(*outbuf, num_words, num_bytes, false);
1300 /*
1301 * Zero out the word area, the caller has to take care of the bcc area
1302 * himself
1303 */
1304 if (num_words != 0) {
1305 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1306 }
1307
1308 return true;
1309 }
1310
1311 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1312 {
1313 char *outbuf;
1314 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1315 num_bytes)) {
1316 smb_panic("could not allocate output buffer\n");
1317 }
1318 req->outbuf = (uint8_t *)outbuf;
1319 }
1320
1321
1322 /*******************************************************************
1323 Dump a packet to a file.
1324 ********************************************************************/
1325
1326 static void smb_dump(const char *name, int type, const char *data)
1327 {
1328 size_t len;
1329 int fd, i;
1330 char *fname = NULL;
1331 if (DEBUGLEVEL < 50) {
1332 return;
1333 }
1334
1335 len = smb_len_tcp(data)+4;
1336 for (i=1;i<100;i++) {
1337 fname = talloc_asprintf(talloc_tos(),
1338 "/tmp/%s.%d.%s",
1339 name,
1340 i,
1341 type ? "req" : "resp");
1342 if (fname == NULL) {
1343 return;
1344 }
1345 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1346 if (fd != -1 || errno != EEXIST) break;
1347 TALLOC_FREE(fname);
1348 }
1349 if (fd != -1) {
1350 ssize_t ret = write(fd, data, len);
1351 if (ret != len)
1352 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1353 close(fd);
1354 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1355 }
1356 TALLOC_FREE(fname);
1357 }
1358
1359 /****************************************************************************
1360 Prepare everything for calling the actual request function, and potentially
1361 call the request function via the "new" interface.
1362
1363 Return False if the "legacy" function needs to be called, everything is
1364 prepared.
1365
1366 Return True if we're done.
1367
1368 I know this API sucks, but it is the one with the least code change I could
1369 find.
1370 ****************************************************************************/
1371
1372 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1373 {
1374 int flags;
1375 uint64_t session_tag;
1376 connection_struct *conn = NULL;
1377 struct smbd_server_connection *sconn = req->sconn;
1378 NTTIME now = timeval_to_nttime(&req->request_time);
1379 struct smbXsrv_session *session = NULL;
1380 NTSTATUS status;
1381
1382 errno = 0;
1383
1384 if (smb_messages[type].fn == NULL) {
1385 DEBUG(0,("Unknown message type %d!\n",type));
1386 smb_dump("Unknown", 1, (const char *)req->inbuf);
1387 reply_unknown_new(req, type);
1388 return NULL;
1389 }
1390
1391 flags = smb_messages[type].flags;
1392
1393 /* In share mode security we must ignore the vuid. */
1394 session_tag = req->vuid;
1395 conn = req->conn;
1396
1397 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1398 (int)getpid(), (unsigned long)conn));
1399
1400 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1401
1402 /* Ensure this value is replaced in the incoming packet. */
1403 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1404
1405 /*
1406 * Ensure the correct username is in current_user_info. This is a
1407 * really ugly bugfix for problems with multiple session_setup_and_X's
1408 * being done and allowing %U and %G substitutions to work correctly.
1409 * There is a reason this code is done here, don't move it unless you
1410 * know what you're doing... :-).
1411 * JRA.
1412 */
1413
1414 /*
1415 * lookup an existing session
1416 *
1417 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1418 * here, the main check is still in change_to_user()
1419 */
1420 status = smb1srv_session_lookup(sconn->conn,
1421 session_tag,
1422 now,
1423 &session);
1424 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1425 switch (type) {
1426 case SMBsesssetupX:
1427 status = NT_STATUS_OK;
1428 break;
1429 default:
1430 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1431 (unsigned long long)session_tag,
1432 (unsigned long long)req->mid));
1433 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1434 return conn;
1435 }
1436 }
1437
1438 if (session_tag != sconn->conn->last_session_id) {
1439 struct user_struct *vuser = NULL;
1440
1441 sconn->conn->last_session_id = session_tag;
1442 if (session) {
1443 vuser = session->compat;
1444 }
1445 if (vuser) {
1446 set_current_user_info(
1447 vuser->session_info->unix_info->sanitized_username,
1448 vuser->session_info->unix_info->unix_name,
1449 vuser->session_info->info->domain_name);
1450 }
1451 }
1452
1453 /* Does this call need to be run as the connected user? */
1454 if (flags & AS_USER) {
1455
1456 /* Does this call need a valid tree connection? */
1457 if (!conn) {
1458 /*
1459 * Amazingly, the error code depends on the command
1460 * (from Samba4).
1461 */
1462 if (type == SMBntcreateX) {
1463 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1464 } else {
1465 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1466 }
1467 return NULL;
1468 }
1469
1470 if (!change_to_user(conn,session_tag)) {
1471 DEBUG(0, ("Error: Could not change to user. Removing "
1472 "deferred open, mid=%llu.\n",
1473 (unsigned long long)req->mid));
1474 reply_force_doserror(req, ERRSRV, ERRbaduid);
1475 return conn;
1476 }
1477
1478 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1479
1480 /* Does it need write permission? */
1481 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1482 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1483 return conn;
1484 }
1485
1486 /* IPC services are limited */
1487 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1488 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1489 return conn;
1490 }
1491 } else {
1492 /* This call needs to be run as root */
1493 change_to_root_user();
1494 }
1495
1496 /* load service specific parameters */
1497 if (conn) {
1498 if (req->encrypted) {
1499 conn->encrypted_tid = true;
1500 /* encrypted required from now on. */
1501 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1502 } else if (ENCRYPTION_REQUIRED(conn)) {
1503 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1504 DEBUG(1,("service[%s] requires encryption"
1505 "%s ACCESS_DENIED. mid=%llu\n",
1506 lp_servicename(talloc_tos(), SNUM(conn)),
1507 smb_fn_name(type),
1508 (unsigned long long)req->mid));
1509 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1510 return conn;
1511 }
1512 }
1513
1514 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1515 (flags & (AS_USER|DO_CHDIR)
1516 ?True:False))) {
1517 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1518 return conn;
1519 }
1520 conn->num_smb_operations++;
1521 }
1522
1523 /*
1524 * Does this protocol need to be run as guest? (Only archane
1525 * messenger service requests have this...)
1526 */
1527 if (flags & AS_GUEST) {
1528 char *raddr;
1529 bool ok;
1530
1531 if (!change_to_guest()) {
1532 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1533 return conn;
1534 }
1535
1536 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1537 talloc_tos());
1538 if (raddr == NULL) {
1539 reply_nterror(req, NT_STATUS_NO_MEMORY);
1540 return conn;
1541 }
1542
1543 /*
1544 * Haven't we checked this in smbd_process already???
1545 */
1546
1547 ok = allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1548 sconn->remote_hostname, raddr);
1549 TALLOC_FREE(raddr);
1550
1551 if (!ok) {
1552 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1553 return conn;
1554 }
1555 }
1556
1557 smb_messages[type].fn(req);
1558 return req->conn;
1559 }
1560
1561 /****************************************************************************
1562 Construct a reply to the incoming packet.
1563 ****************************************************************************/
1564
1565 static void construct_reply(struct smbd_server_connection *sconn,
1566 char *inbuf, int size, size_t unread_bytes,
1567 uint32_t seqnum, bool encrypted,
1568 struct smb_perfcount_data *deferred_pcd)
1569 {
1570 connection_struct *conn;
1571 struct smb_request *req;
1572
1573 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1574 smb_panic("could not allocate smb_request");
1575 }
1576
1577 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1578 encrypted, seqnum)) {
1579 exit_server_cleanly("Invalid SMB request");
1580 }
1581
1582 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1583
1584 /* we popped this message off the queue - keep original perf data */
1585 if (deferred_pcd)
1586 req->pcd = *deferred_pcd;
1587 else {
1588 SMB_PERFCOUNT_START(&req->pcd);
1589 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1590 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1591 }
1592
1593 conn = switch_message(req->cmd, req);
1594
1595 if (req->outbuf == NULL) {
1596 return;
1597 }
1598
1599 if (CVAL(req->outbuf,0) == 0) {
1600 show_msg((char *)req->outbuf);
1601 }
1602
1603 if (!srv_send_smb(req->sconn,
1604 (char *)req->outbuf,
1605 true, req->seqnum+1,
1606 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1607 &req->pcd)) {
1608 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1609 }
1610
1611 TALLOC_FREE(req);
1612
1613 return;
1614 }
1615
1616 static void construct_reply_chain(struct smbd_server_connection *sconn,
1617 char *inbuf, int size, uint32_t seqnum,
1618 bool encrypted,
1619 struct smb_perfcount_data *deferred_pcd)
1620 {
1621 struct smb_request **reqs = NULL;
1622 struct smb_request *req;
1623 unsigned num_reqs;
1624 bool ok;
1625
1626 ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1627 seqnum, &reqs, &num_reqs);
1628 if (!ok) {
1629 char errbuf[smb_size];
1630 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1631 __LINE__, __FILE__);
1632 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1633 NULL)) {
1634 exit_server_cleanly("construct_reply_chain: "
1635 "srv_send_smb failed.");
1636 }
1637 return;
1638 }
1639
1640 req = reqs[0];
1641 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1642
1643 req->conn = switch_message(req->cmd, req);
1644
1645 if (req->outbuf == NULL) {
1646 /*
1647 * Request has suspended itself, will come
1648 * back here.
1649 */
1650 return;
1651 }
1652 smb_request_done(req);
1653 }
1654
1655 /*
1656 * To be called from an async SMB handler that is potentially chained
1657 * when it is finished for shipping.
1658 */
1659
1660 void smb_request_done(struct smb_request *req)
1661 {
1662 struct smb_request **reqs = NULL;
1663 struct smb_request *first_req;
1664 size_t i, num_reqs, next_index;
1665 NTSTATUS status;
1666
1667 if (req->chain == NULL) {
1668 first_req = req;
1669 goto shipit;
1670 }
1671
1672 reqs = req->chain;
1673 num_reqs = talloc_array_length(reqs);
1674
1675 for (i=0; i<num_reqs; i++) {
1676 if (reqs[i] == req) {
1677 break;
1678 }
1679 }
1680 if (i == num_reqs) {
1681 /*
1682 * Invalid chain, should not happen
1683 */
1684 status = NT_STATUS_INTERNAL_ERROR;
1685 goto error;
1686 }
1687 next_index = i+1;
1688
1689 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1690 struct smb_request *next = reqs[next_index];
1691 struct smbXsrv_tcon *tcon;
1692 NTTIME now = timeval_to_nttime(&req->request_time);
1693
1694 next->vuid = SVAL(req->outbuf, smb_uid);
1695 next->tid = SVAL(req->outbuf, smb_tid);
1696 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1697 now, &tcon);
1698 if (NT_STATUS_IS_OK(status)) {
1699 req->conn = tcon->compat;
1700 } else {
1701 req->conn = NULL;
1702 }
1703 next->chain_fsp = req->chain_fsp;
1704 next->inbuf = req->inbuf;
1705
1706 req = next;
1707 req->conn = switch_message(req->cmd, req);
1708
1709 if (req->outbuf == NULL) {
1710 /*
1711 * Request has suspended itself, will come
1712 * back here.
1713 */
1714 return;
1715 }
1716 next_index += 1;
1717 }
1718
1719 first_req = reqs[0];
1720
1721 for (i=1; i<next_index; i++) {
1722 bool ok;
1723
1724 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1725 if (!ok) {
1726 status = NT_STATUS_INTERNAL_ERROR;
1727 goto error;
1728 }
1729 }
1730
1731 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1732 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1733
1734 /*
1735 * This scary statement intends to set the
1736 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1737 * to the value last_req->outbuf carries
1738 */
1739 SSVAL(first_req->outbuf, smb_flg2,
1740 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1741 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1742
1743 /*
1744 * Transfer the error codes from the subrequest to the main one
1745 */
1746 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1747 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1748
1749 _smb_setlen_large(
1750 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1751
1752 shipit:
1753 if (!srv_send_smb(first_req->sconn,
1754 (char *)first_req->outbuf,
1755 true, first_req->seqnum+1,
1756 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1757 &first_req->pcd)) {
1758 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1759 "failed.");
1760 }
1761 TALLOC_FREE(req); /* non-chained case */
1762 TALLOC_FREE(reqs); /* chained case */
1763 return;
1764
1765 error:
1766 {
1767 char errbuf[smb_size];
1768 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1769 if (!srv_send_smb(req->sconn, errbuf, true,
1770 req->seqnum+1, req->encrypted,
1771 NULL)) {
1772 exit_server_cleanly("construct_reply_chain: "
1773 "srv_send_smb failed.");
1774 }
1775 }
1776 TALLOC_FREE(req); /* non-chained case */
1777 TALLOC_FREE(reqs); /* chained case */
1778 }
1779
1780 /****************************************************************************
1781 Process an smb from the client
1782 ****************************************************************************/
1783 static void process_smb(struct smbd_server_connection *sconn,
1784 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1785 uint32_t seqnum, bool encrypted,
1786 struct smb_perfcount_data *deferred_pcd)
1787 {
1788 int msg_type = CVAL(inbuf,0);
1789
1790 DO_PROFILE_INC(smb_count);
1791
1792 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1793 smb_len(inbuf) ) );
1794 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1795 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1796
1797 if (msg_type != NBSSmessage) {
1798 /*
1799 * NetBIOS session request, keepalive, etc.
1800 */
1801 reply_special(sconn, (char *)inbuf, nread);
1802 goto done;
1803 }
1804
1805 if (sconn->using_smb2) {
1806 /* At this point we're not really using smb2,
1807 * we make the decision here.. */
1808 if (smbd_is_smb2_header(inbuf, nread)) {
1809 smbd_smb2_first_negprot(sconn, inbuf, nread);
1810 return;
1811 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1812 && CVAL(inbuf, smb_com) != 0x72) {
1813 /* This is a non-negprot SMB1 packet.
1814 Disable SMB2 from now on. */
1815 sconn->using_smb2 = false;
1816 }
1817 }
1818
1819 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1820 * so subtract 4 from it. */
1821 if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1822 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1823 smb_len(inbuf)));
1824
1825 /* special magic for immediate exit */
1826 if ((nread == 9) &&
1827 (IVAL(inbuf, 4) == 0x74697865) &&
1828 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1829 uint8_t exitcode = CVAL(inbuf, 8);
1830 DEBUG(1, ("Exiting immediately with code %d\n",
1831 (int)exitcode));
1832 exit(exitcode);
1833 }
1834
1835 exit_server_cleanly("Non-SMB packet");
1836 }
1837
1838 show_msg((char *)inbuf);
1839
1840 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1841 construct_reply_chain(sconn, (char *)inbuf, nread,
1842 seqnum, encrypted, deferred_pcd);
1843 } else {
1844 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1845 seqnum, encrypted, deferred_pcd);
1846 }
1847
1848 sconn->trans_num++;
1849
1850 done:
1851 sconn->num_requests++;
1852
1853 /* The timeout_processing function isn't run nearly
1854 often enough to implement 'max log size' without
1855 overrunning the size of the file by many megabytes.
1856 This is especially true if we are running at debug
1857 level 10. Checking every 50 SMBs is a nice
1858 tradeoff of performance vs log file size overrun. */
1859
1860 if ((sconn->num_requests % 50) == 0 &&
1861 need_to_check_log_size()) {
1862 change_to_root_user();
1863 check_log_size();
1864 }
1865 }
1866
1867 /****************************************************************************
1868 Return a string containing the function name of a SMB command.
1869 ****************************************************************************/
1870
1871 const char *smb_fn_name(int type)
1872 {
1873 const char *unknown_name = "SMBunknown";
1874
1875 if (smb_messages[type].name == NULL)
1876 return(unknown_name);
1877
1878 return(smb_messages[type].name);
1879 }
1880
1881 /****************************************************************************
1882 Helper functions for contruct_reply.
1883 ****************************************************************************/
1884
1885 void add_to_common_flags2(uint32 v)
1886 {
1887 common_flags2 |= v;
1888 }
1889
1890 void remove_from_common_flags2(uint32 v)
1891 {
1892 common_flags2 &= ~v;
1893 }
1894
1895 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1896 char *outbuf)
1897 {
1898 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1899 uint16_t out_flags2 = common_flags2;
1900
1901 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1902 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1903 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1904
1905 srv_set_message(outbuf,0,0,false);
1906
1907 SCVAL(outbuf, smb_com, req->cmd);
1908 SIVAL(outbuf,smb_rcls,0);
1909 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1910 SSVAL(outbuf,smb_flg2, out_flags2);
1911 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1912 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1913
1914 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1915 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1916 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1917 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1918 }
1919
1920 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1921 {
1922 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1923 }
1924
1925 /**
1926 * @brief Find the smb_cmd offset of the last command pushed
1927 * @param[in] buf The buffer we're building up
1928 * @retval Where can we put our next andx cmd?
1929 *
1930 * While chaining requests, the "next" request we're looking at needs to put
1931 * its SMB_Command before the data the previous request already built up added
1932 * to the chain. Find the offset to the place where we have to put our cmd.
1933 */
1934
1935 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1936 {
1937 uint8_t cmd;
1938 size_t ofs;
1939
1940 cmd = CVAL(buf, smb_com);
1941
1942 if (!is_andx_req(cmd)) {
1943 return false;
1944 }
1945
1946 ofs = smb_vwv0;
1947
1948 while (CVAL(buf, ofs) != 0xff) {
1949
1950 if (!is_andx_req(CVAL(buf, ofs))) {
1951 return false;
1952 }
1953
1954 /*
1955 * ofs is from start of smb header, so add the 4 length
1956 * bytes. The next cmd is right after the wct field.
1957 */
1958 ofs = SVAL(buf, ofs+2) + 4 + 1;
1959
1960 if (ofs+4 >= talloc_get_size(buf)) {
1961 return false;
1962 }
1963 }
1964
1965 *pofs = ofs;
1966 return true;
1967 }
1968
1969 /**
1970 * @brief Do the smb chaining at a buffer level
1971 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1972 * @param[in] andx_buf Buffer to be appended
1973 */
1974
1975 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1976 {
1977 uint8_t smb_command = CVAL(andx_buf, smb_com);
1978 uint8_t wct = CVAL(andx_buf, smb_wct);
1979 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1980 uint32_t num_bytes = smb_buflen(andx_buf);
1981 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1982
1983 uint8_t *outbuf;
1984 size_t old_size, new_size;
1985 size_t ofs;
1986 size_t chain_padding = 0;
1987 size_t andx_cmd_ofs;
1988
1989
1990 old_size = talloc_get_size(*poutbuf);
1991
1992 if ((old_size % 4) != 0) {
1993 /*
1994 * Align the wct field of subsequent requests to a 4-byte
1995 * boundary
1996 */
1997 chain_padding = 4 - (old_size % 4);
1998 }
1999
2000 /*
2001 * After the old request comes the new wct field (1 byte), the vwv's
2002 * and the num_bytes field.
2003 */
2004
2005 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2006 new_size += num_bytes;
2007
2008 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2009 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2010 (unsigned)new_size));
2011 return false;
2012 }
2013
2014 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2015 if (outbuf == NULL) {
2016 DEBUG(0, ("talloc failed\n"));
2017 return false;
2018 }
2019 *poutbuf = outbuf;
2020
2021 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2022 DEBUG(1, ("invalid command chain\n"));
2023 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2024 return false;
2025 }
2026
2027 if (chain_padding != 0) {
2028 memset(outbuf + old_size, 0, chain_padding);
2029 old_size += chain_padding;
2030 }
2031
2032 SCVAL(outbuf, andx_cmd_ofs, smb_command);
2033 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2034
2035 ofs = old_size;
2036
2037 /*
2038 * Push the chained request:
2039 *
2040 * wct field
2041 */
2042
2043 SCVAL(outbuf, ofs, wct);
2044 ofs += 1;
2045
2046 /*
2047 * vwv array
2048 */
2049
2050 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2051
2052 /*
2053 * HACK ALERT
2054 *
2055 * Read&X has an offset into its data buffer at
2056 * vwv[6]. reply_read_andx has no idea anymore that it's
2057 * running from within a chain, so we have to fix up the
2058 * offset here.
2059 *
2060 * Although it looks disgusting at this place, I want to keep
2061 * it here. The alternative would be to push knowledge about
2062 * the andx chain down into read&x again.
2063 */
2064
2065 if (smb_command == SMBreadX) {
2066 uint8_t *bytes_addr;
2067
2068 if (wct < 7) {
2069 /*
2070 * Invalid read&x response
2071 */
2072 return false;
2073 }
2074
2075 bytes_addr = outbuf + ofs /* vwv start */
2076 + sizeof(uint16_t) * wct /* vwv array */
2077 + sizeof(uint16_t); /* bcc */
2078
2079 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2080 bytes_addr - outbuf - 4);
2081 }
2082
2083 ofs += sizeof(uint16_t) * wct;
2084
2085 /*
2086 * bcc (byte count)
2087 */
2088
2089 SSVAL(outbuf, ofs, num_bytes);
2090 ofs += sizeof(uint16_t);
2091
2092 /*
2093 * The bytes field
2094 */
2095
2096 memcpy(outbuf + ofs, bytes, num_bytes);
2097
2098 return true;
2099 }
2100
2101 bool smb1_is_chain(const uint8_t *buf)
2102 {
2103 uint8_t cmd, wct, andx_cmd;
2104
2105 cmd = CVAL(buf, smb_com);
2106 if (!is_andx_req(cmd)) {
2107 return false;
2108 }
2109 wct = CVAL(buf, smb_wct);
2110 if (wct < 2) {
2111 return false;
2112 }
2113 andx_cmd = CVAL(buf, smb_vwv);
2114 return (andx_cmd != 0xFF);
2115 }
2116
2117 bool smb1_walk_chain(const uint8_t *buf,
2118 bool (*fn)(uint8_t cmd,
2119 uint8_t wct, const uint16_t *vwv,
2120 uint16_t num_bytes, const uint8_t *bytes,
2121 void *private_data),
2122 void *private_data)
2123 {
2124 size_t smblen = smb_len(buf);
2125 const char *smb_buf = smb_base(buf);
2126 uint8_t cmd, chain_cmd;
2127 uint8_t wct;
2128 const uint16_t *vwv;
2129 uint16_t num_bytes;
2130 const uint8_t *bytes;
2131
2132 cmd = CVAL(buf, smb_com);
2133 wct = CVAL(buf, smb_wct);
2134 vwv = (const uint16_t *)(buf + smb_vwv);
2135 num_bytes = smb_buflen(buf);
2136 bytes = (const uint8_t *)smb_buf_const(buf);
2137
2138 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2139 return false;
2140 }
2141
2142 if (!is_andx_req(cmd)) {
2143 return true;
2144 }
2145 if (wct < 2) {
2146 return false;
2147 }
2148
2149 chain_cmd = CVAL(vwv, 0);
2150
2151 while (chain_cmd != 0xff) {
2152 uint32_t chain_offset; /* uint32_t to avoid overflow */
2153 size_t length_needed;
2154 ptrdiff_t vwv_offset;
2155
2156 chain_offset = SVAL(vwv+1, 0);
2157
2158 /*
2159 * Check if the client tries to fool us. The chain
2160 * offset needs to point beyond the current request in
2161 * the chain, it needs to strictly grow. Otherwise we
2162 * might be tricked into an endless loop always
2163 * processing the same request over and over again. We
2164 * used to assume that vwv and the byte buffer array
2165 * in a chain are always attached, but OS/2 the
2166 * Write&X/Read&X chain puts the Read&X vwv array
2167 * right behind the Write&X vwv chain. The Write&X bcc
2168 * array is put behind the Read&X vwv array. So now we
2169 * check whether the chain offset points strictly
2170 * behind the previous vwv array. req->buf points
2171 * right after the vwv array of the previous
2172 * request. See
2173 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2174 * more information.
2175 */
2176
2177 vwv_offset = ((const char *)vwv - smb_buf);
2178 if (chain_offset <= vwv_offset) {
2179 return false;
2180 }
2181
2182 /*
2183 * Next check: Make sure the chain offset does not
2184 * point beyond the overall smb request length.
2185 */
2186
2187 length_needed = chain_offset+1; /* wct */
2188 if (length_needed > smblen) {
2189 return false;
2190 }
2191
2192 /*
2193 * Now comes the pointer magic. Goal here is to set up
2194 * vwv and buf correctly again. The chain offset (the
2195 * former vwv[1]) points at the new wct field.
2196 */
2197
2198 wct = CVAL(smb_buf, chain_offset);
2199
2200 if (is_andx_req(chain_cmd) && (wct < 2)) {
2201 return false;
2202 }
2203
2204 /*
2205 * Next consistency check: Make the new vwv array fits
2206 * in the overall smb request.
2207 */
2208
2209 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2210 if (length_needed > smblen) {
2211 return false;
2212 }
2213 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2214
2215 /*
2216 * Now grab the new byte buffer....
2217 */
2218
2219 num_bytes = SVAL(vwv+wct, 0);
2220
2221 /*
2222 * .. and check that it fits.
2223 */
2224
2225 length_needed += num_bytes;
2226 if (length_needed > smblen) {
2227 return false;
2228 }
2229 bytes = (const uint8_t *)(vwv+wct+1);
2230
2231 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2232 return false;
2233 }
2234
2235 if (!is_andx_req(chain_cmd)) {
2236 return true;
2237 }
2238 chain_cmd = CVAL(vwv, 0);
2239 }
2240 return true;
2241 }
2242
2243 static bool smb1_chain_length_cb(uint8_t cmd,
2244 uint8_t wct, const uint16_t *vwv,
2245 uint16_t num_bytes, const uint8_t *bytes,
2246 void *private_data)
2247 {
2248 unsigned *count = (unsigned *)private_data;
2249 *count += 1;
2250 return true;
2251 }
2252
2253 unsigned smb1_chain_length(const uint8_t *buf)
2254 {
2255 unsigned count = 0;
2256
2257 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2258 return 0;
2259 }
2260 return count;
2261 }
2262
2263 struct smb1_parse_chain_state {
2264 TALLOC_CTX *mem_ctx;
2265 const uint8_t *buf;
2266 struct smbd_server_connection *sconn;
2267 bool encrypted;
2268 uint32_t seqnum;
2269
2270 struct smb_request **reqs;
2271 unsigned num_reqs;
2272 };
2273
2274 static bool smb1_parse_chain_cb(uint8_t cmd,
2275 uint8_t wct, const uint16_t *vwv,
2276 uint16_t num_bytes, const uint8_t *bytes,
2277 void *private_data)
2278 {
2279 struct smb1_parse_chain_state *state =
2280 (struct smb1_parse_chain_state *)private_data;
2281 struct smb_request **reqs;
2282 struct smb_request *req;
2283 bool ok;
2284
2285 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2286 struct smb_request *, state->num_reqs+1);
2287 if (reqs == NULL) {
2288 return false;
2289 }
2290 state->reqs = reqs;
2291
2292 req = talloc(reqs, struct smb_request);
2293 if (req == NULL) {
2294 return false;
2295 }
2296
2297 ok = init_smb_request(req, state->sconn, state->buf, 0,
2298 state->encrypted, state->seqnum);
2299 if (!ok) {
2300 return false;
2301 }
2302 req->cmd = cmd;
2303 req->wct = wct;
2304 req->vwv = vwv;
2305 req->buflen = num_bytes;
2306 req->buf = bytes;
2307
2308 reqs[state->num_reqs] = req;
2309 state->num_reqs += 1;
2310 return true;
2311 }
2312
2313 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2314 struct smbd_server_connection *sconn,
2315 bool encrypted, uint32_t seqnum,
2316 struct smb_request ***reqs, unsigned *num_reqs)
2317 {
2318 struct smb1_parse_chain_state state;
2319 unsigned i;
2320
2321 state.mem_ctx = mem_ctx;
2322 state.buf = buf;
2323 state.sconn = sconn;
2324 state.encrypted = encrypted;
2325 state.seqnum = seqnum;
2326 state.reqs = NULL;
2327 state.num_reqs = 0;
2328
2329 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2330 TALLOC_FREE(state.reqs);
2331 return false;
2332 }
2333 for (i=0; i<state.num_reqs; i++) {
2334 state.reqs[i]->chain = state.reqs;
2335 }
2336 *reqs = state.reqs;
2337 *num_reqs = state.num_reqs;
2338 return true;
2339 }
2340
2341 /****************************************************************************
2342 Check if services need reloading.
2343 ****************************************************************************/
2344
2345 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2346 {
2347
2348 if (last_smb_conf_reload_time == 0) {
2349 last_smb_conf_reload_time = t;
2350 }
2351
2352 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2353 reload_services(sconn, conn_snum_used, true);
2354 last_smb_conf_reload_time = t;
2355 }
2356 }
2357
2358 static bool fd_is_readable(int fd)
2359 {
2360 int ret, revents;
2361
2362 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2363
2364 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2365
2366 }
2367
2368 static void smbd_server_connection_write_handler(
2369 struct smbd_server_connection *sconn)
2370 {
2371 /* TODO: make write nonblocking */
2372 }
2373
2374 static void smbd_server_connection_read_handler(
2375 struct smbd_server_connection *sconn, int fd)
2376 {
2377 uint8_t *inbuf = NULL;
2378 size_t inbuf_len = 0;
2379 size_t unread_bytes = 0;
2380 bool encrypted = false;
2381 TALLOC_CTX *mem_ctx = talloc_tos();
2382 NTSTATUS status;
2383 uint32_t seqnum;
2384
2385 bool from_client;
2386
2387 if (lp_async_smb_echo_handler()
2388 && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2389 /*
2390 * This is the super-ugly hack to prefer the packets
2391 * forwarded by the echo handler over the ones by the
2392 * client directly
2393 */
2394 fd = sconn->smb1.echo_handler.trusted_fd;
2395 }
2396
2397 from_client = (sconn->sock == fd);
2398
2399 if (from_client) {
2400 smbd_lock_socket(sconn);
2401
2402 if (!fd_is_readable(fd)) {
2403 DEBUG(10,("the echo listener was faster\n"));
2404 smbd_unlock_socket(sconn);
2405 return;
2406 }
2407 }
2408
2409 /* TODO: make this completely nonblocking */
2410 status = receive_smb_talloc(mem_ctx, sconn, fd,
2411 (char **)(void *)&inbuf,
2412 0, /* timeout */
2413 &unread_bytes,
2414 &encrypted,
2415 &inbuf_len, &seqnum,
2416 !from_client /* trusted channel */);
2417
2418 if (from_client) {
2419 smbd_unlock_socket(sconn);
2420 }
2421
2422 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2423 goto process;
2424 }
2425 if (NT_STATUS_IS_ERR(status)) {
2426 exit_server_cleanly("failed to receive smb request");
2427 }
2428 if (!NT_STATUS_IS_OK(status)) {
2429 return;
2430 }
2431
2432 process:
2433 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2434 seqnum, encrypted, NULL);
2435 }
2436
2437 static void smbd_server_connection_handler(struct tevent_context *ev,
2438 struct tevent_fd *fde,
2439 uint16_t flags,
2440 void *private_data)
2441 {
2442 struct smbd_server_connection *conn = talloc_get_type(private_data,
2443 struct smbd_server_connection);
2444
2445 if (flags & TEVENT_FD_WRITE) {
2446 smbd_server_connection_write_handler(conn);
2447 return;
2448 }
2449 if (flags & TEVENT_FD_READ) {
2450 smbd_server_connection_read_handler(conn, conn->sock);
2451 return;
2452 }
2453 }
2454
2455 static void smbd_server_echo_handler(struct tevent_context *ev,
2456 struct tevent_fd *fde,
2457 uint16_t flags,
2458 void *private_data)
2459 {
2460 struct smbd_server_connection *conn = talloc_get_type(private_data,
2461 struct smbd_server_connection);
2462
2463 if (flags & TEVENT_FD_WRITE) {
2464 smbd_server_connection_write_handler(conn);
2465 return;
2466 }
2467 if (flags & TEVENT_FD_READ) {
2468 smbd_server_connection_read_handler(
2469 conn, conn->smb1.echo_handler.trusted_fd);
2470 return;
2471 }
2472 }
2473
2474 #ifdef CLUSTER_SUPPORT
2475
2476 struct smbd_release_ip_state {
2477 struct smbd_server_connection *sconn;
2478 char addr[INET6_ADDRSTRLEN];
2479 };
2480
2481 /****************************************************************************
2482 received when we should release a specific IP
2483 ****************************************************************************/
2484 static void release_ip(const char *ip, void *priv)
2485 {
2486 struct smbd_release_ip_state *state =
2487 talloc_get_type_abort(priv,
2488 struct smbd_release_ip_state);
2489 const char *addr = state->addr;
2490 const char *p = addr;
2491
2492 if (strncmp("::ffff:", addr, 7) == 0) {
2493 p = addr + 7;
2494 }
2495
2496 DEBUG(10, ("Got release IP message for %s, "
2497 "our address is %s\n", ip, p));
2498
2499 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2500 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2501 ip));
2502 /*
2503 * With SMB2 we should do a clean disconnect,
2504 * the previous_session_id in the session setup
2505 * will cleanup the old session, tcons and opens.
2506 *
2507 * A clean disconnect is needed in order to support
2508 * durable handles.
2509 *
2510 * Note: typically this is never triggered
2511 * as we got a TCP RST (triggered by ctdb event scripts)
2512 * before we get CTDB_SRVID_RELEASE_IP.
2513 *
2514 * We used to call _exit(1) here, but as this was mostly never
2515 * triggered and has implication on our process model,
2516 * we can just use smbd_server_connection_terminate()
2517 * (also for SMB1).
2518 */
2519 smbd_server_connection_terminate(state->sconn,
2520 "CTDB_SRVID_RELEASE_IP");
2521 return;
2522 }
2523 }
2524
2525 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2526 struct sockaddr_storage *srv,
2527 struct sockaddr_storage *clnt)
2528 {
2529 struct smbd_release_ip_state *state;
2530 struct ctdbd_connection *cconn;
2531
2532 cconn = messaging_ctdbd_connection();
2533 if (cconn == NULL) {
2534 return NT_STATUS_NO_MEMORY;
2535 }
2536
2537 state = talloc_zero(sconn, struct smbd_release_ip_state);
2538 if (state == NULL) {
2539 return NT_STATUS_NO_MEMORY;
2540 }
2541 state->sconn = sconn;
2542 if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2543 return NT_STATUS_NO_MEMORY;
2544 }
2545
2546 return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2547 }
2548
2549 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2550 struct sockaddr_storage *client)
2551 {
2552 socklen_t length;
2553 length = sizeof(*server);
2554 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2555 return -1;
2556 }
2557 length = sizeof(*client);
2558 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2559 return -1;
2560 }
2561 return 0;
2562 }
2563 #endif
2564
2565 /*
2566 * Send keepalive packets to our client
2567 */
2568 static bool keepalive_fn(const struct timeval *now, void *private_data)
2569 {
2570 struct smbd_server_connection *sconn = talloc_get_type_abort(
2571 private_data, struct smbd_server_connection);
2572 bool ret;
2573
2574 if (sconn->using_smb2) {
2575 /* Don't do keepalives on an SMB2 connection. */
2576 return false;
2577 }
2578
2579 smbd_lock_socket(sconn);
2580 ret = send_keepalive(sconn->sock);
2581 smbd_unlock_socket(sconn);
2582
2583 if (!ret) {
2584 char addr[INET6_ADDRSTRLEN];
2585 /*
2586 * Try and give an error message saying what
2587 * client failed.
2588 */
2589 DEBUG(0, ("send_keepalive failed for client %s. "
2590 "Error %s - exiting\n",
2591 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2592 strerror(errno)));
2593 return False;
2594 }
2595 return True;
2596 }
2597
2598 /*
2599 * Do the recurring check if we're idle
2600 */
2601 static bool deadtime_fn(const struct timeval *now, void *private_data)
2602 {
2603 struct smbd_server_connection *sconn =
2604 (struct smbd_server_connection *)private_data;
2605
2606 if ((conn_num_open(sconn) == 0)
2607 || (conn_idle_all(sconn, now->tv_sec))) {
2608 DEBUG( 2, ( "Closing idle connection\n" ) );
2609 messaging_send(sconn->msg_ctx,
2610 messaging_server_id(sconn->msg_ctx),
2611 MSG_SHUTDOWN, &data_blob_null);
2612 return False;
2613 }
2614
2615 return True;
2616 }
2617
2618 /*
2619 * Do the recurring log file and smb.conf reload checks.
2620 */
2621
2622 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2623 {
2624 struct smbd_server_connection *sconn = talloc_get_type_abort(
2625 private_data, struct smbd_server_connection);
2626
2627 DEBUG(5, ("housekeeping\n"));
2628
2629 change_to_root_user();
2630
2631 /* update printer queue caches if necessary */
2632 update_monitored_printq_cache(sconn->msg_ctx);
2633
2634 /* check if we need to reload services */
2635 check_reload(sconn, time_mono(NULL));
2636
2637 /*
2638 * Force a log file check.
2639 */
2640 force_check_log_size();
2641 check_log_size();
2642 return true;
2643 }
2644
2645 /*
2646 * Read an smb packet in the echo handler child, giving the parent
2647 * smbd one second to react once the socket becomes readable.
2648 */
2649
2650 struct smbd_echo_read_state {
2651 struct tevent_context *ev;
2652 struct smbd_server_connection *sconn;
2653
2654 char *buf;
2655 size_t buflen;
2656 uint32_t seqnum;
2657 };
2658
2659 static void smbd_echo_read_readable(struct tevent_req *subreq);
2660 static void smbd_echo_read_waited(struct tevent_req *subreq);
2661
2662 static struct tevent_req *smbd_echo_read_send(
2663 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2664 struct smbd_server_connection *sconn)
2665 {
2666 struct tevent_req *req, *subreq;
2667 struct smbd_echo_read_state *state;
2668
2669 req = tevent_req_create(mem_ctx, &state,
2670 struct smbd_echo_read_state);
2671 if (req == NULL) {
2672 return NULL;
2673 }
2674 state->ev = ev;
2675 state->sconn = sconn;
2676
2677 subreq = wait_for_read_send(state, ev, sconn->sock);
2678 if (tevent_req_nomem(subreq, req)) {
2679 return tevent_req_post(req, ev);
2680 }
2681 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2682 return req;
2683 }
2684
2685 static void smbd_echo_read_readable(struct tevent_req *subreq)
2686 {
2687 struct tevent_req *req = tevent_req_callback_data(
2688 subreq, struct tevent_req);
2689 struct smbd_echo_read_state *state = tevent_req_data(
2690 req, struct smbd_echo_read_state);
2691 bool ok;
2692 int err;
2693
2694 ok = wait_for_read_recv(subreq, &err);
2695 TALLOC_FREE(subreq);
2696 if (!ok) {
2697 tevent_req_nterror(req, map_nt_error_from_unix(err));
2698 return;
2699 }
2700
2701 /*
2702 * Give the parent smbd one second to step in
2703 */
2704
2705 subreq = tevent_wakeup_send(
2706 state, state->ev, timeval_current_ofs(1, 0));
2707 if (tevent_req_nomem(subreq, req)) {
2708 return;
2709 }
2710 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2711 }
2712
2713 static void smbd_echo_read_waited(struct tevent_req *subreq)
2714 {
2715 struct tevent_req *req = tevent_req_callback_data(
2716 subreq, struct tevent_req);
2717 struct smbd_echo_read_state *state = tevent_req_data(
2718 req, struct smbd_echo_read_state);
2719 struct smbd_server_connection *sconn = state->sconn;
2720 bool ok;
2721 NTSTATUS status;
2722 size_t unread = 0;
2723 bool encrypted;
2724
2725 ok = tevent_wakeup_recv(subreq);
2726 TALLOC_FREE(subreq);
2727 if (!ok) {
2728 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2729 return;
2730 }
2731
2732 ok = smbd_lock_socket_internal(sconn);
2733 if (!ok) {
2734 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2735 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2736 return;
2737 }
2738
2739 if (!fd_is_readable(sconn->sock)) {
2740 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2741 (int)getpid()));
2742
2743 ok = smbd_unlock_socket_internal(sconn);
2744 if (!ok) {
2745 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2746 DEBUG(1, ("%s: failed to unlock socket\n",
2747 __location__));
2748 return;
2749 }
2750
2751 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2752 if (tevent_req_nomem(subreq, req)) {
2753 return;
2754 }
2755 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2756 return;
2757 }
2758
2759 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2760 0 /* timeout */,
2761 &unread,
2762 &encrypted,
2763 &state->buflen,
2764 &state->seqnum,
2765 false /* trusted_channel*/);
2766
2767 if (tevent_req_nterror(req, status)) {
2768 tevent_req_nterror(req, status);
2769 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2770 (int)getpid(), nt_errstr(status)));
2771 return;
2772 }
2773
2774 ok = smbd_unlock_socket_internal(sconn);
2775 if (!ok) {
2776 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2777 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2778 return;
2779 }
2780 tevent_req_done(req);
2781 }
2782
2783 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2784 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2785 {
2786 struct smbd_echo_read_state *state = tevent_req_data(
2787 req, struct smbd_echo_read_state);
2788 NTSTATUS status;
2789
2790 if (tevent_req_is_nterror(req, &status)) {
2791 return status;
2792 }
2793 *pbuf = talloc_move(mem_ctx, &state->buf);
2794 *pbuflen = state->buflen;
2795 *pseqnum = state->seqnum;
2796 return NT_STATUS_OK;
2797 }
2798
2799 struct smbd_echo_state {
2800 struct tevent_context *ev;
2801 struct iovec *pending;
2802 struct smbd_server_connection *sconn;
2803 int parent_pipe;
2804
2805 struct tevent_fd *parent_fde;
2806
2807 struct tevent_req *write_req;
2808 };
2809
2810 static void smbd_echo_writer_done(struct tevent_req *req);
2811
2812 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2813 {
2814 int num_pending;
2815
2816 if (state->write_req != NULL) {
2817 return;
2818 }
2819
2820 num_pending = talloc_array_length(state->pending);
2821 if (num_pending == 0) {
2822 return;
2823 }
2824
2825 state->write_req = writev_send(state, state->ev, NULL,
2826 state->parent_pipe, false,
2827 state->pending, num_pending);
2828 if (state->write_req == NULL) {
2829 DEBUG(1, ("writev_send failed\n"));
2830 exit(1);
2831 }
2832
2833 talloc_steal(state->write_req, state->pending);
2834 state->pending = NULL;
2835
2836 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2837 state);
2838 }
2839
2840 static void smbd_echo_writer_done(struct tevent_req *req)
2841 {
2842 struct smbd_echo_state *state = tevent_req_callback_data(
2843 req, struct smbd_echo_state);
2844 ssize_t written;
2845 int err;
2846
2847 written = writev_recv(req, &err);
2848 TALLOC_FREE(req);
2849 state->write_req = NULL;
2850 if (written == -1) {
2851 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2852 exit(1);
2853 }
2854 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2855 smbd_echo_activate_writer(state);
2856 }
2857
2858 static bool smbd_echo_reply(struct smbd_echo_state *state,
2859 uint8_t *inbuf, size_t inbuf_len,
2860 uint32_t seqnum)
2861 {
2862 struct smb_request req;
2863 uint16_t num_replies;
2864 char *outbuf;
2865 bool ok;
2866
2867 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2868 DEBUG(10, ("Got netbios keepalive\n"));
2869 /*
2870 * Just swallow it
2871 */
2872 return true;
2873 }
2874
2875 if (inbuf_len < smb_size) {
2876 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2877 return false;
2878 }
2879 if (!valid_smb_header(state->sconn, inbuf)) {
2880 DEBUG(10, ("Got invalid SMB header\n"));
2881 return false;
2882 }
2883
2884 if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2885 seqnum)) {
2886 return false;
2887 }
2888 req.inbuf = inbuf;
2889
2890 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2891 smb_messages[req.cmd].name
2892 ? smb_messages[req.cmd].name : "unknown"));
2893
2894 if (req.cmd != SMBecho) {
2895 return false;
2896 }
2897 if (req.wct < 1) {
2898 return false;
2899 }
2900
2901 num_replies = SVAL(req.vwv+0, 0);
2902 if (num_replies != 1) {
2903 /* Not a Windows "Hey, you're still there?" request */
2904 return false;
2905 }
2906
2907 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2908 1, req.buflen)) {
2909 DEBUG(10, ("create_outbuf failed\n"));
2910 return false;
2911 }
2912 req.outbuf = (uint8_t *)outbuf;
2913
2914 SSVAL(req.outbuf, smb_vwv0, num_replies);
2915
2916 if (req.buflen > 0) {
2917 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2918 }
2919
2920 ok = srv_send_smb(req.sconn,
2921 (char *)outbuf,
2922 true, seqnum+1,
2923 false, &req.pcd);
2924 TALLOC_FREE(outbuf);
2925 if (!ok) {
2926 exit(1);
2927 }
2928
2929 return true;
2930 }
2931
2932 static void smbd_echo_exit(struct tevent_context *ev,
2933 struct tevent_fd *fde, uint16_t flags,
2934 void *private_data)
2935 {
2936 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2937 exit(0);
2938 }
2939
2940 static void smbd_echo_got_packet(struct tevent_req *req);
2941
2942 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2943 int parent_pipe)
2944 {
2945 struct smbd_echo_state *state;
2946 struct tevent_req *read_req;
2947
2948 state = talloc_zero(sconn, struct smbd_echo_state);
2949 if (state == NULL) {
2950 DEBUG(1, ("talloc failed\n"));
2951 return;
2952 }
2953 state->sconn = sconn;
2954 state->parent_pipe = parent_pipe;
2955 state->ev = s3_tevent_context_init(state);
2956 if (state->ev == NULL) {
2957 DEBUG(1, ("tevent_context_init failed\n"));
2958 TALLOC_FREE(state);
2959 return;
2960 }
2961 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2962 TEVENT_FD_READ, smbd_echo_exit,
2963 state);
2964 if (state->parent_fde == NULL) {
2965 DEBUG(1, ("tevent_add_fd failed\n"));
2966 TALLOC_FREE(state);
2967 return;
2968 }
2969
2970 read_req = smbd_echo_read_send(state, state->ev, sconn);
2971 if (read_req == NULL) {
2972 DEBUG(1, ("smbd_echo_read_send failed\n"));
2973 TALLOC_FREE(state);
2974 return;
2975 }
2976 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2977
2978 while (true) {
2979 if (tevent_loop_once(state->ev) == -1) {
2980 DEBUG(1, ("tevent_loop_once failed: %s\n",
2981 strerror(errno)));
2982 break;
2983 }
2984 }
2985 TALLOC_FREE(state);
2986 }
2987
2988 static void smbd_echo_got_packet(struct tevent_req *req)
2989 {
2990 struct smbd_echo_state *state = tevent_req_callback_data(
2991 req, struct smbd_echo_state);
2992 NTSTATUS status;
2993 char *buf = NULL;
2994 size_t buflen = 0;
2995 uint32_t seqnum = 0;
2996 bool reply;
2997
2998 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2999 TALLOC_FREE(req);
3000 if (!NT_STATUS_IS_OK(status)) {
3001 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3002 nt_errstr(status)));
3003 exit(1);
3004 }
3005
3006 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3007 if (!reply) {
3008 size_t num_pending;
3009 struct iovec *tmp;
3010 struct iovec *iov;
3011
3012 num_pending = talloc_array_length(state->pending);
3013 tmp = talloc_realloc(state, state->pending, struct iovec,
3014 num_pending+1);
3015 if (tmp == NULL) {
3016 DEBUG(1, ("talloc_realloc failed\n"));
3017 exit(1);
3018 }
3019 state->pending = tmp;
3020
3021 if (buflen >= smb_size) {
3022 /*
3023 * place the seqnum in the packet so that the main process
3024 * can reply with signing
3025 */
3026 SIVAL(buf, smb_ss_field, seqnum);
3027 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3028 }
3029
3030 iov = &state->pending[num_pending];
3031 iov->iov_base = talloc_move(state->pending, &buf);
3032 iov->iov_len = buflen;
3033
3034 DEBUG(10,("echo_handler[%d]: forward to main\n",
3035 (int)getpid()));
3036 smbd_echo_activate_writer(state);
3037 }
3038
3039 req = smbd_echo_read_send(state, state->ev, state->sconn);
3040 if (req == NULL) {
3041 DEBUG(1, ("smbd_echo_read_send failed\n"));
3042 exit(1);
3043 }
3044 tevent_req_set_callback(req, smbd_echo_got_packet, state);
3045 }
3046
3047
3048 /*
3049 * Handle SMBecho requests in a forked child process
3050 */
3051 bool fork_echo_handler(struct smbd_server_connection *sconn)
3052 {
3053 int listener_pipe[2];
3054 int res;
3055 pid_t child;
3056
3057 res = pipe(listener_pipe);
3058 if (res == -1) {
3059 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3060 return false;
3061 }
3062 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
3063 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3064 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
3065 goto fail;
3066 }
3067
3068 child = fork();
3069 if (child == 0) {
3070 NTSTATUS status;
3071
3072 close(listener_pipe[0]);
3073 set_blocking(listener_pipe[1], false);
3074
3075 status = reinit_after_fork(sconn->msg_ctx,
3076 sconn->ev_ctx,
3077 true);
3078 if (!NT_STATUS_IS_OK(status)) {
3079 DEBUG(1, ("reinit_after_fork failed: %s\n",
3080 nt_errstr(status)));
3081 exit(1);
3082 }
3083 smbd_echo_loop(sconn, listener_pipe[1]);
3084 exit(0);
3085 }
3086 close(listener_pipe[1]);
3087 listener_pipe[1] = -1;
3088 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3089
3090 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3091
3092 /*
3093 * Without smb signing this is the same as the normal smbd
3094 * listener. This needs to change once signing comes in.
3095 */
3096 sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3097 sconn,
3098 sconn->smb1.echo_handler.trusted_fd,
3099 TEVENT_FD_READ,
3100 smbd_server_echo_handler,
3101 sconn);
3102 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3103 DEBUG(1, ("event_add_fd failed\n"));
3104 goto fail;
3105 }
3106
3107 return true;
3108
3109 fail:
3110 if (listener_pipe[0] != -1) {
3111 close(listener_pipe[0]);
3112 }
3113 if (listener_pipe[1] != -1) {
3114 close(listener_pipe[1]);
3115 }
3116 sconn->smb1.echo_handler.trusted_fd = -1;
3117 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3118 close(sconn->smb1.echo_handler.socket_lock_fd);
3119 }
3120 sconn->smb1.echo_handler.trusted_fd = -1;
3121 sconn->smb1.echo_handler.socket_lock_fd = -1;
3122 return false;
3123 }
3124
3125 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3126 {
3127 while (user) {
3128 if (user->session_info &&
3129 (user->session_info->unix_token->uid == uid)) {
3130 return true;
3131 }
3132 user = user->next;
3133 }
3134 return false;
3135 }
3136
3137 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3138 {
3139 while (user) {
3140 if (user->session_info != NULL) {
3141 int i;
3142 struct security_unix_token *utok;
3143
3144 utok = user->session_info->unix_token;
3145 if (utok->gid == gid) {
3146 return true;
3147 }
3148 for(i=0; i<utok->ngroups; i++) {
3149 if (utok->groups[i] == gid) {
3150 return true;
3151 }
3152 }
3153 }
3154 user = user->next;
3155 }
3156 return false;
3157 }
3158
3159 static bool sid_in_use(const struct user_struct *user,
3160 const struct dom_sid *psid)
3161 {
3162 while (user) {
3163 struct security_token *tok;
3164
3165 if (user->session_info == NULL) {
3166 continue;
3167 }
3168 tok = user->session_info->security_token;
3169 if (tok == NULL) {
3170 /*
3171 * Not sure session_info->security_token can
3172 * ever be NULL. This check might be not
3173 * necessary.
3174 */
3175 continue;
3176 }
3177 if (security_token_has_sid(tok, psid)) {
3178 return true;
3179 }
3180 user = user->next;
3181 }
3182 return false;
3183 }
3184
3185 static bool id_in_use(const struct user_struct *user,
3186 const struct id_cache_ref *id)
3187 {
3188 switch(id->type) {
3189 case UID:
3190 return uid_in_use(user, id->id.uid);
3191 case GID:
3192 return gid_in_use(user, id->id.gid);
3193 case SID:
3194 return sid_in_use(user, &id->id.sid);
3195 default:
3196 break;
3197 }
3198 return false;
3199 }
3200
3201 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3202 void *private_data,
3203 uint32_t msg_type,
3204 struct server_id server_id,
3205 DATA_BLOB* data)
3206 {
3207 const char *msg = (data && data->data)
3208 ? (const char *)data->data : "<NULL>";
3209 struct id_cache_ref id;
3210 struct smbd_server_connection *sconn =
3211 talloc_get_type_abort(private_data,
3212 struct smbd_server_connection);
3213
3214 if (!id_cache_ref_parse(msg, &id)) {
3215 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3216 return;
3217 }
3218
3219 if (id_in_use(sconn->users, &id)) {
3220 exit_server_cleanly(msg);
3221 }
3222 id_cache_delete_from_cache(&id);
3223 }
3224
3225 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3226 enum protocol_types protocol)
3227 {
3228 NTSTATUS status;
3229
3230 set_Protocol(protocol);
3231 conn->protocol = protocol;
3232
3233 if (protocol >= PROTOCOL_SMB2_02) {
3234 status = smb2srv_session_table_init(conn);
3235 if (!NT_STATUS_IS_OK(status)) {
3236 return status;
3237 }
3238
3239 status = smb2srv_open_table_init(conn);
3240 if (!NT_STATUS_IS_OK(status)) {
3241 return status;
3242 }
3243 } else {
3244 status = smb1srv_session_table_init(conn);
3245 if (!NT_STATUS_IS_OK(status)) {
3246 return status;
3247 }
3248
3249 status = smb1srv_tcon_table_init(conn);
3250 if (!NT_STATUS_IS_OK(status)) {
3251 return status;
3252 }
3253
3254 status = smb1srv_open_table_init(conn);
3255 if (!NT_STATUS_IS_OK(status)) {
3256 return status;
3257 }
3258 }
3259
3260 return NT_STATUS_OK;
3261 }
3262
3263 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3264 void *private_data)
3265 {
3266 struct smbXsrv_connection *conn =
3267 talloc_get_type_abort(private_data,
3268 struct smbXsrv_connection);
3269
3270 switch (point) {
3271 case TEVENT_TRACE_BEFORE_WAIT:
3272 /*
3273 * This just removes compiler warning
3274 * without profile support
3275 */
3276 conn->smbd_idle_profstamp = 0;
3277 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3278 break;
3279 case TEVENT_TRACE_AFTER_WAIT:
3280 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3281 break;
3282 }
3283 }
3284
3285 /****************************************************************************
3286 Process commands from the client
3287 ****************************************************************************/
3288
3289 void smbd_process(struct tevent_context *ev_ctx,
3290 struct messaging_context *msg_ctx,
3291 int sock_fd,
3292 bool interactive)
3293 {
3294 TALLOC_CTX *frame = talloc_stackframe();
3295 struct smbXsrv_connection *conn;
3296 struct smbd_server_connection *sconn;
3297 struct sockaddr_storage ss;
3298 struct sockaddr *sa = NULL;
3299 socklen_t sa_socklen;
3300 struct tsocket_address *local_address = NULL;
3301 struct tsocket_address *remote_address = NULL;
3302 const char *locaddr = NULL;
3303 const char *remaddr = NULL;
3304 char *rhost;
3305 int ret;
3306
3307 conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3308 if (conn == NULL) {
3309 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3310 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3311 }
3312
3313 conn->ev_ctx = ev_ctx;
3314 conn->msg_ctx = msg_ctx;
3315
3316 sconn = talloc_zero(conn, struct smbd_server_connection);
3317 if (!sconn) {
3318 exit_server("failed to create smbd_server_connection");
3319 }
3320
3321 conn->sconn = sconn;
3322 sconn->conn = conn;
3323
3324 /*
3325 * TODO: remove this...:-)
3326 */
3327 global_smbXsrv_connection = conn;
3328
3329 sconn->ev_ctx = ev_ctx;
3330 sconn->msg_ctx = msg_ctx;
3331 sconn->sock = sock_fd;
3332 sconn->smb1.echo_handler.trusted_fd = -1;
3333 sconn->smb1.echo_handler.socket_lock_fd = -1;
3334
3335 if (!interactive) {
3336 smbd_setup_sig_term_handler(sconn);
3337 smbd_setup_sig_hup_handler(sconn);
3338
3339 if (!serverid_register(messaging_server_id(msg_ctx),
3340 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3341 |FLAG_MSG_DBWRAP
3342 |FLAG_MSG_PRINT_GENERAL)) {
3343 exit_server_cleanly("Could not register myself in "
3344 "serverid.tdb");
3345 }
3346 }
3347
3348 if (lp_srv_maxprotocol() >= PROTOCOL_SMB2_02) {
3349 /*
3350 * We're not making the decision here,
3351 * we're just allowing the client
3352 * to decide between SMB1 and SMB2
3353 * with the first negprot
3354 * packet.
3355 */
3356 sconn->using_smb2 = true;
3357 }
3358
3359 /* Ensure child is set to blocking mode */
3360 set_blocking(sconn->sock,True);
3361
3362 set_socket_options(sconn->sock, "SO_KEEPALIVE");
3363 set_socket_options(sconn->sock, lp_socket_options());
3364
3365 sa = (struct sockaddr *)(void *)&ss;
3366 sa_socklen = sizeof(ss);
3367 ret = getpeername(sconn->sock, sa, &sa_socklen);
3368 if (ret != 0) {
3369 int level = (errno == ENOTCONN)?2:0;
3370 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3371 exit_server_cleanly("getpeername() failed.\n");
3372 }
3373 ret = tsocket_address_bsd_from_sockaddr(sconn,
3374 sa, sa_socklen,
3375 &remote_address);
3376 if (ret != 0) {
3377 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3378 __location__, strerror(errno)));
3379 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3380 }
3381
3382 sa = (struct sockaddr *)(void *)&ss;
3383 sa_socklen = sizeof(ss);
3384 ret = getsockname(sconn->sock, sa, &sa_socklen);
3385 if (ret != 0) {
3386 int level = (errno == ENOTCONN)?2:0;
3387 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3388 exit_server_cleanly("getsockname() failed.\n");
3389 }
3390 ret = tsocket_address_bsd_from_sockaddr(sconn,
3391 sa, sa_socklen,
3392 &local_address);
3393 if (ret != 0) {
3394 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3395 __location__, strerror(errno)));
3396 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3397 }
3398
3399 sconn->local_address = local_address;
3400 sconn->remote_address = remote_address;
3401
3402 if (tsocket_address_is_inet(local_address, "ip")) {
3403 locaddr = tsocket_address_inet_addr_string(
3404 sconn->local_address,
3405 talloc_tos());
3406 if (locaddr == NULL) {
3407 DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3408 __location__, strerror(errno)));
3409 exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3410 }
3411 } else {
3412 locaddr = "0.0.0.0";
3413 }
3414
3415 if (tsocket_address_is_inet(remote_address, "ip")) {
3416 remaddr = tsocket_address_inet_addr_string(
3417 sconn->remote_address,
3418 talloc_tos());
3419 if (remaddr == NULL) {
3420 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3421 __location__, strerror(errno)));
3422 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3423 }
3424 } else {
3425 remaddr = "0.0.0.0";
3426 }
3427
3428 /* this is needed so that we get decent entries
3429 in smbstatus for port 445 connects */
3430 set_remote_machine_name(remaddr, false);
3431 reload_services(sconn, conn_snum_used, true);
3432
3433 /*
3434 * Before the first packet, check the global hosts allow/ hosts deny
3435 * parameters before doing any parsing of packets passed to us by the
3436 * client. This prevents attacks on our parsing code from hosts not in
3437 * the hosts allow list.
3438 */
3439
3440 ret = get_remote_hostname(remote_address,
3441 &rhost,
3442 talloc_tos());
3443 if (ret < 0) {
3444 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3445 __location__, strerror(errno)));
3446 exit_server_cleanly("get_remote_hostname failed.\n");
3447 }
3448 if (strequal(rhost, "UNKNOWN")) {
3449 rhost = talloc_strdup(talloc_tos(), remaddr);
3450 }
3451 sconn->remote_hostname = talloc_move(sconn, &rhost);
3452
3453 sub_set_socket_ids(remaddr,
3454 sconn->remote_hostname,
3455 locaddr);
3456
3457 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3458 sconn->remote_hostname,
3459 remaddr)) {
3460 /*
3461 * send a negative session response "not listening on calling
3462 * name"
3463 */
3464 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3465 DEBUG( 1, ("Connection denied from %s to %s\n",
3466 tsocket_address_string(remote_address, talloc_tos()),
3467 tsocket_address_string(local_address, talloc_tos())));
3468 (void)srv_send_smb(sconn,(char *)buf, false,
3469 0, false, NULL);
3470 exit_server_cleanly("connection denied");
3471 }
3472
3473 DEBUG(10, ("Connection allowed from %s to %s\n",
3474 tsocket_address_string(remote_address, talloc_tos()),
3475 tsocket_address_string(local_address, talloc_tos())));
3476
3477 if (lp_preload_modules()) {
3478 smb_load_modules(lp_preload_modules());
3479 }
3480
3481 smb_perfcount_init();
3482
3483 if (!init_account_policy()) {
3484 exit_server("Could not open account policy tdb.\n");
3485 }
3486
3487 if (*lp_rootdir(talloc_tos())) {
3488 if (chroot(lp_rootdir(talloc_tos())) != 0) {
3489 DEBUG(0,("Failed to change root to %s\n",
3490 lp_rootdir(talloc_tos())));
3491 exit_server("Failed to chroot()");
3492 }
3493 if (chdir("/") == -1) {
3494 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir(talloc_tos())));
3495 exit_server("Failed to chroot()");
3496 }
3497 DEBUG(0,("Changed root to %s\n", lp_rootdir(talloc_tos())));
3498 }
3499
3500 if (!srv_init_signing(sconn)) {
3501 exit_server("Failed to init smb_signing");
3502 }
3503
3504 if (!file_init(sconn)) {
3505 exit_server("file_init() failed");
3506 }
3507
3508 /* Setup oplocks */
3509 if (!init_oplocks(sconn))
3510 exit_server("Failed to init oplocks");
3511
3512 /* register our message handlers */
3513 messaging_register(sconn->msg_ctx, sconn,
3514 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3515 messaging_register(sconn->msg_ctx, sconn,
3516 MSG_SMB_CLOSE_FILE, msg_close_file);
3517 messaging_register(sconn->msg_ctx, sconn,
3518 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3519
3520 id_cache_register_msgs(sconn->msg_ctx);
3521 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3522 messaging_register(sconn->msg_ctx, sconn,
3523 ID_CACHE_KILL, smbd_id_cache_kill);
3524
3525 messaging_deregister(sconn->msg_ctx,
3526 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3527 messaging_register(sconn->msg_ctx, sconn,
3528 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3529
3530 /*
3531 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3532 * MSGs to all child processes
3533 */
3534 messaging_deregister(sconn->msg_ctx,
3535 MSG_DEBUG, NULL);
3536 messaging_register(sconn->msg_ctx, NULL,
3537 MSG_DEBUG, debug_message);
3538
3539 if ((lp_keepalive() != 0)
3540 && !(event_add_idle(ev_ctx, NULL,
3541 timeval_set(lp_keepalive(), 0),
3542 "keepalive", keepalive_fn,
3543 sconn))) {
3544 DEBUG(0, ("Could not add keepalive event\n"));
3545 exit(1);
3546 }
3547
3548 if (!(event_add_idle(ev_ctx, NULL,
3549 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3550 "deadtime", deadtime_fn, sconn))) {
3551 DEBUG(0, ("Could not add deadtime event\n"));
3552 exit(1);
3553 }
3554
3555 if (!(event_add_idle(ev_ctx, NULL,
3556 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3557 "housekeeping", housekeeping_fn, sconn))) {
3558 DEBUG(0, ("Could not add housekeeping event\n"));
3559 exit(1);
3560 }
3561
3562 #ifdef CLUSTER_SUPPORT
3563
3564 if (lp_clustering()) {
3565 /*
3566 * We need to tell ctdb about our client's TCP
3567 * connection, so that for failover ctdbd can send
3568 * tickle acks, triggering a reconnection by the
3569 * client.
3570 */
3571
3572 struct sockaddr_storage srv, clnt;
3573
3574 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3575 NTSTATUS status;
3576 status = smbd_register_ips(sconn, &srv, &clnt);
3577 if (!NT_STATUS_IS_OK(status)) {
3578 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3579 nt_errstr(status)));
3580 }
3581 } else {
3582 int level = (errno == ENOTCONN)?2:0;
3583 DEBUG(level,("Unable to get tcp info for "
3584 "smbd_register_ips: %s\n",
3585 strerror(errno)));
3586 exit_server_cleanly("client_get_tcp_info() failed.\n");
3587 }
3588 }
3589
3590 #endif
3591
3592 sconn->nbt.got_session = false;
3593
3594 sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
3595
3596 sconn->smb1.sessions.done_sesssetup = false;
3597 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3598
3599 if (!init_dptrs(sconn)) {
3600 exit_server("init_dptrs() failed");
3601 }
3602
3603 sconn->smb1.fde = tevent_add_fd(ev_ctx,
3604 sconn,
3605 sconn->sock,
3606 TEVENT_FD_READ,
3607 smbd_server_connection_handler,
3608 sconn);
3609 if (!sconn->smb1.fde) {
3610 exit_server("failed to create smbd_server_connection fde");
3611 }
3612
3613 sconn->conn->local_address = sconn->local_address;
3614 sconn->conn->remote_address = sconn->remote_address;
3615 sconn->conn->remote_hostname = sconn->remote_hostname;
3616 sconn->conn->protocol = PROTOCOL_NONE;
3617
3618 TALLOC_FREE(frame);
3619
3620 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3621
3622 while (True) {
3623 frame = talloc_stackframe_pool(8192);
3624
3625 errno = 0;
3626 if (tevent_loop_once(ev_ctx) == -1) {
3627 if (errno != EINTR) {
3628 DEBUG(3, ("tevent_loop_once failed: %s,"
3629 " exiting\n", strerror(errno) ));
3630 break;
3631 }
3632 }
3633
3634 TALLOC_FREE(frame);
3635 }
3636
3637 exit_server_cleanly(NULL);
3638 }
3639
3640 bool req_is_in_chain(const struct smb_request *req)
3641 {
3642 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3643 /*
3644 * We're right now handling a subsequent request, so we must
3645 * be in a chain
3646 */
3647 return true;
3648 }
3649
3650 if (!is_andx_req(req->cmd)) {
3651 return false;
3652 }
3653
3654 if (req->wct < 2) {
3655 /*
3656 * Okay, an illegal request, but definitely not chained :-)
3657 */
3658 return false;
3659 }
3660
3661 return (CVAL(req->vwv+0, 0) != 0xFF);
3662 }
Samba GIT mirror