?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: make release_ip() call (ctdb) cope with IPv4 mapped addresses
[Samba.git] / source3 / smbd / process.c
blob14fa2f846a66feb7829333570d7f19b7337502d4
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23
24 extern bool global_machine_password_needs_changing;
25
26 static void construct_reply_common(struct smb_request *req, const char *inbuf,
27 char *outbuf);
28
29 /* Accessor function for smb_read_error for smbd functions. */
30
31 /****************************************************************************
32 Send an smb to a fd.
33 ****************************************************************************/
34
35 bool srv_send_smb(int fd, char *buffer, bool do_encrypt,
36 struct smb_perfcount_data *pcd)
37 {
38 size_t len = 0;
39 size_t nwritten=0;
40 ssize_t ret;
41 char *buf_out = buffer;
42
43 /* Sign the outgoing packet if required. */
44 srv_calculate_sign_mac(buf_out);
45
46 if (do_encrypt) {
47 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
48 if (!NT_STATUS_IS_OK(status)) {
49 DEBUG(0, ("send_smb: SMB encryption failed "
50 "on outgoing packet! Error %s\n",
51 nt_errstr(status) ));
52 goto out;
53 }
54 }
55
56 len = smb_len(buf_out) + 4;
57
58 while (nwritten < len) {
59 ret = write_data(fd,buf_out+nwritten,len - nwritten);
60 if (ret <= 0) {
61 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
62 (int)len,(int)ret, strerror(errno) ));
63 srv_free_enc_buffer(buf_out);
64 goto out;
65 }
66 nwritten += ret;
67 }
68
69 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
70 srv_free_enc_buffer(buf_out);
71 out:
72 SMB_PERFCOUNT_END(pcd);
73 return true;
74 }
75
76 /*******************************************************************
77 Setup the word count and byte count for a smb message.
78 ********************************************************************/
79
80 int srv_set_message(char *buf,
81 int num_words,
82 int num_bytes,
83 bool zero)
84 {
85 if (zero && (num_words || num_bytes)) {
86 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
87 }
88 SCVAL(buf,smb_wct,num_words);
89 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
90 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
91 return (smb_size + num_words*2 + num_bytes);
92 }
93
94 static bool valid_smb_header(const uint8_t *inbuf)
95 {
96 if (is_encrypted_packet(inbuf)) {
97 return true;
98 }
99 /*
100 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
101 * but it just looks weird to call strncmp for this one.
102 */
103 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
104 }
105
106 /* Socket functions for smbd packet processing. */
107
108 static bool valid_packet_size(size_t len)
109 {
110 /*
111 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
112 * of header. Don't print the error if this fits.... JRA.
113 */
114
115 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
116 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
117 (unsigned long)len));
118 return false;
119 }
120 return true;
121 }
122
123 static NTSTATUS read_packet_remainder(int fd, char *buffer,
124 unsigned int timeout, ssize_t len)
125 {
126 if (len <= 0) {
127 return NT_STATUS_OK;
128 }
129
130 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
131 }
132
133 /****************************************************************************
134 Attempt a zerocopy writeX read. We know here that len > smb_size-4
135 ****************************************************************************/
136
137 /*
138 * Unfortunately, earlier versions of smbclient/libsmbclient
139 * don't send this "standard" writeX header. I've fixed this
140 * for 3.2 but we'll use the old method with earlier versions.
141 * Windows and CIFSFS at least use this standard size. Not
142 * sure about MacOSX.
143 */
144
145 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
146 (2*14) + /* word count (including bcc) */ \
147 1 /* pad byte */)
148
149 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
150 const char lenbuf[4],
151 int fd, char **buffer,
152 unsigned int timeout,
153 size_t *p_unread,
154 size_t *len_ret)
155 {
156 /* Size of a WRITEX call (+4 byte len). */
157 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
158 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
159 ssize_t toread;
160 NTSTATUS status;
161
162 memcpy(writeX_header, lenbuf, 4);
163
164 status = read_socket_with_timeout(
165 fd, writeX_header + 4,
166 STANDARD_WRITE_AND_X_HEADER_SIZE,
167 STANDARD_WRITE_AND_X_HEADER_SIZE,
168 timeout, NULL);
169
170 if (!NT_STATUS_IS_OK(status)) {
171 return status;
172 }
173
174 /*
175 * Ok - now try and see if this is a possible
176 * valid writeX call.
177 */
178
179 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
180 /*
181 * If the data offset is beyond what
182 * we've read, drain the extra bytes.
183 */
184 uint16_t doff = SVAL(writeX_header,smb_vwv11);
185 ssize_t newlen;
186
187 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
188 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
189 if (drain_socket(smbd_server_fd(), drain) != drain) {
190 smb_panic("receive_smb_raw_talloc_partial_read:"
191 " failed to drain pending bytes");
192 }
193 } else {
194 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
195 }
196
197 /* Spoof down the length and null out the bcc. */
198 set_message_bcc(writeX_header, 0);
199 newlen = smb_len(writeX_header);
200
201 /* Copy the header we've written. */
202
203 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
204 writeX_header,
205 sizeof(writeX_header));
206
207 if (*buffer == NULL) {
208 DEBUG(0, ("Could not allocate inbuf of length %d\n",
209 (int)sizeof(writeX_header)));
210 return NT_STATUS_NO_MEMORY;
211 }
212
213 /* Work out the remaining bytes. */
214 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
215 *len_ret = newlen + 4;
216 return NT_STATUS_OK;
217 }
218
219 if (!valid_packet_size(len)) {
220 return NT_STATUS_INVALID_PARAMETER;
221 }
222
223 /*
224 * Not a valid writeX call. Just do the standard
225 * talloc and return.
226 */
227
228 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
229
230 if (*buffer == NULL) {
231 DEBUG(0, ("Could not allocate inbuf of length %d\n",
232 (int)len+4));
233 return NT_STATUS_NO_MEMORY;
234 }
235
236 /* Copy in what we already read. */
237 memcpy(*buffer,
238 writeX_header,
239 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
240 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
241
242 if(toread > 0) {
243 status = read_packet_remainder(
244 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
245 timeout, toread);
246
247 if (!NT_STATUS_IS_OK(status)) {
248 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
249 nt_errstr(status)));
250 return status;
251 }
252 }
253
254 *len_ret = len + 4;
255 return NT_STATUS_OK;
256 }
257
258 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
259 char **buffer, unsigned int timeout,
260 size_t *p_unread, size_t *plen)
261 {
262 char lenbuf[4];
263 size_t len;
264 int min_recv_size = lp_min_receive_file_size();
265 NTSTATUS status;
266
267 *p_unread = 0;
268
269 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
270 if (!NT_STATUS_IS_OK(status)) {
271 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
272 return status;
273 }
274
275 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
276 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
277 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
278 !srv_is_signing_active()) {
279
280 return receive_smb_raw_talloc_partial_read(
281 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
282 }
283
284 if (!valid_packet_size(len)) {
285 return NT_STATUS_INVALID_PARAMETER;
286 }
287
288 /*
289 * The +4 here can't wrap, we've checked the length above already.
290 */
291
292 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
293
294 if (*buffer == NULL) {
295 DEBUG(0, ("Could not allocate inbuf of length %d\n",
296 (int)len+4));
297 return NT_STATUS_NO_MEMORY;
298 }
299
300 memcpy(*buffer, lenbuf, sizeof(lenbuf));
301
302 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
303 if (!NT_STATUS_IS_OK(status)) {
304 return status;
305 }
306
307 *plen = len + 4;
308 return NT_STATUS_OK;
309 }
310
311 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
312 char **buffer, unsigned int timeout,
313 size_t *p_unread, bool *p_encrypted,
314 size_t *p_len)
315 {
316 size_t len = 0;
317 NTSTATUS status;
318
319 *p_encrypted = false;
320
321 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
322 p_unread, &len);
323 if (!NT_STATUS_IS_OK(status)) {
324 return status;
325 }
326
327 if (is_encrypted_packet((uint8_t *)*buffer)) {
328 status = srv_decrypt_buffer(*buffer);
329 if (!NT_STATUS_IS_OK(status)) {
330 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
331 "incoming packet! Error %s\n",
332 nt_errstr(status) ));
333 return status;
334 }
335 *p_encrypted = true;
336 }
337
338 /* Check the incoming SMB signature. */
339 if (!srv_check_sign_mac(*buffer, true)) {
340 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
341 "incoming packet!\n"));
342 return NT_STATUS_INVALID_NETWORK_RESPONSE;
343 }
344
345 *p_len = len;
346 return NT_STATUS_OK;
347 }
348
349 /*
350 * Initialize a struct smb_request from an inbuf
351 */
352
353 void init_smb_request(struct smb_request *req,
354 const uint8 *inbuf,
355 size_t unread_bytes,
356 bool encrypted)
357 {
358 size_t req_size = smb_len(inbuf) + 4;
359 /* Ensure we have at least smb_size bytes. */
360 if (req_size < smb_size) {
361 DEBUG(0,("init_smb_request: invalid request size %u\n",
362 (unsigned int)req_size ));
363 exit_server_cleanly("Invalid SMB request");
364 }
365 req->cmd = CVAL(inbuf, smb_com);
366 req->flags2 = SVAL(inbuf, smb_flg2);
367 req->smbpid = SVAL(inbuf, smb_pid);
368 req->mid = SVAL(inbuf, smb_mid);
369 req->vuid = SVAL(inbuf, smb_uid);
370 req->tid = SVAL(inbuf, smb_tid);
371 req->wct = CVAL(inbuf, smb_wct);
372 req->vwv = (uint16_t *)(inbuf+smb_vwv);
373 req->buflen = smb_buflen(inbuf);
374 req->buf = (const uint8_t *)smb_buf(inbuf);
375 req->unread_bytes = unread_bytes;
376 req->encrypted = encrypted;
377 req->conn = conn_find(req->tid);
378 req->chain_fsp = NULL;
379 req->chain_outbuf = NULL;
380 smb_init_perfcount_data(&req->pcd);
381
382 /* Ensure we have at least wct words and 2 bytes of bcc. */
383 if (smb_size + req->wct*2 > req_size) {
384 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
385 (unsigned int)req->wct,
386 (unsigned int)req_size));
387 exit_server_cleanly("Invalid SMB request");
388 }
389 /* Ensure bcc is correct. */
390 if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
391 DEBUG(0,("init_smb_request: invalid bcc number %u "
392 "(wct = %u, size %u)\n",
393 (unsigned int)req->buflen,
394 (unsigned int)req->wct,
395 (unsigned int)req_size));
396 exit_server_cleanly("Invalid SMB request");
397 }
398
399 req->outbuf = NULL;
400 }
401
402 static void process_smb(struct smbd_server_connection *conn,
403 uint8_t *inbuf, size_t nread, size_t unread_bytes,
404 bool encrypted, struct smb_perfcount_data *deferred_pcd);
405
406 static void smbd_deferred_open_timer(struct event_context *ev,
407 struct timed_event *te,
408 struct timeval _tval,
409 void *private_data)
410 {
411 struct pending_message_list *msg = talloc_get_type(private_data,
412 struct pending_message_list);
413 TALLOC_CTX *mem_ctx = talloc_tos();
414 uint8_t *inbuf;
415
416 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
417 msg->buf.length);
418 if (inbuf == NULL) {
419 exit_server("smbd_deferred_open_timer: talloc failed\n");
420 return;
421 }
422
423 /* We leave this message on the queue so the open code can
424 know this is a retry. */
425 DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
426 (unsigned int)SVAL(msg->buf.data,smb_mid)));
427
428 process_smb(smbd_server_conn, inbuf,
429 msg->buf.length, 0,
430 msg->encrypted, &msg->pcd);
431 }
432
433 /****************************************************************************
434 Function to push a message onto the tail of a linked list of smb messages ready
435 for processing.
436 ****************************************************************************/
437
438 static bool push_queued_message(struct smb_request *req,
439 struct timeval request_time,
440 struct timeval end_time,
441 char *private_data, size_t private_len)
442 {
443 int msg_len = smb_len(req->inbuf) + 4;
444 struct pending_message_list *msg;
445
446 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
447
448 if(msg == NULL) {
449 DEBUG(0,("push_message: malloc fail (1)\n"));
450 return False;
451 }
452
453 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
454 if(msg->buf.data == NULL) {
455 DEBUG(0,("push_message: malloc fail (2)\n"));
456 TALLOC_FREE(msg);
457 return False;
458 }
459
460 msg->request_time = request_time;
461 msg->encrypted = req->encrypted;
462 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
463
464 if (private_data) {
465 msg->private_data = data_blob_talloc(msg, private_data,
466 private_len);
467 if (msg->private_data.data == NULL) {
468 DEBUG(0,("push_message: malloc fail (3)\n"));
469 TALLOC_FREE(msg);
470 return False;
471 }
472 }
473
474 msg->te = event_add_timed(smbd_event_context(),
475 msg,
476 end_time,
477 smbd_deferred_open_timer,
478 msg);
479 if (!msg->te) {
480 DEBUG(0,("push_message: event_add_timed failed\n"));
481 TALLOC_FREE(msg);
482 return false;
483 }
484
485 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
486
487 DEBUG(10,("push_message: pushed message length %u on "
488 "deferred_open_queue\n", (unsigned int)msg_len));
489
490 return True;
491 }
492
493 /****************************************************************************
494 Function to delete a sharing violation open message by mid.
495 ****************************************************************************/
496
497 void remove_deferred_open_smb_message(uint16 mid)
498 {
499 struct pending_message_list *pml;
500
501 for (pml = deferred_open_queue; pml; pml = pml->next) {
502 if (mid == SVAL(pml->buf.data,smb_mid)) {
503 DEBUG(10,("remove_sharing_violation_open_smb_message: "
504 "deleting mid %u len %u\n",
505 (unsigned int)mid,
506 (unsigned int)pml->buf.length ));
507 DLIST_REMOVE(deferred_open_queue, pml);
508 TALLOC_FREE(pml);
509 return;
510 }
511 }
512 }
513
514 /****************************************************************************
515 Move a sharing violation open retry message to the front of the list and
516 schedule it for immediate processing.
517 ****************************************************************************/
518
519 void schedule_deferred_open_smb_message(uint16 mid)
520 {
521 struct pending_message_list *pml;
522 int i = 0;
523
524 for (pml = deferred_open_queue; pml; pml = pml->next) {
525 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
526
527 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
528 (unsigned int)msg_mid ));
529
530 if (mid == msg_mid) {
531 struct timed_event *te;
532
533 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
534 mid ));
535
536 te = event_add_timed(smbd_event_context(),
537 pml,
538 timeval_zero(),
539 smbd_deferred_open_timer,
540 pml);
541 if (!te) {
542 DEBUG(10,("schedule_deferred_open_smb_message: "
543 "event_add_timed() failed, skipping mid %u\n",
544 mid ));
545 }
546
547 TALLOC_FREE(pml->te);
548 pml->te = te;
549 DLIST_PROMOTE(deferred_open_queue, pml);
550 return;
551 }
552 }
553
554 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
555 mid ));
556 }
557
558 /****************************************************************************
559 Return true if this mid is on the deferred queue.
560 ****************************************************************************/
561
562 bool open_was_deferred(uint16 mid)
563 {
564 struct pending_message_list *pml;
565
566 for (pml = deferred_open_queue; pml; pml = pml->next) {
567 if (SVAL(pml->buf.data,smb_mid) == mid) {
568 return True;
569 }
570 }
571 return False;
572 }
573
574 /****************************************************************************
575 Return the message queued by this mid.
576 ****************************************************************************/
577
578 struct pending_message_list *get_open_deferred_message(uint16 mid)
579 {
580 struct pending_message_list *pml;
581
582 for (pml = deferred_open_queue; pml; pml = pml->next) {
583 if (SVAL(pml->buf.data,smb_mid) == mid) {
584 return pml;
585 }
586 }
587 return NULL;
588 }
589
590 /****************************************************************************
591 Function to push a deferred open smb message onto a linked list of local smb
592 messages ready for processing.
593 ****************************************************************************/
594
595 bool push_deferred_smb_message(struct smb_request *req,
596 struct timeval request_time,
597 struct timeval timeout,
598 char *private_data, size_t priv_len)
599 {
600 struct timeval end_time;
601
602 if (req->unread_bytes) {
603 DEBUG(0,("push_deferred_smb_message: logic error ! "
604 "unread_bytes = %u\n",
605 (unsigned int)req->unread_bytes ));
606 smb_panic("push_deferred_smb_message: "
607 "logic error unread_bytes != 0" );
608 }
609
610 end_time = timeval_sum(&request_time, &timeout);
611
612 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
613 "timeout time [%u.%06u]\n",
614 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
615 (unsigned int)end_time.tv_sec,
616 (unsigned int)end_time.tv_usec));
617
618 return push_queued_message(req, request_time, end_time,
619 private_data, priv_len);
620 }
621
622 struct idle_event {
623 struct timed_event *te;
624 struct timeval interval;
625 char *name;
626 bool (*handler)(const struct timeval *now, void *private_data);
627 void *private_data;
628 };
629
630 static void smbd_idle_event_handler(struct event_context *ctx,
631 struct timed_event *te,
632 struct timeval now,
633 void *private_data)
634 {
635 struct idle_event *event =
636 talloc_get_type_abort(private_data, struct idle_event);
637
638 TALLOC_FREE(event->te);
639
640 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
641 event->name, event->te));
642
643 if (!event->handler(&now, event->private_data)) {
644 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
645 event->name, event->te));
646 /* Don't repeat, delete ourselves */
647 TALLOC_FREE(event);
648 return;
649 }
650
651 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
652 event->name, event->te));
653
654 event->te = event_add_timed(ctx, event,
655 timeval_sum(&now, &event->interval),
656 smbd_idle_event_handler, event);
657
658 /* We can't do much but fail here. */
659 SMB_ASSERT(event->te != NULL);
660 }
661
662 struct idle_event *event_add_idle(struct event_context *event_ctx,
663 TALLOC_CTX *mem_ctx,
664 struct timeval interval,
665 const char *name,
666 bool (*handler)(const struct timeval *now,
667 void *private_data),
668 void *private_data)
669 {
670 struct idle_event *result;
671 struct timeval now = timeval_current();
672
673 result = TALLOC_P(mem_ctx, struct idle_event);
674 if (result == NULL) {
675 DEBUG(0, ("talloc failed\n"));
676 return NULL;
677 }
678
679 result->interval = interval;
680 result->handler = handler;
681 result->private_data = private_data;
682
683 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
684 DEBUG(0, ("talloc failed\n"));
685 TALLOC_FREE(result);
686 return NULL;
687 }
688
689 result->te = event_add_timed(event_ctx, result,
690 timeval_sum(&now, &interval),
691 smbd_idle_event_handler, result);
692 if (result->te == NULL) {
693 DEBUG(0, ("event_add_timed failed\n"));
694 TALLOC_FREE(result);
695 return NULL;
696 }
697
698 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
699 return result;
700 }
701
702 static void smbd_sig_term_handler(struct tevent_context *ev,
703 struct tevent_signal *se,
704 int signum,
705 int count,
706 void *siginfo,
707 void *private_data)
708 {
709 exit_server_cleanly("termination signal");
710 }
711
712 void smbd_setup_sig_term_handler(void)
713 {
714 struct tevent_signal *se;
715
716 se = tevent_add_signal(smbd_event_context(),
717 smbd_event_context(),
718 SIGTERM, 0,
719 smbd_sig_term_handler,
720 NULL);
721 if (!se) {
722 exit_server("failed to setup SIGTERM handler");
723 }
724 }
725
726 static void smbd_sig_hup_handler(struct tevent_context *ev,
727 struct tevent_signal *se,
728 int signum,
729 int count,
730 void *siginfo,
731 void *private_data)
732 {
733 change_to_root_user();
734 DEBUG(1,("Reloading services after SIGHUP\n"));
735 reload_services(False);
736 }
737
738 void smbd_setup_sig_hup_handler(void)
739 {
740 struct tevent_signal *se;
741
742 se = tevent_add_signal(smbd_event_context(),
743 smbd_event_context(),
744 SIGHUP, 0,
745 smbd_sig_hup_handler,
746 NULL);
747 if (!se) {
748 exit_server("failed to setup SIGHUP handler");
749 }
750 }
751
752 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
753 {
754 fd_set r_fds, w_fds;
755 int selrtn;
756 struct timeval to;
757 int maxfd = 0;
758
759 to.tv_sec = SMBD_SELECT_TIMEOUT;
760 to.tv_usec = 0;
761
762 /*
763 * Setup the select fd sets.
764 */
765
766 FD_ZERO(&r_fds);
767 FD_ZERO(&w_fds);
768
769 /*
770 * Are there any timed events waiting ? If so, ensure we don't
771 * select for longer than it would take to wait for them.
772 */
773
774 {
775 struct timeval now;
776 GetTimeOfDay(&now);
777
778 event_add_to_select_args(smbd_event_context(), &now,
779 &r_fds, &w_fds, &to, &maxfd);
780 }
781
782 /* Process a signal and timed events now... */
783 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
784 return NT_STATUS_RETRY;
785 }
786
787 {
788 int sav;
789 START_PROFILE(smbd_idle);
790
791 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
792 sav = errno;
793
794 END_PROFILE(smbd_idle);
795 errno = sav;
796 }
797
798 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
799 return NT_STATUS_RETRY;
800 }
801
802 /* Check if error */
803 if (selrtn == -1) {
804 /* something is wrong. Maybe the socket is dead? */
805 return map_nt_error_from_unix(errno);
806 }
807
808 /* Did we timeout ? */
809 if (selrtn == 0) {
810 return NT_STATUS_RETRY;
811 }
812
813 /* should not be reached */
814 return NT_STATUS_INTERNAL_ERROR;
815 }
816
817 /*
818 * Only allow 5 outstanding trans requests. We're allocating memory, so
819 * prevent a DoS.
820 */
821
822 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
823 {
824 int count = 0;
825 for (; list != NULL; list = list->next) {
826
827 if (list->mid == mid) {
828 return NT_STATUS_INVALID_PARAMETER;
829 }
830
831 count += 1;
832 }
833 if (count > 5) {
834 return NT_STATUS_INSUFFICIENT_RESOURCES;
835 }
836
837 return NT_STATUS_OK;
838 }
839
840 /*
841 These flags determine some of the permissions required to do an operation
842
843 Note that I don't set NEED_WRITE on some write operations because they
844 are used by some brain-dead clients when printing, and I don't want to
845 force write permissions on print services.
846 */
847 #define AS_USER (1<<0)
848 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
849 #define TIME_INIT (1<<2)
850 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
851 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
852 #define DO_CHDIR (1<<6)
853
854 /*
855 define a list of possible SMB messages and their corresponding
856 functions. Any message that has a NULL function is unimplemented -
857 please feel free to contribute implementations!
858 */
859 static const struct smb_message_struct {
860 const char *name;
861 void (*fn)(struct smb_request *req);
862 int flags;
863 } smb_messages[256] = {
864
865 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
866 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
867 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
868 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
869 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
870 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
871 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
872 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
873 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
874 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
875 /* 0x0a */ { "SMBread",reply_read,AS_USER},
876 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
877 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
878 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
879 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
880 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
881 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
882 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
883 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
884 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
885 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
886 /* 0x15 */ { NULL, NULL, 0 },
887 /* 0x16 */ { NULL, NULL, 0 },
888 /* 0x17 */ { NULL, NULL, 0 },
889 /* 0x18 */ { NULL, NULL, 0 },
890 /* 0x19 */ { NULL, NULL, 0 },
891 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
892 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
893 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
894 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
895 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
896 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
897 /* 0x20 */ { "SMBwritec", NULL,0},
898 /* 0x21 */ { NULL, NULL, 0 },
899 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
900 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
901 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
902 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
903 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
904 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
905 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
906 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
907 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
908 /* 0x2b */ { "SMBecho",reply_echo,0},
909 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
910 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
911 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
912 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
913 /* 0x30 */ { NULL, NULL, 0 },
914 /* 0x31 */ { NULL, NULL, 0 },
915 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
916 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
917 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
918 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
919 /* 0x36 */ { NULL, NULL, 0 },
920 /* 0x37 */ { NULL, NULL, 0 },
921 /* 0x38 */ { NULL, NULL, 0 },
922 /* 0x39 */ { NULL, NULL, 0 },
923 /* 0x3a */ { NULL, NULL, 0 },
924 /* 0x3b */ { NULL, NULL, 0 },
925 /* 0x3c */ { NULL, NULL, 0 },
926 /* 0x3d */ { NULL, NULL, 0 },
927 /* 0x3e */ { NULL, NULL, 0 },
928 /* 0x3f */ { NULL, NULL, 0 },
929 /* 0x40 */ { NULL, NULL, 0 },
930 /* 0x41 */ { NULL, NULL, 0 },
931 /* 0x42 */ { NULL, NULL, 0 },
932 /* 0x43 */ { NULL, NULL, 0 },
933 /* 0x44 */ { NULL, NULL, 0 },
934 /* 0x45 */ { NULL, NULL, 0 },
935 /* 0x46 */ { NULL, NULL, 0 },
936 /* 0x47 */ { NULL, NULL, 0 },
937 /* 0x48 */ { NULL, NULL, 0 },
938 /* 0x49 */ { NULL, NULL, 0 },
939 /* 0x4a */ { NULL, NULL, 0 },
940 /* 0x4b */ { NULL, NULL, 0 },
941 /* 0x4c */ { NULL, NULL, 0 },
942 /* 0x4d */ { NULL, NULL, 0 },
943 /* 0x4e */ { NULL, NULL, 0 },
944 /* 0x4f */ { NULL, NULL, 0 },
945 /* 0x50 */ { NULL, NULL, 0 },
946 /* 0x51 */ { NULL, NULL, 0 },
947 /* 0x52 */ { NULL, NULL, 0 },
948 /* 0x53 */ { NULL, NULL, 0 },
949 /* 0x54 */ { NULL, NULL, 0 },
950 /* 0x55 */ { NULL, NULL, 0 },
951 /* 0x56 */ { NULL, NULL, 0 },
952 /* 0x57 */ { NULL, NULL, 0 },
953 /* 0x58 */ { NULL, NULL, 0 },
954 /* 0x59 */ { NULL, NULL, 0 },
955 /* 0x5a */ { NULL, NULL, 0 },
956 /* 0x5b */ { NULL, NULL, 0 },
957 /* 0x5c */ { NULL, NULL, 0 },
958 /* 0x5d */ { NULL, NULL, 0 },
959 /* 0x5e */ { NULL, NULL, 0 },
960 /* 0x5f */ { NULL, NULL, 0 },
961 /* 0x60 */ { NULL, NULL, 0 },
962 /* 0x61 */ { NULL, NULL, 0 },
963 /* 0x62 */ { NULL, NULL, 0 },
964 /* 0x63 */ { NULL, NULL, 0 },
965 /* 0x64 */ { NULL, NULL, 0 },
966 /* 0x65 */ { NULL, NULL, 0 },
967 /* 0x66 */ { NULL, NULL, 0 },
968 /* 0x67 */ { NULL, NULL, 0 },
969 /* 0x68 */ { NULL, NULL, 0 },
970 /* 0x69 */ { NULL, NULL, 0 },
971 /* 0x6a */ { NULL, NULL, 0 },
972 /* 0x6b */ { NULL, NULL, 0 },
973 /* 0x6c */ { NULL, NULL, 0 },
974 /* 0x6d */ { NULL, NULL, 0 },
975 /* 0x6e */ { NULL, NULL, 0 },
976 /* 0x6f */ { NULL, NULL, 0 },
977 /* 0x70 */ { "SMBtcon",reply_tcon,0},
978 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
979 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
980 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
981 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
982 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
983 /* 0x76 */ { NULL, NULL, 0 },
984 /* 0x77 */ { NULL, NULL, 0 },
985 /* 0x78 */ { NULL, NULL, 0 },
986 /* 0x79 */ { NULL, NULL, 0 },
987 /* 0x7a */ { NULL, NULL, 0 },
988 /* 0x7b */ { NULL, NULL, 0 },
989 /* 0x7c */ { NULL, NULL, 0 },
990 /* 0x7d */ { NULL, NULL, 0 },
991 /* 0x7e */ { NULL, NULL, 0 },
992 /* 0x7f */ { NULL, NULL, 0 },
993 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
994 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
995 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
996 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
997 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
998 /* 0x85 */ { NULL, NULL, 0 },
999 /* 0x86 */ { NULL, NULL, 0 },
1000 /* 0x87 */ { NULL, NULL, 0 },
1001 /* 0x88 */ { NULL, NULL, 0 },
1002 /* 0x89 */ { NULL, NULL, 0 },
1003 /* 0x8a */ { NULL, NULL, 0 },
1004 /* 0x8b */ { NULL, NULL, 0 },
1005 /* 0x8c */ { NULL, NULL, 0 },
1006 /* 0x8d */ { NULL, NULL, 0 },
1007 /* 0x8e */ { NULL, NULL, 0 },
1008 /* 0x8f */ { NULL, NULL, 0 },
1009 /* 0x90 */ { NULL, NULL, 0 },
1010 /* 0x91 */ { NULL, NULL, 0 },
1011 /* 0x92 */ { NULL, NULL, 0 },
1012 /* 0x93 */ { NULL, NULL, 0 },
1013 /* 0x94 */ { NULL, NULL, 0 },
1014 /* 0x95 */ { NULL, NULL, 0 },
1015 /* 0x96 */ { NULL, NULL, 0 },
1016 /* 0x97 */ { NULL, NULL, 0 },
1017 /* 0x98 */ { NULL, NULL, 0 },
1018 /* 0x99 */ { NULL, NULL, 0 },
1019 /* 0x9a */ { NULL, NULL, 0 },
1020 /* 0x9b */ { NULL, NULL, 0 },
1021 /* 0x9c */ { NULL, NULL, 0 },
1022 /* 0x9d */ { NULL, NULL, 0 },
1023 /* 0x9e */ { NULL, NULL, 0 },
1024 /* 0x9f */ { NULL, NULL, 0 },
1025 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1026 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1027 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1028 /* 0xa3 */ { NULL, NULL, 0 },
1029 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1030 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1031 /* 0xa6 */ { NULL, NULL, 0 },
1032 /* 0xa7 */ { NULL, NULL, 0 },
1033 /* 0xa8 */ { NULL, NULL, 0 },
1034 /* 0xa9 */ { NULL, NULL, 0 },
1035 /* 0xaa */ { NULL, NULL, 0 },
1036 /* 0xab */ { NULL, NULL, 0 },
1037 /* 0xac */ { NULL, NULL, 0 },
1038 /* 0xad */ { NULL, NULL, 0 },
1039 /* 0xae */ { NULL, NULL, 0 },
1040 /* 0xaf */ { NULL, NULL, 0 },
1041 /* 0xb0 */ { NULL, NULL, 0 },
1042 /* 0xb1 */ { NULL, NULL, 0 },
1043 /* 0xb2 */ { NULL, NULL, 0 },
1044 /* 0xb3 */ { NULL, NULL, 0 },
1045 /* 0xb4 */ { NULL, NULL, 0 },
1046 /* 0xb5 */ { NULL, NULL, 0 },
1047 /* 0xb6 */ { NULL, NULL, 0 },
1048 /* 0xb7 */ { NULL, NULL, 0 },
1049 /* 0xb8 */ { NULL, NULL, 0 },
1050 /* 0xb9 */ { NULL, NULL, 0 },
1051 /* 0xba */ { NULL, NULL, 0 },
1052 /* 0xbb */ { NULL, NULL, 0 },
1053 /* 0xbc */ { NULL, NULL, 0 },
1054 /* 0xbd */ { NULL, NULL, 0 },
1055 /* 0xbe */ { NULL, NULL, 0 },
1056 /* 0xbf */ { NULL, NULL, 0 },
1057 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1058 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1059 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1060 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1061 /* 0xc4 */ { NULL, NULL, 0 },
1062 /* 0xc5 */ { NULL, NULL, 0 },
1063 /* 0xc6 */ { NULL, NULL, 0 },
1064 /* 0xc7 */ { NULL, NULL, 0 },
1065 /* 0xc8 */ { NULL, NULL, 0 },
1066 /* 0xc9 */ { NULL, NULL, 0 },
1067 /* 0xca */ { NULL, NULL, 0 },
1068 /* 0xcb */ { NULL, NULL, 0 },
1069 /* 0xcc */ { NULL, NULL, 0 },
1070 /* 0xcd */ { NULL, NULL, 0 },
1071 /* 0xce */ { NULL, NULL, 0 },
1072 /* 0xcf */ { NULL, NULL, 0 },
1073 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1074 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1075 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1076 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1077 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1078 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1079 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1080 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1081 /* 0xd8 */ { NULL, NULL, 0 },
1082 /* 0xd9 */ { NULL, NULL, 0 },
1083 /* 0xda */ { NULL, NULL, 0 },
1084 /* 0xdb */ { NULL, NULL, 0 },
1085 /* 0xdc */ { NULL, NULL, 0 },
1086 /* 0xdd */ { NULL, NULL, 0 },
1087 /* 0xde */ { NULL, NULL, 0 },
1088 /* 0xdf */ { NULL, NULL, 0 },
1089 /* 0xe0 */ { NULL, NULL, 0 },
1090 /* 0xe1 */ { NULL, NULL, 0 },
1091 /* 0xe2 */ { NULL, NULL, 0 },
1092 /* 0xe3 */ { NULL, NULL, 0 },
1093 /* 0xe4 */ { NULL, NULL, 0 },
1094 /* 0xe5 */ { NULL, NULL, 0 },
1095 /* 0xe6 */ { NULL, NULL, 0 },
1096 /* 0xe7 */ { NULL, NULL, 0 },
1097 /* 0xe8 */ { NULL, NULL, 0 },
1098 /* 0xe9 */ { NULL, NULL, 0 },
1099 /* 0xea */ { NULL, NULL, 0 },
1100 /* 0xeb */ { NULL, NULL, 0 },
1101 /* 0xec */ { NULL, NULL, 0 },
1102 /* 0xed */ { NULL, NULL, 0 },
1103 /* 0xee */ { NULL, NULL, 0 },
1104 /* 0xef */ { NULL, NULL, 0 },
1105 /* 0xf0 */ { NULL, NULL, 0 },
1106 /* 0xf1 */ { NULL, NULL, 0 },
1107 /* 0xf2 */ { NULL, NULL, 0 },
1108 /* 0xf3 */ { NULL, NULL, 0 },
1109 /* 0xf4 */ { NULL, NULL, 0 },
1110 /* 0xf5 */ { NULL, NULL, 0 },
1111 /* 0xf6 */ { NULL, NULL, 0 },
1112 /* 0xf7 */ { NULL, NULL, 0 },
1113 /* 0xf8 */ { NULL, NULL, 0 },
1114 /* 0xf9 */ { NULL, NULL, 0 },
1115 /* 0xfa */ { NULL, NULL, 0 },
1116 /* 0xfb */ { NULL, NULL, 0 },
1117 /* 0xfc */ { NULL, NULL, 0 },
1118 /* 0xfd */ { NULL, NULL, 0 },
1119 /* 0xfe */ { NULL, NULL, 0 },
1120 /* 0xff */ { NULL, NULL, 0 }
1121
1122 };
1123
1124 /*******************************************************************
1125 allocate and initialize a reply packet
1126 ********************************************************************/
1127
1128 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1129 const char *inbuf, char **outbuf, uint8_t num_words,
1130 uint32_t num_bytes)
1131 {
1132 /*
1133 * Protect against integer wrap
1134 */
1135 if ((num_bytes > 0xffffff)
1136 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1137 char *msg;
1138 if (asprintf(&msg, "num_bytes too large: %u",
1139 (unsigned)num_bytes) == -1) {
1140 msg = CONST_DISCARD(char *, "num_bytes too large");
1141 }
1142 smb_panic(msg);
1143 }
1144
1145 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1146 smb_size + num_words*2 + num_bytes);
1147 if (*outbuf == NULL) {
1148 return false;
1149 }
1150
1151 construct_reply_common(req, inbuf, *outbuf);
1152 srv_set_message(*outbuf, num_words, num_bytes, false);
1153 /*
1154 * Zero out the word area, the caller has to take care of the bcc area
1155 * himself
1156 */
1157 if (num_words != 0) {
1158 memset(*outbuf + smb_vwv0, 0, num_words*2);
1159 }
1160
1161 return true;
1162 }
1163
1164 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1165 {
1166 char *outbuf;
1167 if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1168 num_bytes)) {
1169 smb_panic("could not allocate output buffer\n");
1170 }
1171 req->outbuf = (uint8_t *)outbuf;
1172 }
1173
1174
1175 /*******************************************************************
1176 Dump a packet to a file.
1177 ********************************************************************/
1178
1179 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1180 {
1181 int fd, i;
1182 char *fname = NULL;
1183 if (DEBUGLEVEL < 50) {
1184 return;
1185 }
1186
1187 if (len < 4) len = smb_len(data)+4;
1188 for (i=1;i<100;i++) {
1189 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1190 type ? "req" : "resp") == -1) {
1191 return;
1192 }
1193 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1194 if (fd != -1 || errno != EEXIST) break;
1195 }
1196 if (fd != -1) {
1197 ssize_t ret = write(fd, data, len);
1198 if (ret != len)
1199 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1200 close(fd);
1201 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1202 }
1203 SAFE_FREE(fname);
1204 }
1205
1206 /****************************************************************************
1207 Prepare everything for calling the actual request function, and potentially
1208 call the request function via the "new" interface.
1209
1210 Return False if the "legacy" function needs to be called, everything is
1211 prepared.
1212
1213 Return True if we're done.
1214
1215 I know this API sucks, but it is the one with the least code change I could
1216 find.
1217 ****************************************************************************/
1218
1219 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1220 {
1221 int flags;
1222 uint16 session_tag;
1223 connection_struct *conn = NULL;
1224
1225 errno = 0;
1226
1227 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1228 * so subtract 4 from it. */
1229 if (!valid_smb_header(req->inbuf)
1230 || (size < (smb_size - 4))) {
1231 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1232 smb_len(req->inbuf)));
1233 exit_server_cleanly("Non-SMB packet");
1234 }
1235
1236 if (smb_messages[type].fn == NULL) {
1237 DEBUG(0,("Unknown message type %d!\n",type));
1238 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1239 reply_unknown_new(req, type);
1240 return NULL;
1241 }
1242
1243 flags = smb_messages[type].flags;
1244
1245 /* In share mode security we must ignore the vuid. */
1246 session_tag = (lp_security() == SEC_SHARE)
1247 ? UID_FIELD_INVALID : req->vuid;
1248 conn = req->conn;
1249
1250 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1251 (int)sys_getpid(), (unsigned long)conn));
1252
1253 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1254
1255 /* Ensure this value is replaced in the incoming packet. */
1256 SSVAL(req->inbuf,smb_uid,session_tag);
1257
1258 /*
1259 * Ensure the correct username is in current_user_info. This is a
1260 * really ugly bugfix for problems with multiple session_setup_and_X's
1261 * being done and allowing %U and %G substitutions to work correctly.
1262 * There is a reason this code is done here, don't move it unless you
1263 * know what you're doing... :-).
1264 * JRA.
1265 */
1266
1267 if (session_tag != last_session_tag) {
1268 user_struct *vuser = NULL;
1269
1270 last_session_tag = session_tag;
1271 if(session_tag != UID_FIELD_INVALID) {
1272 vuser = get_valid_user_struct(session_tag);
1273 if (vuser) {
1274 set_current_user_info(
1275 vuser->server_info->sanitized_username,
1276 vuser->server_info->unix_name,
1277 pdb_get_domain(vuser->server_info
1278 ->sam_account));
1279 }
1280 }
1281 }
1282
1283 /* Does this call need to be run as the connected user? */
1284 if (flags & AS_USER) {
1285
1286 /* Does this call need a valid tree connection? */
1287 if (!conn) {
1288 /*
1289 * Amazingly, the error code depends on the command
1290 * (from Samba4).
1291 */
1292 if (type == SMBntcreateX) {
1293 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1294 } else {
1295 reply_doserror(req, ERRSRV, ERRinvnid);
1296 }
1297 return NULL;
1298 }
1299
1300 if (!change_to_user(conn,session_tag)) {
1301 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1302 remove_deferred_open_smb_message(req->mid);
1303 return conn;
1304 }
1305
1306 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1307
1308 /* Does it need write permission? */
1309 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1310 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1311 return conn;
1312 }
1313
1314 /* IPC services are limited */
1315 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1316 reply_doserror(req, ERRSRV,ERRaccess);
1317 return conn;
1318 }
1319 } else {
1320 /* This call needs to be run as root */
1321 change_to_root_user();
1322 }
1323
1324 /* load service specific parameters */
1325 if (conn) {
1326 if (req->encrypted) {
1327 conn->encrypted_tid = true;
1328 /* encrypted required from now on. */
1329 conn->encrypt_level = Required;
1330 } else if (ENCRYPTION_REQUIRED(conn)) {
1331 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1332 exit_server_cleanly("encryption required "
1333 "on connection");
1334 return conn;
1335 }
1336 }
1337
1338 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1339 (flags & (AS_USER|DO_CHDIR)
1340 ?True:False))) {
1341 reply_doserror(req, ERRSRV, ERRaccess);
1342 return conn;
1343 }
1344 conn->num_smb_operations++;
1345 }
1346
1347 /* does this protocol need to be run as guest? */
1348 if ((flags & AS_GUEST)
1349 && (!change_to_guest() ||
1350 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1351 lp_hostsdeny(-1)))) {
1352 reply_doserror(req, ERRSRV, ERRaccess);
1353 return conn;
1354 }
1355
1356 smb_messages[type].fn(req);
1357 return req->conn;
1358 }
1359
1360 /****************************************************************************
1361 Construct a reply to the incoming packet.
1362 ****************************************************************************/
1363
1364 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1365 bool encrypted,
1366 struct smb_perfcount_data *deferred_pcd)
1367 {
1368 connection_struct *conn;
1369 struct smb_request *req;
1370
1371 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1372 smb_panic("could not allocate smb_request");
1373 }
1374
1375 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1376 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1377
1378 /* we popped this message off the queue - keep original perf data */
1379 if (deferred_pcd)
1380 req->pcd = *deferred_pcd;
1381 else {
1382 SMB_PERFCOUNT_START(&req->pcd);
1383 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1384 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1385 }
1386
1387 conn = switch_message(req->cmd, req, size);
1388
1389 if (req->unread_bytes) {
1390 /* writeX failed. drain socket. */
1391 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1392 req->unread_bytes) {
1393 smb_panic("failed to drain pending bytes");
1394 }
1395 req->unread_bytes = 0;
1396 }
1397
1398 if (req->outbuf == NULL) {
1399 return;
1400 }
1401
1402 if (CVAL(req->outbuf,0) == 0) {
1403 show_msg((char *)req->outbuf);
1404 }
1405
1406 if (!srv_send_smb(smbd_server_fd(),
1407 (char *)req->outbuf,
1408 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1409 &req->pcd)) {
1410 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1411 }
1412
1413 TALLOC_FREE(req);
1414
1415 return;
1416 }
1417
1418 /****************************************************************************
1419 Process an smb from the client
1420 ****************************************************************************/
1421 static void process_smb(struct smbd_server_connection *conn,
1422 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1423 bool encrypted, struct smb_perfcount_data *deferred_pcd)
1424 {
1425 int msg_type = CVAL(inbuf,0);
1426
1427 DO_PROFILE_INC(smb_count);
1428
1429 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1430 smb_len(inbuf) ) );
1431 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1432 (int)nread,
1433 (unsigned int)unread_bytes ));
1434
1435 if (msg_type != 0) {
1436 /*
1437 * NetBIOS session request, keepalive, etc.
1438 */
1439 reply_special((char *)inbuf);
1440 goto done;
1441 }
1442
1443 show_msg((char *)inbuf);
1444
1445 construct_reply((char *)inbuf,nread,unread_bytes,encrypted,deferred_pcd);
1446 trans_num++;
1447
1448 done:
1449 conn->num_requests++;
1450
1451 /* The timeout_processing function isn't run nearly
1452 often enough to implement 'max log size' without
1453 overrunning the size of the file by many megabytes.
1454 This is especially true if we are running at debug
1455 level 10. Checking every 50 SMBs is a nice
1456 tradeoff of performance vs log file size overrun. */
1457
1458 if ((conn->num_requests % 50) == 0 &&
1459 need_to_check_log_size()) {
1460 change_to_root_user();
1461 check_log_size();
1462 }
1463 }
1464
1465 /****************************************************************************
1466 Return a string containing the function name of a SMB command.
1467 ****************************************************************************/
1468
1469 const char *smb_fn_name(int type)
1470 {
1471 const char *unknown_name = "SMBunknown";
1472
1473 if (smb_messages[type].name == NULL)
1474 return(unknown_name);
1475
1476 return(smb_messages[type].name);
1477 }
1478
1479 /****************************************************************************
1480 Helper functions for contruct_reply.
1481 ****************************************************************************/
1482
1483 void add_to_common_flags2(uint32 v)
1484 {
1485 common_flags2 |= v;
1486 }
1487
1488 void remove_from_common_flags2(uint32 v)
1489 {
1490 common_flags2 &= ~v;
1491 }
1492
1493 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1494 char *outbuf)
1495 {
1496 srv_set_message(outbuf,0,0,false);
1497
1498 SCVAL(outbuf, smb_com, req->cmd);
1499 SIVAL(outbuf,smb_rcls,0);
1500 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1501 SSVAL(outbuf,smb_flg2,
1502 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1503 common_flags2);
1504 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1505
1506 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1507 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1508 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1509 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1510 }
1511
1512 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1513 {
1514 construct_reply_common(req, (char *)req->inbuf, outbuf);
1515 }
1516
1517 /*
1518 * How many bytes have we already accumulated up to the current wct field
1519 * offset?
1520 */
1521
1522 size_t req_wct_ofs(struct smb_request *req)
1523 {
1524 size_t buf_size;
1525
1526 if (req->chain_outbuf == NULL) {
1527 return smb_wct - 4;
1528 }
1529 buf_size = talloc_get_size(req->chain_outbuf);
1530 if ((buf_size % 4) != 0) {
1531 buf_size += (4 - (buf_size % 4));
1532 }
1533 return buf_size - 4;
1534 }
1535
1536 /*
1537 * Hack around reply_nterror & friends not being aware of chained requests,
1538 * generating illegal (i.e. wct==0) chain replies.
1539 */
1540
1541 static void fixup_chain_error_packet(struct smb_request *req)
1542 {
1543 uint8_t *outbuf = req->outbuf;
1544 req->outbuf = NULL;
1545 reply_outbuf(req, 2, 0);
1546 memcpy(req->outbuf, outbuf, smb_wct);
1547 TALLOC_FREE(outbuf);
1548 SCVAL(req->outbuf, smb_vwv0, 0xff);
1549 }
1550
1551 /****************************************************************************
1552 Construct a chained reply and add it to the already made reply
1553 ****************************************************************************/
1554
1555 void chain_reply(struct smb_request *req)
1556 {
1557 size_t smblen = smb_len(req->inbuf);
1558 size_t already_used, length_needed;
1559 uint8_t chain_cmd;
1560 uint32_t chain_offset; /* uint32_t to avoid overflow */
1561
1562 uint8_t wct;
1563 uint16_t *vwv;
1564 uint16_t buflen;
1565 uint8_t *buf;
1566
1567 if (IVAL(req->outbuf, smb_rcls) != 0) {
1568 fixup_chain_error_packet(req);
1569 }
1570
1571 /*
1572 * Any of the AndX requests and replies have at least a wct of
1573 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1574 * beginning of the SMB header to the next wct field.
1575 *
1576 * None of the AndX requests put anything valuable in vwv[0] and [1],
1577 * so we can overwrite it here to form the chain.
1578 */
1579
1580 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1581 goto error;
1582 }
1583
1584 /*
1585 * Here we assume that this is the end of the chain. For that we need
1586 * to set "next command" to 0xff and the offset to 0. If we later find
1587 * more commands in the chain, this will be overwritten again.
1588 */
1589
1590 SCVAL(req->outbuf, smb_vwv0, 0xff);
1591 SCVAL(req->outbuf, smb_vwv0+1, 0);
1592 SSVAL(req->outbuf, smb_vwv1, 0);
1593
1594 if (req->chain_outbuf == NULL) {
1595 /*
1596 * In req->chain_outbuf we collect all the replies. Start the
1597 * chain by copying in the first reply.
1598 *
1599 * We do the realloc because later on we depend on
1600 * talloc_get_size to determine the length of
1601 * chain_outbuf. The reply_xxx routines might have
1602 * over-allocated (reply_pipe_read_and_X used to be such an
1603 * example).
1604 */
1605 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1606 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1607 if (req->chain_outbuf == NULL) {
1608 goto error;
1609 }
1610 req->outbuf = NULL;
1611 } else {
1612 /*
1613 * Update smb headers where subsequent chained commands
1614 * may have updated them.
1615 */
1616 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
1617 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
1618
1619 if (!smb_splice_chain(&req->chain_outbuf,
1620 CVAL(req->outbuf, smb_com),
1621 CVAL(req->outbuf, smb_wct),
1622 (uint16_t *)(req->outbuf + smb_vwv),
1623 0, smb_buflen(req->outbuf),
1624 (uint8_t *)smb_buf(req->outbuf))) {
1625 goto error;
1626 }
1627 TALLOC_FREE(req->outbuf);
1628 }
1629
1630 /*
1631 * We use the old request's vwv field to grab the next chained command
1632 * and offset into the chained fields.
1633 */
1634
1635 chain_cmd = CVAL(req->vwv+0, 0);
1636 chain_offset = SVAL(req->vwv+1, 0);
1637
1638 if (chain_cmd == 0xff) {
1639 /*
1640 * End of chain, no more requests from the client. So ship the
1641 * replies.
1642 */
1643 smb_setlen((char *)(req->chain_outbuf),
1644 talloc_get_size(req->chain_outbuf) - 4);
1645
1646 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1647 IS_CONN_ENCRYPTED(req->conn)
1648 ||req->encrypted,
1649 &req->pcd)) {
1650 exit_server_cleanly("chain_reply: srv_send_smb "
1651 "failed.");
1652 }
1653 TALLOC_FREE(req);
1654
1655 return;
1656 }
1657
1658 /* add a new perfcounter for this element of chain */
1659 SMB_PERFCOUNT_ADD(&req->pcd);
1660 SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
1661 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
1662
1663 /*
1664 * Check if the client tries to fool us. The request so far uses the
1665 * space to the end of the byte buffer in the request just
1666 * processed. The chain_offset can't point into that area. If that was
1667 * the case, we could end up with an endless processing of the chain,
1668 * we would always handle the same request.
1669 */
1670
1671 already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1672 if (chain_offset < already_used) {
1673 goto error;
1674 }
1675
1676 /*
1677 * Next check: Make sure the chain offset does not point beyond the
1678 * overall smb request length.
1679 */
1680
1681 length_needed = chain_offset+1; /* wct */
1682 if (length_needed > smblen) {
1683 goto error;
1684 }
1685
1686 /*
1687 * Now comes the pointer magic. Goal here is to set up req->vwv and
1688 * req->buf correctly again to be able to call the subsequent
1689 * switch_message(). The chain offset (the former vwv[1]) points at
1690 * the new wct field.
1691 */
1692
1693 wct = CVAL(smb_base(req->inbuf), chain_offset);
1694
1695 /*
1696 * Next consistency check: Make the new vwv array fits in the overall
1697 * smb request.
1698 */
1699
1700 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1701 if (length_needed > smblen) {
1702 goto error;
1703 }
1704 vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1705
1706 /*
1707 * Now grab the new byte buffer....
1708 */
1709
1710 buflen = SVAL(vwv+wct, 0);
1711
1712 /*
1713 * .. and check that it fits.
1714 */
1715
1716 length_needed += buflen;
1717 if (length_needed > smblen) {
1718 goto error;
1719 }
1720 buf = (uint8_t *)(vwv+wct+1);
1721
1722 req->cmd = chain_cmd;
1723 req->wct = wct;
1724 req->vwv = vwv;
1725 req->buflen = buflen;
1726 req->buf = buf;
1727
1728 switch_message(chain_cmd, req, smblen);
1729
1730 if (req->outbuf == NULL) {
1731 /*
1732 * This happens if the chained command has suspended itself or
1733 * if it has called srv_send_smb() itself.
1734 */
1735 return;
1736 }
1737
1738 /*
1739 * We end up here if the chained command was not itself chained or
1740 * suspended, but for example a close() command. We now need to splice
1741 * the chained commands' outbuf into the already built up chain_outbuf
1742 * and ship the result.
1743 */
1744 goto done;
1745
1746 error:
1747 /*
1748 * We end up here if there's any error in the chain syntax. Report a
1749 * DOS error, just like Windows does.
1750 */
1751 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
1752 fixup_chain_error_packet(req);
1753
1754 done:
1755 if (!smb_splice_chain(&req->chain_outbuf,
1756 CVAL(req->outbuf, smb_com),
1757 CVAL(req->outbuf, smb_wct),
1758 (uint16_t *)(req->outbuf + smb_vwv),
1759 0, smb_buflen(req->outbuf),
1760 (uint8_t *)smb_buf(req->outbuf))) {
1761 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
1762 }
1763 TALLOC_FREE(req->outbuf);
1764
1765 smb_setlen((char *)(req->chain_outbuf),
1766 talloc_get_size(req->chain_outbuf) - 4);
1767
1768 show_msg((char *)(req->chain_outbuf));
1769
1770 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1771 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
1772 &req->pcd)) {
1773 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1774 }
1775 TALLOC_FREE(req);
1776 }
1777
1778 /****************************************************************************
1779 Check if services need reloading.
1780 ****************************************************************************/
1781
1782 void check_reload(time_t t)
1783 {
1784 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1785
1786 if(last_smb_conf_reload_time == 0) {
1787 last_smb_conf_reload_time = t;
1788 /* Our printing subsystem might not be ready at smbd start up.
1789 Then no printer is available till the first printers check
1790 is performed. A lower initial interval circumvents this. */
1791 if ( printcap_cache_time > 60 )
1792 last_printer_reload_time = t - printcap_cache_time + 60;
1793 else
1794 last_printer_reload_time = t;
1795 }
1796
1797 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1798 /* randomize over 60 second the printcap reload to avoid all
1799 * process hitting cupsd at the same time */
1800 int time_range = 60;
1801
1802 last_printer_reload_time += random() % time_range;
1803 mypid = getpid();
1804 }
1805
1806 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
1807 reload_services(True);
1808 last_smb_conf_reload_time = t;
1809 }
1810
1811 /* 'printcap cache time = 0' disable the feature */
1812
1813 if ( printcap_cache_time != 0 )
1814 {
1815 /* see if it's time to reload or if the clock has been set back */
1816
1817 if ( (t >= last_printer_reload_time+printcap_cache_time)
1818 || (t-last_printer_reload_time < 0) )
1819 {
1820 DEBUG( 3,( "Printcap cache time expired.\n"));
1821 reload_printers();
1822 last_printer_reload_time = t;
1823 }
1824 }
1825 }
1826
1827 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
1828 {
1829 /* TODO: make write nonblocking */
1830 }
1831
1832 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
1833 {
1834 uint8_t *inbuf = NULL;
1835 size_t inbuf_len = 0;
1836 size_t unread_bytes = 0;
1837 bool encrypted = false;
1838 TALLOC_CTX *mem_ctx = talloc_tos();
1839 NTSTATUS status;
1840
1841 /* TODO: make this completely nonblocking */
1842
1843 status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
1844 (char **)(void *)&inbuf,
1845 0, /* timeout */
1846 &unread_bytes,
1847 &encrypted,
1848 &inbuf_len);
1849 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1850 goto process;
1851 }
1852 if (NT_STATUS_IS_ERR(status)) {
1853 exit_server_cleanly("failed to receive smb request");
1854 }
1855 if (!NT_STATUS_IS_OK(status)) {
1856 return;
1857 }
1858
1859 process:
1860 process_smb(conn, inbuf, inbuf_len, unread_bytes, encrypted, NULL);
1861 }
1862
1863 static void smbd_server_connection_handler(struct event_context *ev,
1864 struct fd_event *fde,
1865 uint16_t flags,
1866 void *private_data)
1867 {
1868 struct smbd_server_connection *conn = talloc_get_type(private_data,
1869 struct smbd_server_connection);
1870
1871 if (flags & EVENT_FD_WRITE) {
1872 smbd_server_connection_write_handler(conn);
1873 } else if (flags & EVENT_FD_READ) {
1874 smbd_server_connection_read_handler(conn);
1875 }
1876 }
1877
1878
1879 /****************************************************************************
1880 received when we should release a specific IP
1881 ****************************************************************************/
1882 static void release_ip(const char *ip, void *priv)
1883 {
1884 char addr[INET6_ADDRSTRLEN];
1885 char *p;
1886
1887 client_socket_addr(get_client_fd(),addr,sizeof(addr));
1888
1889 if (strncmp("::ffff:", addr, 7) == 0) {
1890 p = addr + 7;
1891 }
1892
1893 if ((strcmp(p, ip) == 0) || (strcmp(addr, ip) == 0)) {
1894 /* we can't afford to do a clean exit - that involves
1895 database writes, which would potentially mean we
1896 are still running after the failover has finished -
1897 we have to get rid of this process ID straight
1898 away */
1899 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
1900 ip));
1901 /* note we must exit with non-zero status so the unclean handler gets
1902 called in the parent, so that the brl database is tickled */
1903 _exit(1);
1904 }
1905 }
1906
1907 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
1908 uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
1909 {
1910 release_ip((char *)data->data, NULL);
1911 }
1912
1913 #ifdef CLUSTER_SUPPORT
1914 static int client_get_tcp_info(struct sockaddr_storage *server,
1915 struct sockaddr_storage *client)
1916 {
1917 socklen_t length;
1918 if (server_fd == -1) {
1919 return -1;
1920 }
1921 length = sizeof(*server);
1922 if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
1923 return -1;
1924 }
1925 length = sizeof(*client);
1926 if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
1927 return -1;
1928 }
1929 return 0;
1930 }
1931 #endif
1932
1933 /*
1934 * Send keepalive packets to our client
1935 */
1936 static bool keepalive_fn(const struct timeval *now, void *private_data)
1937 {
1938 if (!send_keepalive(smbd_server_fd())) {
1939 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1940 return False;
1941 }
1942 return True;
1943 }
1944
1945 /*
1946 * Do the recurring check if we're idle
1947 */
1948 static bool deadtime_fn(const struct timeval *now, void *private_data)
1949 {
1950 if ((conn_num_open() == 0)
1951 || (conn_idle_all(now->tv_sec))) {
1952 DEBUG( 2, ( "Closing idle connection\n" ) );
1953 messaging_send(smbd_messaging_context(), procid_self(),
1954 MSG_SHUTDOWN, &data_blob_null);
1955 return False;
1956 }
1957
1958 return True;
1959 }
1960
1961 /*
1962 * Do the recurring log file and smb.conf reload checks.
1963 */
1964
1965 static bool housekeeping_fn(const struct timeval *now, void *private_data)
1966 {
1967 change_to_root_user();
1968
1969 /* update printer queue caches if necessary */
1970 update_monitored_printq_cache();
1971
1972 /* check if we need to reload services */
1973 check_reload(time(NULL));
1974
1975 /* Change machine password if neccessary. */
1976 attempt_machine_password_change();
1977
1978 /*
1979 * Force a log file check.
1980 */
1981 force_check_log_size();
1982 check_log_size();
1983 return true;
1984 }
1985
1986 /****************************************************************************
1987 Process commands from the client
1988 ****************************************************************************/
1989
1990 void smbd_process(void)
1991 {
1992 TALLOC_CTX *frame = talloc_stackframe();
1993 char remaddr[INET6_ADDRSTRLEN];
1994
1995 smbd_server_conn = talloc_zero(smbd_event_context(), struct smbd_server_connection);
1996 if (!smbd_server_conn) {
1997 exit_server("failed to create smbd_server_connection");
1998 }
1999
2000 /* Ensure child is set to blocking mode */
2001 set_blocking(smbd_server_fd(),True);
2002
2003 set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2004 set_socket_options(smbd_server_fd(), lp_socket_options());
2005
2006 /* this is needed so that we get decent entries
2007 in smbstatus for port 445 connects */
2008 set_remote_machine_name(get_peer_addr(smbd_server_fd(),
2009 remaddr,
2010 sizeof(remaddr)),
2011 false);
2012 reload_services(true);
2013
2014 /*
2015 * Before the first packet, check the global hosts allow/ hosts deny
2016 * parameters before doing any parsing of packets passed to us by the
2017 * client. This prevents attacks on our parsing code from hosts not in
2018 * the hosts allow list.
2019 */
2020
2021 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2022 lp_hostsdeny(-1))) {
2023 char addr[INET6_ADDRSTRLEN];
2024
2025 /*
2026 * send a negative session response "not listening on calling
2027 * name"
2028 */
2029 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2030 DEBUG( 1, ("Connection denied from %s\n",
2031 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
2032 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false, NULL);
2033 exit_server_cleanly("connection denied");
2034 }
2035
2036 static_init_rpc;
2037
2038 init_modules();
2039
2040 smb_perfcount_init();
2041
2042 if (!init_account_policy()) {
2043 exit_server("Could not open account policy tdb.\n");
2044 }
2045
2046 if (*lp_rootdir()) {
2047 if (chroot(lp_rootdir()) != 0) {
2048 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2049 exit_server("Failed to chroot()");
2050 }
2051 if (chdir("/") == -1) {
2052 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2053 exit_server("Failed to chroot()");
2054 }
2055 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2056 }
2057
2058 /* Setup oplocks */
2059 if (!init_oplocks(smbd_messaging_context()))
2060 exit_server("Failed to init oplocks");
2061
2062 /* Setup aio signal handler. */
2063 initialize_async_io_handler();
2064
2065 /* register our message handlers */
2066 messaging_register(smbd_messaging_context(), NULL,
2067 MSG_SMB_FORCE_TDIS, msg_force_tdis);
2068 messaging_register(smbd_messaging_context(), NULL,
2069 MSG_SMB_RELEASE_IP, msg_release_ip);
2070 messaging_register(smbd_messaging_context(), NULL,
2071 MSG_SMB_CLOSE_FILE, msg_close_file);
2072
2073 if ((lp_keepalive() != 0)
2074 && !(event_add_idle(smbd_event_context(), NULL,
2075 timeval_set(lp_keepalive(), 0),
2076 "keepalive", keepalive_fn,
2077 NULL))) {
2078 DEBUG(0, ("Could not add keepalive event\n"));
2079 exit(1);
2080 }
2081
2082 if (!(event_add_idle(smbd_event_context(), NULL,
2083 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
2084 "deadtime", deadtime_fn, NULL))) {
2085 DEBUG(0, ("Could not add deadtime event\n"));
2086 exit(1);
2087 }
2088
2089 if (!(event_add_idle(smbd_event_context(), NULL,
2090 timeval_set(SMBD_SELECT_TIMEOUT, 0),
2091 "housekeeping", housekeeping_fn, NULL))) {
2092 DEBUG(0, ("Could not add housekeeping event\n"));
2093 exit(1);
2094 }
2095
2096 #ifdef CLUSTER_SUPPORT
2097
2098 if (lp_clustering()) {
2099 /*
2100 * We need to tell ctdb about our client's TCP
2101 * connection, so that for failover ctdbd can send
2102 * tickle acks, triggering a reconnection by the
2103 * client.
2104 */
2105
2106 struct sockaddr_storage srv, clnt;
2107
2108 if (client_get_tcp_info(&srv, &clnt) == 0) {
2109
2110 NTSTATUS status;
2111
2112 status = ctdbd_register_ips(
2113 messaging_ctdbd_connection(),
2114 &srv, &clnt, release_ip, NULL);
2115
2116 if (!NT_STATUS_IS_OK(status)) {
2117 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
2118 nt_errstr(status)));
2119 }
2120 } else
2121 {
2122 DEBUG(0,("Unable to get tcp info for "
2123 "CTDB_CONTROL_TCP_CLIENT: %s\n",
2124 strerror(errno)));
2125 }
2126 }
2127
2128 #endif
2129
2130 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2131
2132 smbd_server_conn->fde = event_add_fd(smbd_event_context(),
2133 smbd_server_conn,
2134 smbd_server_fd(),
2135 EVENT_FD_READ,
2136 smbd_server_connection_handler,
2137 smbd_server_conn);
2138 if (!smbd_server_conn->fde) {
2139 exit_server("failed to create smbd_server_connection fde");
2140 }
2141
2142 TALLOC_FREE(frame);
2143
2144 while (True) {
2145 NTSTATUS status;
2146
2147 frame = talloc_stackframe_pool(8192);
2148
2149 errno = 0;
2150
2151 status = smbd_server_connection_loop_once(smbd_server_conn);
2152 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
2153 !NT_STATUS_IS_OK(status)) {
2154 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2155 " exiting\n", nt_errstr(status)));
2156 break;
2157 }
2158
2159 TALLOC_FREE(frame);
2160 }
2161
2162 exit_server_cleanly(NULL);
2163 }
2164
2165 bool req_is_in_chain(struct smb_request *req)
2166 {
2167 if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
2168 /*
2169 * We're right now handling a subsequent request, so we must
2170 * be in a chain
2171 */
2172 return true;
2173 }
2174
2175 if (!is_andx_req(req->cmd)) {
2176 return false;
2177 }
2178
2179 if (req->wct < 2) {
2180 /*
2181 * Okay, an illegal request, but definitely not chained :-)
2182 */
2183 return false;
2184 }
2185
2186 return (CVAL(req->vwv+0, 0) != 0xFF);
2187 }
Samba GIT mirror