2 Unix SMB/CIFS implementation.
3 handle unexpected packets
4 Copyright (C) Andrew Tridgell 2000
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "../lib/util/tevent_ntstatus.h"
23 #include "lib/util_tsock.h"
24 #include "lib/tsocket/tsocket.h"
25 #include "libsmb/nmblib.h"
26 #include "lib/util/sys_rw.h"
28 static const char *nmbd_socket_dir(void)
30 return lp_parm_const_string(-1, "nmbd", "socket dir",
31 get_dyn_NMBDSOCKETDIR());
34 struct nb_packet_query
{
35 enum packet_type type
;
36 size_t mailslot_namelen
;
40 struct nb_packet_client
;
42 struct nb_packet_server
{
43 struct tevent_context
*ev
;
45 struct tevent_fd
*listen_fde
;
48 struct nb_packet_client
*clients
;
51 struct nb_packet_client
{
52 struct nb_packet_client
*prev
, *next
;
53 struct nb_packet_server
*server
;
55 enum packet_type type
;
64 struct tstream_context
*sock
;
65 struct tevent_queue
*out_queue
;
68 static int nb_packet_server_destructor(struct nb_packet_server
*s
);
69 static void nb_packet_server_listener(struct tevent_context
*ev
,
70 struct tevent_fd
*fde
,
74 NTSTATUS
nb_packet_server_create(TALLOC_CTX
*mem_ctx
,
75 struct tevent_context
*ev
,
77 struct nb_packet_server
**presult
)
79 struct nb_packet_server
*result
;
83 result
= talloc_zero(mem_ctx
, struct nb_packet_server
);
85 status
= NT_STATUS_NO_MEMORY
;
89 result
->max_clients
= max_clients
;
91 result
->listen_sock
= create_pipe_sock(
92 nmbd_socket_dir(), "unexpected", 0755);
93 if (result
->listen_sock
== -1) {
94 status
= map_nt_error_from_unix(errno
);
97 rc
= listen(result
->listen_sock
, 5);
99 status
= map_nt_error_from_unix(errno
);
102 talloc_set_destructor(result
, nb_packet_server_destructor
);
104 result
->listen_fde
= tevent_add_fd(ev
, result
,
107 nb_packet_server_listener
,
109 if (result
->listen_fde
== NULL
) {
110 status
= NT_STATUS_NO_MEMORY
;
121 static int nb_packet_server_destructor(struct nb_packet_server
*s
)
123 TALLOC_FREE(s
->listen_fde
);
125 if (s
->listen_sock
!= -1) {
126 close(s
->listen_sock
);
132 static int nb_packet_client_destructor(struct nb_packet_client
*c
);
133 static ssize_t
nb_packet_client_more(uint8_t *buf
, size_t buflen
,
135 static void nb_packet_got_query(struct tevent_req
*req
);
136 static void nb_packet_client_ack_done(struct tevent_req
*req
);
137 static void nb_packet_client_read_done(struct tevent_req
*req
);
139 static void nb_packet_server_listener(struct tevent_context
*ev
,
140 struct tevent_fd
*fde
,
144 struct nb_packet_server
*server
= talloc_get_type_abort(
145 private_data
, struct nb_packet_server
);
146 struct nb_packet_client
*client
;
147 struct tevent_req
*req
;
148 struct sockaddr_un sunaddr
;
153 len
= sizeof(sunaddr
);
155 sock
= accept(server
->listen_sock
, (struct sockaddr
*)(void *)&sunaddr
,
160 DEBUG(6,("accepted socket %d\n", sock
));
162 client
= talloc_zero(server
, struct nb_packet_client
);
163 if (client
== NULL
) {
164 DEBUG(10, ("talloc failed\n"));
168 ret
= tstream_bsd_existing_socket(client
, sock
, &client
->sock
);
170 DEBUG(10, ("tstream_bsd_existing_socket failed\n"));
175 client
->server
= server
;
176 talloc_set_destructor(client
, nb_packet_client_destructor
);
178 client
->out_queue
= tevent_queue_create(
179 client
, "unexpected packet output");
180 if (client
->out_queue
== NULL
) {
181 DEBUG(10, ("tevent_queue_create failed\n"));
186 req
= tstream_read_packet_send(client
, ev
, client
->sock
,
187 sizeof(struct nb_packet_query
),
188 nb_packet_client_more
, NULL
);
190 DEBUG(10, ("tstream_read_packet_send failed\n"));
194 tevent_req_set_callback(req
, nb_packet_got_query
, client
);
196 DLIST_ADD(server
->clients
, client
);
197 server
->num_clients
+= 1;
199 if (server
->num_clients
> server
->max_clients
) {
200 DEBUG(10, ("Too many clients, dropping oldest\n"));
203 * no TALLOC_FREE here, don't mess with the list structs
205 talloc_free(server
->clients
->prev
);
209 static ssize_t
nb_packet_client_more(uint8_t *buf
, size_t buflen
,
212 struct nb_packet_query q
;
213 if (buflen
> sizeof(struct nb_packet_query
)) {
216 /* Take care of alignment */
217 memcpy(&q
, buf
, sizeof(q
));
218 if (q
.mailslot_namelen
> 1024) {
219 DEBUG(10, ("Got invalid mailslot namelen %d\n",
220 (int)q
.mailslot_namelen
));
223 return q
.mailslot_namelen
;
226 static int nb_packet_client_destructor(struct nb_packet_client
*c
)
228 tevent_queue_stop(c
->out_queue
);
229 TALLOC_FREE(c
->sock
);
231 DLIST_REMOVE(c
->server
->clients
, c
);
232 c
->server
->num_clients
-= 1;
236 static void nb_packet_got_query(struct tevent_req
*req
)
238 struct nb_packet_client
*client
= tevent_req_callback_data(
239 req
, struct nb_packet_client
);
240 struct nb_packet_query q
;
245 nread
= tstream_read_packet_recv(req
, talloc_tos(), &buf
, &err
);
247 if (nread
< (ssize_t
)sizeof(struct nb_packet_query
)) {
248 DEBUG(10, ("read_packet_recv returned %d (%s)\n",
250 (nread
== -1) ? strerror(err
) : "wrong length"));
255 /* Take care of alignment */
256 memcpy(&q
, buf
, sizeof(q
));
258 if (nread
!= sizeof(struct nb_packet_query
) + q
.mailslot_namelen
) {
259 DEBUG(10, ("nb_packet_got_query: Invalid mailslot namelength\n"));
264 client
->trn_id
= q
.trn_id
;
265 client
->type
= q
.type
;
266 if (q
.mailslot_namelen
> 0) {
267 client
->mailslot_name
= talloc_strndup(
268 client
, (char *)buf
+ sizeof(q
),
270 if (client
->mailslot_name
== NULL
) {
276 client
->ack
.byte
= 0;
277 client
->ack
.iov
[0].iov_base
= &client
->ack
.byte
;
278 client
->ack
.iov
[0].iov_len
= 1;
279 req
= tstream_writev_queue_send(client
, client
->server
->ev
,
284 DEBUG(10, ("tstream_writev_queue_send failed\n"));
288 tevent_req_set_callback(req
, nb_packet_client_ack_done
, client
);
290 req
= tstream_read_packet_send(client
, client
->server
->ev
,
291 client
->sock
, 1, NULL
, NULL
);
293 DEBUG(10, ("Could not activate reader for client exit "
298 tevent_req_set_callback(req
, nb_packet_client_read_done
,
302 static void nb_packet_client_ack_done(struct tevent_req
*req
)
304 struct nb_packet_client
*client
= tevent_req_callback_data(
305 req
, struct nb_packet_client
);
309 nwritten
= tstream_writev_queue_recv(req
, &err
);
313 if (nwritten
== -1) {
314 DEBUG(10, ("tstream_writev_queue_recv failed: %s\n",
321 static void nb_packet_client_read_done(struct tevent_req
*req
)
323 struct nb_packet_client
*client
= tevent_req_callback_data(
324 req
, struct nb_packet_client
);
329 nread
= tstream_read_packet_recv(req
, talloc_tos(), &buf
, &err
);
332 DEBUG(10, ("Protocol error, received data on write-only "
333 "unexpected socket: 0x%2.2x\n", (*buf
)));
338 static void nb_packet_client_send(struct nb_packet_client
*client
,
339 struct packet_struct
*p
);
341 void nb_packet_dispatch(struct nb_packet_server
*server
,
342 struct packet_struct
*p
)
344 struct nb_packet_client
*c
;
347 switch (p
->packet_type
) {
349 trn_id
= p
->packet
.nmb
.header
.name_trn_id
;
352 trn_id
= p
->packet
.dgram
.header
.dgm_id
;
355 DEBUG(10, ("Got invalid packet type %d\n",
356 (int)p
->packet_type
));
359 for (c
= server
->clients
; c
!= NULL
; c
= c
->next
) {
361 if (c
->type
!= p
->packet_type
) {
362 DEBUG(10, ("client expects packet %d, got %d\n",
363 c
->type
, p
->packet_type
));
367 if (p
->packet_type
== NMB_PACKET
) {
369 * See if the client specified transaction
370 * ID. Filter if it did.
372 if ((c
->trn_id
!= -1) &&
373 (c
->trn_id
!= trn_id
)) {
374 DEBUG(10, ("client expects trn %d, got %d\n",
380 * See if the client specified a mailslot
381 * name. Filter if it did.
383 if ((c
->mailslot_name
!= NULL
) &&
384 !match_mailslot_name(p
, c
->mailslot_name
)) {
388 nb_packet_client_send(c
, p
);
392 struct nb_packet_client_header
{
394 enum packet_type type
;
400 struct nb_packet_client_state
{
401 struct nb_packet_client
*client
;
403 struct nb_packet_client_header hdr
;
407 static void nb_packet_client_send_done(struct tevent_req
*req
);
409 static void nb_packet_client_send(struct nb_packet_client
*client
,
410 struct packet_struct
*p
)
412 struct nb_packet_client_state
*state
;
413 struct tevent_req
*req
;
415 if (tevent_queue_length(client
->out_queue
) > 10) {
417 * Skip clients that don't listen anyway, some form of DoS
423 state
= talloc_zero(client
, struct nb_packet_client_state
);
425 DEBUG(10, ("talloc failed\n"));
429 state
->client
= client
;
431 state
->hdr
.ip
= p
->ip
;
432 state
->hdr
.port
= p
->port
;
433 state
->hdr
.timestamp
= p
->timestamp
;
434 state
->hdr
.type
= p
->packet_type
;
435 state
->hdr
.len
= build_packet(state
->buf
, sizeof(state
->buf
), p
);
437 state
->iov
[0].iov_base
= (char *)&state
->hdr
;
438 state
->iov
[0].iov_len
= sizeof(state
->hdr
);
439 state
->iov
[1].iov_base
= state
->buf
;
440 state
->iov
[1].iov_len
= state
->hdr
.len
;
442 req
= tstream_writev_queue_send(state
, client
->server
->ev
,
447 DEBUG(10, ("tstream_writev_queue_send failed\n"));
450 tevent_req_set_callback(req
, nb_packet_client_send_done
, state
);
453 static void nb_packet_client_send_done(struct tevent_req
*req
)
455 struct nb_packet_client_state
*state
= tevent_req_callback_data(
456 req
, struct nb_packet_client_state
);
457 struct nb_packet_client
*client
= state
->client
;
461 nwritten
= tstream_writev_queue_recv(req
, &err
);
466 if (nwritten
== -1) {
467 DEBUG(10, ("tstream_writev_queue failed: %s\n", strerror(err
)));
473 struct nb_packet_reader
{
474 struct tstream_context
*sock
;
477 struct nb_packet_reader_state
{
478 struct tevent_context
*ev
;
479 struct nb_packet_query query
;
480 const char *mailslot_name
;
483 struct nb_packet_reader
*reader
;
486 static void nb_packet_reader_connected(struct tevent_req
*subreq
);
487 static void nb_packet_reader_sent_query(struct tevent_req
*subreq
);
488 static void nb_packet_reader_got_ack(struct tevent_req
*subreq
);
490 struct tevent_req
*nb_packet_reader_send(TALLOC_CTX
*mem_ctx
,
491 struct tevent_context
*ev
,
492 enum packet_type type
,
494 const char *mailslot_name
)
496 struct tevent_req
*req
, *subreq
;
497 struct nb_packet_reader_state
*state
;
498 struct tsocket_address
*laddr
;
500 struct tsocket_address
*raddr
;
503 req
= tevent_req_create(mem_ctx
, &state
,
504 struct nb_packet_reader_state
);
509 state
->query
.trn_id
= trn_id
;
510 state
->query
.type
= type
;
511 state
->mailslot_name
= mailslot_name
;
513 if (mailslot_name
!= NULL
) {
514 state
->query
.mailslot_namelen
= strlen(mailslot_name
);
517 state
->reader
= talloc_zero(state
, struct nb_packet_reader
);
518 if (tevent_req_nomem(state
->reader
, req
)) {
519 return tevent_req_post(req
, ev
);
522 ret
= tsocket_address_unix_from_path(state
, "", &laddr
);
524 tevent_req_nterror(req
, map_nt_error_from_unix(errno
));
525 return tevent_req_post(req
, ev
);
527 rpath
= talloc_asprintf(state
, "%s/%s", nmbd_socket_dir(),
529 if (tevent_req_nomem(rpath
, req
)) {
530 return tevent_req_post(req
, ev
);
532 ret
= tsocket_address_unix_from_path(state
, rpath
, &raddr
);
534 tevent_req_nterror(req
, map_nt_error_from_unix(errno
));
535 return tevent_req_post(req
, ev
);
538 subreq
= tstream_unix_connect_send(state
, ev
, laddr
, raddr
);
539 if (tevent_req_nomem(subreq
, req
)) {
540 return tevent_req_post(req
, ev
);
542 tevent_req_set_callback(subreq
, nb_packet_reader_connected
, req
);
546 static void nb_packet_reader_connected(struct tevent_req
*subreq
)
548 struct tevent_req
*req
= tevent_req_callback_data(
549 subreq
, struct tevent_req
);
550 struct nb_packet_reader_state
*state
= tevent_req_data(
551 req
, struct nb_packet_reader_state
);
555 res
= tstream_unix_connect_recv(subreq
, &err
, state
->reader
,
556 &state
->reader
->sock
);
559 DEBUG(10, ("tstream_unix_connect failed: %s\n", strerror(err
)));
560 tevent_req_nterror(req
, map_nt_error_from_unix(err
));
564 state
->iov
[0].iov_base
= (char *)&state
->query
;
565 state
->iov
[0].iov_len
= sizeof(state
->query
);
567 if (state
->mailslot_name
!= NULL
) {
569 state
->iov
[1].iov_base
= discard_const_p(
570 char, state
->mailslot_name
);
571 state
->iov
[1].iov_len
= state
->query
.mailslot_namelen
;
574 subreq
= tstream_writev_send(state
, state
->ev
, state
->reader
->sock
,
575 state
->iov
, num_iovecs
);
576 if (tevent_req_nomem(subreq
, req
)) {
579 tevent_req_set_callback(subreq
, nb_packet_reader_sent_query
, req
);
582 static void nb_packet_reader_sent_query(struct tevent_req
*subreq
)
584 struct tevent_req
*req
= tevent_req_callback_data(
585 subreq
, struct tevent_req
);
586 struct nb_packet_reader_state
*state
= tevent_req_data(
587 req
, struct nb_packet_reader_state
);
591 written
= tstream_writev_recv(subreq
, &err
);
594 tevent_req_nterror(req
, map_nt_error_from_unix(err
));
597 if (written
!= sizeof(state
->query
) + state
->query
.mailslot_namelen
) {
598 tevent_req_nterror(req
, NT_STATUS_UNEXPECTED_IO_ERROR
);
601 subreq
= tstream_read_packet_send(state
, state
->ev
,
603 sizeof(state
->c
), NULL
, NULL
);
604 if (tevent_req_nomem(subreq
, req
)) {
607 tevent_req_set_callback(subreq
, nb_packet_reader_got_ack
, req
);
610 static void nb_packet_reader_got_ack(struct tevent_req
*subreq
)
612 struct tevent_req
*req
= tevent_req_callback_data(
613 subreq
, struct tevent_req
);
614 struct nb_packet_reader_state
*state
= tevent_req_data(
615 req
, struct nb_packet_reader_state
);
620 nread
= tstream_read_packet_recv(subreq
, state
, &buf
, &err
);
623 DEBUG(10, ("read_packet_recv returned %s\n",
625 tevent_req_nterror(req
, map_nt_error_from_unix(err
));
628 if (nread
!= sizeof(state
->c
)) {
629 DEBUG(10, ("read = %d, expected %d\n", (int)nread
,
630 (int)sizeof(state
->c
)));
631 tevent_req_nterror(req
, NT_STATUS_UNEXPECTED_IO_ERROR
);
634 tevent_req_done(req
);
637 NTSTATUS
nb_packet_reader_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
638 struct nb_packet_reader
**preader
)
640 struct nb_packet_reader_state
*state
= tevent_req_data(
641 req
, struct nb_packet_reader_state
);
644 if (tevent_req_is_nterror(req
, &status
)) {
645 tevent_req_received(req
);
648 *preader
= talloc_move(mem_ctx
, &state
->reader
);
649 tevent_req_received(req
);
653 struct nb_packet_read_state
{
654 struct nb_packet_client_header hdr
;
659 static ssize_t
nb_packet_read_more(uint8_t *buf
, size_t buflen
, void *p
);
660 static void nb_packet_read_done(struct tevent_req
*subreq
);
662 struct tevent_req
*nb_packet_read_send(TALLOC_CTX
*mem_ctx
,
663 struct tevent_context
*ev
,
664 struct nb_packet_reader
*reader
)
666 struct tevent_req
*req
, *subreq
;
667 struct nb_packet_read_state
*state
;
669 req
= tevent_req_create(mem_ctx
, &state
, struct nb_packet_read_state
);
673 subreq
= tstream_read_packet_send(state
, ev
, reader
->sock
,
674 sizeof(struct nb_packet_client_header
),
675 nb_packet_read_more
, state
);
676 if (tevent_req_nomem(subreq
, req
)) {
677 return tevent_req_post(req
, ev
);
679 tevent_req_set_callback(subreq
, nb_packet_read_done
, req
);
683 static ssize_t
nb_packet_read_more(uint8_t *buf
, size_t buflen
, void *p
)
685 struct nb_packet_read_state
*state
= talloc_get_type_abort(
686 p
, struct nb_packet_read_state
);
688 if (buflen
> sizeof(struct nb_packet_client_header
)) {
694 memcpy(&state
->hdr
, buf
, sizeof(struct nb_packet_client_header
));
695 return state
->hdr
.len
;
698 static void nb_packet_read_done(struct tevent_req
*subreq
)
700 struct tevent_req
*req
= tevent_req_callback_data(
701 subreq
, struct tevent_req
);
702 struct nb_packet_read_state
*state
= tevent_req_data(
703 req
, struct nb_packet_read_state
);
707 nread
= tstream_read_packet_recv(subreq
, state
, &state
->buf
, &err
);
709 tevent_req_nterror(req
, map_nt_error_from_unix(err
));
712 state
->buflen
= nread
;
713 tevent_req_done(req
);
716 NTSTATUS
nb_packet_read_recv(struct tevent_req
*req
,
717 struct packet_struct
**ppacket
)
719 struct nb_packet_read_state
*state
= tevent_req_data(
720 req
, struct nb_packet_read_state
);
721 struct nb_packet_client_header hdr
;
722 struct packet_struct
*packet
;
725 if (tevent_req_is_nterror(req
, &status
)) {
726 tevent_req_received(req
);
730 memcpy(&hdr
, state
->buf
, sizeof(hdr
));
732 packet
= parse_packet(
733 (char *)state
->buf
+ sizeof(struct nb_packet_client_header
),
734 state
->buflen
- sizeof(struct nb_packet_client_header
),
735 state
->hdr
.type
, state
->hdr
.ip
, state
->hdr
.port
);
736 if (packet
== NULL
) {
737 tevent_req_received(req
);
738 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
741 tevent_req_received(req
);