?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix the build without cluster
[Samba.git] / source3 / smbd / process.c
blob2ccb7d6a7cef2cf0c5b8184124bc7bb6a6a79811
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23 #include "librpc/gen_ndr/netlogon.h"
24 #include "librpc/gen_ndr/messaging.h"
25
26 extern bool global_machine_password_needs_changing;
27
28 static void construct_reply_common(struct smb_request *req, const char *inbuf,
29 char *outbuf);
30 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
31
32 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
33 {
34 bool ok;
35
36 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
37 return true;
38 }
39
40 sconn->smb1.echo_handler.ref_count++;
41
42 if (sconn->smb1.echo_handler.ref_count > 1) {
43 return true;
44 }
45
46 DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
47
48 ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
49 SMB_F_SETLKW, 0, 0, F_WRLCK);
50 if (!ok) {
51 return false;
52 }
53
54 DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
55
56 return true;
57 }
58
59 void smbd_lock_socket(struct smbd_server_connection *sconn)
60 {
61 if (!smbd_lock_socket_internal(sconn)) {
62 exit_server_cleanly("failed to lock socket");
63 }
64 }
65
66 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
67 {
68 bool ok;
69
70 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
71 return true;
72 }
73
74 sconn->smb1.echo_handler.ref_count--;
75
76 if (sconn->smb1.echo_handler.ref_count > 0) {
77 return true;
78 }
79
80 ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
81 SMB_F_SETLKW, 0, 0, F_UNLCK);
82 if (!ok) {
83 return false;
84 }
85
86 DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
87
88 return true;
89 }
90
91 void smbd_unlock_socket(struct smbd_server_connection *sconn)
92 {
93 if (!smbd_unlock_socket_internal(sconn)) {
94 exit_server_cleanly("failed to unlock socket");
95 }
96 }
97
98 /* Accessor function for smb_read_error for smbd functions. */
99
100 /****************************************************************************
101 Send an smb to a fd.
102 ****************************************************************************/
103
104 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
105 bool do_signing, uint32_t seqnum,
106 bool do_encrypt,
107 struct smb_perfcount_data *pcd)
108 {
109 size_t len = 0;
110 size_t nwritten=0;
111 ssize_t ret;
112 char *buf_out = buffer;
113
114 smbd_lock_socket(sconn);
115
116 if (do_signing) {
117 /* Sign the outgoing packet if required. */
118 srv_calculate_sign_mac(sconn, buf_out, seqnum);
119 }
120
121 if (do_encrypt) {
122 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
123 if (!NT_STATUS_IS_OK(status)) {
124 DEBUG(0, ("send_smb: SMB encryption failed "
125 "on outgoing packet! Error %s\n",
126 nt_errstr(status) ));
127 goto out;
128 }
129 }
130
131 len = smb_len(buf_out) + 4;
132
133 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
134 if (ret <= 0) {
135
136 char addr[INET6_ADDRSTRLEN];
137 /*
138 * Try and give an error message saying what
139 * client failed.
140 */
141 DEBUG(0,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
142 (int)sys_getpid(), (int)len,
143 get_peer_addr(sconn->sock, addr, sizeof(addr)),
144 (int)ret, strerror(errno) ));
145
146 srv_free_enc_buffer(buf_out);
147 goto out;
148 }
149
150 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
151 srv_free_enc_buffer(buf_out);
152 out:
153 SMB_PERFCOUNT_END(pcd);
154
155 smbd_unlock_socket(sconn);
156 return true;
157 }
158
159 /*******************************************************************
160 Setup the word count and byte count for a smb message.
161 ********************************************************************/
162
163 int srv_set_message(char *buf,
164 int num_words,
165 int num_bytes,
166 bool zero)
167 {
168 if (zero && (num_words || num_bytes)) {
169 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
170 }
171 SCVAL(buf,smb_wct,num_words);
172 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
173 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
174 return (smb_size + num_words*2 + num_bytes);
175 }
176
177 static bool valid_smb_header(const uint8_t *inbuf)
178 {
179 if (is_encrypted_packet(inbuf)) {
180 return true;
181 }
182 /*
183 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
184 * but it just looks weird to call strncmp for this one.
185 */
186 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
187 }
188
189 /* Socket functions for smbd packet processing. */
190
191 static bool valid_packet_size(size_t len)
192 {
193 /*
194 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
195 * of header. Don't print the error if this fits.... JRA.
196 */
197
198 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
199 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
200 (unsigned long)len));
201 return false;
202 }
203 return true;
204 }
205
206 static NTSTATUS read_packet_remainder(int fd, char *buffer,
207 unsigned int timeout, ssize_t len)
208 {
209 NTSTATUS status;
210
211 if (len <= 0) {
212 return NT_STATUS_OK;
213 }
214
215 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
216 if (!NT_STATUS_IS_OK(status)) {
217 char addr[INET6_ADDRSTRLEN];
218 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
219 "error = %s.\n",
220 get_peer_addr(fd, addr, sizeof(addr)),
221 nt_errstr(status)));
222 }
223 return status;
224 }
225
226 /****************************************************************************
227 Attempt a zerocopy writeX read. We know here that len > smb_size-4
228 ****************************************************************************/
229
230 /*
231 * Unfortunately, earlier versions of smbclient/libsmbclient
232 * don't send this "standard" writeX header. I've fixed this
233 * for 3.2 but we'll use the old method with earlier versions.
234 * Windows and CIFSFS at least use this standard size. Not
235 * sure about MacOSX.
236 */
237
238 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
239 (2*14) + /* word count (including bcc) */ \
240 1 /* pad byte */)
241
242 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
243 const char lenbuf[4],
244 int fd, char **buffer,
245 unsigned int timeout,
246 size_t *p_unread,
247 size_t *len_ret)
248 {
249 /* Size of a WRITEX call (+4 byte len). */
250 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
251 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
252 ssize_t toread;
253 NTSTATUS status;
254
255 memcpy(writeX_header, lenbuf, 4);
256
257 status = read_fd_with_timeout(
258 fd, writeX_header + 4,
259 STANDARD_WRITE_AND_X_HEADER_SIZE,
260 STANDARD_WRITE_AND_X_HEADER_SIZE,
261 timeout, NULL);
262
263 if (!NT_STATUS_IS_OK(status)) {
264 char addr[INET6_ADDRSTRLEN];
265 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
266 "error = %s.\n",
267 get_peer_addr(fd, addr, sizeof(addr)),
268 nt_errstr(status)));
269 return status;
270 }
271
272 /*
273 * Ok - now try and see if this is a possible
274 * valid writeX call.
275 */
276
277 if (is_valid_writeX_buffer(smbd_server_conn,
278 (uint8_t *)writeX_header)) {
279 /*
280 * If the data offset is beyond what
281 * we've read, drain the extra bytes.
282 */
283 uint16_t doff = SVAL(writeX_header,smb_vwv11);
284 ssize_t newlen;
285
286 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
287 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
288 if (drain_socket(fd, drain) != drain) {
289 smb_panic("receive_smb_raw_talloc_partial_read:"
290 " failed to drain pending bytes");
291 }
292 } else {
293 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
294 }
295
296 /* Spoof down the length and null out the bcc. */
297 set_message_bcc(writeX_header, 0);
298 newlen = smb_len(writeX_header);
299
300 /* Copy the header we've written. */
301
302 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
303 writeX_header,
304 sizeof(writeX_header));
305
306 if (*buffer == NULL) {
307 DEBUG(0, ("Could not allocate inbuf of length %d\n",
308 (int)sizeof(writeX_header)));
309 return NT_STATUS_NO_MEMORY;
310 }
311
312 /* Work out the remaining bytes. */
313 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
314 *len_ret = newlen + 4;
315 return NT_STATUS_OK;
316 }
317
318 if (!valid_packet_size(len)) {
319 return NT_STATUS_INVALID_PARAMETER;
320 }
321
322 /*
323 * Not a valid writeX call. Just do the standard
324 * talloc and return.
325 */
326
327 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
328
329 if (*buffer == NULL) {
330 DEBUG(0, ("Could not allocate inbuf of length %d\n",
331 (int)len+4));
332 return NT_STATUS_NO_MEMORY;
333 }
334
335 /* Copy in what we already read. */
336 memcpy(*buffer,
337 writeX_header,
338 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
339 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
340
341 if(toread > 0) {
342 status = read_packet_remainder(
343 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
344 timeout, toread);
345
346 if (!NT_STATUS_IS_OK(status)) {
347 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
348 nt_errstr(status)));
349 return status;
350 }
351 }
352
353 *len_ret = len + 4;
354 return NT_STATUS_OK;
355 }
356
357 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
358 char **buffer, unsigned int timeout,
359 size_t *p_unread, size_t *plen)
360 {
361 char lenbuf[4];
362 size_t len;
363 int min_recv_size = lp_min_receive_file_size();
364 NTSTATUS status;
365
366 *p_unread = 0;
367
368 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
369 if (!NT_STATUS_IS_OK(status)) {
370 return status;
371 }
372
373 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
374 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
375 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
376 !srv_is_signing_active(smbd_server_conn) &&
377 smbd_server_conn->smb1.echo_handler.trusted_fde == NULL) {
378
379 return receive_smb_raw_talloc_partial_read(
380 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
381 }
382
383 if (!valid_packet_size(len)) {
384 return NT_STATUS_INVALID_PARAMETER;
385 }
386
387 /*
388 * The +4 here can't wrap, we've checked the length above already.
389 */
390
391 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
392
393 if (*buffer == NULL) {
394 DEBUG(0, ("Could not allocate inbuf of length %d\n",
395 (int)len+4));
396 return NT_STATUS_NO_MEMORY;
397 }
398
399 memcpy(*buffer, lenbuf, sizeof(lenbuf));
400
401 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
402 if (!NT_STATUS_IS_OK(status)) {
403 return status;
404 }
405
406 *plen = len + 4;
407 return NT_STATUS_OK;
408 }
409
410 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
411 char **buffer, unsigned int timeout,
412 size_t *p_unread, bool *p_encrypted,
413 size_t *p_len,
414 uint32_t *seqnum,
415 bool trusted_channel)
416 {
417 size_t len = 0;
418 NTSTATUS status;
419
420 *p_encrypted = false;
421
422 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
423 p_unread, &len);
424 if (!NT_STATUS_IS_OK(status)) {
425 char addr[INET6_ADDRSTRLEN];
426 DEBUG(0, ("read_smb_length_return_keepalive failed for "
427 "client %s read error = %s.\n",
428 get_peer_addr(fd, addr, sizeof(addr)),
429 nt_errstr(status)));
430 return status;
431 }
432
433 if (is_encrypted_packet((uint8_t *)*buffer)) {
434 status = srv_decrypt_buffer(*buffer);
435 if (!NT_STATUS_IS_OK(status)) {
436 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
437 "incoming packet! Error %s\n",
438 nt_errstr(status) ));
439 return status;
440 }
441 *p_encrypted = true;
442 }
443
444 /* Check the incoming SMB signature. */
445 if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, trusted_channel)) {
446 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
447 "incoming packet!\n"));
448 return NT_STATUS_INVALID_NETWORK_RESPONSE;
449 }
450
451 *p_len = len;
452 return NT_STATUS_OK;
453 }
454
455 /*
456 * Initialize a struct smb_request from an inbuf
457 */
458
459 static bool init_smb_request(struct smb_request *req,
460 struct smbd_server_connection *sconn,
461 const uint8 *inbuf,
462 size_t unread_bytes, bool encrypted,
463 uint32_t seqnum)
464 {
465 size_t req_size = smb_len(inbuf) + 4;
466 /* Ensure we have at least smb_size bytes. */
467 if (req_size < smb_size) {
468 DEBUG(0,("init_smb_request: invalid request size %u\n",
469 (unsigned int)req_size ));
470 return false;
471 }
472 req->cmd = CVAL(inbuf, smb_com);
473 req->flags2 = SVAL(inbuf, smb_flg2);
474 req->smbpid = SVAL(inbuf, smb_pid);
475 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
476 req->seqnum = seqnum;
477 req->vuid = SVAL(inbuf, smb_uid);
478 req->tid = SVAL(inbuf, smb_tid);
479 req->wct = CVAL(inbuf, smb_wct);
480 req->vwv = (uint16_t *)(inbuf+smb_vwv);
481 req->buflen = smb_buflen(inbuf);
482 req->buf = (const uint8_t *)smb_buf(inbuf);
483 req->unread_bytes = unread_bytes;
484 req->encrypted = encrypted;
485 req->sconn = sconn;
486 req->conn = conn_find(sconn,req->tid);
487 req->chain_fsp = NULL;
488 req->chain_outbuf = NULL;
489 req->done = false;
490 req->smb2req = NULL;
491 smb_init_perfcount_data(&req->pcd);
492
493 /* Ensure we have at least wct words and 2 bytes of bcc. */
494 if (smb_size + req->wct*2 > req_size) {
495 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
496 (unsigned int)req->wct,
497 (unsigned int)req_size));
498 return false;
499 }
500 /* Ensure bcc is correct. */
501 if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
502 DEBUG(0,("init_smb_request: invalid bcc number %u "
503 "(wct = %u, size %u)\n",
504 (unsigned int)req->buflen,
505 (unsigned int)req->wct,
506 (unsigned int)req_size));
507 return false;
508 }
509
510 req->outbuf = NULL;
511 return true;
512 }
513
514 static void process_smb(struct smbd_server_connection *conn,
515 uint8_t *inbuf, size_t nread, size_t unread_bytes,
516 uint32_t seqnum, bool encrypted,
517 struct smb_perfcount_data *deferred_pcd);
518
519 static void smbd_deferred_open_timer(struct event_context *ev,
520 struct timed_event *te,
521 struct timeval _tval,
522 void *private_data)
523 {
524 struct pending_message_list *msg = talloc_get_type(private_data,
525 struct pending_message_list);
526 TALLOC_CTX *mem_ctx = talloc_tos();
527 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
528 uint8_t *inbuf;
529
530 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
531 msg->buf.length);
532 if (inbuf == NULL) {
533 exit_server("smbd_deferred_open_timer: talloc failed\n");
534 return;
535 }
536
537 /* We leave this message on the queue so the open code can
538 know this is a retry. */
539 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
540 (unsigned long long)mid ));
541
542 /* Mark the message as processed so this is not
543 * re-processed in error. */
544 msg->processed = true;
545
546 process_smb(smbd_server_conn, inbuf,
547 msg->buf.length, 0,
548 msg->seqnum, msg->encrypted, &msg->pcd);
549
550 /* If it's still there and was processed, remove it. */
551 msg = get_deferred_open_message_smb(mid);
552 if (msg && msg->processed) {
553 remove_deferred_open_message_smb(mid);
554 }
555 }
556
557 /****************************************************************************
558 Function to push a message onto the tail of a linked list of smb messages ready
559 for processing.
560 ****************************************************************************/
561
562 static bool push_queued_message(struct smb_request *req,
563 struct timeval request_time,
564 struct timeval end_time,
565 char *private_data, size_t private_len)
566 {
567 int msg_len = smb_len(req->inbuf) + 4;
568 struct pending_message_list *msg;
569
570 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
571
572 if(msg == NULL) {
573 DEBUG(0,("push_message: malloc fail (1)\n"));
574 return False;
575 }
576
577 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
578 if(msg->buf.data == NULL) {
579 DEBUG(0,("push_message: malloc fail (2)\n"));
580 TALLOC_FREE(msg);
581 return False;
582 }
583
584 msg->request_time = request_time;
585 msg->seqnum = req->seqnum;
586 msg->encrypted = req->encrypted;
587 msg->processed = false;
588 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
589
590 if (private_data) {
591 msg->private_data = data_blob_talloc(msg, private_data,
592 private_len);
593 if (msg->private_data.data == NULL) {
594 DEBUG(0,("push_message: malloc fail (3)\n"));
595 TALLOC_FREE(msg);
596 return False;
597 }
598 }
599
600 msg->te = event_add_timed(smbd_event_context(),
601 msg,
602 end_time,
603 smbd_deferred_open_timer,
604 msg);
605 if (!msg->te) {
606 DEBUG(0,("push_message: event_add_timed failed\n"));
607 TALLOC_FREE(msg);
608 return false;
609 }
610
611 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
612
613 DEBUG(10,("push_message: pushed message length %u on "
614 "deferred_open_queue\n", (unsigned int)msg_len));
615
616 return True;
617 }
618
619 /****************************************************************************
620 Function to delete a sharing violation open message by mid.
621 ****************************************************************************/
622
623 void remove_deferred_open_message_smb(uint64_t mid)
624 {
625 struct pending_message_list *pml;
626
627 if (smbd_server_conn->using_smb2) {
628 remove_deferred_open_message_smb2(smbd_server_conn, mid);
629 return;
630 }
631
632 for (pml = deferred_open_queue; pml; pml = pml->next) {
633 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
634 DEBUG(10,("remove_deferred_open_message_smb: "
635 "deleting mid %llu len %u\n",
636 (unsigned long long)mid,
637 (unsigned int)pml->buf.length ));
638 DLIST_REMOVE(deferred_open_queue, pml);
639 TALLOC_FREE(pml);
640 return;
641 }
642 }
643 }
644
645 /****************************************************************************
646 Move a sharing violation open retry message to the front of the list and
647 schedule it for immediate processing.
648 ****************************************************************************/
649
650 void schedule_deferred_open_message_smb(uint64_t mid)
651 {
652 struct pending_message_list *pml;
653 int i = 0;
654
655 if (smbd_server_conn->using_smb2) {
656 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
657 return;
658 }
659
660 for (pml = deferred_open_queue; pml; pml = pml->next) {
661 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
662
663 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
664 "msg_mid = %llu\n",
665 i++,
666 (unsigned long long)msg_mid ));
667
668 if (mid == msg_mid) {
669 struct timed_event *te;
670
671 if (pml->processed) {
672 /* A processed message should not be
673 * rescheduled. */
674 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
675 "message mid %llu was already processed\n",
676 (unsigned long long)msg_mid ));
677 continue;
678 }
679
680 DEBUG(10,("schedule_deferred_open_message_smb: "
681 "scheduling mid %llu\n",
682 (unsigned long long)mid ));
683
684 te = event_add_timed(smbd_event_context(),
685 pml,
686 timeval_zero(),
687 smbd_deferred_open_timer,
688 pml);
689 if (!te) {
690 DEBUG(10,("schedule_deferred_open_message_smb: "
691 "event_add_timed() failed, "
692 "skipping mid %llu\n",
693 (unsigned long long)msg_mid ));
694 }
695
696 TALLOC_FREE(pml->te);
697 pml->te = te;
698 DLIST_PROMOTE(deferred_open_queue, pml);
699 return;
700 }
701 }
702
703 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
704 "find message mid %llu\n",
705 (unsigned long long)mid ));
706 }
707
708 /****************************************************************************
709 Return true if this mid is on the deferred queue and was not yet processed.
710 ****************************************************************************/
711
712 bool open_was_deferred(uint64_t mid)
713 {
714 struct pending_message_list *pml;
715
716 if (smbd_server_conn->using_smb2) {
717 return open_was_deferred_smb2(smbd_server_conn, mid);
718 }
719
720 for (pml = deferred_open_queue; pml; pml = pml->next) {
721 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
722 return True;
723 }
724 }
725 return False;
726 }
727
728 /****************************************************************************
729 Return the message queued by this mid.
730 ****************************************************************************/
731
732 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
733 {
734 struct pending_message_list *pml;
735
736 for (pml = deferred_open_queue; pml; pml = pml->next) {
737 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
738 return pml;
739 }
740 }
741 return NULL;
742 }
743
744 /****************************************************************************
745 Get the state data queued by this mid.
746 ****************************************************************************/
747
748 bool get_deferred_open_message_state(struct smb_request *smbreq,
749 struct timeval *p_request_time,
750 void **pp_state)
751 {
752 struct pending_message_list *pml;
753
754 if (smbd_server_conn->using_smb2) {
755 return get_deferred_open_message_state_smb2(smbreq->smb2req,
756 p_request_time,
757 pp_state);
758 }
759
760 pml = get_deferred_open_message_smb(smbreq->mid);
761 if (!pml) {
762 return false;
763 }
764 if (p_request_time) {
765 *p_request_time = pml->request_time;
766 }
767 if (pp_state) {
768 *pp_state = (void *)pml->private_data.data;
769 }
770 return true;
771 }
772
773 /****************************************************************************
774 Function to push a deferred open smb message onto a linked list of local smb
775 messages ready for processing.
776 ****************************************************************************/
777
778 bool push_deferred_open_message_smb(struct smb_request *req,
779 struct timeval request_time,
780 struct timeval timeout,
781 struct file_id id,
782 char *private_data, size_t priv_len)
783 {
784 struct timeval end_time;
785
786 if (req->smb2req) {
787 return push_deferred_open_message_smb2(req->smb2req,
788 request_time,
789 timeout,
790 id,
791 private_data,
792 priv_len);
793 }
794
795 if (req->unread_bytes) {
796 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
797 "unread_bytes = %u\n",
798 (unsigned int)req->unread_bytes ));
799 smb_panic("push_deferred_open_message_smb: "
800 "logic error unread_bytes != 0" );
801 }
802
803 end_time = timeval_sum(&request_time, &timeout);
804
805 DEBUG(10,("push_deferred_open_message_smb: pushing message "
806 "len %u mid %llu timeout time [%u.%06u]\n",
807 (unsigned int) smb_len(req->inbuf)+4,
808 (unsigned long long)req->mid,
809 (unsigned int)end_time.tv_sec,
810 (unsigned int)end_time.tv_usec));
811
812 return push_queued_message(req, request_time, end_time,
813 private_data, priv_len);
814 }
815
816 struct idle_event {
817 struct timed_event *te;
818 struct timeval interval;
819 char *name;
820 bool (*handler)(const struct timeval *now, void *private_data);
821 void *private_data;
822 };
823
824 static void smbd_idle_event_handler(struct event_context *ctx,
825 struct timed_event *te,
826 struct timeval now,
827 void *private_data)
828 {
829 struct idle_event *event =
830 talloc_get_type_abort(private_data, struct idle_event);
831
832 TALLOC_FREE(event->te);
833
834 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
835 event->name, event->te));
836
837 if (!event->handler(&now, event->private_data)) {
838 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
839 event->name, event->te));
840 /* Don't repeat, delete ourselves */
841 TALLOC_FREE(event);
842 return;
843 }
844
845 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
846 event->name, event->te));
847
848 event->te = event_add_timed(ctx, event,
849 timeval_sum(&now, &event->interval),
850 smbd_idle_event_handler, event);
851
852 /* We can't do much but fail here. */
853 SMB_ASSERT(event->te != NULL);
854 }
855
856 struct idle_event *event_add_idle(struct event_context *event_ctx,
857 TALLOC_CTX *mem_ctx,
858 struct timeval interval,
859 const char *name,
860 bool (*handler)(const struct timeval *now,
861 void *private_data),
862 void *private_data)
863 {
864 struct idle_event *result;
865 struct timeval now = timeval_current();
866
867 result = TALLOC_P(mem_ctx, struct idle_event);
868 if (result == NULL) {
869 DEBUG(0, ("talloc failed\n"));
870 return NULL;
871 }
872
873 result->interval = interval;
874 result->handler = handler;
875 result->private_data = private_data;
876
877 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
878 DEBUG(0, ("talloc failed\n"));
879 TALLOC_FREE(result);
880 return NULL;
881 }
882
883 result->te = event_add_timed(event_ctx, result,
884 timeval_sum(&now, &interval),
885 smbd_idle_event_handler, result);
886 if (result->te == NULL) {
887 DEBUG(0, ("event_add_timed failed\n"));
888 TALLOC_FREE(result);
889 return NULL;
890 }
891
892 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
893 return result;
894 }
895
896 static void smbd_sig_term_handler(struct tevent_context *ev,
897 struct tevent_signal *se,
898 int signum,
899 int count,
900 void *siginfo,
901 void *private_data)
902 {
903 exit_server_cleanly("termination signal");
904 }
905
906 void smbd_setup_sig_term_handler(void)
907 {
908 struct tevent_signal *se;
909
910 se = tevent_add_signal(smbd_event_context(),
911 smbd_event_context(),
912 SIGTERM, 0,
913 smbd_sig_term_handler,
914 NULL);
915 if (!se) {
916 exit_server("failed to setup SIGTERM handler");
917 }
918 }
919
920 static void smbd_sig_hup_handler(struct tevent_context *ev,
921 struct tevent_signal *se,
922 int signum,
923 int count,
924 void *siginfo,
925 void *private_data)
926 {
927 struct messaging_context *msg_ctx = talloc_get_type_abort(
928 private_data, struct messaging_context);
929 change_to_root_user();
930 DEBUG(1,("Reloading services after SIGHUP\n"));
931 reload_services(msg_ctx, smbd_server_conn->sock, False);
932 }
933
934 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
935 struct messaging_context *msg_ctx)
936 {
937 struct tevent_signal *se;
938
939 se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
940 msg_ctx);
941 if (!se) {
942 exit_server("failed to setup SIGHUP handler");
943 }
944 }
945
946 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
947 {
948 fd_set r_fds, w_fds;
949 int selrtn;
950 struct timeval to;
951 int maxfd = 0;
952
953 to.tv_sec = SMBD_SELECT_TIMEOUT;
954 to.tv_usec = 0;
955
956 /*
957 * Setup the select fd sets.
958 */
959
960 FD_ZERO(&r_fds);
961 FD_ZERO(&w_fds);
962
963 /*
964 * Are there any timed events waiting ? If so, ensure we don't
965 * select for longer than it would take to wait for them.
966 */
967
968 {
969 struct timeval now;
970 GetTimeOfDay(&now);
971
972 event_add_to_select_args(smbd_event_context(), &now,
973 &r_fds, &w_fds, &to, &maxfd);
974 }
975
976 /* Process a signal and timed events now... */
977 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
978 return NT_STATUS_RETRY;
979 }
980
981 {
982 int sav;
983 START_PROFILE(smbd_idle);
984
985 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
986 sav = errno;
987
988 END_PROFILE(smbd_idle);
989 errno = sav;
990 }
991
992 if ((conn->smb1.echo_handler.trusted_fd != -1)
993 && FD_ISSET(conn->sock, &r_fds)
994 && FD_ISSET(conn->smb1.echo_handler.trusted_fd, &r_fds)) {
995 /*
996 * Prefer to read pending requests from the echo handler. To
997 * quote Jeremy (da70f8ab1): This is a hack of monstrous
998 * proportions...
999 */
1000 FD_CLR(conn->sock, &r_fds);
1001 }
1002
1003 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
1004 return NT_STATUS_RETRY;
1005 }
1006
1007 /* Check if error */
1008 if (selrtn == -1) {
1009 /* something is wrong. Maybe the socket is dead? */
1010 return map_nt_error_from_unix(errno);
1011 }
1012
1013 /* Did we timeout ? */
1014 if (selrtn == 0) {
1015 return NT_STATUS_RETRY;
1016 }
1017
1018 /* should not be reached */
1019 return NT_STATUS_INTERNAL_ERROR;
1020 }
1021
1022 /*
1023 * Only allow 5 outstanding trans requests. We're allocating memory, so
1024 * prevent a DoS.
1025 */
1026
1027 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1028 {
1029 int count = 0;
1030 for (; list != NULL; list = list->next) {
1031
1032 if (list->mid == mid) {
1033 return NT_STATUS_INVALID_PARAMETER;
1034 }
1035
1036 count += 1;
1037 }
1038 if (count > 5) {
1039 return NT_STATUS_INSUFFICIENT_RESOURCES;
1040 }
1041
1042 return NT_STATUS_OK;
1043 }
1044
1045 /*
1046 These flags determine some of the permissions required to do an operation
1047
1048 Note that I don't set NEED_WRITE on some write operations because they
1049 are used by some brain-dead clients when printing, and I don't want to
1050 force write permissions on print services.
1051 */
1052 #define AS_USER (1<<0)
1053 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1054 #define TIME_INIT (1<<2)
1055 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1056 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1057 #define DO_CHDIR (1<<6)
1058
1059 /*
1060 define a list of possible SMB messages and their corresponding
1061 functions. Any message that has a NULL function is unimplemented -
1062 please feel free to contribute implementations!
1063 */
1064 static const struct smb_message_struct {
1065 const char *name;
1066 void (*fn)(struct smb_request *req);
1067 int flags;
1068 } smb_messages[256] = {
1069
1070 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1071 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1072 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1073 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1074 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1075 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1076 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1077 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1078 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1079 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1080 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1081 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1082 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1083 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1084 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1085 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1086 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1087 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1088 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1089 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1090 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1091 /* 0x15 */ { NULL, NULL, 0 },
1092 /* 0x16 */ { NULL, NULL, 0 },
1093 /* 0x17 */ { NULL, NULL, 0 },
1094 /* 0x18 */ { NULL, NULL, 0 },
1095 /* 0x19 */ { NULL, NULL, 0 },
1096 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1097 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1098 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1099 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1100 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1101 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1102 /* 0x20 */ { "SMBwritec", NULL,0},
1103 /* 0x21 */ { NULL, NULL, 0 },
1104 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1105 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1106 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1107 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1108 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1109 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1110 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1111 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1112 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1113 /* 0x2b */ { "SMBecho",reply_echo,0},
1114 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1115 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1116 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1117 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1118 /* 0x30 */ { NULL, NULL, 0 },
1119 /* 0x31 */ { NULL, NULL, 0 },
1120 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1121 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1122 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1123 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1124 /* 0x36 */ { NULL, NULL, 0 },
1125 /* 0x37 */ { NULL, NULL, 0 },
1126 /* 0x38 */ { NULL, NULL, 0 },
1127 /* 0x39 */ { NULL, NULL, 0 },
1128 /* 0x3a */ { NULL, NULL, 0 },
1129 /* 0x3b */ { NULL, NULL, 0 },
1130 /* 0x3c */ { NULL, NULL, 0 },
1131 /* 0x3d */ { NULL, NULL, 0 },
1132 /* 0x3e */ { NULL, NULL, 0 },
1133 /* 0x3f */ { NULL, NULL, 0 },
1134 /* 0x40 */ { NULL, NULL, 0 },
1135 /* 0x41 */ { NULL, NULL, 0 },
1136 /* 0x42 */ { NULL, NULL, 0 },
1137 /* 0x43 */ { NULL, NULL, 0 },
1138 /* 0x44 */ { NULL, NULL, 0 },
1139 /* 0x45 */ { NULL, NULL, 0 },
1140 /* 0x46 */ { NULL, NULL, 0 },
1141 /* 0x47 */ { NULL, NULL, 0 },
1142 /* 0x48 */ { NULL, NULL, 0 },
1143 /* 0x49 */ { NULL, NULL, 0 },
1144 /* 0x4a */ { NULL, NULL, 0 },
1145 /* 0x4b */ { NULL, NULL, 0 },
1146 /* 0x4c */ { NULL, NULL, 0 },
1147 /* 0x4d */ { NULL, NULL, 0 },
1148 /* 0x4e */ { NULL, NULL, 0 },
1149 /* 0x4f */ { NULL, NULL, 0 },
1150 /* 0x50 */ { NULL, NULL, 0 },
1151 /* 0x51 */ { NULL, NULL, 0 },
1152 /* 0x52 */ { NULL, NULL, 0 },
1153 /* 0x53 */ { NULL, NULL, 0 },
1154 /* 0x54 */ { NULL, NULL, 0 },
1155 /* 0x55 */ { NULL, NULL, 0 },
1156 /* 0x56 */ { NULL, NULL, 0 },
1157 /* 0x57 */ { NULL, NULL, 0 },
1158 /* 0x58 */ { NULL, NULL, 0 },
1159 /* 0x59 */ { NULL, NULL, 0 },
1160 /* 0x5a */ { NULL, NULL, 0 },
1161 /* 0x5b */ { NULL, NULL, 0 },
1162 /* 0x5c */ { NULL, NULL, 0 },
1163 /* 0x5d */ { NULL, NULL, 0 },
1164 /* 0x5e */ { NULL, NULL, 0 },
1165 /* 0x5f */ { NULL, NULL, 0 },
1166 /* 0x60 */ { NULL, NULL, 0 },
1167 /* 0x61 */ { NULL, NULL, 0 },
1168 /* 0x62 */ { NULL, NULL, 0 },
1169 /* 0x63 */ { NULL, NULL, 0 },
1170 /* 0x64 */ { NULL, NULL, 0 },
1171 /* 0x65 */ { NULL, NULL, 0 },
1172 /* 0x66 */ { NULL, NULL, 0 },
1173 /* 0x67 */ { NULL, NULL, 0 },
1174 /* 0x68 */ { NULL, NULL, 0 },
1175 /* 0x69 */ { NULL, NULL, 0 },
1176 /* 0x6a */ { NULL, NULL, 0 },
1177 /* 0x6b */ { NULL, NULL, 0 },
1178 /* 0x6c */ { NULL, NULL, 0 },
1179 /* 0x6d */ { NULL, NULL, 0 },
1180 /* 0x6e */ { NULL, NULL, 0 },
1181 /* 0x6f */ { NULL, NULL, 0 },
1182 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1183 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1184 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1185 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1186 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1187 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1188 /* 0x76 */ { NULL, NULL, 0 },
1189 /* 0x77 */ { NULL, NULL, 0 },
1190 /* 0x78 */ { NULL, NULL, 0 },
1191 /* 0x79 */ { NULL, NULL, 0 },
1192 /* 0x7a */ { NULL, NULL, 0 },
1193 /* 0x7b */ { NULL, NULL, 0 },
1194 /* 0x7c */ { NULL, NULL, 0 },
1195 /* 0x7d */ { NULL, NULL, 0 },
1196 /* 0x7e */ { NULL, NULL, 0 },
1197 /* 0x7f */ { NULL, NULL, 0 },
1198 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1199 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1200 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1201 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1202 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1203 /* 0x85 */ { NULL, NULL, 0 },
1204 /* 0x86 */ { NULL, NULL, 0 },
1205 /* 0x87 */ { NULL, NULL, 0 },
1206 /* 0x88 */ { NULL, NULL, 0 },
1207 /* 0x89 */ { NULL, NULL, 0 },
1208 /* 0x8a */ { NULL, NULL, 0 },
1209 /* 0x8b */ { NULL, NULL, 0 },
1210 /* 0x8c */ { NULL, NULL, 0 },
1211 /* 0x8d */ { NULL, NULL, 0 },
1212 /* 0x8e */ { NULL, NULL, 0 },
1213 /* 0x8f */ { NULL, NULL, 0 },
1214 /* 0x90 */ { NULL, NULL, 0 },
1215 /* 0x91 */ { NULL, NULL, 0 },
1216 /* 0x92 */ { NULL, NULL, 0 },
1217 /* 0x93 */ { NULL, NULL, 0 },
1218 /* 0x94 */ { NULL, NULL, 0 },
1219 /* 0x95 */ { NULL, NULL, 0 },
1220 /* 0x96 */ { NULL, NULL, 0 },
1221 /* 0x97 */ { NULL, NULL, 0 },
1222 /* 0x98 */ { NULL, NULL, 0 },
1223 /* 0x99 */ { NULL, NULL, 0 },
1224 /* 0x9a */ { NULL, NULL, 0 },
1225 /* 0x9b */ { NULL, NULL, 0 },
1226 /* 0x9c */ { NULL, NULL, 0 },
1227 /* 0x9d */ { NULL, NULL, 0 },
1228 /* 0x9e */ { NULL, NULL, 0 },
1229 /* 0x9f */ { NULL, NULL, 0 },
1230 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1231 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1232 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1233 /* 0xa3 */ { NULL, NULL, 0 },
1234 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1235 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1236 /* 0xa6 */ { NULL, NULL, 0 },
1237 /* 0xa7 */ { NULL, NULL, 0 },
1238 /* 0xa8 */ { NULL, NULL, 0 },
1239 /* 0xa9 */ { NULL, NULL, 0 },
1240 /* 0xaa */ { NULL, NULL, 0 },
1241 /* 0xab */ { NULL, NULL, 0 },
1242 /* 0xac */ { NULL, NULL, 0 },
1243 /* 0xad */ { NULL, NULL, 0 },
1244 /* 0xae */ { NULL, NULL, 0 },
1245 /* 0xaf */ { NULL, NULL, 0 },
1246 /* 0xb0 */ { NULL, NULL, 0 },
1247 /* 0xb1 */ { NULL, NULL, 0 },
1248 /* 0xb2 */ { NULL, NULL, 0 },
1249 /* 0xb3 */ { NULL, NULL, 0 },
1250 /* 0xb4 */ { NULL, NULL, 0 },
1251 /* 0xb5 */ { NULL, NULL, 0 },
1252 /* 0xb6 */ { NULL, NULL, 0 },
1253 /* 0xb7 */ { NULL, NULL, 0 },
1254 /* 0xb8 */ { NULL, NULL, 0 },
1255 /* 0xb9 */ { NULL, NULL, 0 },
1256 /* 0xba */ { NULL, NULL, 0 },
1257 /* 0xbb */ { NULL, NULL, 0 },
1258 /* 0xbc */ { NULL, NULL, 0 },
1259 /* 0xbd */ { NULL, NULL, 0 },
1260 /* 0xbe */ { NULL, NULL, 0 },
1261 /* 0xbf */ { NULL, NULL, 0 },
1262 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1263 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1264 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1265 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1266 /* 0xc4 */ { NULL, NULL, 0 },
1267 /* 0xc5 */ { NULL, NULL, 0 },
1268 /* 0xc6 */ { NULL, NULL, 0 },
1269 /* 0xc7 */ { NULL, NULL, 0 },
1270 /* 0xc8 */ { NULL, NULL, 0 },
1271 /* 0xc9 */ { NULL, NULL, 0 },
1272 /* 0xca */ { NULL, NULL, 0 },
1273 /* 0xcb */ { NULL, NULL, 0 },
1274 /* 0xcc */ { NULL, NULL, 0 },
1275 /* 0xcd */ { NULL, NULL, 0 },
1276 /* 0xce */ { NULL, NULL, 0 },
1277 /* 0xcf */ { NULL, NULL, 0 },
1278 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1279 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1280 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1281 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1282 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1283 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1284 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1285 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1286 /* 0xd8 */ { NULL, NULL, 0 },
1287 /* 0xd9 */ { NULL, NULL, 0 },
1288 /* 0xda */ { NULL, NULL, 0 },
1289 /* 0xdb */ { NULL, NULL, 0 },
1290 /* 0xdc */ { NULL, NULL, 0 },
1291 /* 0xdd */ { NULL, NULL, 0 },
1292 /* 0xde */ { NULL, NULL, 0 },
1293 /* 0xdf */ { NULL, NULL, 0 },
1294 /* 0xe0 */ { NULL, NULL, 0 },
1295 /* 0xe1 */ { NULL, NULL, 0 },
1296 /* 0xe2 */ { NULL, NULL, 0 },
1297 /* 0xe3 */ { NULL, NULL, 0 },
1298 /* 0xe4 */ { NULL, NULL, 0 },
1299 /* 0xe5 */ { NULL, NULL, 0 },
1300 /* 0xe6 */ { NULL, NULL, 0 },
1301 /* 0xe7 */ { NULL, NULL, 0 },
1302 /* 0xe8 */ { NULL, NULL, 0 },
1303 /* 0xe9 */ { NULL, NULL, 0 },
1304 /* 0xea */ { NULL, NULL, 0 },
1305 /* 0xeb */ { NULL, NULL, 0 },
1306 /* 0xec */ { NULL, NULL, 0 },
1307 /* 0xed */ { NULL, NULL, 0 },
1308 /* 0xee */ { NULL, NULL, 0 },
1309 /* 0xef */ { NULL, NULL, 0 },
1310 /* 0xf0 */ { NULL, NULL, 0 },
1311 /* 0xf1 */ { NULL, NULL, 0 },
1312 /* 0xf2 */ { NULL, NULL, 0 },
1313 /* 0xf3 */ { NULL, NULL, 0 },
1314 /* 0xf4 */ { NULL, NULL, 0 },
1315 /* 0xf5 */ { NULL, NULL, 0 },
1316 /* 0xf6 */ { NULL, NULL, 0 },
1317 /* 0xf7 */ { NULL, NULL, 0 },
1318 /* 0xf8 */ { NULL, NULL, 0 },
1319 /* 0xf9 */ { NULL, NULL, 0 },
1320 /* 0xfa */ { NULL, NULL, 0 },
1321 /* 0xfb */ { NULL, NULL, 0 },
1322 /* 0xfc */ { NULL, NULL, 0 },
1323 /* 0xfd */ { NULL, NULL, 0 },
1324 /* 0xfe */ { NULL, NULL, 0 },
1325 /* 0xff */ { NULL, NULL, 0 }
1326
1327 };
1328
1329 /*******************************************************************
1330 allocate and initialize a reply packet
1331 ********************************************************************/
1332
1333 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1334 const char *inbuf, char **outbuf, uint8_t num_words,
1335 uint32_t num_bytes)
1336 {
1337 /*
1338 * Protect against integer wrap
1339 */
1340 if ((num_bytes > 0xffffff)
1341 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1342 char *msg;
1343 if (asprintf(&msg, "num_bytes too large: %u",
1344 (unsigned)num_bytes) == -1) {
1345 msg = CONST_DISCARD(char *, "num_bytes too large");
1346 }
1347 smb_panic(msg);
1348 }
1349
1350 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1351 smb_size + num_words*2 + num_bytes);
1352 if (*outbuf == NULL) {
1353 return false;
1354 }
1355
1356 construct_reply_common(req, inbuf, *outbuf);
1357 srv_set_message(*outbuf, num_words, num_bytes, false);
1358 /*
1359 * Zero out the word area, the caller has to take care of the bcc area
1360 * himself
1361 */
1362 if (num_words != 0) {
1363 memset(*outbuf + smb_vwv0, 0, num_words*2);
1364 }
1365
1366 return true;
1367 }
1368
1369 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1370 {
1371 char *outbuf;
1372 if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1373 num_bytes)) {
1374 smb_panic("could not allocate output buffer\n");
1375 }
1376 req->outbuf = (uint8_t *)outbuf;
1377 }
1378
1379
1380 /*******************************************************************
1381 Dump a packet to a file.
1382 ********************************************************************/
1383
1384 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1385 {
1386 int fd, i;
1387 char *fname = NULL;
1388 if (DEBUGLEVEL < 50) {
1389 return;
1390 }
1391
1392 if (len < 4) len = smb_len(data)+4;
1393 for (i=1;i<100;i++) {
1394 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1395 type ? "req" : "resp") == -1) {
1396 return;
1397 }
1398 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1399 if (fd != -1 || errno != EEXIST) break;
1400 }
1401 if (fd != -1) {
1402 ssize_t ret = write(fd, data, len);
1403 if (ret != len)
1404 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1405 close(fd);
1406 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1407 }
1408 SAFE_FREE(fname);
1409 }
1410
1411 /****************************************************************************
1412 Prepare everything for calling the actual request function, and potentially
1413 call the request function via the "new" interface.
1414
1415 Return False if the "legacy" function needs to be called, everything is
1416 prepared.
1417
1418 Return True if we're done.
1419
1420 I know this API sucks, but it is the one with the least code change I could
1421 find.
1422 ****************************************************************************/
1423
1424 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1425 {
1426 int flags;
1427 uint16 session_tag;
1428 connection_struct *conn = NULL;
1429 struct smbd_server_connection *sconn = req->sconn;
1430
1431 errno = 0;
1432
1433 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1434 * so subtract 4 from it. */
1435 if (!valid_smb_header(req->inbuf)
1436 || (size < (smb_size - 4))) {
1437 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1438 smb_len(req->inbuf)));
1439 exit_server_cleanly("Non-SMB packet");
1440 }
1441
1442 if (smb_messages[type].fn == NULL) {
1443 DEBUG(0,("Unknown message type %d!\n",type));
1444 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1445 reply_unknown_new(req, type);
1446 return NULL;
1447 }
1448
1449 flags = smb_messages[type].flags;
1450
1451 /* In share mode security we must ignore the vuid. */
1452 session_tag = (lp_security() == SEC_SHARE)
1453 ? UID_FIELD_INVALID : req->vuid;
1454 conn = req->conn;
1455
1456 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1457 (int)sys_getpid(), (unsigned long)conn));
1458
1459 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1460
1461 /* Ensure this value is replaced in the incoming packet. */
1462 SSVAL(req->inbuf,smb_uid,session_tag);
1463
1464 /*
1465 * Ensure the correct username is in current_user_info. This is a
1466 * really ugly bugfix for problems with multiple session_setup_and_X's
1467 * being done and allowing %U and %G substitutions to work correctly.
1468 * There is a reason this code is done here, don't move it unless you
1469 * know what you're doing... :-).
1470 * JRA.
1471 */
1472
1473 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1474 user_struct *vuser = NULL;
1475
1476 sconn->smb1.sessions.last_session_tag = session_tag;
1477 if(session_tag != UID_FIELD_INVALID) {
1478 vuser = get_valid_user_struct(sconn, session_tag);
1479 if (vuser) {
1480 set_current_user_info(
1481 vuser->server_info->sanitized_username,
1482 vuser->server_info->unix_name,
1483 vuser->server_info->info3->base.domain.string);
1484 }
1485 }
1486 }
1487
1488 /* Does this call need to be run as the connected user? */
1489 if (flags & AS_USER) {
1490
1491 /* Does this call need a valid tree connection? */
1492 if (!conn) {
1493 /*
1494 * Amazingly, the error code depends on the command
1495 * (from Samba4).
1496 */
1497 if (type == SMBntcreateX) {
1498 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1499 } else {
1500 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1501 }
1502 return NULL;
1503 }
1504
1505 if (!change_to_user(conn,session_tag)) {
1506 DEBUG(0, ("Error: Could not change to user. Removing "
1507 "deferred open, mid=%llu.\n",
1508 (unsigned long long)req->mid));
1509 reply_force_doserror(req, ERRSRV, ERRbaduid);
1510 return conn;
1511 }
1512
1513 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1514
1515 /* Does it need write permission? */
1516 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1517 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1518 return conn;
1519 }
1520
1521 /* IPC services are limited */
1522 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1523 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1524 return conn;
1525 }
1526 } else {
1527 /* This call needs to be run as root */
1528 change_to_root_user();
1529 }
1530
1531 /* load service specific parameters */
1532 if (conn) {
1533 if (req->encrypted) {
1534 conn->encrypted_tid = true;
1535 /* encrypted required from now on. */
1536 conn->encrypt_level = Required;
1537 } else if (ENCRYPTION_REQUIRED(conn)) {
1538 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1539 exit_server_cleanly("encryption required "
1540 "on connection");
1541 return conn;
1542 }
1543 }
1544
1545 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1546 (flags & (AS_USER|DO_CHDIR)
1547 ?True:False))) {
1548 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1549 return conn;
1550 }
1551 conn->num_smb_operations++;
1552 }
1553
1554 /* does this protocol need to be run as guest? */
1555 if ((flags & AS_GUEST)
1556 && (!change_to_guest() ||
1557 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1558 sconn->client_id.name,
1559 sconn->client_id.addr))) {
1560 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1561 return conn;
1562 }
1563
1564 smb_messages[type].fn(req);
1565 return req->conn;
1566 }
1567
1568 /****************************************************************************
1569 Construct a reply to the incoming packet.
1570 ****************************************************************************/
1571
1572 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1573 uint32_t seqnum, bool encrypted,
1574 struct smb_perfcount_data *deferred_pcd)
1575 {
1576 connection_struct *conn;
1577 struct smb_request *req;
1578
1579 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1580 smb_panic("could not allocate smb_request");
1581 }
1582
1583 if (!init_smb_request(req, smbd_server_conn, (uint8 *)inbuf,
1584 unread_bytes, encrypted, seqnum)) {
1585 exit_server_cleanly("Invalid SMB request");
1586 }
1587
1588 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1589
1590 /* we popped this message off the queue - keep original perf data */
1591 if (deferred_pcd)
1592 req->pcd = *deferred_pcd;
1593 else {
1594 SMB_PERFCOUNT_START(&req->pcd);
1595 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1596 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1597 }
1598
1599 conn = switch_message(req->cmd, req, size);
1600
1601 if (req->unread_bytes) {
1602 /* writeX failed. drain socket. */
1603 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1604 req->unread_bytes) {
1605 smb_panic("failed to drain pending bytes");
1606 }
1607 req->unread_bytes = 0;
1608 }
1609
1610 if (req->done) {
1611 TALLOC_FREE(req);
1612 return;
1613 }
1614
1615 if (req->outbuf == NULL) {
1616 return;
1617 }
1618
1619 if (CVAL(req->outbuf,0) == 0) {
1620 show_msg((char *)req->outbuf);
1621 }
1622
1623 if (!srv_send_smb(req->sconn,
1624 (char *)req->outbuf,
1625 true, req->seqnum+1,
1626 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1627 &req->pcd)) {
1628 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1629 }
1630
1631 TALLOC_FREE(req);
1632
1633 return;
1634 }
1635
1636 /****************************************************************************
1637 Process an smb from the client
1638 ****************************************************************************/
1639 static void process_smb(struct smbd_server_connection *conn,
1640 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1641 uint32_t seqnum, bool encrypted,
1642 struct smb_perfcount_data *deferred_pcd)
1643 {
1644 int msg_type = CVAL(inbuf,0);
1645
1646 DO_PROFILE_INC(smb_count);
1647
1648 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1649 smb_len(inbuf) ) );
1650 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1651 conn->trans_num, (int)nread, (unsigned int)unread_bytes));
1652
1653 if (msg_type != 0) {
1654 /*
1655 * NetBIOS session request, keepalive, etc.
1656 */
1657 reply_special(conn, (char *)inbuf);
1658 goto done;
1659 }
1660
1661 if (smbd_server_conn->using_smb2) {
1662 /* At this point we're not really using smb2,
1663 * we make the decision here.. */
1664 if (smbd_is_smb2_header(inbuf, nread)) {
1665 smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1666 return;
1667 } else if (nread >= smb_size && valid_smb_header(inbuf)
1668 && CVAL(inbuf, smb_com) != 0x72) {
1669 /* This is a non-negprot SMB1 packet.
1670 Disable SMB2 from now on. */
1671 smbd_server_conn->using_smb2 = false;
1672 }
1673 }
1674
1675 show_msg((char *)inbuf);
1676
1677 construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1678 conn->trans_num++;
1679
1680 done:
1681 conn->smb1.num_requests++;
1682
1683 /* The timeout_processing function isn't run nearly
1684 often enough to implement 'max log size' without
1685 overrunning the size of the file by many megabytes.
1686 This is especially true if we are running at debug
1687 level 10. Checking every 50 SMBs is a nice
1688 tradeoff of performance vs log file size overrun. */
1689
1690 if ((conn->smb1.num_requests % 50) == 0 &&
1691 need_to_check_log_size()) {
1692 change_to_root_user();
1693 check_log_size();
1694 }
1695 }
1696
1697 /****************************************************************************
1698 Return a string containing the function name of a SMB command.
1699 ****************************************************************************/
1700
1701 const char *smb_fn_name(int type)
1702 {
1703 const char *unknown_name = "SMBunknown";
1704
1705 if (smb_messages[type].name == NULL)
1706 return(unknown_name);
1707
1708 return(smb_messages[type].name);
1709 }
1710
1711 /****************************************************************************
1712 Helper functions for contruct_reply.
1713 ****************************************************************************/
1714
1715 void add_to_common_flags2(uint32 v)
1716 {
1717 common_flags2 |= v;
1718 }
1719
1720 void remove_from_common_flags2(uint32 v)
1721 {
1722 common_flags2 &= ~v;
1723 }
1724
1725 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1726 char *outbuf)
1727 {
1728 srv_set_message(outbuf,0,0,false);
1729
1730 SCVAL(outbuf, smb_com, req->cmd);
1731 SIVAL(outbuf,smb_rcls,0);
1732 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1733 SSVAL(outbuf,smb_flg2,
1734 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1735 common_flags2);
1736 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1737
1738 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1739 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1740 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1741 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1742 }
1743
1744 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1745 {
1746 construct_reply_common(req, (char *)req->inbuf, outbuf);
1747 }
1748
1749 /*
1750 * How many bytes have we already accumulated up to the current wct field
1751 * offset?
1752 */
1753
1754 size_t req_wct_ofs(struct smb_request *req)
1755 {
1756 size_t buf_size;
1757
1758 if (req->chain_outbuf == NULL) {
1759 return smb_wct - 4;
1760 }
1761 buf_size = talloc_get_size(req->chain_outbuf);
1762 if ((buf_size % 4) != 0) {
1763 buf_size += (4 - (buf_size % 4));
1764 }
1765 return buf_size - 4;
1766 }
1767
1768 /*
1769 * Hack around reply_nterror & friends not being aware of chained requests,
1770 * generating illegal (i.e. wct==0) chain replies.
1771 */
1772
1773 static void fixup_chain_error_packet(struct smb_request *req)
1774 {
1775 uint8_t *outbuf = req->outbuf;
1776 req->outbuf = NULL;
1777 reply_outbuf(req, 2, 0);
1778 memcpy(req->outbuf, outbuf, smb_wct);
1779 TALLOC_FREE(outbuf);
1780 SCVAL(req->outbuf, smb_vwv0, 0xff);
1781 }
1782
1783 /**
1784 * @brief Find the smb_cmd offset of the last command pushed
1785 * @param[in] buf The buffer we're building up
1786 * @retval Where can we put our next andx cmd?
1787 *
1788 * While chaining requests, the "next" request we're looking at needs to put
1789 * its SMB_Command before the data the previous request already built up added
1790 * to the chain. Find the offset to the place where we have to put our cmd.
1791 */
1792
1793 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1794 {
1795 uint8_t cmd;
1796 size_t ofs;
1797
1798 cmd = CVAL(buf, smb_com);
1799
1800 SMB_ASSERT(is_andx_req(cmd));
1801
1802 ofs = smb_vwv0;
1803
1804 while (CVAL(buf, ofs) != 0xff) {
1805
1806 if (!is_andx_req(CVAL(buf, ofs))) {
1807 return false;
1808 }
1809
1810 /*
1811 * ofs is from start of smb header, so add the 4 length
1812 * bytes. The next cmd is right after the wct field.
1813 */
1814 ofs = SVAL(buf, ofs+2) + 4 + 1;
1815
1816 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1817 }
1818
1819 *pofs = ofs;
1820 return true;
1821 }
1822
1823 /**
1824 * @brief Do the smb chaining at a buffer level
1825 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1826 * @param[in] smb_command The command that we want to issue
1827 * @param[in] wct How many words?
1828 * @param[in] vwv The words, already in network order
1829 * @param[in] bytes_alignment How shall we align "bytes"?
1830 * @param[in] num_bytes How many bytes?
1831 * @param[in] bytes The data the request ships
1832 *
1833 * smb_splice_chain() adds the vwv and bytes to the request already present in
1834 * *poutbuf.
1835 */
1836
1837 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1838 uint8_t wct, const uint16_t *vwv,
1839 size_t bytes_alignment,
1840 uint32_t num_bytes, const uint8_t *bytes)
1841 {
1842 uint8_t *outbuf;
1843 size_t old_size, new_size;
1844 size_t ofs;
1845 size_t chain_padding = 0;
1846 size_t bytes_padding = 0;
1847 bool first_request;
1848
1849 old_size = talloc_get_size(*poutbuf);
1850
1851 /*
1852 * old_size == smb_wct means we're pushing the first request in for
1853 * libsmb/
1854 */
1855
1856 first_request = (old_size == smb_wct);
1857
1858 if (!first_request && ((old_size % 4) != 0)) {
1859 /*
1860 * Align the wct field of subsequent requests to a 4-byte
1861 * boundary
1862 */
1863 chain_padding = 4 - (old_size % 4);
1864 }
1865
1866 /*
1867 * After the old request comes the new wct field (1 byte), the vwv's
1868 * and the num_bytes field. After at we might need to align the bytes
1869 * given to us to "bytes_alignment", increasing the num_bytes value.
1870 */
1871
1872 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1873
1874 if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1875 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1876 }
1877
1878 new_size += bytes_padding + num_bytes;
1879
1880 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1881 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1882 (unsigned)new_size));
1883 return false;
1884 }
1885
1886 outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1887 if (outbuf == NULL) {
1888 DEBUG(0, ("talloc failed\n"));
1889 return false;
1890 }
1891 *poutbuf = outbuf;
1892
1893 if (first_request) {
1894 SCVAL(outbuf, smb_com, smb_command);
1895 } else {
1896 size_t andx_cmd_ofs;
1897
1898 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1899 DEBUG(1, ("invalid command chain\n"));
1900 *poutbuf = TALLOC_REALLOC_ARRAY(
1901 NULL, *poutbuf, uint8_t, old_size);
1902 return false;
1903 }
1904
1905 if (chain_padding != 0) {
1906 memset(outbuf + old_size, 0, chain_padding);
1907 old_size += chain_padding;
1908 }
1909
1910 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1911 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1912 }
1913
1914 ofs = old_size;
1915
1916 /*
1917 * Push the chained request:
1918 *
1919 * wct field
1920 */
1921
1922 SCVAL(outbuf, ofs, wct);
1923 ofs += 1;
1924
1925 /*
1926 * vwv array
1927 */
1928
1929 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1930 ofs += sizeof(uint16_t) * wct;
1931
1932 /*
1933 * bcc (byte count)
1934 */
1935
1936 SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1937 ofs += sizeof(uint16_t);
1938
1939 /*
1940 * padding
1941 */
1942
1943 if (bytes_padding != 0) {
1944 memset(outbuf + ofs, 0, bytes_padding);
1945 ofs += bytes_padding;
1946 }
1947
1948 /*
1949 * The bytes field
1950 */
1951
1952 memcpy(outbuf + ofs, bytes, num_bytes);
1953
1954 return true;
1955 }
1956
1957 /****************************************************************************
1958 Construct a chained reply and add it to the already made reply
1959 ****************************************************************************/
1960
1961 void chain_reply(struct smb_request *req)
1962 {
1963 size_t smblen = smb_len(req->inbuf);
1964 size_t already_used, length_needed;
1965 uint8_t chain_cmd;
1966 uint32_t chain_offset; /* uint32_t to avoid overflow */
1967
1968 uint8_t wct;
1969 uint16_t *vwv;
1970 uint16_t buflen;
1971 uint8_t *buf;
1972
1973 if (IVAL(req->outbuf, smb_rcls) != 0) {
1974 fixup_chain_error_packet(req);
1975 }
1976
1977 /*
1978 * Any of the AndX requests and replies have at least a wct of
1979 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1980 * beginning of the SMB header to the next wct field.
1981 *
1982 * None of the AndX requests put anything valuable in vwv[0] and [1],
1983 * so we can overwrite it here to form the chain.
1984 */
1985
1986 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1987 if (req->chain_outbuf == NULL) {
1988 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1989 req, req->outbuf, uint8_t,
1990 smb_len(req->outbuf) + 4);
1991 if (req->chain_outbuf == NULL) {
1992 smb_panic("talloc failed");
1993 }
1994 }
1995 req->outbuf = NULL;
1996 goto error;
1997 }
1998
1999 /*
2000 * Here we assume that this is the end of the chain. For that we need
2001 * to set "next command" to 0xff and the offset to 0. If we later find
2002 * more commands in the chain, this will be overwritten again.
2003 */
2004
2005 SCVAL(req->outbuf, smb_vwv0, 0xff);
2006 SCVAL(req->outbuf, smb_vwv0+1, 0);
2007 SSVAL(req->outbuf, smb_vwv1, 0);
2008
2009 if (req->chain_outbuf == NULL) {
2010 /*
2011 * In req->chain_outbuf we collect all the replies. Start the
2012 * chain by copying in the first reply.
2013 *
2014 * We do the realloc because later on we depend on
2015 * talloc_get_size to determine the length of
2016 * chain_outbuf. The reply_xxx routines might have
2017 * over-allocated (reply_pipe_read_and_X used to be such an
2018 * example).
2019 */
2020 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
2021 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
2022 if (req->chain_outbuf == NULL) {
2023 smb_panic("talloc failed");
2024 }
2025 req->outbuf = NULL;
2026 } else {
2027 /*
2028 * Update smb headers where subsequent chained commands
2029 * may have updated them.
2030 */
2031 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
2032 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
2033
2034 if (!smb_splice_chain(&req->chain_outbuf,
2035 CVAL(req->outbuf, smb_com),
2036 CVAL(req->outbuf, smb_wct),
2037 (uint16_t *)(req->outbuf + smb_vwv),
2038 0, smb_buflen(req->outbuf),
2039 (uint8_t *)smb_buf(req->outbuf))) {
2040 goto error;
2041 }
2042 TALLOC_FREE(req->outbuf);
2043 }
2044
2045 /*
2046 * We use the old request's vwv field to grab the next chained command
2047 * and offset into the chained fields.
2048 */
2049
2050 chain_cmd = CVAL(req->vwv+0, 0);
2051 chain_offset = SVAL(req->vwv+1, 0);
2052
2053 if (chain_cmd == 0xff) {
2054 /*
2055 * End of chain, no more requests from the client. So ship the
2056 * replies.
2057 */
2058 smb_setlen((char *)(req->chain_outbuf),
2059 talloc_get_size(req->chain_outbuf) - 4);
2060
2061 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2062 true, req->seqnum+1,
2063 IS_CONN_ENCRYPTED(req->conn)
2064 ||req->encrypted,
2065 &req->pcd)) {
2066 exit_server_cleanly("chain_reply: srv_send_smb "
2067 "failed.");
2068 }
2069 TALLOC_FREE(req->chain_outbuf);
2070 req->done = true;
2071 return;
2072 }
2073
2074 /* add a new perfcounter for this element of chain */
2075 SMB_PERFCOUNT_ADD(&req->pcd);
2076 SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2077 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2078
2079 /*
2080 * Check if the client tries to fool us. The request so far uses the
2081 * space to the end of the byte buffer in the request just
2082 * processed. The chain_offset can't point into that area. If that was
2083 * the case, we could end up with an endless processing of the chain,
2084 * we would always handle the same request.
2085 */
2086
2087 already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2088 if (chain_offset < already_used) {
2089 goto error;
2090 }
2091
2092 /*
2093 * Next check: Make sure the chain offset does not point beyond the
2094 * overall smb request length.
2095 */
2096
2097 length_needed = chain_offset+1; /* wct */
2098 if (length_needed > smblen) {
2099 goto error;
2100 }
2101
2102 /*
2103 * Now comes the pointer magic. Goal here is to set up req->vwv and
2104 * req->buf correctly again to be able to call the subsequent
2105 * switch_message(). The chain offset (the former vwv[1]) points at
2106 * the new wct field.
2107 */
2108
2109 wct = CVAL(smb_base(req->inbuf), chain_offset);
2110
2111 /*
2112 * Next consistency check: Make the new vwv array fits in the overall
2113 * smb request.
2114 */
2115
2116 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2117 if (length_needed > smblen) {
2118 goto error;
2119 }
2120 vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2121
2122 /*
2123 * Now grab the new byte buffer....
2124 */
2125
2126 buflen = SVAL(vwv+wct, 0);
2127
2128 /*
2129 * .. and check that it fits.
2130 */
2131
2132 length_needed += buflen;
2133 if (length_needed > smblen) {
2134 goto error;
2135 }
2136 buf = (uint8_t *)(vwv+wct+1);
2137
2138 req->cmd = chain_cmd;
2139 req->wct = wct;
2140 req->vwv = vwv;
2141 req->buflen = buflen;
2142 req->buf = buf;
2143
2144 switch_message(chain_cmd, req, smblen);
2145
2146 if (req->outbuf == NULL) {
2147 /*
2148 * This happens if the chained command has suspended itself or
2149 * if it has called srv_send_smb() itself.
2150 */
2151 return;
2152 }
2153
2154 /*
2155 * We end up here if the chained command was not itself chained or
2156 * suspended, but for example a close() command. We now need to splice
2157 * the chained commands' outbuf into the already built up chain_outbuf
2158 * and ship the result.
2159 */
2160 goto done;
2161
2162 error:
2163 /*
2164 * We end up here if there's any error in the chain syntax. Report a
2165 * DOS error, just like Windows does.
2166 */
2167 reply_force_doserror(req, ERRSRV, ERRerror);
2168 fixup_chain_error_packet(req);
2169
2170 done:
2171 /*
2172 * This scary statement intends to set the
2173 * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2174 * to the value req->outbuf carries
2175 */
2176 SSVAL(req->chain_outbuf, smb_flg2,
2177 (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2178 | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2179
2180 /*
2181 * Transfer the error codes from the subrequest to the main one
2182 */
2183 SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2184 SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2185
2186 if (!smb_splice_chain(&req->chain_outbuf,
2187 CVAL(req->outbuf, smb_com),
2188 CVAL(req->outbuf, smb_wct),
2189 (uint16_t *)(req->outbuf + smb_vwv),
2190 0, smb_buflen(req->outbuf),
2191 (uint8_t *)smb_buf(req->outbuf))) {
2192 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2193 }
2194 TALLOC_FREE(req->outbuf);
2195
2196 smb_setlen((char *)(req->chain_outbuf),
2197 talloc_get_size(req->chain_outbuf) - 4);
2198
2199 show_msg((char *)(req->chain_outbuf));
2200
2201 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2202 true, req->seqnum+1,
2203 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2204 &req->pcd)) {
2205 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2206 }
2207 TALLOC_FREE(req->chain_outbuf);
2208 req->done = true;
2209 }
2210
2211 /****************************************************************************
2212 Check if services need reloading.
2213 ****************************************************************************/
2214
2215 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2216 {
2217 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2218
2219 if(last_smb_conf_reload_time == 0) {
2220 last_smb_conf_reload_time = t;
2221 /* Our printing subsystem might not be ready at smbd start up.
2222 Then no printer is available till the first printers check
2223 is performed. A lower initial interval circumvents this. */
2224 if ( printcap_cache_time > 60 )
2225 last_printer_reload_time = t - printcap_cache_time + 60;
2226 else
2227 last_printer_reload_time = t;
2228 }
2229
2230 if (mypid != getpid()) { /* First time or fork happened meanwhile */
2231 /* randomize over 60 second the printcap reload to avoid all
2232 * process hitting cupsd at the same time */
2233 int time_range = 60;
2234
2235 last_printer_reload_time += random() % time_range;
2236 mypid = getpid();
2237 }
2238
2239 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2240 reload_services(sconn->msg_ctx, sconn->sock, True);
2241 last_smb_conf_reload_time = t;
2242 }
2243
2244 /* 'printcap cache time = 0' disable the feature */
2245
2246 if ( printcap_cache_time != 0 )
2247 {
2248 /* see if it's time to reload or if the clock has been set back */
2249
2250 if ( (t >= last_printer_reload_time+printcap_cache_time)
2251 || (t-last_printer_reload_time < 0) )
2252 {
2253 DEBUG( 3,( "Printcap cache time expired.\n"));
2254 reload_printers(sconn->msg_ctx);
2255 last_printer_reload_time = t;
2256 }
2257 }
2258 }
2259
2260 static bool fd_is_readable(int fd)
2261 {
2262 fd_set fds;
2263 struct timeval timeout = {0, };
2264 int ret;
2265
2266 FD_ZERO(&fds);
2267 FD_SET(fd, &fds);
2268
2269 ret = sys_select(fd+1, &fds, NULL, NULL, &timeout);
2270 if (ret == -1) {
2271 return false;
2272 }
2273 return FD_ISSET(fd, &fds);
2274 }
2275
2276 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2277 {
2278 /* TODO: make write nonblocking */
2279 }
2280
2281 static void smbd_server_connection_read_handler(
2282 struct smbd_server_connection *conn, int fd)
2283 {
2284 uint8_t *inbuf = NULL;
2285 size_t inbuf_len = 0;
2286 size_t unread_bytes = 0;
2287 bool encrypted = false;
2288 TALLOC_CTX *mem_ctx = talloc_tos();
2289 NTSTATUS status;
2290 uint32_t seqnum;
2291
2292 bool from_client = (conn->sock == fd);
2293
2294 if (from_client) {
2295 smbd_lock_socket(conn);
2296
2297 if (!fd_is_readable(fd)) {
2298 DEBUG(10,("the echo listener was faster\n"));
2299 smbd_unlock_socket(conn);
2300 return;
2301 }
2302
2303 /* TODO: make this completely nonblocking */
2304 status = receive_smb_talloc(mem_ctx, fd,
2305 (char **)(void *)&inbuf,
2306 0, /* timeout */
2307 &unread_bytes,
2308 &encrypted,
2309 &inbuf_len, &seqnum,
2310 false /* trusted channel */);
2311 smbd_unlock_socket(conn);
2312 } else {
2313 /* TODO: make this completely nonblocking */
2314 status = receive_smb_talloc(mem_ctx, fd,
2315 (char **)(void *)&inbuf,
2316 0, /* timeout */
2317 &unread_bytes,
2318 &encrypted,
2319 &inbuf_len, &seqnum,
2320 true /* trusted channel */);
2321 }
2322
2323 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2324 goto process;
2325 }
2326 if (NT_STATUS_IS_ERR(status)) {
2327 exit_server_cleanly("failed to receive smb request");
2328 }
2329 if (!NT_STATUS_IS_OK(status)) {
2330 return;
2331 }
2332
2333 process:
2334 process_smb(conn, inbuf, inbuf_len, unread_bytes,
2335 seqnum, encrypted, NULL);
2336 }
2337
2338 static void smbd_server_connection_handler(struct event_context *ev,
2339 struct fd_event *fde,
2340 uint16_t flags,
2341 void *private_data)
2342 {
2343 struct smbd_server_connection *conn = talloc_get_type(private_data,
2344 struct smbd_server_connection);
2345
2346 if (flags & EVENT_FD_WRITE) {
2347 smbd_server_connection_write_handler(conn);
2348 return;
2349 }
2350 if (flags & EVENT_FD_READ) {
2351 smbd_server_connection_read_handler(conn, conn->sock);
2352 return;
2353 }
2354 }
2355
2356 static void smbd_server_echo_handler(struct event_context *ev,
2357 struct fd_event *fde,
2358 uint16_t flags,
2359 void *private_data)
2360 {
2361 struct smbd_server_connection *conn = talloc_get_type(private_data,
2362 struct smbd_server_connection);
2363
2364 if (flags & EVENT_FD_WRITE) {
2365 smbd_server_connection_write_handler(conn);
2366 return;
2367 }
2368 if (flags & EVENT_FD_READ) {
2369 smbd_server_connection_read_handler(
2370 conn, conn->smb1.echo_handler.trusted_fd);
2371 return;
2372 }
2373 }
2374
2375 /****************************************************************************
2376 received when we should release a specific IP
2377 ****************************************************************************/
2378 static void release_ip(const char *ip, void *priv)
2379 {
2380 const char *addr = (const char *)priv;
2381 const char *p = addr;
2382
2383 if (strncmp("::ffff:", addr, 7) == 0) {
2384 p = addr + 7;
2385 }
2386
2387 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2388 /* we can't afford to do a clean exit - that involves
2389 database writes, which would potentially mean we
2390 are still running after the failover has finished -
2391 we have to get rid of this process ID straight
2392 away */
2393 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2394 ip));
2395 /* note we must exit with non-zero status so the unclean handler gets
2396 called in the parent, so that the brl database is tickled */
2397 _exit(1);
2398 }
2399 }
2400
2401 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2402 uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2403 {
2404 struct smbd_server_connection *sconn = talloc_get_type_abort(
2405 private_data, struct smbd_server_connection);
2406
2407 release_ip((char *)data->data, sconn->client_id.addr);
2408 }
2409
2410 #ifdef CLUSTER_SUPPORT
2411 static int client_get_tcp_info(struct sockaddr_storage *server,
2412 struct sockaddr_storage *client)
2413 {
2414 socklen_t length;
2415 if (server_fd == -1) {
2416 return -1;
2417 }
2418 length = sizeof(*server);
2419 if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
2420 return -1;
2421 }
2422 length = sizeof(*client);
2423 if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
2424 return -1;
2425 }
2426 return 0;
2427 }
2428 #endif
2429
2430 /*
2431 * Send keepalive packets to our client
2432 */
2433 static bool keepalive_fn(const struct timeval *now, void *private_data)
2434 {
2435 struct smbd_server_connection *sconn = smbd_server_conn;
2436 bool ret;
2437
2438 if (sconn->using_smb2) {
2439 /* Don't do keepalives on an SMB2 connection. */
2440 return false;
2441 }
2442
2443 smbd_lock_socket(smbd_server_conn);
2444 ret = send_keepalive(sconn->sock);
2445 smbd_unlock_socket(smbd_server_conn);
2446
2447 if (!ret) {
2448 char addr[INET6_ADDRSTRLEN];
2449 /*
2450 * Try and give an error message saying what
2451 * client failed.
2452 */
2453 DEBUG(0, ("send_keepalive failed for client %s. "
2454 "Error %s - exiting\n",
2455 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2456 strerror(errno)));
2457 return False;
2458 }
2459 return True;
2460 }
2461
2462 /*
2463 * Do the recurring check if we're idle
2464 */
2465 static bool deadtime_fn(const struct timeval *now, void *private_data)
2466 {
2467 struct smbd_server_connection *sconn =
2468 (struct smbd_server_connection *)private_data;
2469
2470 if (sconn->using_smb2) {
2471 /* TODO: implement real idle check */
2472 if (sconn->smb2.sessions.list) {
2473 return true;
2474 }
2475 DEBUG( 2, ( "Closing idle SMB2 connection\n" ) );
2476 messaging_send(sconn->msg_ctx, procid_self(),
2477 MSG_SHUTDOWN, &data_blob_null);
2478 return false;
2479 }
2480
2481 if ((conn_num_open(sconn) == 0)
2482 || (conn_idle_all(sconn, now->tv_sec))) {
2483 DEBUG( 2, ( "Closing idle SMB1 connection\n" ) );
2484 messaging_send(sconn->msg_ctx, procid_self(),
2485 MSG_SHUTDOWN, &data_blob_null);
2486 return False;
2487 }
2488
2489 return True;
2490 }
2491
2492 /*
2493 * Do the recurring log file and smb.conf reload checks.
2494 */
2495
2496 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2497 {
2498 struct smbd_server_connection *sconn = talloc_get_type_abort(
2499 private_data, struct smbd_server_connection);
2500 change_to_root_user();
2501
2502 /* update printer queue caches if necessary */
2503 update_monitored_printq_cache(sconn->msg_ctx);
2504
2505 /* check if we need to reload services */
2506 check_reload(sconn, time(NULL));
2507
2508 /* Change machine password if neccessary. */
2509 attempt_machine_password_change();
2510
2511 /*
2512 * Force a log file check.
2513 */
2514 force_check_log_size();
2515 check_log_size();
2516 return true;
2517 }
2518
2519 static int create_unlink_tmp(const char *dir)
2520 {
2521 char *fname;
2522 int fd;
2523
2524 fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2525 if (fname == NULL) {
2526 errno = ENOMEM;
2527 return -1;
2528 }
2529 fd = mkstemp(fname);
2530 if (fd == -1) {
2531 TALLOC_FREE(fname);
2532 return -1;
2533 }
2534 if (unlink(fname) == -1) {
2535 int sys_errno = errno;
2536 close(fd);
2537 TALLOC_FREE(fname);
2538 errno = sys_errno;
2539 return -1;
2540 }
2541 TALLOC_FREE(fname);
2542 return fd;
2543 }
2544
2545 struct smbd_echo_state {
2546 struct tevent_context *ev;
2547 struct iovec *pending;
2548 struct smbd_server_connection *sconn;
2549 int parent_pipe;
2550
2551 struct tevent_fd *parent_fde;
2552
2553 struct tevent_fd *read_fde;
2554 struct tevent_req *write_req;
2555 };
2556
2557 static void smbd_echo_writer_done(struct tevent_req *req);
2558
2559 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2560 {
2561 int num_pending;
2562
2563 if (state->write_req != NULL) {
2564 return;
2565 }
2566
2567 num_pending = talloc_array_length(state->pending);
2568 if (num_pending == 0) {
2569 return;
2570 }
2571
2572 state->write_req = writev_send(state, state->ev, NULL,
2573 state->parent_pipe, false,
2574 state->pending, num_pending);
2575 if (state->write_req == NULL) {
2576 DEBUG(1, ("writev_send failed\n"));
2577 exit(1);
2578 }
2579
2580 talloc_steal(state->write_req, state->pending);
2581 state->pending = NULL;
2582
2583 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2584 state);
2585 }
2586
2587 static void smbd_echo_writer_done(struct tevent_req *req)
2588 {
2589 struct smbd_echo_state *state = tevent_req_callback_data(
2590 req, struct smbd_echo_state);
2591 ssize_t written;
2592 int err;
2593
2594 written = writev_recv(req, &err);
2595 TALLOC_FREE(req);
2596 state->write_req = NULL;
2597 if (written == -1) {
2598 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2599 exit(1);
2600 }
2601 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2602 smbd_echo_activate_writer(state);
2603 }
2604
2605 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2606 uint32_t seqnum)
2607 {
2608 struct smb_request req;
2609 uint16_t num_replies;
2610 size_t out_len;
2611 char *outbuf;
2612 bool ok;
2613
2614 if (inbuf_len < smb_size) {
2615 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2616 return false;
2617 }
2618 if (!valid_smb_header(inbuf)) {
2619 DEBUG(10, ("Got invalid SMB header\n"));
2620 return false;
2621 }
2622
2623 if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2624 seqnum)) {
2625 return false;
2626 }
2627 req.inbuf = inbuf;
2628
2629 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2630 smb_messages[req.cmd].name
2631 ? smb_messages[req.cmd].name : "unknown"));
2632
2633 if (req.cmd != SMBecho) {
2634 return false;
2635 }
2636 if (req.wct < 1) {
2637 return false;
2638 }
2639
2640 num_replies = SVAL(req.vwv+0, 0);
2641 if (num_replies != 1) {
2642 /* Not a Windows "Hey, you're still there?" request */
2643 return false;
2644 }
2645
2646 if (!create_outbuf(talloc_tos(), &req, (char *)req.inbuf, &outbuf,
2647 1, req.buflen)) {
2648 DEBUG(10, ("create_outbuf failed\n"));
2649 return false;
2650 }
2651 req.outbuf = (uint8_t *)outbuf;
2652
2653 SSVAL(req.outbuf, smb_vwv0, num_replies);
2654
2655 if (req.buflen > 0) {
2656 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2657 }
2658
2659 out_len = smb_len(req.outbuf) + 4;
2660
2661 ok = srv_send_smb(req.sconn,
2662 (char *)outbuf,
2663 true, seqnum+1,
2664 false, &req.pcd);
2665 TALLOC_FREE(outbuf);
2666 if (!ok) {
2667 exit(1);
2668 }
2669
2670 return true;
2671 }
2672
2673 static void smbd_echo_exit(struct tevent_context *ev,
2674 struct tevent_fd *fde, uint16_t flags,
2675 void *private_data)
2676 {
2677 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2678 exit(0);
2679 }
2680
2681 static void smbd_echo_reader(struct tevent_context *ev,
2682 struct tevent_fd *fde, uint16_t flags,
2683 void *private_data)
2684 {
2685 struct smbd_echo_state *state = talloc_get_type_abort(
2686 private_data, struct smbd_echo_state);
2687 struct smbd_server_connection *sconn = state->sconn;
2688 size_t unread, num_pending;
2689 NTSTATUS status;
2690 struct iovec *tmp;
2691 uint32_t seqnum = 0;
2692 bool reply;
2693 bool ok;
2694 bool encrypted = false;
2695
2696 smb_msleep(1000);
2697
2698 ok = smbd_lock_socket_internal(sconn);
2699 if (!ok) {
2700 DEBUG(0, ("%s: failed to lock socket\n",
2701 __location__));
2702 exit(1);
2703 }
2704
2705 if (!fd_is_readable(sconn->sock)) {
2706 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2707 (int)sys_getpid()));
2708 ok = smbd_unlock_socket_internal(sconn);
2709 if (!ok) {
2710 DEBUG(1, ("%s: failed to unlock socket in\n",
2711 __location__));
2712 exit(1);
2713 }
2714 return;
2715 }
2716
2717 num_pending = talloc_array_length(state->pending);
2718 tmp = talloc_realloc(state, state->pending, struct iovec,
2719 num_pending+1);
2720 if (tmp == NULL) {
2721 DEBUG(1, ("talloc_realloc failed\n"));
2722 exit(1);
2723 }
2724 state->pending = tmp;
2725
2726 DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2727
2728 status = receive_smb_talloc(state->pending, sconn->sock,
2729 (char **)(void *)&state->pending[num_pending].iov_base,
2730 0 /* timeout */,
2731 &unread,
2732 &encrypted,
2733 &state->pending[num_pending].iov_len,
2734 &seqnum,
2735 false /* trusted_channel*/);
2736 if (!NT_STATUS_IS_OK(status)) {
2737 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2738 (int)sys_getpid(), nt_errstr(status)));
2739 exit(1);
2740 }
2741
2742 ok = smbd_unlock_socket_internal(sconn);
2743 if (!ok) {
2744 DEBUG(1, ("%s: failed to unlock socket in\n",
2745 __location__));
2746 exit(1);
2747 }
2748
2749 /*
2750 * place the seqnum in the packet so that the main process can reply
2751 * with signing
2752 */
2753 SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field, seqnum);
2754 SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2755
2756 reply = smbd_echo_reply((uint8_t *)state->pending[num_pending].iov_base,
2757 state->pending[num_pending].iov_len,
2758 seqnum);
2759 if (reply) {
2760 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2761 /* no check, shrinking by some bytes does not fail */
2762 state->pending = talloc_realloc(state, state->pending,
2763 struct iovec,
2764 num_pending);
2765 } else {
2766 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2767 smbd_echo_activate_writer(state);
2768 }
2769 }
2770
2771 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2772 int parent_pipe)
2773 {
2774 struct smbd_echo_state *state;
2775
2776 state = talloc_zero(sconn, struct smbd_echo_state);
2777 if (state == NULL) {
2778 DEBUG(1, ("talloc failed\n"));
2779 return;
2780 }
2781 state->sconn = sconn;
2782 state->parent_pipe = parent_pipe;
2783 state->ev = s3_tevent_context_init(state);
2784 if (state->ev == NULL) {
2785 DEBUG(1, ("tevent_context_init failed\n"));
2786 TALLOC_FREE(state);
2787 return;
2788 }
2789 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2790 TEVENT_FD_READ, smbd_echo_exit,
2791 state);
2792 if (state->parent_fde == NULL) {
2793 DEBUG(1, ("tevent_add_fd failed\n"));
2794 TALLOC_FREE(state);
2795 return;
2796 }
2797 state->read_fde = tevent_add_fd(state->ev, state, sconn->sock,
2798 TEVENT_FD_READ, smbd_echo_reader,
2799 state);
2800 if (state->read_fde == NULL) {
2801 DEBUG(1, ("tevent_add_fd failed\n"));
2802 TALLOC_FREE(state);
2803 return;
2804 }
2805
2806 while (true) {
2807 if (tevent_loop_once(state->ev) == -1) {
2808 DEBUG(1, ("tevent_loop_once failed: %s\n",
2809 strerror(errno)));
2810 break;
2811 }
2812 }
2813 TALLOC_FREE(state);
2814 }
2815
2816 /*
2817 * Handle SMBecho requests in a forked child process
2818 */
2819 static bool fork_echo_handler(struct smbd_server_connection *sconn)
2820 {
2821 int listener_pipe[2];
2822 int res;
2823 pid_t child;
2824
2825 res = pipe(listener_pipe);
2826 if (res == -1) {
2827 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2828 return false;
2829 }
2830 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2831 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2832 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2833 goto fail;
2834 }
2835
2836 child = sys_fork();
2837 if (child == 0) {
2838 NTSTATUS status;
2839
2840 close(listener_pipe[0]);
2841
2842 status = reinit_after_fork(sconn->msg_ctx,
2843 smbd_event_context(),
2844 procid_self(), false);
2845 if (!NT_STATUS_IS_OK(status)) {
2846 DEBUG(1, ("reinit_after_fork failed: %s\n",
2847 nt_errstr(status)));
2848 exit(1);
2849 }
2850 smbd_echo_loop(sconn, listener_pipe[1]);
2851 exit(0);
2852 }
2853 close(listener_pipe[1]);
2854 listener_pipe[1] = -1;
2855 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2856
2857 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2858
2859 /*
2860 * Without smb signing this is the same as the normal smbd
2861 * listener. This needs to change once signing comes in.
2862 */
2863 sconn->smb1.echo_handler.trusted_fde = event_add_fd(smbd_event_context(),
2864 sconn,
2865 sconn->smb1.echo_handler.trusted_fd,
2866 EVENT_FD_READ,
2867 smbd_server_echo_handler,
2868 sconn);
2869 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2870 DEBUG(1, ("event_add_fd failed\n"));
2871 goto fail;
2872 }
2873
2874 return true;
2875
2876 fail:
2877 if (listener_pipe[0] != -1) {
2878 close(listener_pipe[0]);
2879 }
2880 if (listener_pipe[1] != -1) {
2881 close(listener_pipe[1]);
2882 }
2883 sconn->smb1.echo_handler.trusted_fd = -1;
2884 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2885 close(sconn->smb1.echo_handler.socket_lock_fd);
2886 }
2887 sconn->smb1.echo_handler.trusted_fd = -1;
2888 sconn->smb1.echo_handler.socket_lock_fd = -1;
2889 return false;
2890 }
2891
2892 #if CLUSTER_SUPPORT
2893
2894 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2895 struct sockaddr_storage *srv,
2896 struct sockaddr_storage *clnt)
2897 {
2898 struct ctdbd_connection *cconn;
2899 char tmp_addr[INET6_ADDRSTRLEN];
2900 char *addr;
2901
2902 cconn = messaging_ctdbd_connection(procid_self());
2903 if (cconn == NULL) {
2904 return NT_STATUS_NO_MEMORY;
2905 }
2906
2907 client_socket_addr(sconn->sock, addr, sizeof(addr));
2908 addr = talloc_strdup(cconn, tmp_addr);
2909 if (addr == NULL) {
2910 return NT_STATUS_NO_MEMORY;
2911 }
2912 return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2913 }
2914
2915 #endif
2916
2917 /****************************************************************************
2918 Process commands from the client
2919 ****************************************************************************/
2920
2921 void smbd_process(struct smbd_server_connection *sconn)
2922 {
2923 TALLOC_CTX *frame = talloc_stackframe();
2924 struct sockaddr_storage ss;
2925 struct sockaddr *sa = NULL;
2926 socklen_t sa_socklen;
2927 struct tsocket_address *local_address = NULL;
2928 struct tsocket_address *remote_address = NULL;
2929 const char *remaddr = NULL;
2930 int ret;
2931
2932 if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2933 lp_security() != SEC_SHARE &&
2934 !lp_async_smb_echo_handler()) {
2935 /*
2936 * We're not making the desion here,
2937 * we're just allowing the client
2938 * to decide between SMB1 and SMB2
2939 * with the first negprot
2940 * packet.
2941 */
2942 sconn->using_smb2 = true;
2943 }
2944
2945 /* Ensure child is set to blocking mode */
2946 set_blocking(sconn->sock,True);
2947
2948 set_socket_options(sconn->sock, "SO_KEEPALIVE");
2949 set_socket_options(sconn->sock, lp_socket_options());
2950
2951 sa = (struct sockaddr *)(void *)&ss;
2952 sa_socklen = sizeof(ss);
2953 ret = getpeername(sconn->sock, sa, &sa_socklen);
2954 if (ret != 0) {
2955 int level = (errno == ENOTCONN)?2:0;
2956 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2957 exit_server_cleanly("getpeername() failed.\n");
2958 }
2959 ret = tsocket_address_bsd_from_sockaddr(sconn,
2960 sa, sa_socklen,
2961 &remote_address);
2962 if (ret != 0) {
2963 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2964 __location__, strerror(errno)));
2965 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2966 }
2967
2968 sa = (struct sockaddr *)(void *)&ss;
2969 sa_socklen = sizeof(ss);
2970 ret = getsockname(sconn->sock, sa, &sa_socklen);
2971 if (ret != 0) {
2972 int level = (errno == ENOTCONN)?2:0;
2973 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2974 exit_server_cleanly("getsockname() failed.\n");
2975 }
2976 ret = tsocket_address_bsd_from_sockaddr(sconn,
2977 sa, sa_socklen,
2978 &local_address);
2979 if (ret != 0) {
2980 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2981 __location__, strerror(errno)));
2982 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2983 }
2984
2985 sconn->local_address = local_address;
2986 sconn->remote_address = remote_address;
2987
2988 if (tsocket_address_is_inet(remote_address, "ip")) {
2989 remaddr = tsocket_address_inet_addr_string(
2990 sconn->remote_address,
2991 talloc_tos());
2992 if (remaddr == NULL) {
2993
2994 }
2995 } else {
2996 remaddr = "0.0.0.0";
2997 }
2998
2999 /* this is needed so that we get decent entries
3000 in smbstatus for port 445 connects */
3001 set_remote_machine_name(remaddr, false);
3002 reload_services(sconn->msg_ctx, sconn->sock, true);
3003
3004 /*
3005 * Before the first packet, check the global hosts allow/ hosts deny
3006 * parameters before doing any parsing of packets passed to us by the
3007 * client. This prevents attacks on our parsing code from hosts not in
3008 * the hosts allow list.
3009 */
3010
3011 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3012 sconn->client_id.name,
3013 sconn->client_id.addr)) {
3014 /*
3015 * send a negative session response "not listening on calling
3016 * name"
3017 */
3018 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3019 DEBUG( 1, ("Connection denied from %s to %s\n",
3020 tsocket_address_string(remote_address, talloc_tos()),
3021 tsocket_address_string(local_address, talloc_tos())));
3022 (void)srv_send_smb(sconn,(char *)buf, false,
3023 0, false, NULL);
3024 exit_server_cleanly("connection denied");
3025 }
3026
3027 DEBUG(10, ("Connection allowed from %s to %s\n",
3028 tsocket_address_string(remote_address, talloc_tos()),
3029 tsocket_address_string(local_address, talloc_tos())));
3030
3031 init_modules();
3032
3033 smb_perfcount_init();
3034
3035 if (!init_account_policy()) {
3036 exit_server("Could not open account policy tdb.\n");
3037 }
3038
3039 if (*lp_rootdir()) {
3040 if (chroot(lp_rootdir()) != 0) {
3041 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3042 exit_server("Failed to chroot()");
3043 }
3044 if (chdir("/") == -1) {
3045 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3046 exit_server("Failed to chroot()");
3047 }
3048 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3049 }
3050
3051 if (!srv_init_signing(sconn)) {
3052 exit_server("Failed to init smb_signing");
3053 }
3054
3055 if (lp_async_smb_echo_handler() && !fork_echo_handler(sconn)) {
3056 exit_server("Failed to fork echo handler");
3057 }
3058
3059 /* Setup oplocks */
3060 if (!init_oplocks(sconn->msg_ctx))
3061 exit_server("Failed to init oplocks");
3062
3063 /* register our message handlers */
3064 messaging_register(sconn->msg_ctx, NULL,
3065 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3066 messaging_register(sconn->msg_ctx, sconn,
3067 MSG_SMB_RELEASE_IP, msg_release_ip);
3068 messaging_register(sconn->msg_ctx, NULL,
3069 MSG_SMB_CLOSE_FILE, msg_close_file);
3070
3071 /*
3072 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3073 * MSGs to all child processes
3074 */
3075 messaging_deregister(sconn->msg_ctx,
3076 MSG_DEBUG, NULL);
3077 messaging_register(sconn->msg_ctx, NULL,
3078 MSG_DEBUG, debug_message);
3079
3080 if ((lp_keepalive() != 0)
3081 && !(event_add_idle(smbd_event_context(), NULL,
3082 timeval_set(lp_keepalive(), 0),
3083 "keepalive", keepalive_fn,
3084 NULL))) {
3085 DEBUG(0, ("Could not add keepalive event\n"));
3086 exit(1);
3087 }
3088
3089 if (!(event_add_idle(smbd_event_context(), NULL,
3090 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3091 "deadtime", deadtime_fn, sconn))) {
3092 DEBUG(0, ("Could not add deadtime event\n"));
3093 exit(1);
3094 }
3095
3096 if (!(event_add_idle(smbd_event_context(), NULL,
3097 timeval_set(SMBD_SELECT_TIMEOUT, 0),
3098 "housekeeping", housekeeping_fn, sconn))) {
3099 DEBUG(0, ("Could not add housekeeping event\n"));
3100 exit(1);
3101 }
3102
3103 #ifdef CLUSTER_SUPPORT
3104
3105 if (lp_clustering()) {
3106 /*
3107 * We need to tell ctdb about our client's TCP
3108 * connection, so that for failover ctdbd can send
3109 * tickle acks, triggering a reconnection by the
3110 * client.
3111 */
3112
3113 struct sockaddr_storage srv, clnt;
3114
3115 if (client_get_tcp_info(&srv, &clnt) == 0) {
3116 NTSTATUS status;
3117 status = smbd_register_ips(sconn, &srv, &clnt);
3118 if (!NT_STATUS_IS_OK(status)) {
3119 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3120 nt_errstr(status)));
3121 }
3122 } else
3123 {
3124 DEBUG(0,("Unable to get tcp info for "
3125 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3126 strerror(errno)));
3127 }
3128 }
3129
3130 #endif
3131
3132 sconn->nbt.got_session = false;
3133
3134 sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3135
3136 sconn->smb1.sessions.done_sesssetup = false;
3137 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3138 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3139 /* users from session setup */
3140 sconn->smb1.sessions.session_userlist = NULL;
3141 /* workgroup from session setup. */
3142 sconn->smb1.sessions.session_workgroup = NULL;
3143 /* this holds info on user ids that are already validated for this VC */
3144 sconn->smb1.sessions.validated_users = NULL;
3145 sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3146 sconn->smb1.sessions.num_validated_vuids = 0;
3147
3148 conn_init(sconn);
3149 if (!init_dptrs(sconn)) {
3150 exit_server("init_dptrs() failed");
3151 }
3152
3153 sconn->smb1.fde = event_add_fd(smbd_event_context(),
3154 sconn,
3155 sconn->sock,
3156 EVENT_FD_READ,
3157 smbd_server_connection_handler,
3158 sconn);
3159 if (!sconn->smb1.fde) {
3160 exit_server("failed to create smbd_server_connection fde");
3161 }
3162
3163 TALLOC_FREE(frame);
3164
3165 while (True) {
3166 NTSTATUS status;
3167
3168 frame = talloc_stackframe_pool(8192);
3169
3170 errno = 0;
3171
3172 status = smbd_server_connection_loop_once(sconn);
3173 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3174 !NT_STATUS_IS_OK(status)) {
3175 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3176 " exiting\n", nt_errstr(status)));
3177 break;
3178 }
3179
3180 TALLOC_FREE(frame);
3181 }
3182
3183 exit_server_cleanly(NULL);
3184 }
3185
3186 bool req_is_in_chain(struct smb_request *req)
3187 {
3188 if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
3189 /*
3190 * We're right now handling a subsequent request, so we must
3191 * be in a chain
3192 */
3193 return true;
3194 }
3195
3196 if (!is_andx_req(req->cmd)) {
3197 return false;
3198 }
3199
3200 if (req->wct < 2) {
3201 /*
3202 * Okay, an illegal request, but definitely not chained :-)
3203 */
3204 return false;
3205 }
3206
3207 return (CVAL(req->vwv+0, 0) != 0xFF);
3208 }
Samba GIT mirror