?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: move dptr globals into struct smbd_server_connection
[Samba/aatanasov.git] / source3 / smbd / process.c
blob6ec46071ff60ab5b844fee2e5a1d89fb60c79dfb
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/globals.h"
23
24 extern bool global_machine_password_needs_changing;
25
26 static void construct_reply_common(struct smb_request *req, const char *inbuf,
27 char *outbuf);
28
29 /* Accessor function for smb_read_error for smbd functions. */
30
31 /****************************************************************************
32 Send an smb to a fd.
33 ****************************************************************************/
34
35 bool srv_send_smb(int fd, char *buffer,
36 bool do_signing, uint32_t seqnum,
37 bool do_encrypt,
38 struct smb_perfcount_data *pcd)
39 {
40 size_t len = 0;
41 size_t nwritten=0;
42 ssize_t ret;
43 char *buf_out = buffer;
44
45 if (do_signing) {
46 /* Sign the outgoing packet if required. */
47 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
48 }
49
50 if (do_encrypt) {
51 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
52 if (!NT_STATUS_IS_OK(status)) {
53 DEBUG(0, ("send_smb: SMB encryption failed "
54 "on outgoing packet! Error %s\n",
55 nt_errstr(status) ));
56 goto out;
57 }
58 }
59
60 len = smb_len(buf_out) + 4;
61
62 ret = write_data(fd,buf_out+nwritten,len - nwritten);
63 if (ret <= 0) {
64 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
65 (int)len,(int)ret, strerror(errno) ));
66 srv_free_enc_buffer(buf_out);
67 goto out;
68 }
69
70 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
71 srv_free_enc_buffer(buf_out);
72 out:
73 SMB_PERFCOUNT_END(pcd);
74 return true;
75 }
76
77 /*******************************************************************
78 Setup the word count and byte count for a smb message.
79 ********************************************************************/
80
81 int srv_set_message(char *buf,
82 int num_words,
83 int num_bytes,
84 bool zero)
85 {
86 if (zero && (num_words || num_bytes)) {
87 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
88 }
89 SCVAL(buf,smb_wct,num_words);
90 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
91 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
92 return (smb_size + num_words*2 + num_bytes);
93 }
94
95 static bool valid_smb_header(const uint8_t *inbuf)
96 {
97 if (is_encrypted_packet(inbuf)) {
98 return true;
99 }
100 /*
101 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
102 * but it just looks weird to call strncmp for this one.
103 */
104 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
105 }
106
107 /* Socket functions for smbd packet processing. */
108
109 static bool valid_packet_size(size_t len)
110 {
111 /*
112 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
113 * of header. Don't print the error if this fits.... JRA.
114 */
115
116 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
117 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
118 (unsigned long)len));
119 return false;
120 }
121 return true;
122 }
123
124 static NTSTATUS read_packet_remainder(int fd, char *buffer,
125 unsigned int timeout, ssize_t len)
126 {
127 if (len <= 0) {
128 return NT_STATUS_OK;
129 }
130
131 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
132 }
133
134 /****************************************************************************
135 Attempt a zerocopy writeX read. We know here that len > smb_size-4
136 ****************************************************************************/
137
138 /*
139 * Unfortunately, earlier versions of smbclient/libsmbclient
140 * don't send this "standard" writeX header. I've fixed this
141 * for 3.2 but we'll use the old method with earlier versions.
142 * Windows and CIFSFS at least use this standard size. Not
143 * sure about MacOSX.
144 */
145
146 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
147 (2*14) + /* word count (including bcc) */ \
148 1 /* pad byte */)
149
150 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
151 const char lenbuf[4],
152 int fd, char **buffer,
153 unsigned int timeout,
154 size_t *p_unread,
155 size_t *len_ret)
156 {
157 /* Size of a WRITEX call (+4 byte len). */
158 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
159 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
160 ssize_t toread;
161 NTSTATUS status;
162
163 memcpy(writeX_header, lenbuf, 4);
164
165 status = read_socket_with_timeout(
166 fd, writeX_header + 4,
167 STANDARD_WRITE_AND_X_HEADER_SIZE,
168 STANDARD_WRITE_AND_X_HEADER_SIZE,
169 timeout, NULL);
170
171 if (!NT_STATUS_IS_OK(status)) {
172 return status;
173 }
174
175 /*
176 * Ok - now try and see if this is a possible
177 * valid writeX call.
178 */
179
180 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
181 /*
182 * If the data offset is beyond what
183 * we've read, drain the extra bytes.
184 */
185 uint16_t doff = SVAL(writeX_header,smb_vwv11);
186 ssize_t newlen;
187
188 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
189 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
190 if (drain_socket(smbd_server_fd(), drain) != drain) {
191 smb_panic("receive_smb_raw_talloc_partial_read:"
192 " failed to drain pending bytes");
193 }
194 } else {
195 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
196 }
197
198 /* Spoof down the length and null out the bcc. */
199 set_message_bcc(writeX_header, 0);
200 newlen = smb_len(writeX_header);
201
202 /* Copy the header we've written. */
203
204 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
205 writeX_header,
206 sizeof(writeX_header));
207
208 if (*buffer == NULL) {
209 DEBUG(0, ("Could not allocate inbuf of length %d\n",
210 (int)sizeof(writeX_header)));
211 return NT_STATUS_NO_MEMORY;
212 }
213
214 /* Work out the remaining bytes. */
215 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
216 *len_ret = newlen + 4;
217 return NT_STATUS_OK;
218 }
219
220 if (!valid_packet_size(len)) {
221 return NT_STATUS_INVALID_PARAMETER;
222 }
223
224 /*
225 * Not a valid writeX call. Just do the standard
226 * talloc and return.
227 */
228
229 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
230
231 if (*buffer == NULL) {
232 DEBUG(0, ("Could not allocate inbuf of length %d\n",
233 (int)len+4));
234 return NT_STATUS_NO_MEMORY;
235 }
236
237 /* Copy in what we already read. */
238 memcpy(*buffer,
239 writeX_header,
240 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
241 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
242
243 if(toread > 0) {
244 status = read_packet_remainder(
245 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
246 timeout, toread);
247
248 if (!NT_STATUS_IS_OK(status)) {
249 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
250 nt_errstr(status)));
251 return status;
252 }
253 }
254
255 *len_ret = len + 4;
256 return NT_STATUS_OK;
257 }
258
259 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
260 char **buffer, unsigned int timeout,
261 size_t *p_unread, size_t *plen)
262 {
263 char lenbuf[4];
264 size_t len;
265 int min_recv_size = lp_min_receive_file_size();
266 NTSTATUS status;
267
268 *p_unread = 0;
269
270 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
271 if (!NT_STATUS_IS_OK(status)) {
272 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
273 return status;
274 }
275
276 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
277 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
278 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
279 !srv_is_signing_active(smbd_server_conn)) {
280
281 return receive_smb_raw_talloc_partial_read(
282 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
283 }
284
285 if (!valid_packet_size(len)) {
286 return NT_STATUS_INVALID_PARAMETER;
287 }
288
289 /*
290 * The +4 here can't wrap, we've checked the length above already.
291 */
292
293 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
294
295 if (*buffer == NULL) {
296 DEBUG(0, ("Could not allocate inbuf of length %d\n",
297 (int)len+4));
298 return NT_STATUS_NO_MEMORY;
299 }
300
301 memcpy(*buffer, lenbuf, sizeof(lenbuf));
302
303 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
304 if (!NT_STATUS_IS_OK(status)) {
305 return status;
306 }
307
308 *plen = len + 4;
309 return NT_STATUS_OK;
310 }
311
312 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
313 char **buffer, unsigned int timeout,
314 size_t *p_unread, bool *p_encrypted,
315 size_t *p_len,
316 uint32_t *seqnum)
317 {
318 size_t len = 0;
319 NTSTATUS status;
320
321 *p_encrypted = false;
322
323 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
324 p_unread, &len);
325 if (!NT_STATUS_IS_OK(status)) {
326 return status;
327 }
328
329 if (is_encrypted_packet((uint8_t *)*buffer)) {
330 status = srv_decrypt_buffer(*buffer);
331 if (!NT_STATUS_IS_OK(status)) {
332 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
333 "incoming packet! Error %s\n",
334 nt_errstr(status) ));
335 return status;
336 }
337 *p_encrypted = true;
338 }
339
340 /* Check the incoming SMB signature. */
341 if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum)) {
342 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
343 "incoming packet!\n"));
344 return NT_STATUS_INVALID_NETWORK_RESPONSE;
345 }
346
347 *p_len = len;
348 return NT_STATUS_OK;
349 }
350
351 /*
352 * Initialize a struct smb_request from an inbuf
353 */
354
355 void init_smb_request(struct smb_request *req,
356 const uint8 *inbuf,
357 size_t unread_bytes,
358 bool encrypted)
359 {
360 struct smbd_server_connection *sconn = smbd_server_conn;
361 size_t req_size = smb_len(inbuf) + 4;
362 /* Ensure we have at least smb_size bytes. */
363 if (req_size < smb_size) {
364 DEBUG(0,("init_smb_request: invalid request size %u\n",
365 (unsigned int)req_size ));
366 exit_server_cleanly("Invalid SMB request");
367 }
368 req->cmd = CVAL(inbuf, smb_com);
369 req->flags2 = SVAL(inbuf, smb_flg2);
370 req->smbpid = SVAL(inbuf, smb_pid);
371 req->mid = SVAL(inbuf, smb_mid);
372 req->seqnum = 0;
373 req->vuid = SVAL(inbuf, smb_uid);
374 req->tid = SVAL(inbuf, smb_tid);
375 req->wct = CVAL(inbuf, smb_wct);
376 req->vwv = (uint16_t *)(inbuf+smb_vwv);
377 req->buflen = smb_buflen(inbuf);
378 req->buf = (const uint8_t *)smb_buf(inbuf);
379 req->unread_bytes = unread_bytes;
380 req->encrypted = encrypted;
381 req->conn = conn_find(sconn,req->tid);
382 req->chain_fsp = NULL;
383 req->chain_outbuf = NULL;
384 req->done = false;
385 smb_init_perfcount_data(&req->pcd);
386
387 /* Ensure we have at least wct words and 2 bytes of bcc. */
388 if (smb_size + req->wct*2 > req_size) {
389 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
390 (unsigned int)req->wct,
391 (unsigned int)req_size));
392 exit_server_cleanly("Invalid SMB request");
393 }
394 /* Ensure bcc is correct. */
395 if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
396 DEBUG(0,("init_smb_request: invalid bcc number %u "
397 "(wct = %u, size %u)\n",
398 (unsigned int)req->buflen,
399 (unsigned int)req->wct,
400 (unsigned int)req_size));
401 exit_server_cleanly("Invalid SMB request");
402 }
403
404 req->outbuf = NULL;
405 }
406
407 static void process_smb(struct smbd_server_connection *conn,
408 uint8_t *inbuf, size_t nread, size_t unread_bytes,
409 uint32_t seqnum, bool encrypted,
410 struct smb_perfcount_data *deferred_pcd);
411
412 static void smbd_deferred_open_timer(struct event_context *ev,
413 struct timed_event *te,
414 struct timeval _tval,
415 void *private_data)
416 {
417 struct pending_message_list *msg = talloc_get_type(private_data,
418 struct pending_message_list);
419 TALLOC_CTX *mem_ctx = talloc_tos();
420 uint8_t *inbuf;
421
422 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
423 msg->buf.length);
424 if (inbuf == NULL) {
425 exit_server("smbd_deferred_open_timer: talloc failed\n");
426 return;
427 }
428
429 /* We leave this message on the queue so the open code can
430 know this is a retry. */
431 DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
432 (unsigned int)SVAL(msg->buf.data,smb_mid)));
433
434 process_smb(smbd_server_conn, inbuf,
435 msg->buf.length, 0,
436 msg->seqnum, msg->encrypted, &msg->pcd);
437 }
438
439 /****************************************************************************
440 Function to push a message onto the tail of a linked list of smb messages ready
441 for processing.
442 ****************************************************************************/
443
444 static bool push_queued_message(struct smb_request *req,
445 struct timeval request_time,
446 struct timeval end_time,
447 char *private_data, size_t private_len)
448 {
449 int msg_len = smb_len(req->inbuf) + 4;
450 struct pending_message_list *msg;
451
452 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
453
454 if(msg == NULL) {
455 DEBUG(0,("push_message: malloc fail (1)\n"));
456 return False;
457 }
458
459 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
460 if(msg->buf.data == NULL) {
461 DEBUG(0,("push_message: malloc fail (2)\n"));
462 TALLOC_FREE(msg);
463 return False;
464 }
465
466 msg->request_time = request_time;
467 msg->seqnum = req->seqnum;
468 msg->encrypted = req->encrypted;
469 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
470
471 if (private_data) {
472 msg->private_data = data_blob_talloc(msg, private_data,
473 private_len);
474 if (msg->private_data.data == NULL) {
475 DEBUG(0,("push_message: malloc fail (3)\n"));
476 TALLOC_FREE(msg);
477 return False;
478 }
479 }
480
481 msg->te = event_add_timed(smbd_event_context(),
482 msg,
483 end_time,
484 smbd_deferred_open_timer,
485 msg);
486 if (!msg->te) {
487 DEBUG(0,("push_message: event_add_timed failed\n"));
488 TALLOC_FREE(msg);
489 return false;
490 }
491
492 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
493
494 DEBUG(10,("push_message: pushed message length %u on "
495 "deferred_open_queue\n", (unsigned int)msg_len));
496
497 return True;
498 }
499
500 /****************************************************************************
501 Function to delete a sharing violation open message by mid.
502 ****************************************************************************/
503
504 void remove_deferred_open_smb_message(uint16 mid)
505 {
506 struct pending_message_list *pml;
507
508 for (pml = deferred_open_queue; pml; pml = pml->next) {
509 if (mid == SVAL(pml->buf.data,smb_mid)) {
510 DEBUG(10,("remove_sharing_violation_open_smb_message: "
511 "deleting mid %u len %u\n",
512 (unsigned int)mid,
513 (unsigned int)pml->buf.length ));
514 DLIST_REMOVE(deferred_open_queue, pml);
515 TALLOC_FREE(pml);
516 return;
517 }
518 }
519 }
520
521 /****************************************************************************
522 Move a sharing violation open retry message to the front of the list and
523 schedule it for immediate processing.
524 ****************************************************************************/
525
526 void schedule_deferred_open_smb_message(uint16 mid)
527 {
528 struct pending_message_list *pml;
529 int i = 0;
530
531 for (pml = deferred_open_queue; pml; pml = pml->next) {
532 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
533
534 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
535 (unsigned int)msg_mid ));
536
537 if (mid == msg_mid) {
538 struct timed_event *te;
539
540 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
541 mid ));
542
543 te = event_add_timed(smbd_event_context(),
544 pml,
545 timeval_zero(),
546 smbd_deferred_open_timer,
547 pml);
548 if (!te) {
549 DEBUG(10,("schedule_deferred_open_smb_message: "
550 "event_add_timed() failed, skipping mid %u\n",
551 mid ));
552 }
553
554 TALLOC_FREE(pml->te);
555 pml->te = te;
556 DLIST_PROMOTE(deferred_open_queue, pml);
557 return;
558 }
559 }
560
561 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
562 mid ));
563 }
564
565 /****************************************************************************
566 Return true if this mid is on the deferred queue.
567 ****************************************************************************/
568
569 bool open_was_deferred(uint16 mid)
570 {
571 struct pending_message_list *pml;
572
573 for (pml = deferred_open_queue; pml; pml = pml->next) {
574 if (SVAL(pml->buf.data,smb_mid) == mid) {
575 return True;
576 }
577 }
578 return False;
579 }
580
581 /****************************************************************************
582 Return the message queued by this mid.
583 ****************************************************************************/
584
585 struct pending_message_list *get_open_deferred_message(uint16 mid)
586 {
587 struct pending_message_list *pml;
588
589 for (pml = deferred_open_queue; pml; pml = pml->next) {
590 if (SVAL(pml->buf.data,smb_mid) == mid) {
591 return pml;
592 }
593 }
594 return NULL;
595 }
596
597 /****************************************************************************
598 Function to push a deferred open smb message onto a linked list of local smb
599 messages ready for processing.
600 ****************************************************************************/
601
602 bool push_deferred_smb_message(struct smb_request *req,
603 struct timeval request_time,
604 struct timeval timeout,
605 char *private_data, size_t priv_len)
606 {
607 struct timeval end_time;
608
609 if (req->unread_bytes) {
610 DEBUG(0,("push_deferred_smb_message: logic error ! "
611 "unread_bytes = %u\n",
612 (unsigned int)req->unread_bytes ));
613 smb_panic("push_deferred_smb_message: "
614 "logic error unread_bytes != 0" );
615 }
616
617 end_time = timeval_sum(&request_time, &timeout);
618
619 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
620 "timeout time [%u.%06u]\n",
621 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
622 (unsigned int)end_time.tv_sec,
623 (unsigned int)end_time.tv_usec));
624
625 return push_queued_message(req, request_time, end_time,
626 private_data, priv_len);
627 }
628
629 struct idle_event {
630 struct timed_event *te;
631 struct timeval interval;
632 char *name;
633 bool (*handler)(const struct timeval *now, void *private_data);
634 void *private_data;
635 };
636
637 static void smbd_idle_event_handler(struct event_context *ctx,
638 struct timed_event *te,
639 struct timeval now,
640 void *private_data)
641 {
642 struct idle_event *event =
643 talloc_get_type_abort(private_data, struct idle_event);
644
645 TALLOC_FREE(event->te);
646
647 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
648 event->name, event->te));
649
650 if (!event->handler(&now, event->private_data)) {
651 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
652 event->name, event->te));
653 /* Don't repeat, delete ourselves */
654 TALLOC_FREE(event);
655 return;
656 }
657
658 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
659 event->name, event->te));
660
661 event->te = event_add_timed(ctx, event,
662 timeval_sum(&now, &event->interval),
663 smbd_idle_event_handler, event);
664
665 /* We can't do much but fail here. */
666 SMB_ASSERT(event->te != NULL);
667 }
668
669 struct idle_event *event_add_idle(struct event_context *event_ctx,
670 TALLOC_CTX *mem_ctx,
671 struct timeval interval,
672 const char *name,
673 bool (*handler)(const struct timeval *now,
674 void *private_data),
675 void *private_data)
676 {
677 struct idle_event *result;
678 struct timeval now = timeval_current();
679
680 result = TALLOC_P(mem_ctx, struct idle_event);
681 if (result == NULL) {
682 DEBUG(0, ("talloc failed\n"));
683 return NULL;
684 }
685
686 result->interval = interval;
687 result->handler = handler;
688 result->private_data = private_data;
689
690 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
691 DEBUG(0, ("talloc failed\n"));
692 TALLOC_FREE(result);
693 return NULL;
694 }
695
696 result->te = event_add_timed(event_ctx, result,
697 timeval_sum(&now, &interval),
698 smbd_idle_event_handler, result);
699 if (result->te == NULL) {
700 DEBUG(0, ("event_add_timed failed\n"));
701 TALLOC_FREE(result);
702 return NULL;
703 }
704
705 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
706 return result;
707 }
708
709 static void smbd_sig_term_handler(struct tevent_context *ev,
710 struct tevent_signal *se,
711 int signum,
712 int count,
713 void *siginfo,
714 void *private_data)
715 {
716 exit_server_cleanly("termination signal");
717 }
718
719 void smbd_setup_sig_term_handler(void)
720 {
721 struct tevent_signal *se;
722
723 se = tevent_add_signal(smbd_event_context(),
724 smbd_event_context(),
725 SIGTERM, 0,
726 smbd_sig_term_handler,
727 NULL);
728 if (!se) {
729 exit_server("failed to setup SIGTERM handler");
730 }
731 }
732
733 static void smbd_sig_hup_handler(struct tevent_context *ev,
734 struct tevent_signal *se,
735 int signum,
736 int count,
737 void *siginfo,
738 void *private_data)
739 {
740 change_to_root_user();
741 DEBUG(1,("Reloading services after SIGHUP\n"));
742 reload_services(False);
743 }
744
745 void smbd_setup_sig_hup_handler(void)
746 {
747 struct tevent_signal *se;
748
749 se = tevent_add_signal(smbd_event_context(),
750 smbd_event_context(),
751 SIGHUP, 0,
752 smbd_sig_hup_handler,
753 NULL);
754 if (!se) {
755 exit_server("failed to setup SIGHUP handler");
756 }
757 }
758
759 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
760 {
761 fd_set r_fds, w_fds;
762 int selrtn;
763 struct timeval to;
764 int maxfd = 0;
765
766 to.tv_sec = SMBD_SELECT_TIMEOUT;
767 to.tv_usec = 0;
768
769 /*
770 * Setup the select fd sets.
771 */
772
773 FD_ZERO(&r_fds);
774 FD_ZERO(&w_fds);
775
776 /*
777 * Are there any timed events waiting ? If so, ensure we don't
778 * select for longer than it would take to wait for them.
779 */
780
781 {
782 struct timeval now;
783 GetTimeOfDay(&now);
784
785 event_add_to_select_args(smbd_event_context(), &now,
786 &r_fds, &w_fds, &to, &maxfd);
787 }
788
789 /* Process a signal and timed events now... */
790 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
791 return NT_STATUS_RETRY;
792 }
793
794 {
795 int sav;
796 START_PROFILE(smbd_idle);
797
798 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
799 sav = errno;
800
801 END_PROFILE(smbd_idle);
802 errno = sav;
803 }
804
805 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
806 return NT_STATUS_RETRY;
807 }
808
809 /* Check if error */
810 if (selrtn == -1) {
811 /* something is wrong. Maybe the socket is dead? */
812 return map_nt_error_from_unix(errno);
813 }
814
815 /* Did we timeout ? */
816 if (selrtn == 0) {
817 return NT_STATUS_RETRY;
818 }
819
820 /* should not be reached */
821 return NT_STATUS_INTERNAL_ERROR;
822 }
823
824 /*
825 * Only allow 5 outstanding trans requests. We're allocating memory, so
826 * prevent a DoS.
827 */
828
829 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
830 {
831 int count = 0;
832 for (; list != NULL; list = list->next) {
833
834 if (list->mid == mid) {
835 return NT_STATUS_INVALID_PARAMETER;
836 }
837
838 count += 1;
839 }
840 if (count > 5) {
841 return NT_STATUS_INSUFFICIENT_RESOURCES;
842 }
843
844 return NT_STATUS_OK;
845 }
846
847 /*
848 These flags determine some of the permissions required to do an operation
849
850 Note that I don't set NEED_WRITE on some write operations because they
851 are used by some brain-dead clients when printing, and I don't want to
852 force write permissions on print services.
853 */
854 #define AS_USER (1<<0)
855 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
856 #define TIME_INIT (1<<2)
857 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
858 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
859 #define DO_CHDIR (1<<6)
860
861 /*
862 define a list of possible SMB messages and their corresponding
863 functions. Any message that has a NULL function is unimplemented -
864 please feel free to contribute implementations!
865 */
866 static const struct smb_message_struct {
867 const char *name;
868 void (*fn)(struct smb_request *req);
869 int flags;
870 } smb_messages[256] = {
871
872 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
873 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
874 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
875 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
876 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
877 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
878 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
879 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
880 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
881 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
882 /* 0x0a */ { "SMBread",reply_read,AS_USER},
883 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
884 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
885 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
886 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
887 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
888 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
889 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
890 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
891 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
892 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
893 /* 0x15 */ { NULL, NULL, 0 },
894 /* 0x16 */ { NULL, NULL, 0 },
895 /* 0x17 */ { NULL, NULL, 0 },
896 /* 0x18 */ { NULL, NULL, 0 },
897 /* 0x19 */ { NULL, NULL, 0 },
898 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
899 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
900 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
901 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
902 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
903 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
904 /* 0x20 */ { "SMBwritec", NULL,0},
905 /* 0x21 */ { NULL, NULL, 0 },
906 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
907 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
908 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
909 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
910 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
911 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
912 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
913 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
914 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
915 /* 0x2b */ { "SMBecho",reply_echo,0},
916 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
917 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
918 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
919 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
920 /* 0x30 */ { NULL, NULL, 0 },
921 /* 0x31 */ { NULL, NULL, 0 },
922 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
923 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
924 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
925 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
926 /* 0x36 */ { NULL, NULL, 0 },
927 /* 0x37 */ { NULL, NULL, 0 },
928 /* 0x38 */ { NULL, NULL, 0 },
929 /* 0x39 */ { NULL, NULL, 0 },
930 /* 0x3a */ { NULL, NULL, 0 },
931 /* 0x3b */ { NULL, NULL, 0 },
932 /* 0x3c */ { NULL, NULL, 0 },
933 /* 0x3d */ { NULL, NULL, 0 },
934 /* 0x3e */ { NULL, NULL, 0 },
935 /* 0x3f */ { NULL, NULL, 0 },
936 /* 0x40 */ { NULL, NULL, 0 },
937 /* 0x41 */ { NULL, NULL, 0 },
938 /* 0x42 */ { NULL, NULL, 0 },
939 /* 0x43 */ { NULL, NULL, 0 },
940 /* 0x44 */ { NULL, NULL, 0 },
941 /* 0x45 */ { NULL, NULL, 0 },
942 /* 0x46 */ { NULL, NULL, 0 },
943 /* 0x47 */ { NULL, NULL, 0 },
944 /* 0x48 */ { NULL, NULL, 0 },
945 /* 0x49 */ { NULL, NULL, 0 },
946 /* 0x4a */ { NULL, NULL, 0 },
947 /* 0x4b */ { NULL, NULL, 0 },
948 /* 0x4c */ { NULL, NULL, 0 },
949 /* 0x4d */ { NULL, NULL, 0 },
950 /* 0x4e */ { NULL, NULL, 0 },
951 /* 0x4f */ { NULL, NULL, 0 },
952 /* 0x50 */ { NULL, NULL, 0 },
953 /* 0x51 */ { NULL, NULL, 0 },
954 /* 0x52 */ { NULL, NULL, 0 },
955 /* 0x53 */ { NULL, NULL, 0 },
956 /* 0x54 */ { NULL, NULL, 0 },
957 /* 0x55 */ { NULL, NULL, 0 },
958 /* 0x56 */ { NULL, NULL, 0 },
959 /* 0x57 */ { NULL, NULL, 0 },
960 /* 0x58 */ { NULL, NULL, 0 },
961 /* 0x59 */ { NULL, NULL, 0 },
962 /* 0x5a */ { NULL, NULL, 0 },
963 /* 0x5b */ { NULL, NULL, 0 },
964 /* 0x5c */ { NULL, NULL, 0 },
965 /* 0x5d */ { NULL, NULL, 0 },
966 /* 0x5e */ { NULL, NULL, 0 },
967 /* 0x5f */ { NULL, NULL, 0 },
968 /* 0x60 */ { NULL, NULL, 0 },
969 /* 0x61 */ { NULL, NULL, 0 },
970 /* 0x62 */ { NULL, NULL, 0 },
971 /* 0x63 */ { NULL, NULL, 0 },
972 /* 0x64 */ { NULL, NULL, 0 },
973 /* 0x65 */ { NULL, NULL, 0 },
974 /* 0x66 */ { NULL, NULL, 0 },
975 /* 0x67 */ { NULL, NULL, 0 },
976 /* 0x68 */ { NULL, NULL, 0 },
977 /* 0x69 */ { NULL, NULL, 0 },
978 /* 0x6a */ { NULL, NULL, 0 },
979 /* 0x6b */ { NULL, NULL, 0 },
980 /* 0x6c */ { NULL, NULL, 0 },
981 /* 0x6d */ { NULL, NULL, 0 },
982 /* 0x6e */ { NULL, NULL, 0 },
983 /* 0x6f */ { NULL, NULL, 0 },
984 /* 0x70 */ { "SMBtcon",reply_tcon,0},
985 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
986 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
987 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
988 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
989 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
990 /* 0x76 */ { NULL, NULL, 0 },
991 /* 0x77 */ { NULL, NULL, 0 },
992 /* 0x78 */ { NULL, NULL, 0 },
993 /* 0x79 */ { NULL, NULL, 0 },
994 /* 0x7a */ { NULL, NULL, 0 },
995 /* 0x7b */ { NULL, NULL, 0 },
996 /* 0x7c */ { NULL, NULL, 0 },
997 /* 0x7d */ { NULL, NULL, 0 },
998 /* 0x7e */ { NULL, NULL, 0 },
999 /* 0x7f */ { NULL, NULL, 0 },
1000 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1001 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1002 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1003 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1004 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1005 /* 0x85 */ { NULL, NULL, 0 },
1006 /* 0x86 */ { NULL, NULL, 0 },
1007 /* 0x87 */ { NULL, NULL, 0 },
1008 /* 0x88 */ { NULL, NULL, 0 },
1009 /* 0x89 */ { NULL, NULL, 0 },
1010 /* 0x8a */ { NULL, NULL, 0 },
1011 /* 0x8b */ { NULL, NULL, 0 },
1012 /* 0x8c */ { NULL, NULL, 0 },
1013 /* 0x8d */ { NULL, NULL, 0 },
1014 /* 0x8e */ { NULL, NULL, 0 },
1015 /* 0x8f */ { NULL, NULL, 0 },
1016 /* 0x90 */ { NULL, NULL, 0 },
1017 /* 0x91 */ { NULL, NULL, 0 },
1018 /* 0x92 */ { NULL, NULL, 0 },
1019 /* 0x93 */ { NULL, NULL, 0 },
1020 /* 0x94 */ { NULL, NULL, 0 },
1021 /* 0x95 */ { NULL, NULL, 0 },
1022 /* 0x96 */ { NULL, NULL, 0 },
1023 /* 0x97 */ { NULL, NULL, 0 },
1024 /* 0x98 */ { NULL, NULL, 0 },
1025 /* 0x99 */ { NULL, NULL, 0 },
1026 /* 0x9a */ { NULL, NULL, 0 },
1027 /* 0x9b */ { NULL, NULL, 0 },
1028 /* 0x9c */ { NULL, NULL, 0 },
1029 /* 0x9d */ { NULL, NULL, 0 },
1030 /* 0x9e */ { NULL, NULL, 0 },
1031 /* 0x9f */ { NULL, NULL, 0 },
1032 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1033 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1034 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1035 /* 0xa3 */ { NULL, NULL, 0 },
1036 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1037 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1038 /* 0xa6 */ { NULL, NULL, 0 },
1039 /* 0xa7 */ { NULL, NULL, 0 },
1040 /* 0xa8 */ { NULL, NULL, 0 },
1041 /* 0xa9 */ { NULL, NULL, 0 },
1042 /* 0xaa */ { NULL, NULL, 0 },
1043 /* 0xab */ { NULL, NULL, 0 },
1044 /* 0xac */ { NULL, NULL, 0 },
1045 /* 0xad */ { NULL, NULL, 0 },
1046 /* 0xae */ { NULL, NULL, 0 },
1047 /* 0xaf */ { NULL, NULL, 0 },
1048 /* 0xb0 */ { NULL, NULL, 0 },
1049 /* 0xb1 */ { NULL, NULL, 0 },
1050 /* 0xb2 */ { NULL, NULL, 0 },
1051 /* 0xb3 */ { NULL, NULL, 0 },
1052 /* 0xb4 */ { NULL, NULL, 0 },
1053 /* 0xb5 */ { NULL, NULL, 0 },
1054 /* 0xb6 */ { NULL, NULL, 0 },
1055 /* 0xb7 */ { NULL, NULL, 0 },
1056 /* 0xb8 */ { NULL, NULL, 0 },
1057 /* 0xb9 */ { NULL, NULL, 0 },
1058 /* 0xba */ { NULL, NULL, 0 },
1059 /* 0xbb */ { NULL, NULL, 0 },
1060 /* 0xbc */ { NULL, NULL, 0 },
1061 /* 0xbd */ { NULL, NULL, 0 },
1062 /* 0xbe */ { NULL, NULL, 0 },
1063 /* 0xbf */ { NULL, NULL, 0 },
1064 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1065 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1066 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1067 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1068 /* 0xc4 */ { NULL, NULL, 0 },
1069 /* 0xc5 */ { NULL, NULL, 0 },
1070 /* 0xc6 */ { NULL, NULL, 0 },
1071 /* 0xc7 */ { NULL, NULL, 0 },
1072 /* 0xc8 */ { NULL, NULL, 0 },
1073 /* 0xc9 */ { NULL, NULL, 0 },
1074 /* 0xca */ { NULL, NULL, 0 },
1075 /* 0xcb */ { NULL, NULL, 0 },
1076 /* 0xcc */ { NULL, NULL, 0 },
1077 /* 0xcd */ { NULL, NULL, 0 },
1078 /* 0xce */ { NULL, NULL, 0 },
1079 /* 0xcf */ { NULL, NULL, 0 },
1080 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1081 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1082 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1083 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1084 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1085 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1086 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1087 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1088 /* 0xd8 */ { NULL, NULL, 0 },
1089 /* 0xd9 */ { NULL, NULL, 0 },
1090 /* 0xda */ { NULL, NULL, 0 },
1091 /* 0xdb */ { NULL, NULL, 0 },
1092 /* 0xdc */ { NULL, NULL, 0 },
1093 /* 0xdd */ { NULL, NULL, 0 },
1094 /* 0xde */ { NULL, NULL, 0 },
1095 /* 0xdf */ { NULL, NULL, 0 },
1096 /* 0xe0 */ { NULL, NULL, 0 },
1097 /* 0xe1 */ { NULL, NULL, 0 },
1098 /* 0xe2 */ { NULL, NULL, 0 },
1099 /* 0xe3 */ { NULL, NULL, 0 },
1100 /* 0xe4 */ { NULL, NULL, 0 },
1101 /* 0xe5 */ { NULL, NULL, 0 },
1102 /* 0xe6 */ { NULL, NULL, 0 },
1103 /* 0xe7 */ { NULL, NULL, 0 },
1104 /* 0xe8 */ { NULL, NULL, 0 },
1105 /* 0xe9 */ { NULL, NULL, 0 },
1106 /* 0xea */ { NULL, NULL, 0 },
1107 /* 0xeb */ { NULL, NULL, 0 },
1108 /* 0xec */ { NULL, NULL, 0 },
1109 /* 0xed */ { NULL, NULL, 0 },
1110 /* 0xee */ { NULL, NULL, 0 },
1111 /* 0xef */ { NULL, NULL, 0 },
1112 /* 0xf0 */ { NULL, NULL, 0 },
1113 /* 0xf1 */ { NULL, NULL, 0 },
1114 /* 0xf2 */ { NULL, NULL, 0 },
1115 /* 0xf3 */ { NULL, NULL, 0 },
1116 /* 0xf4 */ { NULL, NULL, 0 },
1117 /* 0xf5 */ { NULL, NULL, 0 },
1118 /* 0xf6 */ { NULL, NULL, 0 },
1119 /* 0xf7 */ { NULL, NULL, 0 },
1120 /* 0xf8 */ { NULL, NULL, 0 },
1121 /* 0xf9 */ { NULL, NULL, 0 },
1122 /* 0xfa */ { NULL, NULL, 0 },
1123 /* 0xfb */ { NULL, NULL, 0 },
1124 /* 0xfc */ { NULL, NULL, 0 },
1125 /* 0xfd */ { NULL, NULL, 0 },
1126 /* 0xfe */ { NULL, NULL, 0 },
1127 /* 0xff */ { NULL, NULL, 0 }
1128
1129 };
1130
1131 /*******************************************************************
1132 allocate and initialize a reply packet
1133 ********************************************************************/
1134
1135 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1136 const char *inbuf, char **outbuf, uint8_t num_words,
1137 uint32_t num_bytes)
1138 {
1139 /*
1140 * Protect against integer wrap
1141 */
1142 if ((num_bytes > 0xffffff)
1143 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1144 char *msg;
1145 if (asprintf(&msg, "num_bytes too large: %u",
1146 (unsigned)num_bytes) == -1) {
1147 msg = CONST_DISCARD(char *, "num_bytes too large");
1148 }
1149 smb_panic(msg);
1150 }
1151
1152 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1153 smb_size + num_words*2 + num_bytes);
1154 if (*outbuf == NULL) {
1155 return false;
1156 }
1157
1158 construct_reply_common(req, inbuf, *outbuf);
1159 srv_set_message(*outbuf, num_words, num_bytes, false);
1160 /*
1161 * Zero out the word area, the caller has to take care of the bcc area
1162 * himself
1163 */
1164 if (num_words != 0) {
1165 memset(*outbuf + smb_vwv0, 0, num_words*2);
1166 }
1167
1168 return true;
1169 }
1170
1171 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1172 {
1173 char *outbuf;
1174 if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1175 num_bytes)) {
1176 smb_panic("could not allocate output buffer\n");
1177 }
1178 req->outbuf = (uint8_t *)outbuf;
1179 }
1180
1181
1182 /*******************************************************************
1183 Dump a packet to a file.
1184 ********************************************************************/
1185
1186 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1187 {
1188 int fd, i;
1189 char *fname = NULL;
1190 if (DEBUGLEVEL < 50) {
1191 return;
1192 }
1193
1194 if (len < 4) len = smb_len(data)+4;
1195 for (i=1;i<100;i++) {
1196 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1197 type ? "req" : "resp") == -1) {
1198 return;
1199 }
1200 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1201 if (fd != -1 || errno != EEXIST) break;
1202 }
1203 if (fd != -1) {
1204 ssize_t ret = write(fd, data, len);
1205 if (ret != len)
1206 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1207 close(fd);
1208 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1209 }
1210 SAFE_FREE(fname);
1211 }
1212
1213 /****************************************************************************
1214 Prepare everything for calling the actual request function, and potentially
1215 call the request function via the "new" interface.
1216
1217 Return False if the "legacy" function needs to be called, everything is
1218 prepared.
1219
1220 Return True if we're done.
1221
1222 I know this API sucks, but it is the one with the least code change I could
1223 find.
1224 ****************************************************************************/
1225
1226 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1227 {
1228 int flags;
1229 uint16 session_tag;
1230 connection_struct *conn = NULL;
1231 struct smbd_server_connection *sconn = smbd_server_conn;
1232
1233 errno = 0;
1234
1235 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1236 * so subtract 4 from it. */
1237 if (!valid_smb_header(req->inbuf)
1238 || (size < (smb_size - 4))) {
1239 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1240 smb_len(req->inbuf)));
1241 exit_server_cleanly("Non-SMB packet");
1242 }
1243
1244 if (smb_messages[type].fn == NULL) {
1245 DEBUG(0,("Unknown message type %d!\n",type));
1246 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1247 reply_unknown_new(req, type);
1248 return NULL;
1249 }
1250
1251 flags = smb_messages[type].flags;
1252
1253 /* In share mode security we must ignore the vuid. */
1254 session_tag = (lp_security() == SEC_SHARE)
1255 ? UID_FIELD_INVALID : req->vuid;
1256 conn = req->conn;
1257
1258 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1259 (int)sys_getpid(), (unsigned long)conn));
1260
1261 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1262
1263 /* Ensure this value is replaced in the incoming packet. */
1264 SSVAL(req->inbuf,smb_uid,session_tag);
1265
1266 /*
1267 * Ensure the correct username is in current_user_info. This is a
1268 * really ugly bugfix for problems with multiple session_setup_and_X's
1269 * being done and allowing %U and %G substitutions to work correctly.
1270 * There is a reason this code is done here, don't move it unless you
1271 * know what you're doing... :-).
1272 * JRA.
1273 */
1274
1275 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1276 user_struct *vuser = NULL;
1277
1278 sconn->smb1.sessions.last_session_tag = session_tag;
1279 if(session_tag != UID_FIELD_INVALID) {
1280 vuser = get_valid_user_struct(sconn, session_tag);
1281 if (vuser) {
1282 set_current_user_info(
1283 vuser->server_info->sanitized_username,
1284 vuser->server_info->unix_name,
1285 pdb_get_domain(vuser->server_info
1286 ->sam_account));
1287 }
1288 }
1289 }
1290
1291 /* Does this call need to be run as the connected user? */
1292 if (flags & AS_USER) {
1293
1294 /* Does this call need a valid tree connection? */
1295 if (!conn) {
1296 /*
1297 * Amazingly, the error code depends on the command
1298 * (from Samba4).
1299 */
1300 if (type == SMBntcreateX) {
1301 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1302 } else {
1303 reply_doserror(req, ERRSRV, ERRinvnid);
1304 }
1305 return NULL;
1306 }
1307
1308 if (!change_to_user(conn,session_tag)) {
1309 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1310 remove_deferred_open_smb_message(req->mid);
1311 return conn;
1312 }
1313
1314 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1315
1316 /* Does it need write permission? */
1317 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1318 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1319 return conn;
1320 }
1321
1322 /* IPC services are limited */
1323 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1324 reply_doserror(req, ERRSRV,ERRaccess);
1325 return conn;
1326 }
1327 } else {
1328 /* This call needs to be run as root */
1329 change_to_root_user();
1330 }
1331
1332 /* load service specific parameters */
1333 if (conn) {
1334 if (req->encrypted) {
1335 conn->encrypted_tid = true;
1336 /* encrypted required from now on. */
1337 conn->encrypt_level = Required;
1338 } else if (ENCRYPTION_REQUIRED(conn)) {
1339 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1340 exit_server_cleanly("encryption required "
1341 "on connection");
1342 return conn;
1343 }
1344 }
1345
1346 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1347 (flags & (AS_USER|DO_CHDIR)
1348 ?True:False))) {
1349 reply_doserror(req, ERRSRV, ERRaccess);
1350 return conn;
1351 }
1352 conn->num_smb_operations++;
1353 }
1354
1355 /* does this protocol need to be run as guest? */
1356 if ((flags & AS_GUEST)
1357 && (!change_to_guest() ||
1358 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1359 lp_hostsdeny(-1)))) {
1360 reply_doserror(req, ERRSRV, ERRaccess);
1361 return conn;
1362 }
1363
1364 smb_messages[type].fn(req);
1365 return req->conn;
1366 }
1367
1368 /****************************************************************************
1369 Construct a reply to the incoming packet.
1370 ****************************************************************************/
1371
1372 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1373 uint32_t seqnum, bool encrypted,
1374 struct smb_perfcount_data *deferred_pcd)
1375 {
1376 connection_struct *conn;
1377 struct smb_request *req;
1378
1379 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1380 smb_panic("could not allocate smb_request");
1381 }
1382
1383 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1384 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1385 req->seqnum = seqnum;
1386
1387 /* we popped this message off the queue - keep original perf data */
1388 if (deferred_pcd)
1389 req->pcd = *deferred_pcd;
1390 else {
1391 SMB_PERFCOUNT_START(&req->pcd);
1392 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1393 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1394 }
1395
1396 conn = switch_message(req->cmd, req, size);
1397
1398 if (req->unread_bytes) {
1399 /* writeX failed. drain socket. */
1400 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1401 req->unread_bytes) {
1402 smb_panic("failed to drain pending bytes");
1403 }
1404 req->unread_bytes = 0;
1405 }
1406
1407 if (req->done) {
1408 TALLOC_FREE(req);
1409 return;
1410 }
1411
1412 if (req->outbuf == NULL) {
1413 return;
1414 }
1415
1416 if (CVAL(req->outbuf,0) == 0) {
1417 show_msg((char *)req->outbuf);
1418 }
1419
1420 if (!srv_send_smb(smbd_server_fd(),
1421 (char *)req->outbuf,
1422 true, req->seqnum+1,
1423 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1424 &req->pcd)) {
1425 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1426 }
1427
1428 TALLOC_FREE(req);
1429
1430 return;
1431 }
1432
1433 /****************************************************************************
1434 Process an smb from the client
1435 ****************************************************************************/
1436 static void process_smb(struct smbd_server_connection *conn,
1437 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1438 uint32_t seqnum, bool encrypted,
1439 struct smb_perfcount_data *deferred_pcd)
1440 {
1441 int msg_type = CVAL(inbuf,0);
1442
1443 DO_PROFILE_INC(smb_count);
1444
1445 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1446 smb_len(inbuf) ) );
1447 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1448 (int)nread,
1449 (unsigned int)unread_bytes ));
1450
1451 if (msg_type != 0) {
1452 /*
1453 * NetBIOS session request, keepalive, etc.
1454 */
1455 reply_special((char *)inbuf);
1456 goto done;
1457 }
1458
1459 if (smbd_server_conn->allow_smb2) {
1460 if (smbd_is_smb2_header(inbuf, nread)) {
1461 smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1462 return;
1463 }
1464 smbd_server_conn->allow_smb2 = false;
1465 }
1466
1467 show_msg((char *)inbuf);
1468
1469 construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1470 trans_num++;
1471
1472 done:
1473 conn->smb1.num_requests++;
1474
1475 /* The timeout_processing function isn't run nearly
1476 often enough to implement 'max log size' without
1477 overrunning the size of the file by many megabytes.
1478 This is especially true if we are running at debug
1479 level 10. Checking every 50 SMBs is a nice
1480 tradeoff of performance vs log file size overrun. */
1481
1482 if ((conn->smb1.num_requests % 50) == 0 &&
1483 need_to_check_log_size()) {
1484 change_to_root_user();
1485 check_log_size();
1486 }
1487 }
1488
1489 /****************************************************************************
1490 Return a string containing the function name of a SMB command.
1491 ****************************************************************************/
1492
1493 const char *smb_fn_name(int type)
1494 {
1495 const char *unknown_name = "SMBunknown";
1496
1497 if (smb_messages[type].name == NULL)
1498 return(unknown_name);
1499
1500 return(smb_messages[type].name);
1501 }
1502
1503 /****************************************************************************
1504 Helper functions for contruct_reply.
1505 ****************************************************************************/
1506
1507 void add_to_common_flags2(uint32 v)
1508 {
1509 common_flags2 |= v;
1510 }
1511
1512 void remove_from_common_flags2(uint32 v)
1513 {
1514 common_flags2 &= ~v;
1515 }
1516
1517 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1518 char *outbuf)
1519 {
1520 srv_set_message(outbuf,0,0,false);
1521
1522 SCVAL(outbuf, smb_com, req->cmd);
1523 SIVAL(outbuf,smb_rcls,0);
1524 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1525 SSVAL(outbuf,smb_flg2,
1526 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1527 common_flags2);
1528 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1529
1530 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1531 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1532 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1533 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1534 }
1535
1536 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1537 {
1538 construct_reply_common(req, (char *)req->inbuf, outbuf);
1539 }
1540
1541 /*
1542 * How many bytes have we already accumulated up to the current wct field
1543 * offset?
1544 */
1545
1546 size_t req_wct_ofs(struct smb_request *req)
1547 {
1548 size_t buf_size;
1549
1550 if (req->chain_outbuf == NULL) {
1551 return smb_wct - 4;
1552 }
1553 buf_size = talloc_get_size(req->chain_outbuf);
1554 if ((buf_size % 4) != 0) {
1555 buf_size += (4 - (buf_size % 4));
1556 }
1557 return buf_size - 4;
1558 }
1559
1560 /*
1561 * Hack around reply_nterror & friends not being aware of chained requests,
1562 * generating illegal (i.e. wct==0) chain replies.
1563 */
1564
1565 static void fixup_chain_error_packet(struct smb_request *req)
1566 {
1567 uint8_t *outbuf = req->outbuf;
1568 req->outbuf = NULL;
1569 reply_outbuf(req, 2, 0);
1570 memcpy(req->outbuf, outbuf, smb_wct);
1571 TALLOC_FREE(outbuf);
1572 SCVAL(req->outbuf, smb_vwv0, 0xff);
1573 }
1574
1575 /****************************************************************************
1576 Construct a chained reply and add it to the already made reply
1577 ****************************************************************************/
1578
1579 void chain_reply(struct smb_request *req)
1580 {
1581 size_t smblen = smb_len(req->inbuf);
1582 size_t already_used, length_needed;
1583 uint8_t chain_cmd;
1584 uint32_t chain_offset; /* uint32_t to avoid overflow */
1585
1586 uint8_t wct;
1587 uint16_t *vwv;
1588 uint16_t buflen;
1589 uint8_t *buf;
1590
1591 if (IVAL(req->outbuf, smb_rcls) != 0) {
1592 fixup_chain_error_packet(req);
1593 }
1594
1595 /*
1596 * Any of the AndX requests and replies have at least a wct of
1597 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1598 * beginning of the SMB header to the next wct field.
1599 *
1600 * None of the AndX requests put anything valuable in vwv[0] and [1],
1601 * so we can overwrite it here to form the chain.
1602 */
1603
1604 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1605 goto error;
1606 }
1607
1608 /*
1609 * Here we assume that this is the end of the chain. For that we need
1610 * to set "next command" to 0xff and the offset to 0. If we later find
1611 * more commands in the chain, this will be overwritten again.
1612 */
1613
1614 SCVAL(req->outbuf, smb_vwv0, 0xff);
1615 SCVAL(req->outbuf, smb_vwv0+1, 0);
1616 SSVAL(req->outbuf, smb_vwv1, 0);
1617
1618 if (req->chain_outbuf == NULL) {
1619 /*
1620 * In req->chain_outbuf we collect all the replies. Start the
1621 * chain by copying in the first reply.
1622 *
1623 * We do the realloc because later on we depend on
1624 * talloc_get_size to determine the length of
1625 * chain_outbuf. The reply_xxx routines might have
1626 * over-allocated (reply_pipe_read_and_X used to be such an
1627 * example).
1628 */
1629 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1630 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1631 if (req->chain_outbuf == NULL) {
1632 goto error;
1633 }
1634 req->outbuf = NULL;
1635 } else {
1636 /*
1637 * Update smb headers where subsequent chained commands
1638 * may have updated them.
1639 */
1640 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
1641 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
1642
1643 if (!smb_splice_chain(&req->chain_outbuf,
1644 CVAL(req->outbuf, smb_com),
1645 CVAL(req->outbuf, smb_wct),
1646 (uint16_t *)(req->outbuf + smb_vwv),
1647 0, smb_buflen(req->outbuf),
1648 (uint8_t *)smb_buf(req->outbuf))) {
1649 goto error;
1650 }
1651 TALLOC_FREE(req->outbuf);
1652 }
1653
1654 /*
1655 * We use the old request's vwv field to grab the next chained command
1656 * and offset into the chained fields.
1657 */
1658
1659 chain_cmd = CVAL(req->vwv+0, 0);
1660 chain_offset = SVAL(req->vwv+1, 0);
1661
1662 if (chain_cmd == 0xff) {
1663 /*
1664 * End of chain, no more requests from the client. So ship the
1665 * replies.
1666 */
1667 smb_setlen((char *)(req->chain_outbuf),
1668 talloc_get_size(req->chain_outbuf) - 4);
1669
1670 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1671 true, req->seqnum+1,
1672 IS_CONN_ENCRYPTED(req->conn)
1673 ||req->encrypted,
1674 &req->pcd)) {
1675 exit_server_cleanly("chain_reply: srv_send_smb "
1676 "failed.");
1677 }
1678 TALLOC_FREE(req->chain_outbuf);
1679 req->done = true;
1680 return;
1681 }
1682
1683 /* add a new perfcounter for this element of chain */
1684 SMB_PERFCOUNT_ADD(&req->pcd);
1685 SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
1686 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
1687
1688 /*
1689 * Check if the client tries to fool us. The request so far uses the
1690 * space to the end of the byte buffer in the request just
1691 * processed. The chain_offset can't point into that area. If that was
1692 * the case, we could end up with an endless processing of the chain,
1693 * we would always handle the same request.
1694 */
1695
1696 already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1697 if (chain_offset < already_used) {
1698 goto error;
1699 }
1700
1701 /*
1702 * Next check: Make sure the chain offset does not point beyond the
1703 * overall smb request length.
1704 */
1705
1706 length_needed = chain_offset+1; /* wct */
1707 if (length_needed > smblen) {
1708 goto error;
1709 }
1710
1711 /*
1712 * Now comes the pointer magic. Goal here is to set up req->vwv and
1713 * req->buf correctly again to be able to call the subsequent
1714 * switch_message(). The chain offset (the former vwv[1]) points at
1715 * the new wct field.
1716 */
1717
1718 wct = CVAL(smb_base(req->inbuf), chain_offset);
1719
1720 /*
1721 * Next consistency check: Make the new vwv array fits in the overall
1722 * smb request.
1723 */
1724
1725 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1726 if (length_needed > smblen) {
1727 goto error;
1728 }
1729 vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1730
1731 /*
1732 * Now grab the new byte buffer....
1733 */
1734
1735 buflen = SVAL(vwv+wct, 0);
1736
1737 /*
1738 * .. and check that it fits.
1739 */
1740
1741 length_needed += buflen;
1742 if (length_needed > smblen) {
1743 goto error;
1744 }
1745 buf = (uint8_t *)(vwv+wct+1);
1746
1747 req->cmd = chain_cmd;
1748 req->wct = wct;
1749 req->vwv = vwv;
1750 req->buflen = buflen;
1751 req->buf = buf;
1752
1753 switch_message(chain_cmd, req, smblen);
1754
1755 if (req->outbuf == NULL) {
1756 /*
1757 * This happens if the chained command has suspended itself or
1758 * if it has called srv_send_smb() itself.
1759 */
1760 return;
1761 }
1762
1763 /*
1764 * We end up here if the chained command was not itself chained or
1765 * suspended, but for example a close() command. We now need to splice
1766 * the chained commands' outbuf into the already built up chain_outbuf
1767 * and ship the result.
1768 */
1769 goto done;
1770
1771 error:
1772 /*
1773 * We end up here if there's any error in the chain syntax. Report a
1774 * DOS error, just like Windows does.
1775 */
1776 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
1777 fixup_chain_error_packet(req);
1778
1779 done:
1780 /*
1781 * This scary statement intends to set the
1782 * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
1783 * to the value req->outbuf carries
1784 */
1785 SSVAL(req->chain_outbuf, smb_flg2,
1786 (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1787 | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1788
1789 /*
1790 * Transfer the error codes from the subrequest to the main one
1791 */
1792 SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1793 SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
1794
1795 if (!smb_splice_chain(&req->chain_outbuf,
1796 CVAL(req->outbuf, smb_com),
1797 CVAL(req->outbuf, smb_wct),
1798 (uint16_t *)(req->outbuf + smb_vwv),
1799 0, smb_buflen(req->outbuf),
1800 (uint8_t *)smb_buf(req->outbuf))) {
1801 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
1802 }
1803 TALLOC_FREE(req->outbuf);
1804
1805 smb_setlen((char *)(req->chain_outbuf),
1806 talloc_get_size(req->chain_outbuf) - 4);
1807
1808 show_msg((char *)(req->chain_outbuf));
1809
1810 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1811 true, req->seqnum+1,
1812 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
1813 &req->pcd)) {
1814 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1815 }
1816 TALLOC_FREE(req->chain_outbuf);
1817 req->done = true;
1818 }
1819
1820 /****************************************************************************
1821 Check if services need reloading.
1822 ****************************************************************************/
1823
1824 void check_reload(time_t t)
1825 {
1826 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1827
1828 if(last_smb_conf_reload_time == 0) {
1829 last_smb_conf_reload_time = t;
1830 /* Our printing subsystem might not be ready at smbd start up.
1831 Then no printer is available till the first printers check
1832 is performed. A lower initial interval circumvents this. */
1833 if ( printcap_cache_time > 60 )
1834 last_printer_reload_time = t - printcap_cache_time + 60;
1835 else
1836 last_printer_reload_time = t;
1837 }
1838
1839 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1840 /* randomize over 60 second the printcap reload to avoid all
1841 * process hitting cupsd at the same time */
1842 int time_range = 60;
1843
1844 last_printer_reload_time += random() % time_range;
1845 mypid = getpid();
1846 }
1847
1848 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
1849 reload_services(True);
1850 last_smb_conf_reload_time = t;
1851 }
1852
1853 /* 'printcap cache time = 0' disable the feature */
1854
1855 if ( printcap_cache_time != 0 )
1856 {
1857 /* see if it's time to reload or if the clock has been set back */
1858
1859 if ( (t >= last_printer_reload_time+printcap_cache_time)
1860 || (t-last_printer_reload_time < 0) )
1861 {
1862 DEBUG( 3,( "Printcap cache time expired.\n"));
1863 reload_printers();
1864 last_printer_reload_time = t;
1865 }
1866 }
1867 }
1868
1869 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
1870 {
1871 /* TODO: make write nonblocking */
1872 }
1873
1874 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
1875 {
1876 uint8_t *inbuf = NULL;
1877 size_t inbuf_len = 0;
1878 size_t unread_bytes = 0;
1879 bool encrypted = false;
1880 TALLOC_CTX *mem_ctx = talloc_tos();
1881 NTSTATUS status;
1882 uint32_t seqnum;
1883
1884 /* TODO: make this completely nonblocking */
1885
1886 status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
1887 (char **)(void *)&inbuf,
1888 0, /* timeout */
1889 &unread_bytes,
1890 &encrypted,
1891 &inbuf_len, &seqnum);
1892 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1893 goto process;
1894 }
1895 if (NT_STATUS_IS_ERR(status)) {
1896 exit_server_cleanly("failed to receive smb request");
1897 }
1898 if (!NT_STATUS_IS_OK(status)) {
1899 return;
1900 }
1901
1902 process:
1903 process_smb(conn, inbuf, inbuf_len, unread_bytes,
1904 seqnum, encrypted, NULL);
1905 }
1906
1907 static void smbd_server_connection_handler(struct event_context *ev,
1908 struct fd_event *fde,
1909 uint16_t flags,
1910 void *private_data)
1911 {
1912 struct smbd_server_connection *conn = talloc_get_type(private_data,
1913 struct smbd_server_connection);
1914
1915 if (flags & EVENT_FD_WRITE) {
1916 smbd_server_connection_write_handler(conn);
1917 } else if (flags & EVENT_FD_READ) {
1918 smbd_server_connection_read_handler(conn);
1919 }
1920 }
1921
1922
1923 /****************************************************************************
1924 received when we should release a specific IP
1925 ****************************************************************************/
1926 static void release_ip(const char *ip, void *priv)
1927 {
1928 char addr[INET6_ADDRSTRLEN];
1929 char *p = addr;
1930
1931 client_socket_addr(get_client_fd(),addr,sizeof(addr));
1932
1933 if (strncmp("::ffff:", addr, 7) == 0) {
1934 p = addr + 7;
1935 }
1936
1937 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
1938 /* we can't afford to do a clean exit - that involves
1939 database writes, which would potentially mean we
1940 are still running after the failover has finished -
1941 we have to get rid of this process ID straight
1942 away */
1943 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
1944 ip));
1945 /* note we must exit with non-zero status so the unclean handler gets
1946 called in the parent, so that the brl database is tickled */
1947 _exit(1);
1948 }
1949 }
1950
1951 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
1952 uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
1953 {
1954 release_ip((char *)data->data, NULL);
1955 }
1956
1957 #ifdef CLUSTER_SUPPORT
1958 static int client_get_tcp_info(struct sockaddr_storage *server,
1959 struct sockaddr_storage *client)
1960 {
1961 socklen_t length;
1962 if (server_fd == -1) {
1963 return -1;
1964 }
1965 length = sizeof(*server);
1966 if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
1967 return -1;
1968 }
1969 length = sizeof(*client);
1970 if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
1971 return -1;
1972 }
1973 return 0;
1974 }
1975 #endif
1976
1977 /*
1978 * Send keepalive packets to our client
1979 */
1980 static bool keepalive_fn(const struct timeval *now, void *private_data)
1981 {
1982 if (!send_keepalive(smbd_server_fd())) {
1983 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1984 return False;
1985 }
1986 return True;
1987 }
1988
1989 /*
1990 * Do the recurring check if we're idle
1991 */
1992 static bool deadtime_fn(const struct timeval *now, void *private_data)
1993 {
1994 struct smbd_server_connection *sconn = smbd_server_conn;
1995 if ((conn_num_open(sconn) == 0)
1996 || (conn_idle_all(sconn, now->tv_sec))) {
1997 DEBUG( 2, ( "Closing idle connection\n" ) );
1998 messaging_send(smbd_messaging_context(), procid_self(),
1999 MSG_SHUTDOWN, &data_blob_null);
2000 return False;
2001 }
2002
2003 return True;
2004 }
2005
2006 /*
2007 * Do the recurring log file and smb.conf reload checks.
2008 */
2009
2010 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2011 {
2012 change_to_root_user();
2013
2014 /* update printer queue caches if necessary */
2015 update_monitored_printq_cache();
2016
2017 /* check if we need to reload services */
2018 check_reload(time(NULL));
2019
2020 /* Change machine password if neccessary. */
2021 attempt_machine_password_change();
2022
2023 /*
2024 * Force a log file check.
2025 */
2026 force_check_log_size();
2027 check_log_size();
2028 return true;
2029 }
2030
2031 /****************************************************************************
2032 Process commands from the client
2033 ****************************************************************************/
2034
2035 void smbd_process(void)
2036 {
2037 TALLOC_CTX *frame = talloc_stackframe();
2038 char remaddr[INET6_ADDRSTRLEN];
2039
2040 if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2041 lp_security() != SEC_SHARE) {
2042 smbd_server_conn->allow_smb2 = true;
2043 }
2044
2045 /* Ensure child is set to blocking mode */
2046 set_blocking(smbd_server_fd(),True);
2047
2048 set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2049 set_socket_options(smbd_server_fd(), lp_socket_options());
2050
2051 /* this is needed so that we get decent entries
2052 in smbstatus for port 445 connects */
2053 set_remote_machine_name(get_peer_addr(smbd_server_fd(),
2054 remaddr,
2055 sizeof(remaddr)),
2056 false);
2057 reload_services(true);
2058
2059 /*
2060 * Before the first packet, check the global hosts allow/ hosts deny
2061 * parameters before doing any parsing of packets passed to us by the
2062 * client. This prevents attacks on our parsing code from hosts not in
2063 * the hosts allow list.
2064 */
2065
2066 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2067 lp_hostsdeny(-1))) {
2068 char addr[INET6_ADDRSTRLEN];
2069
2070 /*
2071 * send a negative session response "not listening on calling
2072 * name"
2073 */
2074 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2075 DEBUG( 1, ("Connection denied from %s\n",
2076 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
2077 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2078 0, false, NULL);
2079 exit_server_cleanly("connection denied");
2080 }
2081
2082 static_init_rpc;
2083
2084 init_modules();
2085
2086 smb_perfcount_init();
2087
2088 if (!init_account_policy()) {
2089 exit_server("Could not open account policy tdb.\n");
2090 }
2091
2092 if (*lp_rootdir()) {
2093 if (chroot(lp_rootdir()) != 0) {
2094 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2095 exit_server("Failed to chroot()");
2096 }
2097 if (chdir("/") == -1) {
2098 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2099 exit_server("Failed to chroot()");
2100 }
2101 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2102 }
2103
2104 if (!srv_init_signing(smbd_server_conn)) {
2105 exit_server("Failed to init smb_signing");
2106 }
2107
2108 /* Setup oplocks */
2109 if (!init_oplocks(smbd_messaging_context()))
2110 exit_server("Failed to init oplocks");
2111
2112 /* Setup aio signal handler. */
2113 initialize_async_io_handler();
2114
2115 /* register our message handlers */
2116 messaging_register(smbd_messaging_context(), NULL,
2117 MSG_SMB_FORCE_TDIS, msg_force_tdis);
2118 messaging_register(smbd_messaging_context(), NULL,
2119 MSG_SMB_RELEASE_IP, msg_release_ip);
2120 messaging_register(smbd_messaging_context(), NULL,
2121 MSG_SMB_CLOSE_FILE, msg_close_file);
2122
2123 /*
2124 * Use the default MSG_DEBUG handler to avoid rebroadcasting
2125 * MSGs to all child processes
2126 */
2127 messaging_deregister(smbd_messaging_context(),
2128 MSG_DEBUG, NULL);
2129 messaging_register(smbd_messaging_context(), NULL,
2130 MSG_DEBUG, debug_message);
2131
2132 if ((lp_keepalive() != 0)
2133 && !(event_add_idle(smbd_event_context(), NULL,
2134 timeval_set(lp_keepalive(), 0),
2135 "keepalive", keepalive_fn,
2136 NULL))) {
2137 DEBUG(0, ("Could not add keepalive event\n"));
2138 exit(1);
2139 }
2140
2141 if (!(event_add_idle(smbd_event_context(), NULL,
2142 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
2143 "deadtime", deadtime_fn, NULL))) {
2144 DEBUG(0, ("Could not add deadtime event\n"));
2145 exit(1);
2146 }
2147
2148 if (!(event_add_idle(smbd_event_context(), NULL,
2149 timeval_set(SMBD_SELECT_TIMEOUT, 0),
2150 "housekeeping", housekeeping_fn, NULL))) {
2151 DEBUG(0, ("Could not add housekeeping event\n"));
2152 exit(1);
2153 }
2154
2155 #ifdef CLUSTER_SUPPORT
2156
2157 if (lp_clustering()) {
2158 /*
2159 * We need to tell ctdb about our client's TCP
2160 * connection, so that for failover ctdbd can send
2161 * tickle acks, triggering a reconnection by the
2162 * client.
2163 */
2164
2165 struct sockaddr_storage srv, clnt;
2166
2167 if (client_get_tcp_info(&srv, &clnt) == 0) {
2168
2169 NTSTATUS status;
2170
2171 status = ctdbd_register_ips(
2172 messaging_ctdbd_connection(),
2173 &srv, &clnt, release_ip, NULL);
2174
2175 if (!NT_STATUS_IS_OK(status)) {
2176 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
2177 nt_errstr(status)));
2178 }
2179 } else
2180 {
2181 DEBUG(0,("Unable to get tcp info for "
2182 "CTDB_CONTROL_TCP_CLIENT: %s\n",
2183 strerror(errno)));
2184 }
2185 }
2186
2187 #endif
2188
2189 smbd_server_conn->nbt.got_session = false;
2190
2191 smbd_server_conn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2192
2193 smbd_server_conn->smb1.sessions.done_sesssetup = false;
2194 smbd_server_conn->smb1.sessions.max_send = BUFFER_SIZE;
2195 smbd_server_conn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
2196 /* users from session setup */
2197 smbd_server_conn->smb1.sessions.session_userlist = NULL;
2198 /* workgroup from session setup. */
2199 smbd_server_conn->smb1.sessions.session_workgroup = NULL;
2200 /* this holds info on user ids that are already validated for this VC */
2201 smbd_server_conn->smb1.sessions.validated_users = NULL;
2202 smbd_server_conn->smb1.sessions.next_vuid = VUID_OFFSET;
2203 smbd_server_conn->smb1.sessions.num_validated_vuids = 0;
2204 #ifdef HAVE_NETGROUP
2205 smbd_server_conn->smb1.sessions.my_yp_domain = NULL;
2206 #endif
2207
2208 conn_init(smbd_server_conn);
2209 if (!init_dptrs(smbd_server_conn)) {
2210 exit_server("init_dptrs() failed");
2211 }
2212
2213 smbd_server_conn->smb1.fde = event_add_fd(smbd_event_context(),
2214 smbd_server_conn,
2215 smbd_server_fd(),
2216 EVENT_FD_READ,
2217 smbd_server_connection_handler,
2218 smbd_server_conn);
2219 if (!smbd_server_conn->smb1.fde) {
2220 exit_server("failed to create smbd_server_connection fde");
2221 }
2222
2223 TALLOC_FREE(frame);
2224
2225 while (True) {
2226 NTSTATUS status;
2227
2228 frame = talloc_stackframe_pool(8192);
2229
2230 errno = 0;
2231
2232 status = smbd_server_connection_loop_once(smbd_server_conn);
2233 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
2234 !NT_STATUS_IS_OK(status)) {
2235 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2236 " exiting\n", nt_errstr(status)));
2237 break;
2238 }
2239
2240 TALLOC_FREE(frame);
2241 }
2242
2243 exit_server_cleanly(NULL);
2244 }
2245
2246 bool req_is_in_chain(struct smb_request *req)
2247 {
2248 if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
2249 /*
2250 * We're right now handling a subsequent request, so we must
2251 * be in a chain
2252 */
2253 return true;
2254 }
2255
2256 if (!is_andx_req(req->cmd)) {
2257 return false;
2258 }
2259
2260 if (req->wct < 2) {
2261 /*
2262 * Okay, an illegal request, but definitely not chained :-)
2263 */
2264 return false;
2265 }
2266
2267 return (CVAL(req->vwv+0, 0) != 0xFF);
2268 }
aatanasov's samba4 branch