source3/modules/vfs_scannedonly.c

   1 /*
   2  * scannedonly VFS module for Samba 3.5
   3  *
   4  * Copyright 2007,2008,2009,2010 (C) Olivier Sessink
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  *
  20  * ABOUT SCANNEDONLY
  21  *
  22  * scannedonly implements a 'filter' like vfs module that talks over a
  23  * unix domain socket or over UDP to a anti-virus engine.
  24  *
  25  * files that are clean have a corresponding .scanned:{filename} file
  26  * in the same directory. So why the .scanned: files? They take up
  27  * only an inode, because they are 0 bytes. To test if the file is
  28  * scanned only a stat() call on the filesystem is needed which is
  29  * very quick compared to a database lookup. All modern filesystems
  30  * use database technology such as balanced trees for lookups anyway.
  31  * The number of inodes in modern filesystems is also not limiting
  32  * anymore. The .scanned: files are also easy scriptable. You can
  33  * remove them with a simple find command or create them with a
  34  * simple touch command. Extended filesystem attributes have similar
  35  * properties, but are not supported on all filesystems, so that
  36  * would limit the usage of the module (and attributes are not as
  37  * easily scriptable)
  38  *
  39  * files that are not clean are sent to the AV-engine. Only the
  40  * filename is sent over the socket. The protocol is very simple:
  41  * a newline separated list of filenames inside each datagram.
  42  *
  43  * a file AV-scan may be requested multiple times, the AV-engine
  44  * should also check if the file has been scanned already. Requests
  45  * can also be dropped by the AV-engine (and we thus don't need the
  46  * reliability of TCP).
  47  *
  48  */
  49
  50 #include "includes.h"
  51
  52 #include "config.h"
  53
  54 #define SENDBUFFERSIZE 1450
  55
  56 #ifndef       SUN_LEN
  57 #define       SUN_LEN(sunp)   ((size_t)((struct sockaddr_un *)0)->sun_path \
  58                                 + strlen((sunp)->sun_path))
  59 #endif
  60
  61
  62 struct Tscannedonly {
  63         int socket;
  64         int domain_socket;
  65         int portnum;
  66         int scanning_message_len;
  67         int recheck_time_open;
  68         int recheck_tries_open;
  69         int recheck_size_open;
  70         int recheck_time_readdir;
  71         int recheck_tries_readdir;
  72         bool show_special_files;
  73         bool rm_hidden_files_on_rmdir;
  74         bool hide_nonscanned_files;
  75         bool allow_nonscanned_files;
  76         char *socketname;
  77         char *scanhost;
  78         char *scanning_message;
  79         char *p_scanned; /* prefix for scanned files */
  80         char *p_virus; /* prefix for virus containing files */
  81         char *p_failed; /* prefix for failed to scan files */
  82         char gsendbuffer[SENDBUFFERSIZE + 1];
  83 };
  84
  85 #define STRUCTSCANO(var) ((struct Tscannedonly *)var)
  86
  87 struct scannedonly_DIR {
  88         char *base;
  89         int notify_loop_done;
  90         SMB_STRUCT_DIR *DIR;
  91 };
  92 #define SCANNEDONLY_DEBUG 9
  93 /*********************/
  94 /* utility functions */
  95 /*********************/
  96
  97 static char *real_path_from_notify_path(TALLOC_CTX *ctx,
  98                                         struct Tscannedonly *so,
  99                                         const char *path)
 100 {
 101         char *name;
 102         int len, pathlen;
 103
 104         name = strrchr(path, '/');
 105         if (!name) {
 106                 return NULL;
 107         }
 108         pathlen = name - path;
 109         name++;
 110         len = strlen(name);
 111         if (len <= so->scanning_message_len) {
 112                 return NULL;
 113         }
 114
 115         if (strcmp(name + (len - so->scanning_message_len),
 116                    so->scanning_message) != 0) {
 117                 return NULL;
 118         }
 119
 120         return talloc_strndup(ctx,path,
 121                               pathlen + len - so->scanning_message_len);
 122 }
 123
 124 static char *cachefile_name(TALLOC_CTX *ctx,
 125                             const char *shortname,
 126                             const char *base,
 127                             const char *p_scanned)
 128 {
 129         return talloc_asprintf(ctx, "%s%s%s", base, p_scanned, shortname);
 130 }
 131
 132 static char *name_w_ending_slash(TALLOC_CTX *ctx, const char *name)
 133 {
 134         int len = strlen(name);
 135         if (name[len - 1] == '/') {
 136                 return talloc_strdup(ctx,name);
 137         } else {
 138                 return talloc_asprintf(ctx, "%s/", name);
 139         }
 140 }
 141
 142 static char *cachefile_name_f_fullpath(TALLOC_CTX *ctx,
 143                                        const char *fullpath,
 144                                        const char *p_scanned)
 145 {
 146         const char *base;
 147         char *tmp, *cachefile, *shortname;
 148         tmp = strrchr(fullpath, '/');
 149         if (tmp) {
 150                 base = talloc_strndup(ctx, fullpath, (tmp - fullpath) + 1);
 151                 shortname = tmp + 1;
 152         } else {
 153                 base = "";
 154                 shortname = (char *)fullpath;
 155         }
 156         cachefile = cachefile_name(ctx, shortname, base, p_scanned);
 157         DEBUG(SCANNEDONLY_DEBUG,
 158               ("cachefile_name_f_fullpath cachefile=%s\n", cachefile));
 159         return cachefile;
 160 }
 161
 162 static char *construct_full_path(TALLOC_CTX *ctx, vfs_handle_struct * handle,
 163                                  const char *somepath, bool ending_slash)
 164 {
 165         char *tmp;
 166
 167         if (!somepath) {
 168                 return NULL;
 169         }
 170         if (somepath[0] == '/') {
 171                 if (ending_slash) {
 172                         return name_w_ending_slash(ctx,somepath);
 173                 }
 174                 return talloc_strdup(ctx,somepath);
 175         }
 176         tmp=(char *)somepath;
 177         if (tmp[0]=='.'&&tmp[1]=='/') {
 178                 tmp+=2;
 179         }
 180         /* vfs_GetWd() seems to return a path with a slash */
 181         if (ending_slash) {
 182                 return talloc_asprintf(ctx, "%s/%s/",
 183                                        vfs_GetWd(ctx, handle->conn),tmp);
 184         }
 185         return talloc_asprintf(ctx, "%s/%s",
 186                                vfs_GetWd(ctx, handle->conn),tmp);
 187 }
 188
 189 static int connect_to_scanner(vfs_handle_struct * handle)
 190 {
 191         struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
 192
 193         if (so->domain_socket) {
 194                 struct sockaddr_un saun;
 195                 DEBUG(SCANNEDONLY_DEBUG, ("socket=%s\n", so->socketname));
 196                 if ((so->socket = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) {
 197                         DEBUG(2, ("failed to create socket %s\n",
 198                                   so->socketname));
 199                         return -1;
 200                 }
 201                 saun.sun_family = AF_UNIX;
 202                 strncpy(saun.sun_path, so->socketname,
 203                         sizeof(saun.sun_path) - 1);
 204                 if (connect(so->socket, (struct sockaddr *)(void *)&saun,
 205                             SUN_LEN(&saun)) < 0) {
 206                         DEBUG(2, ("failed to connect to socket %s\n",
 207                                   so->socketname));
 208                         return -1;
 209                 }
 210                 DEBUG(SCANNEDONLY_DEBUG,("bound %s to socket %d\n",
 211                                          saun.sun_path, so->socket));
 212
 213         } else {
 214                 so->socket = open_udp_socket(so->scanhost, so->portnum);
 215                 if (so->socket < 0) {
 216                         DEBUG(2,("failed to open UDP socket to %s:%d\n",
 217                                  so->scanhost,so->portnum));
 218                         return -1;
 219                 }
 220         }
 221
 222         {/* increasing the socket buffer is done because we have large bursts
 223             of UDP packets or DGRAM's on a domain socket whenever we hit a
 224             large directory with lots of unscanned files. */
 225                 int sndsize;
 226                 socklen_t size = sizeof(int);
 227                 getsockopt(so->socket, SOL_SOCKET, SO_RCVBUF,
 228                            (char *)&sndsize, &size);
 229                 DEBUG(SCANNEDONLY_DEBUG, ("current socket buffer size=%d\n",
 230                                           sndsize));
 231                 sndsize = 262144;
 232                 if (setsockopt(so->socket, SOL_SOCKET, SO_RCVBUF,
 233                                (char *)&sndsize,
 234                                (int)sizeof(sndsize)) != 0) {
 235                         DEBUG(SCANNEDONLY_DEBUG,
 236                               ("error setting socket buffer %s (%d)\n",
 237                                strerror(errno), errno));
 238                 }
 239         }
 240         set_blocking(so->socket, false);
 241         return 0;
 242 }
 243
 244 static void flush_sendbuffer(vfs_handle_struct * handle)
 245 {
 246         struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
 247         int ret, len, loop = 10;
 248         if (so->gsendbuffer[0] == '\0') {
 249                 return;
 250         }
 251
 252         do {
 253                 loop--;
 254                 len = strlen(so->gsendbuffer);
 255                 ret = send(so->socket, so->gsendbuffer, len, 0);
 256                 if (ret == len) {
 257                         so->gsendbuffer[0] = '\0';
 258                         break;
 259                 }
 260                 if (ret == -1) {
 261                         DEBUG(3,("scannedonly flush_sendbuffer: "
 262                                  "error sending on socket %d to scanner:"
 263                                  " %s (%d)\n",
 264                                  so->socket, strerror(errno), errno));
 265                         if (errno == ECONNREFUSED || errno == ENOTCONN
 266                             || errno == ECONNRESET) {
 267                                 if (connect_to_scanner(handle) == -1)
 268                                         break;  /* connecting fails, abort */
 269                                 /* try again */
 270                         } else if (errno != EINTR) {
 271                                 /* on EINTR we just try again, all remaining
 272                                    other errors we log the error
 273                                    and try again ONCE */
 274                                 loop = 1;
 275                                 DEBUG(3,("scannedonly flush_sendbuffer: "
 276                                          "error sending data to scanner: %s "
 277                                          "(%d)\n", strerror(errno), errno));
 278                         }
 279                 } else {
 280                         /* --> partial write: Resend all filenames that were
 281                            not or not completely written. a partial filename
 282                            written means the filename will not arrive correctly,
 283                            so resend it completely */
 284                         int pos = 0;
 285                         while (pos < len) {
 286                                 char *tmp = strchr(so->gsendbuffer+pos, '\n');
 287                                 if (tmp && tmp - so->gsendbuffer < ret)
 288                                         pos = tmp - so->gsendbuffer + 1;
 289                                 else
 290                                         break;
 291                         }
 292                         memmove(so->gsendbuffer, so->gsendbuffer + pos,
 293                                 SENDBUFFERSIZE - ret);
 294                         /* now try again */
 295                 }
 296         } while (loop > 0);
 297
 298         if (so->gsendbuffer[0] != '\0') {
 299                 DEBUG(2,
 300                       ("scannedonly flush_sendbuffer: "
 301                        "failed to send files to AV scanner, "
 302                        "discarding files."));
 303                 so->gsendbuffer[0] = '\0';
 304         }
 305 }
 306
 307 static void notify_scanner(vfs_handle_struct * handle, const char *scanfile)
 308 {
 309         char *tmp;
 310         int tmplen, gsendlen;
 311         struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
 312         TALLOC_CTX *ctx=talloc_tos();
 313         if (scanfile[0] != '/') {
 314                 tmp = construct_full_path(ctx,handle, scanfile, false);
 315         } else {
 316                 tmp = (char *)scanfile;
 317         }
 318         tmplen = strlen(tmp);
 319         gsendlen = strlen(so->gsendbuffer);
 320         DEBUG(SCANNEDONLY_DEBUG,
 321               ("scannedonly notify_scanner: tmp=%s, tmplen=%d, gsendlen=%d\n",
 322                tmp, tmplen, gsendlen));
 323         if (gsendlen + tmplen >= SENDBUFFERSIZE) {
 324                 flush_sendbuffer(handle);
 325         }
 326         strlcat(so->gsendbuffer, tmp, SENDBUFFERSIZE + 1);
 327         strlcat(so->gsendbuffer, "\n", SENDBUFFERSIZE + 1);
 328 }
 329
 330 static bool is_scannedonly_file(struct Tscannedonly *so, const char *shortname)
 331 {
 332         if (shortname[0]!='.') {
 333                 return false;
 334         }
 335         if (strncmp(shortname, so->p_scanned, strlen(so->p_scanned)) == 0) {
 336                 return true;
 337         }
 338         if (strncmp(shortname, so->p_virus, strlen(so->p_virus)) == 0) {
 339                 return true;
 340         }
 341         if (strncmp(shortname, so->p_failed, strlen(so->p_failed)) == 0) {
 342                 return true;
 343         }
 344         return false;
 345 }
 346
 347 static bool timespec_is_newer(struct timespec *base, struct timespec *test)
 348 {
 349         return timespec_compare(base,test) < 0;
 350 }
 351
 352 /*
 353 vfs_handle_struct *handle the scannedonly handle
 354 scannedonly_DIR * sDIR the scannedonly struct if called from _readdir()
 355 or NULL
 356 fullpath is a full path starting from / or a relative path to the
 357 current working directory
 358 shortname is the filename without directory components
 359 basename, is the directory without file name component
 360 allow_nonexistant return TRUE if stat() on the requested file fails
 361 recheck_time, the time in milliseconds to wait for the daemon to
 362 create a .scanned file
 363 recheck_tries, the number of tries to wait
 364 recheck_size, size in Kb of files that should not be waited for
 365 loop : boolean if we should try to loop over all files in the directory
 366 and send a notify to the scanner for all files that need scanning
 367 */
 368 static bool scannedonly_allow_access(vfs_handle_struct * handle,
 369                                      struct scannedonly_DIR *sDIR,
 370                                      struct smb_filename *smb_fname,
 371                                      const char *shortname,
 372                                      const char *base_name,
 373                                      int allow_nonexistant,
 374                                      int recheck_time, int recheck_tries,
 375                                      int recheck_size, int loop)
 376 {
 377         struct smb_filename *cache_smb_fname;
 378         TALLOC_CTX *ctx=talloc_tos();
 379         char *cachefile;
 380         int retval = -1;
 381         int didloop;
 382         DEBUG(SCANNEDONLY_DEBUG,
 383               ("smb_fname->base_name=%s, shortname=%s, base_name=%s\n"
 384                ,smb_fname->base_name,shortname,base_name));
 385
 386         if (ISDOT(shortname) || ISDOTDOT(shortname)) {
 387                 return true;
 388         }
 389         if (is_scannedonly_file(STRUCTSCANO(handle->data), shortname)) {
 390                 DEBUG(SCANNEDONLY_DEBUG,
 391                       ("scannedonly_allow_access, %s is a scannedonly file, "
 392                        "return 0\n", shortname));
 393                 return false;
 394         }
 395
 396         if (!VALID_STAT(smb_fname->st)) {
 397                 DEBUG(SCANNEDONLY_DEBUG,("stat %s\n",smb_fname->base_name));
 398                 retval = SMB_VFS_NEXT_STAT(handle, smb_fname);
 399                 if (retval != 0) {
 400                         /* failed to stat this file?!? --> hide it */
 401                         DEBUG(SCANNEDONLY_DEBUG,("no valid stat, return"
 402                                                  " allow_nonexistant=%d\n",
 403                                                  allow_nonexistant));
 404                         return allow_nonexistant;
 405                 }
 406         }
 407         if (!S_ISREG(smb_fname->st.st_ex_mode)) {
 408                 DEBUG(SCANNEDONLY_DEBUG,
 409                       ("%s is not a regular file, ISDIR=%d\n",
 410                        smb_fname->base_name,
 411                        S_ISDIR(smb_fname->st.st_ex_mode)));
 412                 return (STRUCTSCANO(handle->data)->
 413                         show_special_files ||
 414                         S_ISDIR(smb_fname->st.st_ex_mode));
 415         }
 416         if (smb_fname->st.st_ex_size == 0) {
 417                 DEBUG(SCANNEDONLY_DEBUG,("empty file, return 1\n"));
 418                 return true;    /* empty files cannot contain viruses ! */
 419         }
 420         cachefile = cachefile_name(ctx,
 421                                    shortname,
 422                                    base_name,
 423                                    STRUCTSCANO(handle->data)->p_scanned);
 424         create_synthetic_smb_fname(ctx, cachefile,NULL,NULL,&cache_smb_fname);
 425         if (!VALID_STAT(cache_smb_fname->st)) {
 426                 retval = SMB_VFS_NEXT_STAT(handle, cache_smb_fname);
 427         }
 428         if (retval == 0 && VALID_STAT(cache_smb_fname->st)) {
 429                 if (timespec_is_newer(&smb_fname->st.st_ex_ctime,
 430                                       &cache_smb_fname->st.st_ex_ctime)) {
 431                         talloc_free(cache_smb_fname);
 432                         return true;
 433                 }
 434                 /* no cachefile or too old */
 435                 SMB_VFS_NEXT_UNLINK(handle, cache_smb_fname);
 436                 retval = -1;
 437         }
 438
 439         notify_scanner(handle, smb_fname->base_name);
 440
 441         didloop = 0;
 442         if (loop && sDIR && !sDIR->notify_loop_done) {
 443                 /* check the rest of the directory and notify the
 444                    scanner if some file needs scanning */
 445                 long offset;
 446                 SMB_STRUCT_DIRENT *dire;
 447
 448                 offset = SMB_VFS_NEXT_TELLDIR(handle, sDIR->DIR);
 449                 dire = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR, NULL);
 450                 while (dire) {
 451                         char *fpath2;
 452                         struct smb_filename *smb_fname2;
 453                         fpath2 = talloc_asprintf(ctx, "%s%s", base_name,dire->d_name);
 454                         DEBUG(SCANNEDONLY_DEBUG,
 455                               ("scannedonly_allow_access in loop, "
 456                                "found %s\n", fpath2));
 457                         create_synthetic_smb_fname(ctx, fpath2,NULL,NULL,
 458                                                    &smb_fname2);
 459                         scannedonly_allow_access(handle, NULL,
 460                                                  smb_fname2,
 461                                                  dire->d_name,
 462                                                  base_name, 0, 0, 0, 0, 0);
 463                         talloc_free(fpath2);
 464                         talloc_free(smb_fname2);
 465                         dire = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR,NULL);
 466                 }
 467                 sDIR->notify_loop_done = 1;
 468                 didloop = 1;
 469                 SMB_VFS_NEXT_SEEKDIR(handle, sDIR->DIR, offset);
 470         }
 471         if (recheck_time > 0
 472             && ((recheck_size > 0
 473                  && smb_fname->st.st_ex_size < (1024 * recheck_size))
 474                 || didloop)) {
 475                 int i = 0;
 476                 flush_sendbuffer(handle);
 477                 while (retval != 0      /*&& errno == ENOENT */
 478                        && i < recheck_tries) {
 479                         DEBUG(SCANNEDONLY_DEBUG,
 480                               ("scannedonly_allow_access, wait (try=%d "
 481                                "(max %d), %d ms) for %s\n",
 482                                i, recheck_tries,
 483                                recheck_time, cache_smb_fname->base_name));
 484                         smb_msleep(recheck_time);
 485                         retval = SMB_VFS_NEXT_STAT(handle, cache_smb_fname);
 486                         i++;
 487                 }
 488         }
 489         /* still no cachefile, or still too old, return 0 */
 490         if (retval != 0
 491             || !timespec_is_newer(&smb_fname->st.st_ex_ctime,
 492                                   &cache_smb_fname->st.st_ex_ctime)) {
 493                 DEBUG(SCANNEDONLY_DEBUG,
 494                       ("retval=%d, return 0\n",retval));
 495                 return false;
 496         }
 497         return true;
 498 }
 499
 500 /*********************/
 501 /* VFS functions     */
 502 /*********************/
 503
 504 static SMB_STRUCT_DIR *scannedonly_opendir(vfs_handle_struct * handle,
 505                                            const char *fname,
 506                                            const char *mask, uint32 attr)
 507 {
 508         SMB_STRUCT_DIR *DIRp;
 509         struct scannedonly_DIR *sDIR;
 510
 511         DIRp = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
 512         if (!DIRp) {
 513                 return NULL;
 514         }
 515
 516         sDIR = TALLOC_P(NULL, struct scannedonly_DIR);
 517         if (fname[0] != '/') {
 518                 sDIR->base = construct_full_path(sDIR,handle, fname, true);
 519         } else {
 520                 sDIR->base = name_w_ending_slash(sDIR, fname);
 521         }
 522         DEBUG(SCANNEDONLY_DEBUG,
 523                         ("scannedonly_opendir, fname=%s, base=%s\n",fname,sDIR->base));
 524         sDIR->DIR = DIRp;
 525         sDIR->notify_loop_done = 0;
 526         return (SMB_STRUCT_DIR *) sDIR;
 527 }
 528
 529 static SMB_STRUCT_DIR *scannedonly_fdopendir(vfs_handle_struct * handle,
 530                                            files_struct *fsp,
 531                                            const char *mask, uint32 attr)
 532 {
 533         SMB_STRUCT_DIR *DIRp;
 534         struct scannedonly_DIR *sDIR;
 535         const char *fname;
 536
 537         DIRp = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 538         if (!DIRp) {
 539                 return NULL;
 540         }
 541
 542         fname = (const char *)fsp->fsp_name->base_name;
 543
 544         sDIR = TALLOC_P(NULL, struct scannedonly_DIR);
 545         if (fname[0] != '/') {
 546                 sDIR->base = construct_full_path(sDIR,handle, fname, true);
 547         } else {
 548                 sDIR->base = name_w_ending_slash(sDIR, fname);
 549         }
 550         DEBUG(SCANNEDONLY_DEBUG,
 551                         ("scannedonly_fdopendir, fname=%s, base=%s\n",fname,sDIR->base));
 552         sDIR->DIR = DIRp;
 553         sDIR->notify_loop_done = 0;
 554         return (SMB_STRUCT_DIR *) sDIR;
 555 }
 556
 557
 558 static SMB_STRUCT_DIRENT *scannedonly_readdir(vfs_handle_struct *handle,
 559                                               SMB_STRUCT_DIR * dirp,
 560                                               SMB_STRUCT_STAT *sbuf)
 561 {
 562         SMB_STRUCT_DIRENT *result;
 563         int allowed = 0;
 564         char *tmp;
 565         struct smb_filename *smb_fname;
 566         char *notify_name;
 567         int namelen;
 568         SMB_STRUCT_DIRENT *newdirent;
 569         TALLOC_CTX *ctx=talloc_tos();
 570
 571         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 572         if (!dirp) {
 573                 return NULL;
 574         }
 575
 576         result = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR, sbuf);
 577
 578         if (!result)
 579                 return NULL;
 580
 581         if (is_scannedonly_file(STRUCTSCANO(handle->data), result->d_name)) {
 582                 DEBUG(SCANNEDONLY_DEBUG,
 583                       ("scannedonly_readdir, %s is a scannedonly file, "
 584                        "skip to next entry\n", result->d_name));
 585                 return scannedonly_readdir(handle, dirp, NULL);
 586         }
 587         tmp = talloc_asprintf(ctx, "%s%s", sDIR->base, result->d_name);
 588         DEBUG(SCANNEDONLY_DEBUG,
 589               ("scannedonly_readdir, check access to %s (sbuf=%p)\n",
 590                tmp,sbuf));
 591
 592         /* even if we don't hide nonscanned files or we allow non scanned
 593            files we call allow_access because it will notify the daemon to
 594            scan these files */
 595         create_synthetic_smb_fname(ctx, tmp,NULL,
 596                                    sbuf?VALID_STAT(*sbuf)?sbuf:NULL:NULL,
 597                                    &smb_fname);
 598         allowed = scannedonly_allow_access(
 599                 handle, sDIR, smb_fname,
 600                 result->d_name,
 601                 sDIR->base, 0,
 602                 STRUCTSCANO(handle->data)->hide_nonscanned_files
 603                 ? STRUCTSCANO(handle->data)->recheck_time_readdir
 604                 : 0,
 605                 STRUCTSCANO(handle->data)->recheck_tries_readdir,
 606                 -1,
 607                 1);
 608         DEBUG(SCANNEDONLY_DEBUG,
 609               ("scannedonly_readdir access to %s (%s) = %d\n", tmp,
 610                result->d_name, allowed));
 611         if (allowed) {
 612                 return result;
 613         }
 614         DEBUG(SCANNEDONLY_DEBUG,
 615               ("hide_nonscanned_files=%d, allow_nonscanned_files=%d\n",
 616                STRUCTSCANO(handle->data)->hide_nonscanned_files,
 617                STRUCTSCANO(handle->data)->allow_nonscanned_files
 618                       ));
 619
 620         if (!STRUCTSCANO(handle->data)->hide_nonscanned_files
 621             || STRUCTSCANO(handle->data)->allow_nonscanned_files) {
 622                 return result;
 623         }
 624
 625         DEBUG(SCANNEDONLY_DEBUG,
 626               ("scannedonly_readdir, readdir listing for %s not "
 627                "allowed, notify user\n", result->d_name));
 628         notify_name = talloc_asprintf(
 629                 ctx,"%s %s",result->d_name,
 630                 STRUCTSCANO(handle->data)->scanning_message);
 631         namelen = strlen(notify_name);
 632         newdirent = (SMB_STRUCT_DIRENT *)TALLOC_ARRAY(
 633                 ctx, char, sizeof(SMB_STRUCT_DIRENT) + namelen + 1);
 634         if (!newdirent) {
 635                 return NULL;
 636         }
 637         memcpy(newdirent, result, sizeof(SMB_STRUCT_DIRENT));
 638         memcpy(&newdirent->d_name, notify_name, namelen + 1);
 639         DEBUG(SCANNEDONLY_DEBUG,
 640               ("scannedonly_readdir, return newdirent at %p with "
 641                "notification %s\n", newdirent, newdirent->d_name));
 642         return newdirent;
 643 }
 644
 645 static void scannedonly_seekdir(struct vfs_handle_struct *handle,
 646                                 SMB_STRUCT_DIR * dirp, long offset)
 647 {
 648         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 649         SMB_VFS_NEXT_SEEKDIR(handle, sDIR->DIR, offset);
 650 }
 651
 652 static long scannedonly_telldir(struct vfs_handle_struct *handle,
 653                                 SMB_STRUCT_DIR * dirp)
 654 {
 655         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 656         return SMB_VFS_NEXT_TELLDIR(handle, sDIR->DIR);
 657 }
 658
 659 static void scannedonly_rewinddir(struct vfs_handle_struct *handle,
 660                                   SMB_STRUCT_DIR * dirp)
 661 {
 662         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 663         SMB_VFS_NEXT_REWINDDIR(handle, sDIR->DIR);
 664 }
 665
 666 static int scannedonly_closedir(vfs_handle_struct * handle,
 667                                 SMB_STRUCT_DIR * dirp)
 668 {
 669         int retval;
 670         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 671         flush_sendbuffer(handle);
 672         retval = SMB_VFS_NEXT_CLOSEDIR(handle, sDIR->DIR);
 673         TALLOC_FREE(sDIR);
 674         return retval;
 675 }
 676
 677 static int scannedonly_stat(vfs_handle_struct * handle,
 678                             struct smb_filename *smb_fname)
 679 {
 680         int ret;
 681         ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
 682         DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_stat: %s returned %d\n",
 683                                   smb_fname->base_name, ret));
 684         if (ret != 0 && errno == ENOENT) {
 685                 TALLOC_CTX *ctx=talloc_tos();
 686                 char *test_base_name, *tmp_base_name = smb_fname->base_name;
 687                 /* possibly this was a fake name (file is being scanned for
 688                    viruses.txt): check for that and create the real name and
 689                    stat the real name */
 690                 test_base_name = real_path_from_notify_path(
 691                         ctx,
 692                         STRUCTSCANO(handle->data),
 693                         smb_fname->base_name);
 694                 if (test_base_name) {
 695                         smb_fname->base_name = test_base_name;
 696                         ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
 697                         DEBUG(5, ("_stat: %s returned %d\n",
 698                                   test_base_name, ret));
 699                         smb_fname->base_name = tmp_base_name;
 700                 }
 701         }
 702         return ret;
 703 }
 704
 705 static int scannedonly_lstat(vfs_handle_struct * handle,
 706                              struct smb_filename *smb_fname)
 707 {
 708         int ret;
 709         ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
 710         DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_lstat: %s returned %d\n",
 711                                   smb_fname->base_name, ret));
 712         if (ret != 0 && errno == ENOENT) {
 713                 TALLOC_CTX *ctx=talloc_tos();
 714                 char *test_base_name, *tmp_base_name = smb_fname->base_name;
 715                 /* possibly this was a fake name (file is being scanned for
 716                    viruses.txt): check for that and create the real name and
 717                    stat the real name */
 718                 test_base_name = real_path_from_notify_path(
 719                         ctx, STRUCTSCANO(handle->data), smb_fname->base_name);
 720                 if (test_base_name) {
 721                         smb_fname->base_name = test_base_name;
 722                         ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
 723                         DEBUG(5, ("_lstat: %s returned %d\n",
 724                                   test_base_name, ret));
 725                         smb_fname->base_name = tmp_base_name;
 726                 }
 727         }
 728         return ret;
 729 }
 730
 731 static int scannedonly_open(vfs_handle_struct * handle,
 732                             struct smb_filename *smb_fname,
 733                             files_struct * fsp, int flags, mode_t mode)
 734 {
 735         const char *base;
 736         char *tmp, *shortname;
 737         int allowed, write_access = 0;
 738         TALLOC_CTX *ctx=talloc_tos();
 739         /* if open for writing ignore it */
 740         if ((flags & O_ACCMODE) == O_WRONLY) {
 741                 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 742         }
 743         if ((flags & O_ACCMODE) == O_RDWR) {
 744                 write_access = 1;
 745         }
 746         /* check if this file is scanned already */
 747         tmp = strrchr(smb_fname->base_name, '/');
 748         if (tmp) {
 749                 base = talloc_strndup(ctx,smb_fname->base_name,
 750                                       (tmp - smb_fname->base_name) + 1);
 751                 shortname = tmp + 1;
 752         } else {
 753                 base = "";
 754                 shortname = (char *)smb_fname->base_name;
 755         }
 756         allowed = scannedonly_allow_access(
 757                 handle, NULL, smb_fname, shortname,
 758                 base,
 759                 write_access,
 760                 STRUCTSCANO(handle->data)->recheck_time_open,
 761                 STRUCTSCANO(handle->data)->recheck_tries_open,
 762                 STRUCTSCANO(handle->data)->recheck_size_open,
 763                 0);
 764         flush_sendbuffer(handle);
 765         DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_open: allow=%d for %s\n",
 766                                   allowed, smb_fname->base_name));
 767         if (allowed
 768             || STRUCTSCANO(handle->data)->allow_nonscanned_files) {
 769                 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 770         }
 771         errno = EACCES;
 772         return -1;
 773 }
 774
 775 static int scannedonly_close(vfs_handle_struct * handle, files_struct * fsp)
 776 {
 777         /* we only have to notify the scanner
 778            for files that were open readwrite or writable. */
 779         if (fsp->can_write) {
 780                 TALLOC_CTX *ctx = talloc_tos();
 781                 notify_scanner(handle, construct_full_path(
 782                                        ctx,handle,
 783                                        fsp->fsp_name->base_name,false));
 784                 flush_sendbuffer(handle);
 785         }
 786         return SMB_VFS_NEXT_CLOSE(handle, fsp);
 787 }
 788
 789 static int scannedonly_rename(vfs_handle_struct * handle,
 790                               const struct smb_filename *smb_fname_src,
 791                               const struct smb_filename *smb_fname_dst)
 792 {
 793         /* rename the cache file before we pass the actual rename on */
 794         struct smb_filename *smb_fname_src_tmp = NULL;
 795         struct smb_filename *smb_fname_dst_tmp = NULL;
 796         char *cachefile_src, *cachefile_dst;
 797         bool needscandst=false;
 798         int ret;
 799         TALLOC_CTX *ctx = talloc_tos();
 800
 801         /* Setup temporary smb_filename structs. */
 802         cachefile_src = cachefile_name_f_fullpath(
 803                 ctx,
 804                 smb_fname_src->base_name,
 805                 STRUCTSCANO(handle->data)->p_scanned);
 806         cachefile_dst = cachefile_name_f_fullpath(
 807                 ctx,
 808                 smb_fname_dst->base_name,
 809                 STRUCTSCANO(handle->data)->p_scanned);
 810         create_synthetic_smb_fname(ctx, cachefile_src,NULL,NULL,
 811                                    &smb_fname_src_tmp);
 812         create_synthetic_smb_fname(ctx, cachefile_dst,NULL,NULL,
 813                                    &smb_fname_dst_tmp);
 814
 815         ret = SMB_VFS_NEXT_RENAME(handle, smb_fname_src_tmp, smb_fname_dst_tmp);
 816         if (ret == ENOENT) {
 817                 needscandst=true;
 818         } else if (ret != 0) {
 819                 DEBUG(SCANNEDONLY_DEBUG,
 820                       ("failed to rename %s into %s error %d: %s\n", cachefile_src,
 821                        cachefile_dst, ret, strerror(ret)));
 822                 needscandst=true;
 823         }
 824         ret = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
 825         if (ret == 0 && needscandst) {
 826                 notify_scanner(handle, smb_fname_dst->base_name);
 827                 flush_sendbuffer(handle);
 828         }
 829         return ret;
 830 }
 831
 832 static int scannedonly_unlink(vfs_handle_struct * handle,
 833                               const struct smb_filename *smb_fname)
 834 {
 835         /* unlink the 'scanned' file too */
 836         struct smb_filename *smb_fname_cache = NULL;
 837         char * cachefile;
 838         TALLOC_CTX *ctx = talloc_tos();
 839
 840         cachefile = cachefile_name_f_fullpath(
 841                 ctx,
 842                 smb_fname->base_name,
 843                 STRUCTSCANO(handle->data)->p_scanned);
 844         create_synthetic_smb_fname(ctx, cachefile,NULL,NULL,
 845                                    &smb_fname_cache);
 846         if (SMB_VFS_NEXT_UNLINK(handle, smb_fname_cache) != 0) {
 847                 DEBUG(SCANNEDONLY_DEBUG, ("_unlink: failed to unlink %s\n",
 848                                           smb_fname_cache->base_name));
 849         }
 850         return SMB_VFS_NEXT_UNLINK(handle, smb_fname);
 851 }
 852
 853 static int scannedonly_rmdir(vfs_handle_struct * handle, const char *path)
 854 {
 855         /* if there are only .scanned: .virus: or .failed: files, we delete
 856            those, because the client cannot see them */
 857         DIR *dirp;
 858         SMB_STRUCT_DIRENT *dire;
 859         TALLOC_CTX *ctx = talloc_tos();
 860         bool only_deletable_files = true, have_files = false;
 861         char *path_w_slash;
 862
 863         if (!STRUCTSCANO(handle->data)->rm_hidden_files_on_rmdir)
 864                 return SMB_VFS_NEXT_RMDIR(handle, path);
 865
 866         path_w_slash = name_w_ending_slash(ctx,path);
 867         dirp = SMB_VFS_NEXT_OPENDIR(handle, path, NULL, 0);
 868         if (!dirp) {
 869                 return -1;
 870         }
 871         while ((dire = SMB_VFS_NEXT_READDIR(handle, dirp, NULL)) != NULL) {
 872                 if (ISDOT(dire->d_name) || ISDOTDOT(dire->d_name)) {
 873                         continue;
 874                 }
 875                 have_files = true;
 876                 if (!is_scannedonly_file(STRUCTSCANO(handle->data),
 877                                          dire->d_name)) {
 878                         struct smb_filename *smb_fname = NULL;
 879                         char *fullpath;
 880                         int retval;
 881
 882                         if (STRUCTSCANO(handle->data)->show_special_files) {
 883                                 only_deletable_files = false;
 884                                 break;
 885                         }
 886                         /* stat the file and see if it is a
 887                            special file */
 888                         fullpath = talloc_asprintf(ctx, "%s%s", path_w_slash,
 889                                                   dire->d_name);
 890                         create_synthetic_smb_fname(ctx, fullpath,NULL,NULL,
 891                                                    &smb_fname);
 892                         retval = SMB_VFS_NEXT_STAT(handle, smb_fname);
 893                         if (retval == 0
 894                             && S_ISREG(smb_fname->st.st_ex_mode)) {
 895                                 only_deletable_files = false;
 896                         }
 897                         TALLOC_FREE(fullpath);
 898                         TALLOC_FREE(smb_fname);
 899                         break;
 900                 }
 901         }
 902         DEBUG(SCANNEDONLY_DEBUG,
 903               ("path=%s, have_files=%d, only_deletable_files=%d\n",
 904                path, have_files, only_deletable_files));
 905         if (have_files && only_deletable_files) {
 906                 DEBUG(SCANNEDONLY_DEBUG,
 907                       ("scannedonly_rmdir, remove leftover scannedonly "
 908                        "files from %s\n", path_w_slash));
 909                 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 910                 while ((dire = SMB_VFS_NEXT_READDIR(handle, dirp, NULL))
 911                        != NULL) {
 912                         char *fullpath;
 913                         struct smb_filename *smb_fname = NULL;
 914                         if (ISDOT(dire->d_name) || ISDOTDOT(dire->d_name)) {
 915                                 continue;
 916                         }
 917                         fullpath = talloc_asprintf(ctx, "%s%s", path_w_slash,
 918                                                   dire->d_name);
 919                         create_synthetic_smb_fname(ctx, fullpath,NULL,NULL,
 920                                                    &smb_fname);
 921                         DEBUG(SCANNEDONLY_DEBUG, ("unlink %s\n", fullpath));
 922                         SMB_VFS_NEXT_UNLINK(handle, smb_fname);
 923                         TALLOC_FREE(fullpath);
 924                         TALLOC_FREE(smb_fname);
 925                 }
 926         }
 927         SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 928         return SMB_VFS_NEXT_RMDIR(handle, path);
 929 }
 930
 931 static void free_scannedonly_data(void **data)
 932 {
 933         SAFE_FREE(*data);
 934 }
 935
 936 static int scannedonly_connect(struct vfs_handle_struct *handle,
 937                                const char *service, const char *user)
 938 {
 939
 940         struct Tscannedonly *so;
 941
 942         so = SMB_MALLOC_P(struct Tscannedonly);
 943         handle->data = (void *)so;
 944         handle->free_data = free_scannedonly_data;
 945         so->gsendbuffer[0]='\0';
 946         so->domain_socket =
 947                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 948                              "domain_socket", True);
 949         so->socketname =
 950                 (char *)lp_parm_const_string(SNUM(handle->conn),
 951                                              "scannedonly", "socketname",
 952                                              "/var/lib/scannedonly/scan");
 953         so->portnum =
 954                 lp_parm_int(SNUM(handle->conn), "scannedonly", "portnum",
 955                             2020);
 956         so->scanhost =
 957                 (char *)lp_parm_const_string(SNUM(handle->conn),
 958                                              "scannedonly", "scanhost",
 959                                              "localhost");
 960
 961         so->show_special_files =
 962                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 963                              "show_special_files", True);
 964         so->rm_hidden_files_on_rmdir =
 965                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 966                              "rm_hidden_files_on_rmdir", True);
 967         so->hide_nonscanned_files =
 968                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 969                              "hide_nonscanned_files", False);
 970         so->allow_nonscanned_files =
 971                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 972                              "allow_nonscanned_files", False);
 973         so->scanning_message =
 974                 (char *)lp_parm_const_string(SNUM(handle->conn),
 975                                              "scannedonly",
 976                                              "scanning_message",
 977                                              "is being scanned for viruses");
 978         so->scanning_message_len = strlen(so->scanning_message);
 979         so->recheck_time_open =
 980                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 981                             "recheck_time_open", 50);
 982         so->recheck_tries_open =
 983                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 984                             "recheck_tries_open", 100);
 985         so->recheck_size_open =
 986                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 987                             "recheck_size_open", 100);
 988         so->recheck_time_readdir =
 989                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 990                             "recheck_time_readdir", 50);
 991         so->recheck_tries_readdir =
 992                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 993                             "recheck_tries_readdir", 20);
 994
 995         so->p_scanned =
 996                 (char *)lp_parm_const_string(SNUM(handle->conn),
 997                                              "scannedonly",
 998                                              "pref_scanned",
 999                                              ".scanned:");
1000         so->p_virus =
1001                 (char *)lp_parm_const_string(SNUM(handle->conn),
1002                                              "scannedonly",
1003                                              "pref_virus",
1004                                              ".virus:");
1005         so->p_failed =
1006                 (char *)lp_parm_const_string(SNUM(handle->conn),
1007                                              "scannedonly",
1008                                              "pref_failed",
1009                                              ".failed:");
1010         connect_to_scanner(handle);
1011
1012         return SMB_VFS_NEXT_CONNECT(handle, service, user);
1013 }
1014
1015 /* VFS operations structure */
1016 static struct vfs_fn_pointers vfs_scannedonly_fns = {
1017         .opendir = scannedonly_opendir,
1018         .fdopendir = scannedonly_fdopendir,
1019         .readdir = scannedonly_readdir,
1020         .seekdir = scannedonly_seekdir,
1021         .telldir = scannedonly_telldir,
1022         .rewind_dir = scannedonly_rewinddir,
1023         .closedir = scannedonly_closedir,
1024         .rmdir = scannedonly_rmdir,
1025         .stat = scannedonly_stat,
1026         .lstat = scannedonly_lstat,
1027         .open = scannedonly_open,
1028         .close_fn = scannedonly_close,
1029         .rename = scannedonly_rename,
1030         .unlink = scannedonly_unlink,
1031         .connect_fn = scannedonly_connect
1032 };
1033
1034 NTSTATUS vfs_scannedonly_init(void)
1035 {
1036         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "scannedonly",
1037                                 &vfs_scannedonly_fns);
1038 }