?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-domain-join: do not add DFSR entries when joining, this should be done in the...
[Samba/gebeck_regimport.git] / source3 / smbd / process.c
blobab0c147007b20a7b0b4bbef671f320042494d5d6
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39
40 extern bool global_machine_password_needs_changing;
41
42 static void construct_reply_common(struct smb_request *req, const char *inbuf,
43 char *outbuf);
44 static struct pending_message_list *get_deferred_open_message_smb(
45 struct smbd_server_connection *sconn, uint64_t mid);
46
47 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
48 {
49 bool ok;
50
51 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
52 return true;
53 }
54
55 sconn->smb1.echo_handler.ref_count++;
56
57 if (sconn->smb1.echo_handler.ref_count > 1) {
58 return true;
59 }
60
61 DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
62
63 do {
64 ok = fcntl_lock(
65 sconn->smb1.echo_handler.socket_lock_fd,
66 SMB_F_SETLKW, 0, 0, F_WRLCK);
67 } while (!ok && (errno == EINTR));
68
69 if (!ok) {
70 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
71 return false;
72 }
73
74 DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
75
76 return true;
77 }
78
79 void smbd_lock_socket(struct smbd_server_connection *sconn)
80 {
81 if (!smbd_lock_socket_internal(sconn)) {
82 exit_server_cleanly("failed to lock socket");
83 }
84 }
85
86 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
87 {
88 bool ok;
89
90 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
91 return true;
92 }
93
94 sconn->smb1.echo_handler.ref_count--;
95
96 if (sconn->smb1.echo_handler.ref_count > 0) {
97 return true;
98 }
99
100 do {
101 ok = fcntl_lock(
102 sconn->smb1.echo_handler.socket_lock_fd,
103 SMB_F_SETLKW, 0, 0, F_UNLCK);
104 } while (!ok && (errno == EINTR));
105
106 if (!ok) {
107 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
108 return false;
109 }
110
111 DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
112
113 return true;
114 }
115
116 void smbd_unlock_socket(struct smbd_server_connection *sconn)
117 {
118 if (!smbd_unlock_socket_internal(sconn)) {
119 exit_server_cleanly("failed to unlock socket");
120 }
121 }
122
123 /* Accessor function for smb_read_error for smbd functions. */
124
125 /****************************************************************************
126 Send an smb to a fd.
127 ****************************************************************************/
128
129 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
130 bool do_signing, uint32_t seqnum,
131 bool do_encrypt,
132 struct smb_perfcount_data *pcd)
133 {
134 size_t len = 0;
135 size_t nwritten=0;
136 ssize_t ret;
137 char *buf_out = buffer;
138
139 smbd_lock_socket(sconn);
140
141 if (do_signing) {
142 /* Sign the outgoing packet if required. */
143 srv_calculate_sign_mac(sconn, buf_out, seqnum);
144 }
145
146 if (do_encrypt) {
147 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
148 if (!NT_STATUS_IS_OK(status)) {
149 DEBUG(0, ("send_smb: SMB encryption failed "
150 "on outgoing packet! Error %s\n",
151 nt_errstr(status) ));
152 goto out;
153 }
154 }
155
156 len = smb_len(buf_out) + 4;
157
158 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
159 if (ret <= 0) {
160
161 char addr[INET6_ADDRSTRLEN];
162 /*
163 * Try and give an error message saying what
164 * client failed.
165 */
166 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
167 (int)sys_getpid(), (int)len,
168 get_peer_addr(sconn->sock, addr, sizeof(addr)),
169 (int)ret, strerror(errno) ));
170
171 srv_free_enc_buffer(sconn, buf_out);
172 goto out;
173 }
174
175 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
176 srv_free_enc_buffer(sconn, buf_out);
177 out:
178 SMB_PERFCOUNT_END(pcd);
179
180 smbd_unlock_socket(sconn);
181 return true;
182 }
183
184 /*******************************************************************
185 Setup the word count and byte count for a smb message.
186 ********************************************************************/
187
188 int srv_set_message(char *buf,
189 int num_words,
190 int num_bytes,
191 bool zero)
192 {
193 if (zero && (num_words || num_bytes)) {
194 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
195 }
196 SCVAL(buf,smb_wct,num_words);
197 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
198 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
199 return (smb_size + num_words*2 + num_bytes);
200 }
201
202 static bool valid_smb_header(struct smbd_server_connection *sconn,
203 const uint8_t *inbuf)
204 {
205 if (is_encrypted_packet(sconn, inbuf)) {
206 return true;
207 }
208 /*
209 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
210 * but it just looks weird to call strncmp for this one.
211 */
212 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
213 }
214
215 /* Socket functions for smbd packet processing. */
216
217 static bool valid_packet_size(size_t len)
218 {
219 /*
220 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
221 * of header. Don't print the error if this fits.... JRA.
222 */
223
224 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
225 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
226 (unsigned long)len));
227 return false;
228 }
229 return true;
230 }
231
232 static NTSTATUS read_packet_remainder(int fd, char *buffer,
233 unsigned int timeout, ssize_t len)
234 {
235 NTSTATUS status;
236
237 if (len <= 0) {
238 return NT_STATUS_OK;
239 }
240
241 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
242 if (!NT_STATUS_IS_OK(status)) {
243 char addr[INET6_ADDRSTRLEN];
244 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
245 "error = %s.\n",
246 get_peer_addr(fd, addr, sizeof(addr)),
247 nt_errstr(status)));
248 }
249 return status;
250 }
251
252 /****************************************************************************
253 Attempt a zerocopy writeX read. We know here that len > smb_size-4
254 ****************************************************************************/
255
256 /*
257 * Unfortunately, earlier versions of smbclient/libsmbclient
258 * don't send this "standard" writeX header. I've fixed this
259 * for 3.2 but we'll use the old method with earlier versions.
260 * Windows and CIFSFS at least use this standard size. Not
261 * sure about MacOSX.
262 */
263
264 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
265 (2*14) + /* word count (including bcc) */ \
266 1 /* pad byte */)
267
268 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
269 const char lenbuf[4],
270 struct smbd_server_connection *sconn,
271 int sock,
272 char **buffer,
273 unsigned int timeout,
274 size_t *p_unread,
275 size_t *len_ret)
276 {
277 /* Size of a WRITEX call (+4 byte len). */
278 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
279 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
280 ssize_t toread;
281 NTSTATUS status;
282
283 memcpy(writeX_header, lenbuf, 4);
284
285 status = read_fd_with_timeout(
286 sock, writeX_header + 4,
287 STANDARD_WRITE_AND_X_HEADER_SIZE,
288 STANDARD_WRITE_AND_X_HEADER_SIZE,
289 timeout, NULL);
290
291 if (!NT_STATUS_IS_OK(status)) {
292 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
293 "error = %s.\n",
294 tsocket_address_string(sconn->remote_address,
295 talloc_tos()),
296 nt_errstr(status)));
297 return status;
298 }
299
300 /*
301 * Ok - now try and see if this is a possible
302 * valid writeX call.
303 */
304
305 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
306 /*
307 * If the data offset is beyond what
308 * we've read, drain the extra bytes.
309 */
310 uint16_t doff = SVAL(writeX_header,smb_vwv11);
311 ssize_t newlen;
312
313 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
314 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
315 if (drain_socket(sock, drain) != drain) {
316 smb_panic("receive_smb_raw_talloc_partial_read:"
317 " failed to drain pending bytes");
318 }
319 } else {
320 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
321 }
322
323 /* Spoof down the length and null out the bcc. */
324 set_message_bcc(writeX_header, 0);
325 newlen = smb_len(writeX_header);
326
327 /* Copy the header we've written. */
328
329 *buffer = (char *)talloc_memdup(mem_ctx,
330 writeX_header,
331 sizeof(writeX_header));
332
333 if (*buffer == NULL) {
334 DEBUG(0, ("Could not allocate inbuf of length %d\n",
335 (int)sizeof(writeX_header)));
336 return NT_STATUS_NO_MEMORY;
337 }
338
339 /* Work out the remaining bytes. */
340 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
341 *len_ret = newlen + 4;
342 return NT_STATUS_OK;
343 }
344
345 if (!valid_packet_size(len)) {
346 return NT_STATUS_INVALID_PARAMETER;
347 }
348
349 /*
350 * Not a valid writeX call. Just do the standard
351 * talloc and return.
352 */
353
354 *buffer = talloc_array(mem_ctx, char, len+4);
355
356 if (*buffer == NULL) {
357 DEBUG(0, ("Could not allocate inbuf of length %d\n",
358 (int)len+4));
359 return NT_STATUS_NO_MEMORY;
360 }
361
362 /* Copy in what we already read. */
363 memcpy(*buffer,
364 writeX_header,
365 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
366 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
367
368 if(toread > 0) {
369 status = read_packet_remainder(
370 sock,
371 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
372 timeout, toread);
373
374 if (!NT_STATUS_IS_OK(status)) {
375 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
376 nt_errstr(status)));
377 return status;
378 }
379 }
380
381 *len_ret = len + 4;
382 return NT_STATUS_OK;
383 }
384
385 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
386 struct smbd_server_connection *sconn,
387 int sock,
388 char **buffer, unsigned int timeout,
389 size_t *p_unread, size_t *plen)
390 {
391 char lenbuf[4];
392 size_t len;
393 int min_recv_size = lp_min_receive_file_size();
394 NTSTATUS status;
395
396 *p_unread = 0;
397
398 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
399 &len);
400 if (!NT_STATUS_IS_OK(status)) {
401 return status;
402 }
403
404 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
405 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
406 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
407 !srv_is_signing_active(sconn) &&
408 sconn->smb1.echo_handler.trusted_fde == NULL) {
409
410 return receive_smb_raw_talloc_partial_read(
411 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
412 p_unread, plen);
413 }
414
415 if (!valid_packet_size(len)) {
416 return NT_STATUS_INVALID_PARAMETER;
417 }
418
419 /*
420 * The +4 here can't wrap, we've checked the length above already.
421 */
422
423 *buffer = talloc_array(mem_ctx, char, len+4);
424
425 if (*buffer == NULL) {
426 DEBUG(0, ("Could not allocate inbuf of length %d\n",
427 (int)len+4));
428 return NT_STATUS_NO_MEMORY;
429 }
430
431 memcpy(*buffer, lenbuf, sizeof(lenbuf));
432
433 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
434 if (!NT_STATUS_IS_OK(status)) {
435 return status;
436 }
437
438 *plen = len + 4;
439 return NT_STATUS_OK;
440 }
441
442 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
443 struct smbd_server_connection *sconn,
444 int sock,
445 char **buffer, unsigned int timeout,
446 size_t *p_unread, bool *p_encrypted,
447 size_t *p_len,
448 uint32_t *seqnum,
449 bool trusted_channel)
450 {
451 size_t len = 0;
452 NTSTATUS status;
453
454 *p_encrypted = false;
455
456 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
457 p_unread, &len);
458 if (!NT_STATUS_IS_OK(status)) {
459 DEBUG(1, ("read_smb_length_return_keepalive failed for "
460 "client %s read error = %s.\n",
461 tsocket_address_string(sconn->remote_address,
462 talloc_tos()),
463 nt_errstr(status)));
464 return status;
465 }
466
467 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
468 status = srv_decrypt_buffer(sconn, *buffer);
469 if (!NT_STATUS_IS_OK(status)) {
470 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
471 "incoming packet! Error %s\n",
472 nt_errstr(status) ));
473 return status;
474 }
475 *p_encrypted = true;
476 }
477
478 /* Check the incoming SMB signature. */
479 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
480 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
481 "incoming packet!\n"));
482 return NT_STATUS_INVALID_NETWORK_RESPONSE;
483 }
484
485 *p_len = len;
486 return NT_STATUS_OK;
487 }
488
489 /*
490 * Initialize a struct smb_request from an inbuf
491 */
492
493 static bool init_smb_request(struct smb_request *req,
494 struct smbd_server_connection *sconn,
495 const uint8 *inbuf,
496 size_t unread_bytes, bool encrypted,
497 uint32_t seqnum)
498 {
499 size_t req_size = smb_len(inbuf) + 4;
500 /* Ensure we have at least smb_size bytes. */
501 if (req_size < smb_size) {
502 DEBUG(0,("init_smb_request: invalid request size %u\n",
503 (unsigned int)req_size ));
504 return false;
505 }
506 req->cmd = CVAL(inbuf, smb_com);
507 req->flags2 = SVAL(inbuf, smb_flg2);
508 req->smbpid = SVAL(inbuf, smb_pid);
509 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
510 req->seqnum = seqnum;
511 req->vuid = SVAL(inbuf, smb_uid);
512 req->tid = SVAL(inbuf, smb_tid);
513 req->wct = CVAL(inbuf, smb_wct);
514 req->vwv = discard_const_p(uint16_t, (inbuf+smb_vwv));
515 req->buflen = smb_buflen(inbuf);
516 req->buf = (const uint8_t *)smb_buf_const(inbuf);
517 req->unread_bytes = unread_bytes;
518 req->encrypted = encrypted;
519 req->sconn = sconn;
520 req->conn = conn_find(sconn,req->tid);
521 req->chain_fsp = NULL;
522 req->chain_outbuf = NULL;
523 req->done = false;
524 req->smb2req = NULL;
525 smb_init_perfcount_data(&req->pcd);
526
527 /* Ensure we have at least wct words and 2 bytes of bcc. */
528 if (smb_size + req->wct*2 > req_size) {
529 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
530 (unsigned int)req->wct,
531 (unsigned int)req_size));
532 return false;
533 }
534 /* Ensure bcc is correct. */
535 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
536 DEBUG(0,("init_smb_request: invalid bcc number %u "
537 "(wct = %u, size %u)\n",
538 (unsigned int)req->buflen,
539 (unsigned int)req->wct,
540 (unsigned int)req_size));
541 return false;
542 }
543
544 req->outbuf = NULL;
545 return true;
546 }
547
548 static void process_smb(struct smbd_server_connection *conn,
549 uint8_t *inbuf, size_t nread, size_t unread_bytes,
550 uint32_t seqnum, bool encrypted,
551 struct smb_perfcount_data *deferred_pcd);
552
553 static void smbd_deferred_open_timer(struct event_context *ev,
554 struct timed_event *te,
555 struct timeval _tval,
556 void *private_data)
557 {
558 struct pending_message_list *msg = talloc_get_type(private_data,
559 struct pending_message_list);
560 TALLOC_CTX *mem_ctx = talloc_tos();
561 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
562 uint8_t *inbuf;
563
564 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
565 msg->buf.length);
566 if (inbuf == NULL) {
567 exit_server("smbd_deferred_open_timer: talloc failed\n");
568 return;
569 }
570
571 /* We leave this message on the queue so the open code can
572 know this is a retry. */
573 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
574 (unsigned long long)mid ));
575
576 /* Mark the message as processed so this is not
577 * re-processed in error. */
578 msg->processed = true;
579
580 process_smb(smbd_server_conn, inbuf,
581 msg->buf.length, 0,
582 msg->seqnum, msg->encrypted, &msg->pcd);
583
584 /* If it's still there and was processed, remove it. */
585 msg = get_deferred_open_message_smb(smbd_server_conn, mid);
586 if (msg && msg->processed) {
587 remove_deferred_open_message_smb(smbd_server_conn, mid);
588 }
589 }
590
591 /****************************************************************************
592 Function to push a message onto the tail of a linked list of smb messages ready
593 for processing.
594 ****************************************************************************/
595
596 static bool push_queued_message(struct smb_request *req,
597 struct timeval request_time,
598 struct timeval end_time,
599 char *private_data, size_t private_len)
600 {
601 int msg_len = smb_len(req->inbuf) + 4;
602 struct pending_message_list *msg;
603
604 msg = talloc_zero(NULL, struct pending_message_list);
605
606 if(msg == NULL) {
607 DEBUG(0,("push_message: malloc fail (1)\n"));
608 return False;
609 }
610
611 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
612 if(msg->buf.data == NULL) {
613 DEBUG(0,("push_message: malloc fail (2)\n"));
614 TALLOC_FREE(msg);
615 return False;
616 }
617
618 msg->request_time = request_time;
619 msg->seqnum = req->seqnum;
620 msg->encrypted = req->encrypted;
621 msg->processed = false;
622 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
623
624 if (private_data) {
625 msg->private_data = data_blob_talloc(msg, private_data,
626 private_len);
627 if (msg->private_data.data == NULL) {
628 DEBUG(0,("push_message: malloc fail (3)\n"));
629 TALLOC_FREE(msg);
630 return False;
631 }
632 }
633
634 msg->te = event_add_timed(server_event_context(),
635 msg,
636 end_time,
637 smbd_deferred_open_timer,
638 msg);
639 if (!msg->te) {
640 DEBUG(0,("push_message: event_add_timed failed\n"));
641 TALLOC_FREE(msg);
642 return false;
643 }
644
645 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
646 struct pending_message_list *);
647
648 DEBUG(10,("push_message: pushed message length %u on "
649 "deferred_open_queue\n", (unsigned int)msg_len));
650
651 return True;
652 }
653
654 /****************************************************************************
655 Function to delete a sharing violation open message by mid.
656 ****************************************************************************/
657
658 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
659 uint64_t mid)
660 {
661 struct pending_message_list *pml;
662
663 if (sconn->using_smb2) {
664 remove_deferred_open_message_smb2(sconn, mid);
665 return;
666 }
667
668 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
669 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
670 DEBUG(10,("remove_deferred_open_message_smb: "
671 "deleting mid %llu len %u\n",
672 (unsigned long long)mid,
673 (unsigned int)pml->buf.length ));
674 DLIST_REMOVE(sconn->deferred_open_queue, pml);
675 TALLOC_FREE(pml);
676 return;
677 }
678 }
679 }
680
681 /****************************************************************************
682 Move a sharing violation open retry message to the front of the list and
683 schedule it for immediate processing.
684 ****************************************************************************/
685
686 void schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
687 uint64_t mid)
688 {
689 struct pending_message_list *pml;
690 int i = 0;
691
692 if (sconn->using_smb2) {
693 schedule_deferred_open_message_smb2(sconn, mid);
694 return;
695 }
696
697 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
698 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
699
700 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
701 "msg_mid = %llu\n",
702 i++,
703 (unsigned long long)msg_mid ));
704
705 if (mid == msg_mid) {
706 struct timed_event *te;
707
708 if (pml->processed) {
709 /* A processed message should not be
710 * rescheduled. */
711 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
712 "message mid %llu was already processed\n",
713 (unsigned long long)msg_mid ));
714 continue;
715 }
716
717 DEBUG(10,("schedule_deferred_open_message_smb: "
718 "scheduling mid %llu\n",
719 (unsigned long long)mid ));
720
721 te = event_add_timed(server_event_context(),
722 pml,
723 timeval_zero(),
724 smbd_deferred_open_timer,
725 pml);
726 if (!te) {
727 DEBUG(10,("schedule_deferred_open_message_smb: "
728 "event_add_timed() failed, "
729 "skipping mid %llu\n",
730 (unsigned long long)msg_mid ));
731 }
732
733 TALLOC_FREE(pml->te);
734 pml->te = te;
735 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
736 return;
737 }
738 }
739
740 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
741 "find message mid %llu\n",
742 (unsigned long long)mid ));
743 }
744
745 /****************************************************************************
746 Return true if this mid is on the deferred queue and was not yet processed.
747 ****************************************************************************/
748
749 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
750 {
751 struct pending_message_list *pml;
752
753 if (sconn->using_smb2) {
754 return open_was_deferred_smb2(sconn, mid);
755 }
756
757 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
758 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
759 return True;
760 }
761 }
762 return False;
763 }
764
765 /****************************************************************************
766 Return the message queued by this mid.
767 ****************************************************************************/
768
769 static struct pending_message_list *get_deferred_open_message_smb(
770 struct smbd_server_connection *sconn, uint64_t mid)
771 {
772 struct pending_message_list *pml;
773
774 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
775 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
776 return pml;
777 }
778 }
779 return NULL;
780 }
781
782 /****************************************************************************
783 Get the state data queued by this mid.
784 ****************************************************************************/
785
786 bool get_deferred_open_message_state(struct smb_request *smbreq,
787 struct timeval *p_request_time,
788 void **pp_state)
789 {
790 struct pending_message_list *pml;
791
792 if (smbd_server_conn->using_smb2) {
793 return get_deferred_open_message_state_smb2(smbreq->smb2req,
794 p_request_time,
795 pp_state);
796 }
797
798 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
799 if (!pml) {
800 return false;
801 }
802 if (p_request_time) {
803 *p_request_time = pml->request_time;
804 }
805 if (pp_state) {
806 *pp_state = (void *)pml->private_data.data;
807 }
808 return true;
809 }
810
811 /****************************************************************************
812 Function to push a deferred open smb message onto a linked list of local smb
813 messages ready for processing.
814 ****************************************************************************/
815
816 bool push_deferred_open_message_smb(struct smb_request *req,
817 struct timeval request_time,
818 struct timeval timeout,
819 struct file_id id,
820 char *private_data, size_t priv_len)
821 {
822 struct timeval end_time;
823
824 if (req->smb2req) {
825 return push_deferred_open_message_smb2(req->smb2req,
826 request_time,
827 timeout,
828 id,
829 private_data,
830 priv_len);
831 }
832
833 if (req->unread_bytes) {
834 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
835 "unread_bytes = %u\n",
836 (unsigned int)req->unread_bytes ));
837 smb_panic("push_deferred_open_message_smb: "
838 "logic error unread_bytes != 0" );
839 }
840
841 end_time = timeval_sum(&request_time, &timeout);
842
843 DEBUG(10,("push_deferred_open_message_smb: pushing message "
844 "len %u mid %llu timeout time [%u.%06u]\n",
845 (unsigned int) smb_len(req->inbuf)+4,
846 (unsigned long long)req->mid,
847 (unsigned int)end_time.tv_sec,
848 (unsigned int)end_time.tv_usec));
849
850 return push_queued_message(req, request_time, end_time,
851 private_data, priv_len);
852 }
853
854 static void smbd_sig_term_handler(struct tevent_context *ev,
855 struct tevent_signal *se,
856 int signum,
857 int count,
858 void *siginfo,
859 void *private_data)
860 {
861 exit_server_cleanly("termination signal");
862 }
863
864 void smbd_setup_sig_term_handler(void)
865 {
866 struct tevent_signal *se;
867
868 se = tevent_add_signal(server_event_context(),
869 server_event_context(),
870 SIGTERM, 0,
871 smbd_sig_term_handler,
872 NULL);
873 if (!se) {
874 exit_server("failed to setup SIGTERM handler");
875 }
876 }
877
878 static void smbd_sig_hup_handler(struct tevent_context *ev,
879 struct tevent_signal *se,
880 int signum,
881 int count,
882 void *siginfo,
883 void *private_data)
884 {
885 struct messaging_context *msg_ctx = talloc_get_type_abort(
886 private_data, struct messaging_context);
887 change_to_root_user();
888 DEBUG(1,("Reloading services after SIGHUP\n"));
889 reload_services(msg_ctx, smbd_server_conn->sock, False);
890 if (am_parent) {
891 printing_subsystem_update(ev, msg_ctx, true);
892 }
893 }
894
895 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
896 struct messaging_context *msg_ctx)
897 {
898 struct tevent_signal *se;
899
900 se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
901 msg_ctx);
902 if (!se) {
903 exit_server("failed to setup SIGHUP handler");
904 }
905 }
906
907 static NTSTATUS smbd_server_connection_loop_once(struct tevent_context *ev_ctx,
908 struct smbd_server_connection *conn)
909 {
910 int timeout;
911 int num_pfds = 0;
912 int ret;
913 bool retry;
914
915 timeout = SMBD_SELECT_TIMEOUT * 1000;
916
917 /*
918 * Are there any timed events waiting ? If so, ensure we don't
919 * select for longer than it would take to wait for them.
920 */
921
922 event_add_to_poll_args(ev_ctx, conn, &conn->pfds, &num_pfds, &timeout);
923
924 /* Process a signal and timed events now... */
925 if (run_events_poll(ev_ctx, 0, NULL, 0)) {
926 return NT_STATUS_RETRY;
927 }
928
929 {
930 int sav;
931 START_PROFILE(smbd_idle);
932
933 ret = sys_poll(conn->pfds, num_pfds, timeout);
934 sav = errno;
935
936 END_PROFILE(smbd_idle);
937 errno = sav;
938 }
939
940 if (ret == -1) {
941 if (errno == EINTR) {
942 return NT_STATUS_RETRY;
943 }
944 return map_nt_error_from_unix(errno);
945 }
946
947 retry = run_events_poll(ev_ctx, ret, conn->pfds, num_pfds);
948 if (retry) {
949 return NT_STATUS_RETRY;
950 }
951
952 /* Did we timeout ? */
953 if (ret == 0) {
954 return NT_STATUS_RETRY;
955 }
956
957 /* should not be reached */
958 return NT_STATUS_INTERNAL_ERROR;
959 }
960
961 /*
962 * Only allow 5 outstanding trans requests. We're allocating memory, so
963 * prevent a DoS.
964 */
965
966 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
967 {
968 int count = 0;
969 for (; list != NULL; list = list->next) {
970
971 if (list->mid == mid) {
972 return NT_STATUS_INVALID_PARAMETER;
973 }
974
975 count += 1;
976 }
977 if (count > 5) {
978 return NT_STATUS_INSUFFICIENT_RESOURCES;
979 }
980
981 return NT_STATUS_OK;
982 }
983
984 /*
985 These flags determine some of the permissions required to do an operation
986
987 Note that I don't set NEED_WRITE on some write operations because they
988 are used by some brain-dead clients when printing, and I don't want to
989 force write permissions on print services.
990 */
991 #define AS_USER (1<<0)
992 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
993 #define TIME_INIT (1<<2)
994 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
995 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
996 #define DO_CHDIR (1<<6)
997
998 /*
999 define a list of possible SMB messages and their corresponding
1000 functions. Any message that has a NULL function is unimplemented -
1001 please feel free to contribute implementations!
1002 */
1003 static const struct smb_message_struct {
1004 const char *name;
1005 void (*fn)(struct smb_request *req);
1006 int flags;
1007 } smb_messages[256] = {
1008
1009 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1010 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1011 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1012 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1013 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1014 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1015 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1016 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1017 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1018 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1019 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1020 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1021 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1022 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1023 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1024 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1025 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1026 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1027 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1028 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1029 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1030 /* 0x15 */ { NULL, NULL, 0 },
1031 /* 0x16 */ { NULL, NULL, 0 },
1032 /* 0x17 */ { NULL, NULL, 0 },
1033 /* 0x18 */ { NULL, NULL, 0 },
1034 /* 0x19 */ { NULL, NULL, 0 },
1035 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1036 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1037 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1038 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1039 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1040 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1041 /* 0x20 */ { "SMBwritec", NULL,0},
1042 /* 0x21 */ { NULL, NULL, 0 },
1043 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1044 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1045 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1046 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1047 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1048 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1049 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1050 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1051 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1052 /* 0x2b */ { "SMBecho",reply_echo,0},
1053 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1054 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1055 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1056 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1057 /* 0x30 */ { NULL, NULL, 0 },
1058 /* 0x31 */ { NULL, NULL, 0 },
1059 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1060 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1061 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1062 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1063 /* 0x36 */ { NULL, NULL, 0 },
1064 /* 0x37 */ { NULL, NULL, 0 },
1065 /* 0x38 */ { NULL, NULL, 0 },
1066 /* 0x39 */ { NULL, NULL, 0 },
1067 /* 0x3a */ { NULL, NULL, 0 },
1068 /* 0x3b */ { NULL, NULL, 0 },
1069 /* 0x3c */ { NULL, NULL, 0 },
1070 /* 0x3d */ { NULL, NULL, 0 },
1071 /* 0x3e */ { NULL, NULL, 0 },
1072 /* 0x3f */ { NULL, NULL, 0 },
1073 /* 0x40 */ { NULL, NULL, 0 },
1074 /* 0x41 */ { NULL, NULL, 0 },
1075 /* 0x42 */ { NULL, NULL, 0 },
1076 /* 0x43 */ { NULL, NULL, 0 },
1077 /* 0x44 */ { NULL, NULL, 0 },
1078 /* 0x45 */ { NULL, NULL, 0 },
1079 /* 0x46 */ { NULL, NULL, 0 },
1080 /* 0x47 */ { NULL, NULL, 0 },
1081 /* 0x48 */ { NULL, NULL, 0 },
1082 /* 0x49 */ { NULL, NULL, 0 },
1083 /* 0x4a */ { NULL, NULL, 0 },
1084 /* 0x4b */ { NULL, NULL, 0 },
1085 /* 0x4c */ { NULL, NULL, 0 },
1086 /* 0x4d */ { NULL, NULL, 0 },
1087 /* 0x4e */ { NULL, NULL, 0 },
1088 /* 0x4f */ { NULL, NULL, 0 },
1089 /* 0x50 */ { NULL, NULL, 0 },
1090 /* 0x51 */ { NULL, NULL, 0 },
1091 /* 0x52 */ { NULL, NULL, 0 },
1092 /* 0x53 */ { NULL, NULL, 0 },
1093 /* 0x54 */ { NULL, NULL, 0 },
1094 /* 0x55 */ { NULL, NULL, 0 },
1095 /* 0x56 */ { NULL, NULL, 0 },
1096 /* 0x57 */ { NULL, NULL, 0 },
1097 /* 0x58 */ { NULL, NULL, 0 },
1098 /* 0x59 */ { NULL, NULL, 0 },
1099 /* 0x5a */ { NULL, NULL, 0 },
1100 /* 0x5b */ { NULL, NULL, 0 },
1101 /* 0x5c */ { NULL, NULL, 0 },
1102 /* 0x5d */ { NULL, NULL, 0 },
1103 /* 0x5e */ { NULL, NULL, 0 },
1104 /* 0x5f */ { NULL, NULL, 0 },
1105 /* 0x60 */ { NULL, NULL, 0 },
1106 /* 0x61 */ { NULL, NULL, 0 },
1107 /* 0x62 */ { NULL, NULL, 0 },
1108 /* 0x63 */ { NULL, NULL, 0 },
1109 /* 0x64 */ { NULL, NULL, 0 },
1110 /* 0x65 */ { NULL, NULL, 0 },
1111 /* 0x66 */ { NULL, NULL, 0 },
1112 /* 0x67 */ { NULL, NULL, 0 },
1113 /* 0x68 */ { NULL, NULL, 0 },
1114 /* 0x69 */ { NULL, NULL, 0 },
1115 /* 0x6a */ { NULL, NULL, 0 },
1116 /* 0x6b */ { NULL, NULL, 0 },
1117 /* 0x6c */ { NULL, NULL, 0 },
1118 /* 0x6d */ { NULL, NULL, 0 },
1119 /* 0x6e */ { NULL, NULL, 0 },
1120 /* 0x6f */ { NULL, NULL, 0 },
1121 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1122 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1123 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1124 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1125 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1126 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1127 /* 0x76 */ { NULL, NULL, 0 },
1128 /* 0x77 */ { NULL, NULL, 0 },
1129 /* 0x78 */ { NULL, NULL, 0 },
1130 /* 0x79 */ { NULL, NULL, 0 },
1131 /* 0x7a */ { NULL, NULL, 0 },
1132 /* 0x7b */ { NULL, NULL, 0 },
1133 /* 0x7c */ { NULL, NULL, 0 },
1134 /* 0x7d */ { NULL, NULL, 0 },
1135 /* 0x7e */ { NULL, NULL, 0 },
1136 /* 0x7f */ { NULL, NULL, 0 },
1137 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1138 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1139 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1140 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1141 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1142 /* 0x85 */ { NULL, NULL, 0 },
1143 /* 0x86 */ { NULL, NULL, 0 },
1144 /* 0x87 */ { NULL, NULL, 0 },
1145 /* 0x88 */ { NULL, NULL, 0 },
1146 /* 0x89 */ { NULL, NULL, 0 },
1147 /* 0x8a */ { NULL, NULL, 0 },
1148 /* 0x8b */ { NULL, NULL, 0 },
1149 /* 0x8c */ { NULL, NULL, 0 },
1150 /* 0x8d */ { NULL, NULL, 0 },
1151 /* 0x8e */ { NULL, NULL, 0 },
1152 /* 0x8f */ { NULL, NULL, 0 },
1153 /* 0x90 */ { NULL, NULL, 0 },
1154 /* 0x91 */ { NULL, NULL, 0 },
1155 /* 0x92 */ { NULL, NULL, 0 },
1156 /* 0x93 */ { NULL, NULL, 0 },
1157 /* 0x94 */ { NULL, NULL, 0 },
1158 /* 0x95 */ { NULL, NULL, 0 },
1159 /* 0x96 */ { NULL, NULL, 0 },
1160 /* 0x97 */ { NULL, NULL, 0 },
1161 /* 0x98 */ { NULL, NULL, 0 },
1162 /* 0x99 */ { NULL, NULL, 0 },
1163 /* 0x9a */ { NULL, NULL, 0 },
1164 /* 0x9b */ { NULL, NULL, 0 },
1165 /* 0x9c */ { NULL, NULL, 0 },
1166 /* 0x9d */ { NULL, NULL, 0 },
1167 /* 0x9e */ { NULL, NULL, 0 },
1168 /* 0x9f */ { NULL, NULL, 0 },
1169 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1170 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1171 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1172 /* 0xa3 */ { NULL, NULL, 0 },
1173 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1174 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1175 /* 0xa6 */ { NULL, NULL, 0 },
1176 /* 0xa7 */ { NULL, NULL, 0 },
1177 /* 0xa8 */ { NULL, NULL, 0 },
1178 /* 0xa9 */ { NULL, NULL, 0 },
1179 /* 0xaa */ { NULL, NULL, 0 },
1180 /* 0xab */ { NULL, NULL, 0 },
1181 /* 0xac */ { NULL, NULL, 0 },
1182 /* 0xad */ { NULL, NULL, 0 },
1183 /* 0xae */ { NULL, NULL, 0 },
1184 /* 0xaf */ { NULL, NULL, 0 },
1185 /* 0xb0 */ { NULL, NULL, 0 },
1186 /* 0xb1 */ { NULL, NULL, 0 },
1187 /* 0xb2 */ { NULL, NULL, 0 },
1188 /* 0xb3 */ { NULL, NULL, 0 },
1189 /* 0xb4 */ { NULL, NULL, 0 },
1190 /* 0xb5 */ { NULL, NULL, 0 },
1191 /* 0xb6 */ { NULL, NULL, 0 },
1192 /* 0xb7 */ { NULL, NULL, 0 },
1193 /* 0xb8 */ { NULL, NULL, 0 },
1194 /* 0xb9 */ { NULL, NULL, 0 },
1195 /* 0xba */ { NULL, NULL, 0 },
1196 /* 0xbb */ { NULL, NULL, 0 },
1197 /* 0xbc */ { NULL, NULL, 0 },
1198 /* 0xbd */ { NULL, NULL, 0 },
1199 /* 0xbe */ { NULL, NULL, 0 },
1200 /* 0xbf */ { NULL, NULL, 0 },
1201 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1202 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1203 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1204 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1205 /* 0xc4 */ { NULL, NULL, 0 },
1206 /* 0xc5 */ { NULL, NULL, 0 },
1207 /* 0xc6 */ { NULL, NULL, 0 },
1208 /* 0xc7 */ { NULL, NULL, 0 },
1209 /* 0xc8 */ { NULL, NULL, 0 },
1210 /* 0xc9 */ { NULL, NULL, 0 },
1211 /* 0xca */ { NULL, NULL, 0 },
1212 /* 0xcb */ { NULL, NULL, 0 },
1213 /* 0xcc */ { NULL, NULL, 0 },
1214 /* 0xcd */ { NULL, NULL, 0 },
1215 /* 0xce */ { NULL, NULL, 0 },
1216 /* 0xcf */ { NULL, NULL, 0 },
1217 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1218 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1219 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1220 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1221 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1222 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1223 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1224 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1225 /* 0xd8 */ { NULL, NULL, 0 },
1226 /* 0xd9 */ { NULL, NULL, 0 },
1227 /* 0xda */ { NULL, NULL, 0 },
1228 /* 0xdb */ { NULL, NULL, 0 },
1229 /* 0xdc */ { NULL, NULL, 0 },
1230 /* 0xdd */ { NULL, NULL, 0 },
1231 /* 0xde */ { NULL, NULL, 0 },
1232 /* 0xdf */ { NULL, NULL, 0 },
1233 /* 0xe0 */ { NULL, NULL, 0 },
1234 /* 0xe1 */ { NULL, NULL, 0 },
1235 /* 0xe2 */ { NULL, NULL, 0 },
1236 /* 0xe3 */ { NULL, NULL, 0 },
1237 /* 0xe4 */ { NULL, NULL, 0 },
1238 /* 0xe5 */ { NULL, NULL, 0 },
1239 /* 0xe6 */ { NULL, NULL, 0 },
1240 /* 0xe7 */ { NULL, NULL, 0 },
1241 /* 0xe8 */ { NULL, NULL, 0 },
1242 /* 0xe9 */ { NULL, NULL, 0 },
1243 /* 0xea */ { NULL, NULL, 0 },
1244 /* 0xeb */ { NULL, NULL, 0 },
1245 /* 0xec */ { NULL, NULL, 0 },
1246 /* 0xed */ { NULL, NULL, 0 },
1247 /* 0xee */ { NULL, NULL, 0 },
1248 /* 0xef */ { NULL, NULL, 0 },
1249 /* 0xf0 */ { NULL, NULL, 0 },
1250 /* 0xf1 */ { NULL, NULL, 0 },
1251 /* 0xf2 */ { NULL, NULL, 0 },
1252 /* 0xf3 */ { NULL, NULL, 0 },
1253 /* 0xf4 */ { NULL, NULL, 0 },
1254 /* 0xf5 */ { NULL, NULL, 0 },
1255 /* 0xf6 */ { NULL, NULL, 0 },
1256 /* 0xf7 */ { NULL, NULL, 0 },
1257 /* 0xf8 */ { NULL, NULL, 0 },
1258 /* 0xf9 */ { NULL, NULL, 0 },
1259 /* 0xfa */ { NULL, NULL, 0 },
1260 /* 0xfb */ { NULL, NULL, 0 },
1261 /* 0xfc */ { NULL, NULL, 0 },
1262 /* 0xfd */ { NULL, NULL, 0 },
1263 /* 0xfe */ { NULL, NULL, 0 },
1264 /* 0xff */ { NULL, NULL, 0 }
1265
1266 };
1267
1268 /*******************************************************************
1269 allocate and initialize a reply packet
1270 ********************************************************************/
1271
1272 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1273 const char *inbuf, char **outbuf, uint8_t num_words,
1274 uint32_t num_bytes)
1275 {
1276 /*
1277 * Protect against integer wrap
1278 */
1279 if ((num_bytes > 0xffffff)
1280 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1281 char *msg;
1282 if (asprintf(&msg, "num_bytes too large: %u",
1283 (unsigned)num_bytes) == -1) {
1284 msg = discard_const_p(char, "num_bytes too large");
1285 }
1286 smb_panic(msg);
1287 }
1288
1289 *outbuf = talloc_array(mem_ctx, char,
1290 smb_size + num_words*2 + num_bytes);
1291 if (*outbuf == NULL) {
1292 return false;
1293 }
1294
1295 construct_reply_common(req, inbuf, *outbuf);
1296 srv_set_message(*outbuf, num_words, num_bytes, false);
1297 /*
1298 * Zero out the word area, the caller has to take care of the bcc area
1299 * himself
1300 */
1301 if (num_words != 0) {
1302 memset(*outbuf + smb_vwv0, 0, num_words*2);
1303 }
1304
1305 return true;
1306 }
1307
1308 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1309 {
1310 char *outbuf;
1311 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1312 num_bytes)) {
1313 smb_panic("could not allocate output buffer\n");
1314 }
1315 req->outbuf = (uint8_t *)outbuf;
1316 }
1317
1318
1319 /*******************************************************************
1320 Dump a packet to a file.
1321 ********************************************************************/
1322
1323 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1324 {
1325 int fd, i;
1326 char *fname = NULL;
1327 if (DEBUGLEVEL < 50) {
1328 return;
1329 }
1330
1331 if (len < 4) len = smb_len(data)+4;
1332 for (i=1;i<100;i++) {
1333 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1334 type ? "req" : "resp") == -1) {
1335 return;
1336 }
1337 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1338 if (fd != -1 || errno != EEXIST) break;
1339 }
1340 if (fd != -1) {
1341 ssize_t ret = write(fd, data, len);
1342 if (ret != len)
1343 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1344 close(fd);
1345 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1346 }
1347 SAFE_FREE(fname);
1348 }
1349
1350 /****************************************************************************
1351 Prepare everything for calling the actual request function, and potentially
1352 call the request function via the "new" interface.
1353
1354 Return False if the "legacy" function needs to be called, everything is
1355 prepared.
1356
1357 Return True if we're done.
1358
1359 I know this API sucks, but it is the one with the least code change I could
1360 find.
1361 ****************************************************************************/
1362
1363 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1364 {
1365 int flags;
1366 uint16 session_tag;
1367 connection_struct *conn = NULL;
1368 struct smbd_server_connection *sconn = req->sconn;
1369 char *raddr;
1370
1371 errno = 0;
1372
1373 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1374 * so subtract 4 from it. */
1375 if (!valid_smb_header(sconn, req->inbuf)
1376 || (size < (smb_size - 4))) {
1377 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1378 smb_len(req->inbuf)));
1379 exit_server_cleanly("Non-SMB packet");
1380 }
1381
1382 if (smb_messages[type].fn == NULL) {
1383 DEBUG(0,("Unknown message type %d!\n",type));
1384 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1385 reply_unknown_new(req, type);
1386 return NULL;
1387 }
1388
1389 flags = smb_messages[type].flags;
1390
1391 /* In share mode security we must ignore the vuid. */
1392 session_tag = (lp_security() == SEC_SHARE)
1393 ? UID_FIELD_INVALID : req->vuid;
1394 conn = req->conn;
1395
1396 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1397 (int)sys_getpid(), (unsigned long)conn));
1398
1399 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1400
1401 /* Ensure this value is replaced in the incoming packet. */
1402 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1403
1404 /*
1405 * Ensure the correct username is in current_user_info. This is a
1406 * really ugly bugfix for problems with multiple session_setup_and_X's
1407 * being done and allowing %U and %G substitutions to work correctly.
1408 * There is a reason this code is done here, don't move it unless you
1409 * know what you're doing... :-).
1410 * JRA.
1411 */
1412
1413 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1414 user_struct *vuser = NULL;
1415
1416 sconn->smb1.sessions.last_session_tag = session_tag;
1417 if(session_tag != UID_FIELD_INVALID) {
1418 vuser = get_valid_user_struct(sconn, session_tag);
1419 if (vuser) {
1420 set_current_user_info(
1421 vuser->session_info->unix_info->sanitized_username,
1422 vuser->session_info->unix_info->unix_name,
1423 vuser->session_info->info->domain_name);
1424 }
1425 }
1426 }
1427
1428 /* Does this call need to be run as the connected user? */
1429 if (flags & AS_USER) {
1430
1431 /* Does this call need a valid tree connection? */
1432 if (!conn) {
1433 /*
1434 * Amazingly, the error code depends on the command
1435 * (from Samba4).
1436 */
1437 if (type == SMBntcreateX) {
1438 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1439 } else {
1440 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1441 }
1442 return NULL;
1443 }
1444
1445 if (!change_to_user(conn,session_tag)) {
1446 DEBUG(0, ("Error: Could not change to user. Removing "
1447 "deferred open, mid=%llu.\n",
1448 (unsigned long long)req->mid));
1449 reply_force_doserror(req, ERRSRV, ERRbaduid);
1450 return conn;
1451 }
1452
1453 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1454
1455 /* Does it need write permission? */
1456 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1457 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1458 return conn;
1459 }
1460
1461 /* IPC services are limited */
1462 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1463 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1464 return conn;
1465 }
1466 } else {
1467 /* This call needs to be run as root */
1468 change_to_root_user();
1469 }
1470
1471 /* load service specific parameters */
1472 if (conn) {
1473 if (req->encrypted) {
1474 conn->encrypted_tid = true;
1475 /* encrypted required from now on. */
1476 conn->encrypt_level = Required;
1477 } else if (ENCRYPTION_REQUIRED(conn)) {
1478 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1479 exit_server_cleanly("encryption required "
1480 "on connection");
1481 return conn;
1482 }
1483 }
1484
1485 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1486 (flags & (AS_USER|DO_CHDIR)
1487 ?True:False))) {
1488 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1489 return conn;
1490 }
1491 conn->num_smb_operations++;
1492 }
1493
1494 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1495 talloc_tos());
1496 if (raddr == NULL) {
1497 reply_nterror(req, NT_STATUS_NO_MEMORY);
1498 return conn;
1499 }
1500
1501 /* does this protocol need to be run as guest? */
1502 if ((flags & AS_GUEST)
1503 && (!change_to_guest() ||
1504 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1505 sconn->remote_hostname,
1506 raddr))) {
1507 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1508 return conn;
1509 }
1510
1511 smb_messages[type].fn(req);
1512 return req->conn;
1513 }
1514
1515 /****************************************************************************
1516 Construct a reply to the incoming packet.
1517 ****************************************************************************/
1518
1519 static void construct_reply(struct smbd_server_connection *sconn,
1520 char *inbuf, int size, size_t unread_bytes,
1521 uint32_t seqnum, bool encrypted,
1522 struct smb_perfcount_data *deferred_pcd)
1523 {
1524 connection_struct *conn;
1525 struct smb_request *req;
1526
1527 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1528 smb_panic("could not allocate smb_request");
1529 }
1530
1531 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1532 encrypted, seqnum)) {
1533 exit_server_cleanly("Invalid SMB request");
1534 }
1535
1536 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1537
1538 /* we popped this message off the queue - keep original perf data */
1539 if (deferred_pcd)
1540 req->pcd = *deferred_pcd;
1541 else {
1542 SMB_PERFCOUNT_START(&req->pcd);
1543 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1544 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1545 }
1546
1547 conn = switch_message(req->cmd, req, size);
1548
1549 if (req->unread_bytes) {
1550 /* writeX failed. drain socket. */
1551 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1552 req->unread_bytes) {
1553 smb_panic("failed to drain pending bytes");
1554 }
1555 req->unread_bytes = 0;
1556 }
1557
1558 if (req->done) {
1559 TALLOC_FREE(req);
1560 return;
1561 }
1562
1563 if (req->outbuf == NULL) {
1564 return;
1565 }
1566
1567 if (CVAL(req->outbuf,0) == 0) {
1568 show_msg((char *)req->outbuf);
1569 }
1570
1571 if (!srv_send_smb(req->sconn,
1572 (char *)req->outbuf,
1573 true, req->seqnum+1,
1574 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1575 &req->pcd)) {
1576 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1577 }
1578
1579 TALLOC_FREE(req);
1580
1581 return;
1582 }
1583
1584 /****************************************************************************
1585 Process an smb from the client
1586 ****************************************************************************/
1587 static void process_smb(struct smbd_server_connection *sconn,
1588 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1589 uint32_t seqnum, bool encrypted,
1590 struct smb_perfcount_data *deferred_pcd)
1591 {
1592 int msg_type = CVAL(inbuf,0);
1593
1594 DO_PROFILE_INC(smb_count);
1595
1596 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1597 smb_len(inbuf) ) );
1598 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1599 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1600
1601 if (msg_type != NBSSmessage) {
1602 /*
1603 * NetBIOS session request, keepalive, etc.
1604 */
1605 reply_special(sconn, (char *)inbuf, nread);
1606 goto done;
1607 }
1608
1609 if (sconn->using_smb2) {
1610 /* At this point we're not really using smb2,
1611 * we make the decision here.. */
1612 if (smbd_is_smb2_header(inbuf, nread)) {
1613 smbd_smb2_first_negprot(sconn, inbuf, nread);
1614 return;
1615 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1616 && CVAL(inbuf, smb_com) != 0x72) {
1617 /* This is a non-negprot SMB1 packet.
1618 Disable SMB2 from now on. */
1619 sconn->using_smb2 = false;
1620 }
1621 }
1622
1623 show_msg((char *)inbuf);
1624
1625 construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1626 encrypted, deferred_pcd);
1627 sconn->trans_num++;
1628
1629 done:
1630 sconn->num_requests++;
1631
1632 /* The timeout_processing function isn't run nearly
1633 often enough to implement 'max log size' without
1634 overrunning the size of the file by many megabytes.
1635 This is especially true if we are running at debug
1636 level 10. Checking every 50 SMBs is a nice
1637 tradeoff of performance vs log file size overrun. */
1638
1639 if ((sconn->num_requests % 50) == 0 &&
1640 need_to_check_log_size()) {
1641 change_to_root_user();
1642 check_log_size();
1643 }
1644 }
1645
1646 /****************************************************************************
1647 Return a string containing the function name of a SMB command.
1648 ****************************************************************************/
1649
1650 const char *smb_fn_name(int type)
1651 {
1652 const char *unknown_name = "SMBunknown";
1653
1654 if (smb_messages[type].name == NULL)
1655 return(unknown_name);
1656
1657 return(smb_messages[type].name);
1658 }
1659
1660 /****************************************************************************
1661 Helper functions for contruct_reply.
1662 ****************************************************************************/
1663
1664 void add_to_common_flags2(uint32 v)
1665 {
1666 common_flags2 |= v;
1667 }
1668
1669 void remove_from_common_flags2(uint32 v)
1670 {
1671 common_flags2 &= ~v;
1672 }
1673
1674 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1675 char *outbuf)
1676 {
1677 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1678 uint16_t out_flags2 = common_flags2;
1679
1680 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1681 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1682 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1683
1684 srv_set_message(outbuf,0,0,false);
1685
1686 SCVAL(outbuf, smb_com, req->cmd);
1687 SIVAL(outbuf,smb_rcls,0);
1688 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1689 SSVAL(outbuf,smb_flg2, out_flags2);
1690 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1691 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1692
1693 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1694 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1695 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1696 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1697 }
1698
1699 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1700 {
1701 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1702 }
1703
1704 /*
1705 * How many bytes have we already accumulated up to the current wct field
1706 * offset?
1707 */
1708
1709 size_t req_wct_ofs(struct smb_request *req)
1710 {
1711 size_t buf_size;
1712
1713 if (req->chain_outbuf == NULL) {
1714 return smb_wct - 4;
1715 }
1716 buf_size = talloc_get_size(req->chain_outbuf);
1717 if ((buf_size % 4) != 0) {
1718 buf_size += (4 - (buf_size % 4));
1719 }
1720 return buf_size - 4;
1721 }
1722
1723 /*
1724 * Hack around reply_nterror & friends not being aware of chained requests,
1725 * generating illegal (i.e. wct==0) chain replies.
1726 */
1727
1728 static void fixup_chain_error_packet(struct smb_request *req)
1729 {
1730 uint8_t *outbuf = req->outbuf;
1731 req->outbuf = NULL;
1732 reply_outbuf(req, 2, 0);
1733 memcpy(req->outbuf, outbuf, smb_wct);
1734 TALLOC_FREE(outbuf);
1735 SCVAL(req->outbuf, smb_vwv0, 0xff);
1736 }
1737
1738 /**
1739 * @brief Find the smb_cmd offset of the last command pushed
1740 * @param[in] buf The buffer we're building up
1741 * @retval Where can we put our next andx cmd?
1742 *
1743 * While chaining requests, the "next" request we're looking at needs to put
1744 * its SMB_Command before the data the previous request already built up added
1745 * to the chain. Find the offset to the place where we have to put our cmd.
1746 */
1747
1748 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1749 {
1750 uint8_t cmd;
1751 size_t ofs;
1752
1753 cmd = CVAL(buf, smb_com);
1754
1755 SMB_ASSERT(is_andx_req(cmd));
1756
1757 ofs = smb_vwv0;
1758
1759 while (CVAL(buf, ofs) != 0xff) {
1760
1761 if (!is_andx_req(CVAL(buf, ofs))) {
1762 return false;
1763 }
1764
1765 /*
1766 * ofs is from start of smb header, so add the 4 length
1767 * bytes. The next cmd is right after the wct field.
1768 */
1769 ofs = SVAL(buf, ofs+2) + 4 + 1;
1770
1771 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1772 }
1773
1774 *pofs = ofs;
1775 return true;
1776 }
1777
1778 /**
1779 * @brief Do the smb chaining at a buffer level
1780 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1781 * @param[in] smb_command The command that we want to issue
1782 * @param[in] wct How many words?
1783 * @param[in] vwv The words, already in network order
1784 * @param[in] bytes_alignment How shall we align "bytes"?
1785 * @param[in] num_bytes How many bytes?
1786 * @param[in] bytes The data the request ships
1787 *
1788 * smb_splice_chain() adds the vwv and bytes to the request already present in
1789 * *poutbuf.
1790 */
1791
1792 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1793 uint8_t wct, const uint16_t *vwv,
1794 size_t bytes_alignment,
1795 uint32_t num_bytes, const uint8_t *bytes)
1796 {
1797 uint8_t *outbuf;
1798 size_t old_size, new_size;
1799 size_t ofs;
1800 size_t chain_padding = 0;
1801 size_t bytes_padding = 0;
1802 bool first_request;
1803
1804 old_size = talloc_get_size(*poutbuf);
1805
1806 /*
1807 * old_size == smb_wct means we're pushing the first request in for
1808 * libsmb/
1809 */
1810
1811 first_request = (old_size == smb_wct);
1812
1813 if (!first_request && ((old_size % 4) != 0)) {
1814 /*
1815 * Align the wct field of subsequent requests to a 4-byte
1816 * boundary
1817 */
1818 chain_padding = 4 - (old_size % 4);
1819 }
1820
1821 /*
1822 * After the old request comes the new wct field (1 byte), the vwv's
1823 * and the num_bytes field. After at we might need to align the bytes
1824 * given to us to "bytes_alignment", increasing the num_bytes value.
1825 */
1826
1827 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1828
1829 if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1830 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1831 }
1832
1833 new_size += bytes_padding + num_bytes;
1834
1835 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1836 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1837 (unsigned)new_size));
1838 return false;
1839 }
1840
1841 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1842 if (outbuf == NULL) {
1843 DEBUG(0, ("talloc failed\n"));
1844 return false;
1845 }
1846 *poutbuf = outbuf;
1847
1848 if (first_request) {
1849 SCVAL(outbuf, smb_com, smb_command);
1850 } else {
1851 size_t andx_cmd_ofs;
1852
1853 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1854 DEBUG(1, ("invalid command chain\n"));
1855 *poutbuf = talloc_realloc(
1856 NULL, *poutbuf, uint8_t, old_size);
1857 return false;
1858 }
1859
1860 if (chain_padding != 0) {
1861 memset(outbuf + old_size, 0, chain_padding);
1862 old_size += chain_padding;
1863 }
1864
1865 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1866 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1867 }
1868
1869 ofs = old_size;
1870
1871 /*
1872 * Push the chained request:
1873 *
1874 * wct field
1875 */
1876
1877 SCVAL(outbuf, ofs, wct);
1878 ofs += 1;
1879
1880 /*
1881 * vwv array
1882 */
1883
1884 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1885 ofs += sizeof(uint16_t) * wct;
1886
1887 /*
1888 * bcc (byte count)
1889 */
1890
1891 SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1892 ofs += sizeof(uint16_t);
1893
1894 /*
1895 * padding
1896 */
1897
1898 if (bytes_padding != 0) {
1899 memset(outbuf + ofs, 0, bytes_padding);
1900 ofs += bytes_padding;
1901 }
1902
1903 /*
1904 * The bytes field
1905 */
1906
1907 memcpy(outbuf + ofs, bytes, num_bytes);
1908
1909 return true;
1910 }
1911
1912 /****************************************************************************
1913 Construct a chained reply and add it to the already made reply
1914 ****************************************************************************/
1915
1916 void chain_reply(struct smb_request *req)
1917 {
1918 size_t smblen = smb_len(req->inbuf);
1919 size_t already_used, length_needed;
1920 uint8_t chain_cmd;
1921 uint32_t chain_offset; /* uint32_t to avoid overflow */
1922
1923 uint8_t wct;
1924 const uint16_t *vwv;
1925 uint16_t buflen;
1926 const uint8_t *buf;
1927
1928 if (IVAL(req->outbuf, smb_rcls) != 0) {
1929 fixup_chain_error_packet(req);
1930 }
1931
1932 /*
1933 * Any of the AndX requests and replies have at least a wct of
1934 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1935 * beginning of the SMB header to the next wct field.
1936 *
1937 * None of the AndX requests put anything valuable in vwv[0] and [1],
1938 * so we can overwrite it here to form the chain.
1939 */
1940
1941 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1942 if (req->chain_outbuf == NULL) {
1943 req->chain_outbuf = talloc_realloc(
1944 req, req->outbuf, uint8_t,
1945 smb_len(req->outbuf) + 4);
1946 if (req->chain_outbuf == NULL) {
1947 smb_panic("talloc failed");
1948 }
1949 }
1950 req->outbuf = NULL;
1951 goto error;
1952 }
1953
1954 /*
1955 * Here we assume that this is the end of the chain. For that we need
1956 * to set "next command" to 0xff and the offset to 0. If we later find
1957 * more commands in the chain, this will be overwritten again.
1958 */
1959
1960 SCVAL(req->outbuf, smb_vwv0, 0xff);
1961 SCVAL(req->outbuf, smb_vwv0+1, 0);
1962 SSVAL(req->outbuf, smb_vwv1, 0);
1963
1964 if (req->chain_outbuf == NULL) {
1965 /*
1966 * In req->chain_outbuf we collect all the replies. Start the
1967 * chain by copying in the first reply.
1968 *
1969 * We do the realloc because later on we depend on
1970 * talloc_get_size to determine the length of
1971 * chain_outbuf. The reply_xxx routines might have
1972 * over-allocated (reply_pipe_read_and_X used to be such an
1973 * example).
1974 */
1975 req->chain_outbuf = talloc_realloc(
1976 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1977 if (req->chain_outbuf == NULL) {
1978 smb_panic("talloc failed");
1979 }
1980 req->outbuf = NULL;
1981 } else {
1982 /*
1983 * Update smb headers where subsequent chained commands
1984 * may have updated them.
1985 */
1986 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1987 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1988
1989 if (!smb_splice_chain(&req->chain_outbuf,
1990 CVAL(req->outbuf, smb_com),
1991 CVAL(req->outbuf, smb_wct),
1992 (uint16_t *)(req->outbuf + smb_vwv),
1993 0, smb_buflen(req->outbuf),
1994 (uint8_t *)smb_buf(req->outbuf))) {
1995 goto error;
1996 }
1997 TALLOC_FREE(req->outbuf);
1998 }
1999
2000 /*
2001 * We use the old request's vwv field to grab the next chained command
2002 * and offset into the chained fields.
2003 */
2004
2005 chain_cmd = CVAL(req->vwv+0, 0);
2006 chain_offset = SVAL(req->vwv+1, 0);
2007
2008 if (chain_cmd == 0xff) {
2009 /*
2010 * End of chain, no more requests from the client. So ship the
2011 * replies.
2012 */
2013 smb_setlen((char *)(req->chain_outbuf),
2014 talloc_get_size(req->chain_outbuf) - 4);
2015
2016 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2017 true, req->seqnum+1,
2018 IS_CONN_ENCRYPTED(req->conn)
2019 ||req->encrypted,
2020 &req->pcd)) {
2021 exit_server_cleanly("chain_reply: srv_send_smb "
2022 "failed.");
2023 }
2024 TALLOC_FREE(req->chain_outbuf);
2025 req->done = true;
2026 return;
2027 }
2028
2029 /* add a new perfcounter for this element of chain */
2030 SMB_PERFCOUNT_ADD(&req->pcd);
2031 SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2032 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2033
2034 /*
2035 * Check if the client tries to fool us. The chain offset
2036 * needs to point beyond the current request in the chain, it
2037 * needs to strictly grow. Otherwise we might be tricked into
2038 * an endless loop always processing the same request over and
2039 * over again. We used to assume that vwv and the byte buffer
2040 * array in a chain are always attached, but OS/2 the
2041 * Write&X/Read&X chain puts the Read&X vwv array right behind
2042 * the Write&X vwv chain. The Write&X bcc array is put behind
2043 * the Read&X vwv array. So now we check whether the chain
2044 * offset points strictly behind the previous vwv
2045 * array. req->buf points right after the vwv array of the
2046 * previous request. See
2047 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for more
2048 * information.
2049 */
2050
2051 already_used = PTR_DIFF(req->buf, smb_base(req->inbuf));
2052 if (chain_offset <= already_used) {
2053 goto error;
2054 }
2055
2056 /*
2057 * Next check: Make sure the chain offset does not point beyond the
2058 * overall smb request length.
2059 */
2060
2061 length_needed = chain_offset+1; /* wct */
2062 if (length_needed > smblen) {
2063 goto error;
2064 }
2065
2066 /*
2067 * Now comes the pointer magic. Goal here is to set up req->vwv and
2068 * req->buf correctly again to be able to call the subsequent
2069 * switch_message(). The chain offset (the former vwv[1]) points at
2070 * the new wct field.
2071 */
2072
2073 wct = CVAL(smb_base(req->inbuf), chain_offset);
2074
2075 /*
2076 * Next consistency check: Make the new vwv array fits in the overall
2077 * smb request.
2078 */
2079
2080 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2081 if (length_needed > smblen) {
2082 goto error;
2083 }
2084 vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2085
2086 /*
2087 * Now grab the new byte buffer....
2088 */
2089
2090 buflen = SVAL(vwv+wct, 0);
2091
2092 /*
2093 * .. and check that it fits.
2094 */
2095
2096 length_needed += buflen;
2097 if (length_needed > smblen) {
2098 goto error;
2099 }
2100 buf = (const uint8_t *)(vwv+wct+1);
2101
2102 req->cmd = chain_cmd;
2103 req->wct = wct;
2104 req->vwv = discard_const_p(uint16_t, vwv);
2105 req->buflen = buflen;
2106 req->buf = buf;
2107
2108 switch_message(chain_cmd, req, smblen);
2109
2110 if (req->outbuf == NULL) {
2111 /*
2112 * This happens if the chained command has suspended itself or
2113 * if it has called srv_send_smb() itself.
2114 */
2115 return;
2116 }
2117
2118 /*
2119 * We end up here if the chained command was not itself chained or
2120 * suspended, but for example a close() command. We now need to splice
2121 * the chained commands' outbuf into the already built up chain_outbuf
2122 * and ship the result.
2123 */
2124 goto done;
2125
2126 error:
2127 /*
2128 * We end up here if there's any error in the chain syntax. Report a
2129 * DOS error, just like Windows does.
2130 */
2131 reply_force_doserror(req, ERRSRV, ERRerror);
2132 fixup_chain_error_packet(req);
2133
2134 done:
2135 /*
2136 * This scary statement intends to set the
2137 * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2138 * to the value req->outbuf carries
2139 */
2140 SSVAL(req->chain_outbuf, smb_flg2,
2141 (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2142 | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2143
2144 /*
2145 * Transfer the error codes from the subrequest to the main one
2146 */
2147 SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2148 SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2149
2150 if (!smb_splice_chain(&req->chain_outbuf,
2151 CVAL(req->outbuf, smb_com),
2152 CVAL(req->outbuf, smb_wct),
2153 (uint16_t *)(req->outbuf + smb_vwv),
2154 0, smb_buflen(req->outbuf),
2155 (uint8_t *)smb_buf(req->outbuf))) {
2156 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2157 }
2158 TALLOC_FREE(req->outbuf);
2159
2160 smb_setlen((char *)(req->chain_outbuf),
2161 talloc_get_size(req->chain_outbuf) - 4);
2162
2163 show_msg((char *)(req->chain_outbuf));
2164
2165 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2166 true, req->seqnum+1,
2167 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2168 &req->pcd)) {
2169 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2170 }
2171 TALLOC_FREE(req->chain_outbuf);
2172 req->done = true;
2173 }
2174
2175 /****************************************************************************
2176 Check if services need reloading.
2177 ****************************************************************************/
2178
2179 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2180 {
2181
2182 if (last_smb_conf_reload_time == 0) {
2183 last_smb_conf_reload_time = t;
2184 }
2185
2186 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2187 reload_services(sconn->msg_ctx, sconn->sock, True);
2188 last_smb_conf_reload_time = t;
2189 }
2190 }
2191
2192 static bool fd_is_readable(int fd)
2193 {
2194 int ret, revents;
2195
2196 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2197
2198 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2199
2200 }
2201
2202 static void smbd_server_connection_write_handler(
2203 struct smbd_server_connection *sconn)
2204 {
2205 /* TODO: make write nonblocking */
2206 }
2207
2208 static void smbd_server_connection_read_handler(
2209 struct smbd_server_connection *sconn, int fd)
2210 {
2211 uint8_t *inbuf = NULL;
2212 size_t inbuf_len = 0;
2213 size_t unread_bytes = 0;
2214 bool encrypted = false;
2215 TALLOC_CTX *mem_ctx = talloc_tos();
2216 NTSTATUS status;
2217 uint32_t seqnum;
2218
2219 bool from_client = (sconn->sock == fd);
2220
2221 if (from_client) {
2222 smbd_lock_socket(sconn);
2223
2224 if (lp_async_smb_echo_handler()) {
2225
2226 if (fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2227 /*
2228 * This is the super-ugly hack to
2229 * prefer the packets forwarded by the
2230 * echo handler over the ones by the
2231 * client directly
2232 */
2233 fd = sconn->smb1.echo_handler.trusted_fd;
2234 } else if (!fd_is_readable(fd)) {
2235 DEBUG(10,("the echo listener was faster\n"));
2236 smbd_unlock_socket(sconn);
2237 return;
2238 }
2239 }
2240
2241 /* TODO: make this completely nonblocking */
2242 status = receive_smb_talloc(mem_ctx, sconn, fd,
2243 (char **)(void *)&inbuf,
2244 0, /* timeout */
2245 &unread_bytes,
2246 &encrypted,
2247 &inbuf_len, &seqnum,
2248 false /* trusted channel */);
2249 smbd_unlock_socket(sconn);
2250 } else {
2251 /* TODO: make this completely nonblocking */
2252 status = receive_smb_talloc(mem_ctx, sconn, fd,
2253 (char **)(void *)&inbuf,
2254 0, /* timeout */
2255 &unread_bytes,
2256 &encrypted,
2257 &inbuf_len, &seqnum,
2258 true /* trusted channel */);
2259 }
2260
2261 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2262 goto process;
2263 }
2264 if (NT_STATUS_IS_ERR(status)) {
2265 exit_server_cleanly("failed to receive smb request");
2266 }
2267 if (!NT_STATUS_IS_OK(status)) {
2268 return;
2269 }
2270
2271 process:
2272 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2273 seqnum, encrypted, NULL);
2274 }
2275
2276 static void smbd_server_connection_handler(struct event_context *ev,
2277 struct fd_event *fde,
2278 uint16_t flags,
2279 void *private_data)
2280 {
2281 struct smbd_server_connection *conn = talloc_get_type(private_data,
2282 struct smbd_server_connection);
2283
2284 if (flags & EVENT_FD_WRITE) {
2285 smbd_server_connection_write_handler(conn);
2286 return;
2287 }
2288 if (flags & EVENT_FD_READ) {
2289 smbd_server_connection_read_handler(conn, conn->sock);
2290 return;
2291 }
2292 }
2293
2294 static void smbd_server_echo_handler(struct event_context *ev,
2295 struct fd_event *fde,
2296 uint16_t flags,
2297 void *private_data)
2298 {
2299 struct smbd_server_connection *conn = talloc_get_type(private_data,
2300 struct smbd_server_connection);
2301
2302 if (flags & EVENT_FD_WRITE) {
2303 smbd_server_connection_write_handler(conn);
2304 return;
2305 }
2306 if (flags & EVENT_FD_READ) {
2307 smbd_server_connection_read_handler(
2308 conn, conn->smb1.echo_handler.trusted_fd);
2309 return;
2310 }
2311 }
2312
2313 #ifdef CLUSTER_SUPPORT
2314 /****************************************************************************
2315 received when we should release a specific IP
2316 ****************************************************************************/
2317 static void release_ip(const char *ip, void *priv)
2318 {
2319 const char *addr = (const char *)priv;
2320 const char *p = addr;
2321
2322 if (strncmp("::ffff:", addr, 7) == 0) {
2323 p = addr + 7;
2324 }
2325
2326 DEBUG(10, ("Got release IP message for %s, "
2327 "our address is %s\n", ip, p));
2328
2329 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2330 /* we can't afford to do a clean exit - that involves
2331 database writes, which would potentially mean we
2332 are still running after the failover has finished -
2333 we have to get rid of this process ID straight
2334 away */
2335 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2336 ip));
2337 /* note we must exit with non-zero status so the unclean handler gets
2338 called in the parent, so that the brl database is tickled */
2339 _exit(1);
2340 }
2341 }
2342
2343 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2344 struct sockaddr_storage *client)
2345 {
2346 socklen_t length;
2347 length = sizeof(*server);
2348 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2349 return -1;
2350 }
2351 length = sizeof(*client);
2352 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2353 return -1;
2354 }
2355 return 0;
2356 }
2357 #endif
2358
2359 /*
2360 * Send keepalive packets to our client
2361 */
2362 static bool keepalive_fn(const struct timeval *now, void *private_data)
2363 {
2364 struct smbd_server_connection *sconn = talloc_get_type_abort(
2365 private_data, struct smbd_server_connection);
2366 bool ret;
2367
2368 if (sconn->using_smb2) {
2369 /* Don't do keepalives on an SMB2 connection. */
2370 return false;
2371 }
2372
2373 smbd_lock_socket(smbd_server_conn);
2374 ret = send_keepalive(sconn->sock);
2375 smbd_unlock_socket(smbd_server_conn);
2376
2377 if (!ret) {
2378 char addr[INET6_ADDRSTRLEN];
2379 /*
2380 * Try and give an error message saying what
2381 * client failed.
2382 */
2383 DEBUG(0, ("send_keepalive failed for client %s. "
2384 "Error %s - exiting\n",
2385 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2386 strerror(errno)));
2387 return False;
2388 }
2389 return True;
2390 }
2391
2392 /*
2393 * Do the recurring check if we're idle
2394 */
2395 static bool deadtime_fn(const struct timeval *now, void *private_data)
2396 {
2397 struct smbd_server_connection *sconn =
2398 (struct smbd_server_connection *)private_data;
2399
2400 if ((conn_num_open(sconn) == 0)
2401 || (conn_idle_all(sconn, now->tv_sec))) {
2402 DEBUG( 2, ( "Closing idle connection\n" ) );
2403 messaging_send(sconn->msg_ctx,
2404 messaging_server_id(sconn->msg_ctx),
2405 MSG_SHUTDOWN, &data_blob_null);
2406 return False;
2407 }
2408
2409 return True;
2410 }
2411
2412 /*
2413 * Do the recurring log file and smb.conf reload checks.
2414 */
2415
2416 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2417 {
2418 struct smbd_server_connection *sconn = talloc_get_type_abort(
2419 private_data, struct smbd_server_connection);
2420
2421 DEBUG(5, ("housekeeping\n"));
2422
2423 change_to_root_user();
2424
2425 /* update printer queue caches if necessary */
2426 update_monitored_printq_cache(sconn->msg_ctx);
2427
2428 /* check if we need to reload services */
2429 check_reload(sconn, time_mono(NULL));
2430
2431 /* Change machine password if neccessary. */
2432 attempt_machine_password_change();
2433
2434 /*
2435 * Force a log file check.
2436 */
2437 force_check_log_size();
2438 check_log_size();
2439 return true;
2440 }
2441
2442 /*
2443 * Read an smb packet in the echo handler child, giving the parent
2444 * smbd one second to react once the socket becomes readable.
2445 */
2446
2447 struct smbd_echo_read_state {
2448 struct tevent_context *ev;
2449 struct smbd_server_connection *sconn;
2450
2451 char *buf;
2452 size_t buflen;
2453 uint32_t seqnum;
2454 };
2455
2456 static void smbd_echo_read_readable(struct tevent_req *subreq);
2457 static void smbd_echo_read_waited(struct tevent_req *subreq);
2458
2459 static struct tevent_req *smbd_echo_read_send(
2460 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2461 struct smbd_server_connection *sconn)
2462 {
2463 struct tevent_req *req, *subreq;
2464 struct smbd_echo_read_state *state;
2465
2466 req = tevent_req_create(mem_ctx, &state,
2467 struct smbd_echo_read_state);
2468 if (req == NULL) {
2469 return NULL;
2470 }
2471 state->ev = ev;
2472 state->sconn = sconn;
2473
2474 subreq = wait_for_read_send(state, ev, sconn->sock);
2475 if (tevent_req_nomem(subreq, req)) {
2476 return tevent_req_post(req, ev);
2477 }
2478 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2479 return req;
2480 }
2481
2482 static void smbd_echo_read_readable(struct tevent_req *subreq)
2483 {
2484 struct tevent_req *req = tevent_req_callback_data(
2485 subreq, struct tevent_req);
2486 struct smbd_echo_read_state *state = tevent_req_data(
2487 req, struct smbd_echo_read_state);
2488 bool ok;
2489 int err;
2490
2491 ok = wait_for_read_recv(subreq, &err);
2492 TALLOC_FREE(subreq);
2493 if (!ok) {
2494 tevent_req_nterror(req, map_nt_error_from_unix(err));
2495 return;
2496 }
2497
2498 /*
2499 * Give the parent smbd one second to step in
2500 */
2501
2502 subreq = tevent_wakeup_send(
2503 state, state->ev, timeval_current_ofs(1, 0));
2504 if (tevent_req_nomem(subreq, req)) {
2505 return;
2506 }
2507 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2508 }
2509
2510 static void smbd_echo_read_waited(struct tevent_req *subreq)
2511 {
2512 struct tevent_req *req = tevent_req_callback_data(
2513 subreq, struct tevent_req);
2514 struct smbd_echo_read_state *state = tevent_req_data(
2515 req, struct smbd_echo_read_state);
2516 struct smbd_server_connection *sconn = state->sconn;
2517 bool ok;
2518 NTSTATUS status;
2519 size_t unread = 0;
2520 bool encrypted;
2521
2522 ok = tevent_wakeup_recv(subreq);
2523 TALLOC_FREE(subreq);
2524 if (!ok) {
2525 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2526 return;
2527 }
2528
2529 ok = smbd_lock_socket_internal(sconn);
2530 if (!ok) {
2531 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2532 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2533 return;
2534 }
2535
2536 if (!fd_is_readable(sconn->sock)) {
2537 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2538 (int)sys_getpid()));
2539
2540 ok = smbd_unlock_socket_internal(sconn);
2541 if (!ok) {
2542 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2543 DEBUG(1, ("%s: failed to unlock socket\n",
2544 __location__));
2545 return;
2546 }
2547
2548 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2549 if (tevent_req_nomem(subreq, req)) {
2550 return;
2551 }
2552 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2553 return;
2554 }
2555
2556 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2557 0 /* timeout */,
2558 &unread,
2559 &encrypted,
2560 &state->buflen,
2561 &state->seqnum,
2562 false /* trusted_channel*/);
2563
2564 if (tevent_req_nterror(req, status)) {
2565 tevent_req_nterror(req, status);
2566 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2567 (int)sys_getpid(), nt_errstr(status)));
2568 return;
2569 }
2570
2571 ok = smbd_unlock_socket_internal(sconn);
2572 if (!ok) {
2573 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2574 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2575 return;
2576 }
2577 tevent_req_done(req);
2578 }
2579
2580 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2581 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2582 {
2583 struct smbd_echo_read_state *state = tevent_req_data(
2584 req, struct smbd_echo_read_state);
2585 NTSTATUS status;
2586
2587 if (tevent_req_is_nterror(req, &status)) {
2588 return status;
2589 }
2590 *pbuf = talloc_move(mem_ctx, &state->buf);
2591 *pbuflen = state->buflen;
2592 *pseqnum = state->seqnum;
2593 return NT_STATUS_OK;
2594 }
2595
2596 struct smbd_echo_state {
2597 struct tevent_context *ev;
2598 struct iovec *pending;
2599 struct smbd_server_connection *sconn;
2600 int parent_pipe;
2601
2602 struct tevent_fd *parent_fde;
2603
2604 struct tevent_req *write_req;
2605 };
2606
2607 static void smbd_echo_writer_done(struct tevent_req *req);
2608
2609 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2610 {
2611 int num_pending;
2612
2613 if (state->write_req != NULL) {
2614 return;
2615 }
2616
2617 num_pending = talloc_array_length(state->pending);
2618 if (num_pending == 0) {
2619 return;
2620 }
2621
2622 state->write_req = writev_send(state, state->ev, NULL,
2623 state->parent_pipe, false,
2624 state->pending, num_pending);
2625 if (state->write_req == NULL) {
2626 DEBUG(1, ("writev_send failed\n"));
2627 exit(1);
2628 }
2629
2630 talloc_steal(state->write_req, state->pending);
2631 state->pending = NULL;
2632
2633 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2634 state);
2635 }
2636
2637 static void smbd_echo_writer_done(struct tevent_req *req)
2638 {
2639 struct smbd_echo_state *state = tevent_req_callback_data(
2640 req, struct smbd_echo_state);
2641 ssize_t written;
2642 int err;
2643
2644 written = writev_recv(req, &err);
2645 TALLOC_FREE(req);
2646 state->write_req = NULL;
2647 if (written == -1) {
2648 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2649 exit(1);
2650 }
2651 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2652 smbd_echo_activate_writer(state);
2653 }
2654
2655 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2656 uint32_t seqnum)
2657 {
2658 struct smb_request req;
2659 uint16_t num_replies;
2660 size_t out_len;
2661 char *outbuf;
2662 bool ok;
2663
2664 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2665 DEBUG(10, ("Got netbios keepalive\n"));
2666 /*
2667 * Just swallow it
2668 */
2669 return true;
2670 }
2671
2672 if (inbuf_len < smb_size) {
2673 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2674 return false;
2675 }
2676 if (!valid_smb_header(smbd_server_conn, inbuf)) {
2677 DEBUG(10, ("Got invalid SMB header\n"));
2678 return false;
2679 }
2680
2681 if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2682 seqnum)) {
2683 return false;
2684 }
2685 req.inbuf = inbuf;
2686
2687 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2688 smb_messages[req.cmd].name
2689 ? smb_messages[req.cmd].name : "unknown"));
2690
2691 if (req.cmd != SMBecho) {
2692 return false;
2693 }
2694 if (req.wct < 1) {
2695 return false;
2696 }
2697
2698 num_replies = SVAL(req.vwv+0, 0);
2699 if (num_replies != 1) {
2700 /* Not a Windows "Hey, you're still there?" request */
2701 return false;
2702 }
2703
2704 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2705 1, req.buflen)) {
2706 DEBUG(10, ("create_outbuf failed\n"));
2707 return false;
2708 }
2709 req.outbuf = (uint8_t *)outbuf;
2710
2711 SSVAL(req.outbuf, smb_vwv0, num_replies);
2712
2713 if (req.buflen > 0) {
2714 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2715 }
2716
2717 out_len = smb_len(req.outbuf) + 4;
2718
2719 ok = srv_send_smb(req.sconn,
2720 (char *)outbuf,
2721 true, seqnum+1,
2722 false, &req.pcd);
2723 TALLOC_FREE(outbuf);
2724 if (!ok) {
2725 exit(1);
2726 }
2727
2728 return true;
2729 }
2730
2731 static void smbd_echo_exit(struct tevent_context *ev,
2732 struct tevent_fd *fde, uint16_t flags,
2733 void *private_data)
2734 {
2735 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2736 exit(0);
2737 }
2738
2739 static void smbd_echo_got_packet(struct tevent_req *req);
2740
2741 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2742 int parent_pipe)
2743 {
2744 struct smbd_echo_state *state;
2745 struct tevent_req *read_req;
2746
2747 state = talloc_zero(sconn, struct smbd_echo_state);
2748 if (state == NULL) {
2749 DEBUG(1, ("talloc failed\n"));
2750 return;
2751 }
2752 state->sconn = sconn;
2753 state->parent_pipe = parent_pipe;
2754 state->ev = s3_tevent_context_init(state);
2755 if (state->ev == NULL) {
2756 DEBUG(1, ("tevent_context_init failed\n"));
2757 TALLOC_FREE(state);
2758 return;
2759 }
2760 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2761 TEVENT_FD_READ, smbd_echo_exit,
2762 state);
2763 if (state->parent_fde == NULL) {
2764 DEBUG(1, ("tevent_add_fd failed\n"));
2765 TALLOC_FREE(state);
2766 return;
2767 }
2768
2769 read_req = smbd_echo_read_send(state, state->ev, sconn);
2770 if (read_req == NULL) {
2771 DEBUG(1, ("smbd_echo_read_send failed\n"));
2772 TALLOC_FREE(state);
2773 return;
2774 }
2775 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2776
2777 while (true) {
2778 if (tevent_loop_once(state->ev) == -1) {
2779 DEBUG(1, ("tevent_loop_once failed: %s\n",
2780 strerror(errno)));
2781 break;
2782 }
2783 }
2784 TALLOC_FREE(state);
2785 }
2786
2787 static void smbd_echo_got_packet(struct tevent_req *req)
2788 {
2789 struct smbd_echo_state *state = tevent_req_callback_data(
2790 req, struct smbd_echo_state);
2791 NTSTATUS status;
2792 char *buf = NULL;
2793 size_t buflen = 0;
2794 uint32_t seqnum = 0;
2795 bool reply;
2796
2797 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2798 TALLOC_FREE(req);
2799 if (!NT_STATUS_IS_OK(status)) {
2800 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2801 nt_errstr(status)));
2802 exit(1);
2803 }
2804
2805 reply = smbd_echo_reply((uint8_t *)buf, buflen, seqnum);
2806 if (!reply) {
2807 size_t num_pending;
2808 struct iovec *tmp;
2809 struct iovec *iov;
2810
2811 num_pending = talloc_array_length(state->pending);
2812 tmp = talloc_realloc(state, state->pending, struct iovec,
2813 num_pending+1);
2814 if (tmp == NULL) {
2815 DEBUG(1, ("talloc_realloc failed\n"));
2816 exit(1);
2817 }
2818 state->pending = tmp;
2819
2820 if (buflen >= smb_size) {
2821 /*
2822 * place the seqnum in the packet so that the main process
2823 * can reply with signing
2824 */
2825 SIVAL(buf, smb_ss_field, seqnum);
2826 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2827 }
2828
2829 iov = &state->pending[num_pending];
2830 iov->iov_base = buf;
2831 iov->iov_len = buflen;
2832
2833 DEBUG(10,("echo_handler[%d]: forward to main\n",
2834 (int)sys_getpid()));
2835 smbd_echo_activate_writer(state);
2836 }
2837
2838 req = smbd_echo_read_send(state, state->ev, state->sconn);
2839 if (req == NULL) {
2840 DEBUG(1, ("smbd_echo_read_send failed\n"));
2841 exit(1);
2842 }
2843 tevent_req_set_callback(req, smbd_echo_got_packet, state);
2844 }
2845
2846
2847 /*
2848 * Handle SMBecho requests in a forked child process
2849 */
2850 bool fork_echo_handler(struct smbd_server_connection *sconn)
2851 {
2852 int listener_pipe[2];
2853 int res;
2854 pid_t child;
2855
2856 res = pipe(listener_pipe);
2857 if (res == -1) {
2858 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2859 return false;
2860 }
2861 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2862 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2863 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2864 goto fail;
2865 }
2866
2867 child = sys_fork();
2868 if (child == 0) {
2869 NTSTATUS status;
2870
2871 close(listener_pipe[0]);
2872 set_blocking(listener_pipe[1], false);
2873
2874 status = reinit_after_fork(sconn->msg_ctx,
2875 server_event_context(),
2876 procid_self(), false);
2877 if (!NT_STATUS_IS_OK(status)) {
2878 DEBUG(1, ("reinit_after_fork failed: %s\n",
2879 nt_errstr(status)));
2880 exit(1);
2881 }
2882 smbd_echo_loop(sconn, listener_pipe[1]);
2883 exit(0);
2884 }
2885 close(listener_pipe[1]);
2886 listener_pipe[1] = -1;
2887 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2888
2889 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2890
2891 /*
2892 * Without smb signing this is the same as the normal smbd
2893 * listener. This needs to change once signing comes in.
2894 */
2895 sconn->smb1.echo_handler.trusted_fde = event_add_fd(server_event_context(),
2896 sconn,
2897 sconn->smb1.echo_handler.trusted_fd,
2898 EVENT_FD_READ,
2899 smbd_server_echo_handler,
2900 sconn);
2901 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2902 DEBUG(1, ("event_add_fd failed\n"));
2903 goto fail;
2904 }
2905
2906 return true;
2907
2908 fail:
2909 if (listener_pipe[0] != -1) {
2910 close(listener_pipe[0]);
2911 }
2912 if (listener_pipe[1] != -1) {
2913 close(listener_pipe[1]);
2914 }
2915 sconn->smb1.echo_handler.trusted_fd = -1;
2916 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2917 close(sconn->smb1.echo_handler.socket_lock_fd);
2918 }
2919 sconn->smb1.echo_handler.trusted_fd = -1;
2920 sconn->smb1.echo_handler.socket_lock_fd = -1;
2921 return false;
2922 }
2923
2924 #if CLUSTER_SUPPORT
2925
2926 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2927 struct sockaddr_storage *srv,
2928 struct sockaddr_storage *clnt)
2929 {
2930 struct ctdbd_connection *cconn;
2931 char tmp_addr[INET6_ADDRSTRLEN];
2932 char *addr;
2933
2934 cconn = messaging_ctdbd_connection();
2935 if (cconn == NULL) {
2936 return NT_STATUS_NO_MEMORY;
2937 }
2938
2939 client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2940 addr = talloc_strdup(cconn, tmp_addr);
2941 if (addr == NULL) {
2942 return NT_STATUS_NO_MEMORY;
2943 }
2944 return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2945 }
2946
2947 #endif
2948
2949 /****************************************************************************
2950 Process commands from the client
2951 ****************************************************************************/
2952
2953 void smbd_process(struct tevent_context *ev_ctx,
2954 struct smbd_server_connection *sconn)
2955 {
2956 TALLOC_CTX *frame = talloc_stackframe();
2957 struct sockaddr_storage ss;
2958 struct sockaddr *sa = NULL;
2959 socklen_t sa_socklen;
2960 struct tsocket_address *local_address = NULL;
2961 struct tsocket_address *remote_address = NULL;
2962 const char *remaddr = NULL;
2963 char *rhost;
2964 int ret;
2965
2966 if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
2967 /*
2968 * We're not making the decision here,
2969 * we're just allowing the client
2970 * to decide between SMB1 and SMB2
2971 * with the first negprot
2972 * packet.
2973 */
2974 sconn->using_smb2 = true;
2975 }
2976
2977 /* Ensure child is set to blocking mode */
2978 set_blocking(sconn->sock,True);
2979
2980 set_socket_options(sconn->sock, "SO_KEEPALIVE");
2981 set_socket_options(sconn->sock, lp_socket_options());
2982
2983 sa = (struct sockaddr *)(void *)&ss;
2984 sa_socklen = sizeof(ss);
2985 ret = getpeername(sconn->sock, sa, &sa_socklen);
2986 if (ret != 0) {
2987 int level = (errno == ENOTCONN)?2:0;
2988 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2989 exit_server_cleanly("getpeername() failed.\n");
2990 }
2991 ret = tsocket_address_bsd_from_sockaddr(sconn,
2992 sa, sa_socklen,
2993 &remote_address);
2994 if (ret != 0) {
2995 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2996 __location__, strerror(errno)));
2997 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2998 }
2999
3000 sa = (struct sockaddr *)(void *)&ss;
3001 sa_socklen = sizeof(ss);
3002 ret = getsockname(sconn->sock, sa, &sa_socklen);
3003 if (ret != 0) {
3004 int level = (errno == ENOTCONN)?2:0;
3005 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3006 exit_server_cleanly("getsockname() failed.\n");
3007 }
3008 ret = tsocket_address_bsd_from_sockaddr(sconn,
3009 sa, sa_socklen,
3010 &local_address);
3011 if (ret != 0) {
3012 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3013 __location__, strerror(errno)));
3014 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3015 }
3016
3017 sconn->local_address = local_address;
3018 sconn->remote_address = remote_address;
3019
3020 if (tsocket_address_is_inet(remote_address, "ip")) {
3021 remaddr = tsocket_address_inet_addr_string(
3022 sconn->remote_address,
3023 talloc_tos());
3024 if (remaddr == NULL) {
3025 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3026 __location__, strerror(errno)));
3027 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3028 }
3029 } else {
3030 remaddr = "0.0.0.0";
3031 }
3032
3033 /* this is needed so that we get decent entries
3034 in smbstatus for port 445 connects */
3035 set_remote_machine_name(remaddr, false);
3036 reload_services(sconn->msg_ctx, sconn->sock, true);
3037
3038 /*
3039 * Before the first packet, check the global hosts allow/ hosts deny
3040 * parameters before doing any parsing of packets passed to us by the
3041 * client. This prevents attacks on our parsing code from hosts not in
3042 * the hosts allow list.
3043 */
3044
3045 ret = get_remote_hostname(remote_address,
3046 &rhost,
3047 talloc_tos());
3048 if (ret < 0) {
3049 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3050 __location__, strerror(errno)));
3051 exit_server_cleanly("get_remote_hostname failed.\n");
3052 }
3053 if (strequal(rhost, "UNKNOWN")) {
3054 rhost = talloc_strdup(talloc_tos(), remaddr);
3055 }
3056 sconn->remote_hostname = talloc_move(sconn, &rhost);
3057
3058 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3059 sconn->remote_hostname,
3060 remaddr)) {
3061 /*
3062 * send a negative session response "not listening on calling
3063 * name"
3064 */
3065 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3066 DEBUG( 1, ("Connection denied from %s to %s\n",
3067 tsocket_address_string(remote_address, talloc_tos()),
3068 tsocket_address_string(local_address, talloc_tos())));
3069 (void)srv_send_smb(sconn,(char *)buf, false,
3070 0, false, NULL);
3071 exit_server_cleanly("connection denied");
3072 }
3073
3074 DEBUG(10, ("Connection allowed from %s to %s\n",
3075 tsocket_address_string(remote_address, talloc_tos()),
3076 tsocket_address_string(local_address, talloc_tos())));
3077
3078 init_modules();
3079
3080 smb_perfcount_init();
3081
3082 if (!init_account_policy()) {
3083 exit_server("Could not open account policy tdb.\n");
3084 }
3085
3086 if (*lp_rootdir()) {
3087 if (chroot(lp_rootdir()) != 0) {
3088 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3089 exit_server("Failed to chroot()");
3090 }
3091 if (chdir("/") == -1) {
3092 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3093 exit_server("Failed to chroot()");
3094 }
3095 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3096 }
3097
3098 if (!srv_init_signing(sconn)) {
3099 exit_server("Failed to init smb_signing");
3100 }
3101
3102 /* Setup oplocks */
3103 if (!init_oplocks(sconn->msg_ctx))
3104 exit_server("Failed to init oplocks");
3105
3106 /* register our message handlers */
3107 messaging_register(sconn->msg_ctx, NULL,
3108 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3109 messaging_register(sconn->msg_ctx, NULL,
3110 MSG_SMB_CLOSE_FILE, msg_close_file);
3111
3112 /*
3113 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3114 * MSGs to all child processes
3115 */
3116 messaging_deregister(sconn->msg_ctx,
3117 MSG_DEBUG, NULL);
3118 messaging_register(sconn->msg_ctx, NULL,
3119 MSG_DEBUG, debug_message);
3120
3121 if ((lp_keepalive() != 0)
3122 && !(event_add_idle(ev_ctx, NULL,
3123 timeval_set(lp_keepalive(), 0),
3124 "keepalive", keepalive_fn,
3125 sconn))) {
3126 DEBUG(0, ("Could not add keepalive event\n"));
3127 exit(1);
3128 }
3129
3130 if (!(event_add_idle(ev_ctx, NULL,
3131 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3132 "deadtime", deadtime_fn, sconn))) {
3133 DEBUG(0, ("Could not add deadtime event\n"));
3134 exit(1);
3135 }
3136
3137 if (!(event_add_idle(ev_ctx, NULL,
3138 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3139 "housekeeping", housekeeping_fn, sconn))) {
3140 DEBUG(0, ("Could not add housekeeping event\n"));
3141 exit(1);
3142 }
3143
3144 #ifdef CLUSTER_SUPPORT
3145
3146 if (lp_clustering()) {
3147 /*
3148 * We need to tell ctdb about our client's TCP
3149 * connection, so that for failover ctdbd can send
3150 * tickle acks, triggering a reconnection by the
3151 * client.
3152 */
3153
3154 struct sockaddr_storage srv, clnt;
3155
3156 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3157 NTSTATUS status;
3158 status = smbd_register_ips(sconn, &srv, &clnt);
3159 if (!NT_STATUS_IS_OK(status)) {
3160 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3161 nt_errstr(status)));
3162 }
3163 } else
3164 {
3165 DEBUG(0,("Unable to get tcp info for "
3166 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3167 strerror(errno)));
3168 }
3169 }
3170
3171 #endif
3172
3173 sconn->nbt.got_session = false;
3174
3175 sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3176
3177 sconn->smb1.sessions.done_sesssetup = false;
3178 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3179 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3180 /* users from session setup */
3181 sconn->smb1.sessions.session_userlist = NULL;
3182 /* workgroup from session setup. */
3183 sconn->smb1.sessions.session_workgroup = NULL;
3184 /* this holds info on user ids that are already validated for this VC */
3185 sconn->smb1.sessions.validated_users = NULL;
3186 sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3187 sconn->smb1.sessions.num_validated_vuids = 0;
3188
3189 conn_init(sconn);
3190 if (!init_dptrs(sconn)) {
3191 exit_server("init_dptrs() failed");
3192 }
3193
3194 sconn->smb1.fde = event_add_fd(ev_ctx,
3195 sconn,
3196 sconn->sock,
3197 EVENT_FD_READ,
3198 smbd_server_connection_handler,
3199 sconn);
3200 if (!sconn->smb1.fde) {
3201 exit_server("failed to create smbd_server_connection fde");
3202 }
3203
3204 TALLOC_FREE(frame);
3205
3206 while (True) {
3207 NTSTATUS status;
3208
3209 frame = talloc_stackframe_pool(8192);
3210
3211 errno = 0;
3212
3213 status = smbd_server_connection_loop_once(ev_ctx, sconn);
3214 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3215 !NT_STATUS_IS_OK(status)) {
3216 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3217 " exiting\n", nt_errstr(status)));
3218 break;
3219 }
3220
3221 TALLOC_FREE(frame);
3222 }
3223
3224 exit_server_cleanly(NULL);
3225 }
3226
3227 bool req_is_in_chain(struct smb_request *req)
3228 {
3229 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3230 /*
3231 * We're right now handling a subsequent request, so we must
3232 * be in a chain
3233 */
3234 return true;
3235 }
3236
3237 if (!is_andx_req(req->cmd)) {
3238 return false;
3239 }
3240
3241 if (req->wct < 2) {
3242 /*
3243 * Okay, an illegal request, but definitely not chained :-)
3244 */
3245 return false;
3246 }
3247
3248 return (CVAL(req->vwv+0, 0) != 0xFF);
3249 }
reg import