?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: make use of smbXsrv_session for smb1
[Samba/gebeck_regimport.git] / source3 / smbd / process.c
blob1cff64a3001009b0f9f1ea2229381452e7bbc922
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39 #include "../libcli/security/dom_sid.h"
40 #include "../libcli/security/security_token.h"
41 #include "lib/id_cache.h"
42 #include "serverid.h"
43
44 extern bool global_machine_password_needs_changing;
45
46 /* Internal message queue for deferred opens. */
47 struct pending_message_list {
48 struct pending_message_list *next, *prev;
49 struct timeval request_time; /* When was this first issued? */
50 struct smbd_server_connection *sconn;
51 struct timed_event *te;
52 struct smb_perfcount_data pcd;
53 uint32_t seqnum;
54 bool encrypted;
55 bool processed;
56 DATA_BLOB buf;
57 DATA_BLOB private_data;
58 };
59
60 static void construct_reply_common(struct smb_request *req, const char *inbuf,
61 char *outbuf);
62 static struct pending_message_list *get_deferred_open_message_smb(
63 struct smbd_server_connection *sconn, uint64_t mid);
64 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
65
66 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
67 {
68 bool ok;
69
70 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
71 return true;
72 }
73
74 sconn->smb1.echo_handler.ref_count++;
75
76 if (sconn->smb1.echo_handler.ref_count > 1) {
77 return true;
78 }
79
80 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
81
82 do {
83 ok = fcntl_lock(
84 sconn->smb1.echo_handler.socket_lock_fd,
85 F_SETLKW, 0, 0, F_WRLCK);
86 } while (!ok && (errno == EINTR));
87
88 if (!ok) {
89 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
90 return false;
91 }
92
93 DEBUG(10,("pid[%d] got for socket lock\n", (int)getpid()));
94
95 return true;
96 }
97
98 void smbd_lock_socket(struct smbd_server_connection *sconn)
99 {
100 if (!smbd_lock_socket_internal(sconn)) {
101 exit_server_cleanly("failed to lock socket");
102 }
103 }
104
105 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
106 {
107 bool ok;
108
109 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
110 return true;
111 }
112
113 sconn->smb1.echo_handler.ref_count--;
114
115 if (sconn->smb1.echo_handler.ref_count > 0) {
116 return true;
117 }
118
119 do {
120 ok = fcntl_lock(
121 sconn->smb1.echo_handler.socket_lock_fd,
122 F_SETLKW, 0, 0, F_UNLCK);
123 } while (!ok && (errno == EINTR));
124
125 if (!ok) {
126 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
127 return false;
128 }
129
130 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
131
132 return true;
133 }
134
135 void smbd_unlock_socket(struct smbd_server_connection *sconn)
136 {
137 if (!smbd_unlock_socket_internal(sconn)) {
138 exit_server_cleanly("failed to unlock socket");
139 }
140 }
141
142 /* Accessor function for smb_read_error for smbd functions. */
143
144 /****************************************************************************
145 Send an smb to a fd.
146 ****************************************************************************/
147
148 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
149 bool do_signing, uint32_t seqnum,
150 bool do_encrypt,
151 struct smb_perfcount_data *pcd)
152 {
153 size_t len = 0;
154 size_t nwritten=0;
155 ssize_t ret;
156 char *buf_out = buffer;
157
158 smbd_lock_socket(sconn);
159
160 if (do_signing) {
161 /* Sign the outgoing packet if required. */
162 srv_calculate_sign_mac(sconn, buf_out, seqnum);
163 }
164
165 if (do_encrypt) {
166 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
167 if (!NT_STATUS_IS_OK(status)) {
168 DEBUG(0, ("send_smb: SMB encryption failed "
169 "on outgoing packet! Error %s\n",
170 nt_errstr(status) ));
171 goto out;
172 }
173 }
174
175 len = smb_len(buf_out) + 4;
176
177 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
178 if (ret <= 0) {
179
180 char addr[INET6_ADDRSTRLEN];
181 /*
182 * Try and give an error message saying what
183 * client failed.
184 */
185 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
186 (int)getpid(), (int)len,
187 get_peer_addr(sconn->sock, addr, sizeof(addr)),
188 (int)ret, strerror(errno) ));
189
190 srv_free_enc_buffer(sconn, buf_out);
191 goto out;
192 }
193
194 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
195 srv_free_enc_buffer(sconn, buf_out);
196 out:
197 SMB_PERFCOUNT_END(pcd);
198
199 smbd_unlock_socket(sconn);
200 return true;
201 }
202
203 /*******************************************************************
204 Setup the word count and byte count for a smb message.
205 ********************************************************************/
206
207 int srv_set_message(char *buf,
208 int num_words,
209 int num_bytes,
210 bool zero)
211 {
212 if (zero && (num_words || num_bytes)) {
213 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
214 }
215 SCVAL(buf,smb_wct,num_words);
216 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
217 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
218 return (smb_size + num_words*2 + num_bytes);
219 }
220
221 static bool valid_smb_header(struct smbd_server_connection *sconn,
222 const uint8_t *inbuf)
223 {
224 if (is_encrypted_packet(sconn, inbuf)) {
225 return true;
226 }
227 /*
228 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
229 * but it just looks weird to call strncmp for this one.
230 */
231 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
232 }
233
234 /* Socket functions for smbd packet processing. */
235
236 static bool valid_packet_size(size_t len)
237 {
238 /*
239 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
240 * of header. Don't print the error if this fits.... JRA.
241 */
242
243 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
244 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
245 (unsigned long)len));
246 return false;
247 }
248 return true;
249 }
250
251 static NTSTATUS read_packet_remainder(int fd, char *buffer,
252 unsigned int timeout, ssize_t len)
253 {
254 NTSTATUS status;
255
256 if (len <= 0) {
257 return NT_STATUS_OK;
258 }
259
260 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
261 if (!NT_STATUS_IS_OK(status)) {
262 char addr[INET6_ADDRSTRLEN];
263 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
264 "error = %s.\n",
265 get_peer_addr(fd, addr, sizeof(addr)),
266 nt_errstr(status)));
267 }
268 return status;
269 }
270
271 /****************************************************************************
272 Attempt a zerocopy writeX read. We know here that len > smb_size-4
273 ****************************************************************************/
274
275 /*
276 * Unfortunately, earlier versions of smbclient/libsmbclient
277 * don't send this "standard" writeX header. I've fixed this
278 * for 3.2 but we'll use the old method with earlier versions.
279 * Windows and CIFSFS at least use this standard size. Not
280 * sure about MacOSX.
281 */
282
283 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
284 (2*14) + /* word count (including bcc) */ \
285 1 /* pad byte */)
286
287 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
288 const char lenbuf[4],
289 struct smbd_server_connection *sconn,
290 int sock,
291 char **buffer,
292 unsigned int timeout,
293 size_t *p_unread,
294 size_t *len_ret)
295 {
296 /* Size of a WRITEX call (+4 byte len). */
297 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
298 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
299 ssize_t toread;
300 NTSTATUS status;
301
302 memcpy(writeX_header, lenbuf, 4);
303
304 status = read_fd_with_timeout(
305 sock, writeX_header + 4,
306 STANDARD_WRITE_AND_X_HEADER_SIZE,
307 STANDARD_WRITE_AND_X_HEADER_SIZE,
308 timeout, NULL);
309
310 if (!NT_STATUS_IS_OK(status)) {
311 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
312 "error = %s.\n",
313 tsocket_address_string(sconn->remote_address,
314 talloc_tos()),
315 nt_errstr(status)));
316 return status;
317 }
318
319 /*
320 * Ok - now try and see if this is a possible
321 * valid writeX call.
322 */
323
324 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
325 /*
326 * If the data offset is beyond what
327 * we've read, drain the extra bytes.
328 */
329 uint16_t doff = SVAL(writeX_header,smb_vwv11);
330 ssize_t newlen;
331
332 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
333 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
334 if (drain_socket(sock, drain) != drain) {
335 smb_panic("receive_smb_raw_talloc_partial_read:"
336 " failed to drain pending bytes");
337 }
338 } else {
339 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
340 }
341
342 /* Spoof down the length and null out the bcc. */
343 set_message_bcc(writeX_header, 0);
344 newlen = smb_len(writeX_header);
345
346 /* Copy the header we've written. */
347
348 *buffer = (char *)talloc_memdup(mem_ctx,
349 writeX_header,
350 sizeof(writeX_header));
351
352 if (*buffer == NULL) {
353 DEBUG(0, ("Could not allocate inbuf of length %d\n",
354 (int)sizeof(writeX_header)));
355 return NT_STATUS_NO_MEMORY;
356 }
357
358 /* Work out the remaining bytes. */
359 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
360 *len_ret = newlen + 4;
361 return NT_STATUS_OK;
362 }
363
364 if (!valid_packet_size(len)) {
365 return NT_STATUS_INVALID_PARAMETER;
366 }
367
368 /*
369 * Not a valid writeX call. Just do the standard
370 * talloc and return.
371 */
372
373 *buffer = talloc_array(mem_ctx, char, len+4);
374
375 if (*buffer == NULL) {
376 DEBUG(0, ("Could not allocate inbuf of length %d\n",
377 (int)len+4));
378 return NT_STATUS_NO_MEMORY;
379 }
380
381 /* Copy in what we already read. */
382 memcpy(*buffer,
383 writeX_header,
384 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
385 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
386
387 if(toread > 0) {
388 status = read_packet_remainder(
389 sock,
390 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
391 timeout, toread);
392
393 if (!NT_STATUS_IS_OK(status)) {
394 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
395 nt_errstr(status)));
396 return status;
397 }
398 }
399
400 *len_ret = len + 4;
401 return NT_STATUS_OK;
402 }
403
404 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
405 struct smbd_server_connection *sconn,
406 int sock,
407 char **buffer, unsigned int timeout,
408 size_t *p_unread, size_t *plen)
409 {
410 char lenbuf[4];
411 size_t len;
412 int min_recv_size = lp_min_receive_file_size();
413 NTSTATUS status;
414
415 *p_unread = 0;
416
417 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
418 &len);
419 if (!NT_STATUS_IS_OK(status)) {
420 return status;
421 }
422
423 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
424 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
425 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
426 !srv_is_signing_active(sconn) &&
427 sconn->smb1.echo_handler.trusted_fde == NULL) {
428
429 return receive_smb_raw_talloc_partial_read(
430 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
431 p_unread, plen);
432 }
433
434 if (!valid_packet_size(len)) {
435 return NT_STATUS_INVALID_PARAMETER;
436 }
437
438 /*
439 * The +4 here can't wrap, we've checked the length above already.
440 */
441
442 *buffer = talloc_array(mem_ctx, char, len+4);
443
444 if (*buffer == NULL) {
445 DEBUG(0, ("Could not allocate inbuf of length %d\n",
446 (int)len+4));
447 return NT_STATUS_NO_MEMORY;
448 }
449
450 memcpy(*buffer, lenbuf, sizeof(lenbuf));
451
452 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
453 if (!NT_STATUS_IS_OK(status)) {
454 return status;
455 }
456
457 *plen = len + 4;
458 return NT_STATUS_OK;
459 }
460
461 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
462 struct smbd_server_connection *sconn,
463 int sock,
464 char **buffer, unsigned int timeout,
465 size_t *p_unread, bool *p_encrypted,
466 size_t *p_len,
467 uint32_t *seqnum,
468 bool trusted_channel)
469 {
470 size_t len = 0;
471 NTSTATUS status;
472
473 *p_encrypted = false;
474
475 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
476 p_unread, &len);
477 if (!NT_STATUS_IS_OK(status)) {
478 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
479 ("receive_smb_raw_talloc failed for client %s "
480 "read error = %s.\n",
481 tsocket_address_string(sconn->remote_address,
482 talloc_tos()),
483 nt_errstr(status)) );
484 return status;
485 }
486
487 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
488 status = srv_decrypt_buffer(sconn, *buffer);
489 if (!NT_STATUS_IS_OK(status)) {
490 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
491 "incoming packet! Error %s\n",
492 nt_errstr(status) ));
493 return status;
494 }
495 *p_encrypted = true;
496 }
497
498 /* Check the incoming SMB signature. */
499 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
500 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
501 "incoming packet!\n"));
502 return NT_STATUS_INVALID_NETWORK_RESPONSE;
503 }
504
505 *p_len = len;
506 return NT_STATUS_OK;
507 }
508
509 /*
510 * Initialize a struct smb_request from an inbuf
511 */
512
513 static bool init_smb_request(struct smb_request *req,
514 struct smbd_server_connection *sconn,
515 const uint8 *inbuf,
516 size_t unread_bytes, bool encrypted,
517 uint32_t seqnum)
518 {
519 struct smbXsrv_tcon *tcon;
520 NTSTATUS status;
521 NTTIME now;
522 size_t req_size = smb_len(inbuf) + 4;
523
524 /* Ensure we have at least smb_size bytes. */
525 if (req_size < smb_size) {
526 DEBUG(0,("init_smb_request: invalid request size %u\n",
527 (unsigned int)req_size ));
528 return false;
529 }
530
531 req->request_time = timeval_current();
532 now = timeval_to_nttime(&req->request_time);
533
534 req->cmd = CVAL(inbuf, smb_com);
535 req->flags2 = SVAL(inbuf, smb_flg2);
536 req->smbpid = SVAL(inbuf, smb_pid);
537 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
538 req->seqnum = seqnum;
539 req->vuid = SVAL(inbuf, smb_uid);
540 req->tid = SVAL(inbuf, smb_tid);
541 req->wct = CVAL(inbuf, smb_wct);
542 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
543 req->buflen = smb_buflen(inbuf);
544 req->buf = (const uint8_t *)smb_buf_const(inbuf);
545 req->unread_bytes = unread_bytes;
546 req->encrypted = encrypted;
547 req->sconn = sconn;
548 status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
549 if (NT_STATUS_IS_OK(status)) {
550 req->conn = tcon->compat;
551 } else {
552 req->conn = NULL;
553 }
554 req->chain_fsp = NULL;
555 req->smb2req = NULL;
556 req->priv_paths = NULL;
557 req->chain = NULL;
558 smb_init_perfcount_data(&req->pcd);
559
560 /* Ensure we have at least wct words and 2 bytes of bcc. */
561 if (smb_size + req->wct*2 > req_size) {
562 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
563 (unsigned int)req->wct,
564 (unsigned int)req_size));
565 return false;
566 }
567 /* Ensure bcc is correct. */
568 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
569 DEBUG(0,("init_smb_request: invalid bcc number %u "
570 "(wct = %u, size %u)\n",
571 (unsigned int)req->buflen,
572 (unsigned int)req->wct,
573 (unsigned int)req_size));
574 return false;
575 }
576
577 req->outbuf = NULL;
578 return true;
579 }
580
581 static void process_smb(struct smbd_server_connection *conn,
582 uint8_t *inbuf, size_t nread, size_t unread_bytes,
583 uint32_t seqnum, bool encrypted,
584 struct smb_perfcount_data *deferred_pcd);
585
586 static void smbd_deferred_open_timer(struct event_context *ev,
587 struct timed_event *te,
588 struct timeval _tval,
589 void *private_data)
590 {
591 struct pending_message_list *msg = talloc_get_type(private_data,
592 struct pending_message_list);
593 struct smbd_server_connection *sconn = msg->sconn;
594 TALLOC_CTX *mem_ctx = talloc_tos();
595 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
596 uint8_t *inbuf;
597
598 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
599 msg->buf.length);
600 if (inbuf == NULL) {
601 exit_server("smbd_deferred_open_timer: talloc failed\n");
602 return;
603 }
604
605 /* We leave this message on the queue so the open code can
606 know this is a retry. */
607 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
608 (unsigned long long)mid ));
609
610 /* Mark the message as processed so this is not
611 * re-processed in error. */
612 msg->processed = true;
613
614 process_smb(sconn, inbuf,
615 msg->buf.length, 0,
616 msg->seqnum, msg->encrypted, &msg->pcd);
617
618 /* If it's still there and was processed, remove it. */
619 msg = get_deferred_open_message_smb(sconn, mid);
620 if (msg && msg->processed) {
621 remove_deferred_open_message_smb(sconn, mid);
622 }
623 }
624
625 /****************************************************************************
626 Function to push a message onto the tail of a linked list of smb messages ready
627 for processing.
628 ****************************************************************************/
629
630 static bool push_queued_message(struct smb_request *req,
631 struct timeval request_time,
632 struct timeval end_time,
633 char *private_data, size_t private_len)
634 {
635 int msg_len = smb_len(req->inbuf) + 4;
636 struct pending_message_list *msg;
637
638 msg = talloc_zero(NULL, struct pending_message_list);
639
640 if(msg == NULL) {
641 DEBUG(0,("push_message: malloc fail (1)\n"));
642 return False;
643 }
644 msg->sconn = req->sconn;
645
646 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
647 if(msg->buf.data == NULL) {
648 DEBUG(0,("push_message: malloc fail (2)\n"));
649 TALLOC_FREE(msg);
650 return False;
651 }
652
653 msg->request_time = request_time;
654 msg->seqnum = req->seqnum;
655 msg->encrypted = req->encrypted;
656 msg->processed = false;
657 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
658
659 if (private_data) {
660 msg->private_data = data_blob_talloc(msg, private_data,
661 private_len);
662 if (msg->private_data.data == NULL) {
663 DEBUG(0,("push_message: malloc fail (3)\n"));
664 TALLOC_FREE(msg);
665 return False;
666 }
667 }
668
669 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
670 msg,
671 end_time,
672 smbd_deferred_open_timer,
673 msg);
674 if (!msg->te) {
675 DEBUG(0,("push_message: event_add_timed failed\n"));
676 TALLOC_FREE(msg);
677 return false;
678 }
679
680 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
681 struct pending_message_list *);
682
683 DEBUG(10,("push_message: pushed message length %u on "
684 "deferred_open_queue\n", (unsigned int)msg_len));
685
686 return True;
687 }
688
689 /****************************************************************************
690 Function to delete a sharing violation open message by mid.
691 ****************************************************************************/
692
693 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
694 uint64_t mid)
695 {
696 struct pending_message_list *pml;
697
698 if (sconn->using_smb2) {
699 remove_deferred_open_message_smb2(sconn, mid);
700 return;
701 }
702
703 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
704 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
705 DEBUG(10,("remove_deferred_open_message_smb: "
706 "deleting mid %llu len %u\n",
707 (unsigned long long)mid,
708 (unsigned int)pml->buf.length ));
709 DLIST_REMOVE(sconn->deferred_open_queue, pml);
710 TALLOC_FREE(pml);
711 return;
712 }
713 }
714 }
715
716 /****************************************************************************
717 Move a sharing violation open retry message to the front of the list and
718 schedule it for immediate processing.
719 ****************************************************************************/
720
721 void schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
722 uint64_t mid)
723 {
724 struct pending_message_list *pml;
725 int i = 0;
726
727 if (sconn->using_smb2) {
728 schedule_deferred_open_message_smb2(sconn, mid);
729 return;
730 }
731
732 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
733 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
734
735 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
736 "msg_mid = %llu\n",
737 i++,
738 (unsigned long long)msg_mid ));
739
740 if (mid == msg_mid) {
741 struct timed_event *te;
742
743 if (pml->processed) {
744 /* A processed message should not be
745 * rescheduled. */
746 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
747 "message mid %llu was already processed\n",
748 (unsigned long long)msg_mid ));
749 continue;
750 }
751
752 DEBUG(10,("schedule_deferred_open_message_smb: "
753 "scheduling mid %llu\n",
754 (unsigned long long)mid ));
755
756 te = tevent_add_timer(pml->sconn->ev_ctx,
757 pml,
758 timeval_zero(),
759 smbd_deferred_open_timer,
760 pml);
761 if (!te) {
762 DEBUG(10,("schedule_deferred_open_message_smb: "
763 "event_add_timed() failed, "
764 "skipping mid %llu\n",
765 (unsigned long long)msg_mid ));
766 }
767
768 TALLOC_FREE(pml->te);
769 pml->te = te;
770 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
771 return;
772 }
773 }
774
775 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
776 "find message mid %llu\n",
777 (unsigned long long)mid ));
778 }
779
780 /****************************************************************************
781 Return true if this mid is on the deferred queue and was not yet processed.
782 ****************************************************************************/
783
784 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
785 {
786 struct pending_message_list *pml;
787
788 if (sconn->using_smb2) {
789 return open_was_deferred_smb2(sconn, mid);
790 }
791
792 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
793 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
794 return True;
795 }
796 }
797 return False;
798 }
799
800 /****************************************************************************
801 Return the message queued by this mid.
802 ****************************************************************************/
803
804 static struct pending_message_list *get_deferred_open_message_smb(
805 struct smbd_server_connection *sconn, uint64_t mid)
806 {
807 struct pending_message_list *pml;
808
809 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
810 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
811 return pml;
812 }
813 }
814 return NULL;
815 }
816
817 /****************************************************************************
818 Get the state data queued by this mid.
819 ****************************************************************************/
820
821 bool get_deferred_open_message_state(struct smb_request *smbreq,
822 struct timeval *p_request_time,
823 void **pp_state)
824 {
825 struct pending_message_list *pml;
826
827 if (smbreq->sconn->using_smb2) {
828 return get_deferred_open_message_state_smb2(smbreq->smb2req,
829 p_request_time,
830 pp_state);
831 }
832
833 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
834 if (!pml) {
835 return false;
836 }
837 if (p_request_time) {
838 *p_request_time = pml->request_time;
839 }
840 if (pp_state) {
841 *pp_state = (void *)pml->private_data.data;
842 }
843 return true;
844 }
845
846 /****************************************************************************
847 Function to push a deferred open smb message onto a linked list of local smb
848 messages ready for processing.
849 ****************************************************************************/
850
851 bool push_deferred_open_message_smb(struct smb_request *req,
852 struct timeval request_time,
853 struct timeval timeout,
854 struct file_id id,
855 char *private_data, size_t priv_len)
856 {
857 struct timeval end_time;
858
859 if (req->smb2req) {
860 return push_deferred_open_message_smb2(req->smb2req,
861 request_time,
862 timeout,
863 id,
864 private_data,
865 priv_len);
866 }
867
868 if (req->unread_bytes) {
869 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
870 "unread_bytes = %u\n",
871 (unsigned int)req->unread_bytes ));
872 smb_panic("push_deferred_open_message_smb: "
873 "logic error unread_bytes != 0" );
874 }
875
876 end_time = timeval_sum(&request_time, &timeout);
877
878 DEBUG(10,("push_deferred_open_message_smb: pushing message "
879 "len %u mid %llu timeout time [%u.%06u]\n",
880 (unsigned int) smb_len(req->inbuf)+4,
881 (unsigned long long)req->mid,
882 (unsigned int)end_time.tv_sec,
883 (unsigned int)end_time.tv_usec));
884
885 return push_queued_message(req, request_time, end_time,
886 private_data, priv_len);
887 }
888
889 static void smbd_sig_term_handler(struct tevent_context *ev,
890 struct tevent_signal *se,
891 int signum,
892 int count,
893 void *siginfo,
894 void *private_data)
895 {
896 exit_server_cleanly("termination signal");
897 }
898
899 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
900 {
901 struct tevent_signal *se;
902
903 se = tevent_add_signal(sconn->ev_ctx,
904 sconn,
905 SIGTERM, 0,
906 smbd_sig_term_handler,
907 sconn);
908 if (!se) {
909 exit_server("failed to setup SIGTERM handler");
910 }
911 }
912
913 static void smbd_sig_hup_handler(struct tevent_context *ev,
914 struct tevent_signal *se,
915 int signum,
916 int count,
917 void *siginfo,
918 void *private_data)
919 {
920 struct smbd_server_connection *sconn =
921 talloc_get_type_abort(private_data,
922 struct smbd_server_connection);
923
924 change_to_root_user();
925 DEBUG(1,("Reloading services after SIGHUP\n"));
926 reload_services(sconn, conn_snum_used, false);
927 }
928
929 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
930 {
931 struct tevent_signal *se;
932
933 se = tevent_add_signal(sconn->ev_ctx,
934 sconn,
935 SIGHUP, 0,
936 smbd_sig_hup_handler,
937 sconn);
938 if (!se) {
939 exit_server("failed to setup SIGHUP handler");
940 }
941 }
942
943 static void smbd_conf_updated(struct messaging_context *msg,
944 void *private_data,
945 uint32_t msg_type,
946 struct server_id server_id,
947 DATA_BLOB *data)
948 {
949 struct smbd_server_connection *sconn =
950 talloc_get_type_abort(private_data,
951 struct smbd_server_connection);
952
953 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
954 "updated. Reloading.\n"));
955 change_to_root_user();
956 reload_services(sconn, conn_snum_used, false);
957 }
958
959 /*
960 * Only allow 5 outstanding trans requests. We're allocating memory, so
961 * prevent a DoS.
962 */
963
964 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
965 {
966 int count = 0;
967 for (; list != NULL; list = list->next) {
968
969 if (list->mid == mid) {
970 return NT_STATUS_INVALID_PARAMETER;
971 }
972
973 count += 1;
974 }
975 if (count > 5) {
976 return NT_STATUS_INSUFFICIENT_RESOURCES;
977 }
978
979 return NT_STATUS_OK;
980 }
981
982 /*
983 These flags determine some of the permissions required to do an operation
984
985 Note that I don't set NEED_WRITE on some write operations because they
986 are used by some brain-dead clients when printing, and I don't want to
987 force write permissions on print services.
988 */
989 #define AS_USER (1<<0)
990 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
991 #define TIME_INIT (1<<2)
992 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
993 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
994 #define DO_CHDIR (1<<6)
995
996 /*
997 define a list of possible SMB messages and their corresponding
998 functions. Any message that has a NULL function is unimplemented -
999 please feel free to contribute implementations!
1000 */
1001 static const struct smb_message_struct {
1002 const char *name;
1003 void (*fn)(struct smb_request *req);
1004 int flags;
1005 } smb_messages[256] = {
1006
1007 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1008 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1009 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1010 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1011 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1012 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1013 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1014 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1015 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1016 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1017 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1018 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1019 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1020 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1021 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1022 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1023 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1024 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1025 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1026 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1027 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1028 /* 0x15 */ { NULL, NULL, 0 },
1029 /* 0x16 */ { NULL, NULL, 0 },
1030 /* 0x17 */ { NULL, NULL, 0 },
1031 /* 0x18 */ { NULL, NULL, 0 },
1032 /* 0x19 */ { NULL, NULL, 0 },
1033 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1034 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1035 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1036 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1037 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1038 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1039 /* 0x20 */ { "SMBwritec", NULL,0},
1040 /* 0x21 */ { NULL, NULL, 0 },
1041 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1042 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1043 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1044 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1045 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1046 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1047 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1048 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1049 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1050 /* 0x2b */ { "SMBecho",reply_echo,0},
1051 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1052 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1053 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1054 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1055 /* 0x30 */ { NULL, NULL, 0 },
1056 /* 0x31 */ { NULL, NULL, 0 },
1057 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1058 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1059 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1060 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1061 /* 0x36 */ { NULL, NULL, 0 },
1062 /* 0x37 */ { NULL, NULL, 0 },
1063 /* 0x38 */ { NULL, NULL, 0 },
1064 /* 0x39 */ { NULL, NULL, 0 },
1065 /* 0x3a */ { NULL, NULL, 0 },
1066 /* 0x3b */ { NULL, NULL, 0 },
1067 /* 0x3c */ { NULL, NULL, 0 },
1068 /* 0x3d */ { NULL, NULL, 0 },
1069 /* 0x3e */ { NULL, NULL, 0 },
1070 /* 0x3f */ { NULL, NULL, 0 },
1071 /* 0x40 */ { NULL, NULL, 0 },
1072 /* 0x41 */ { NULL, NULL, 0 },
1073 /* 0x42 */ { NULL, NULL, 0 },
1074 /* 0x43 */ { NULL, NULL, 0 },
1075 /* 0x44 */ { NULL, NULL, 0 },
1076 /* 0x45 */ { NULL, NULL, 0 },
1077 /* 0x46 */ { NULL, NULL, 0 },
1078 /* 0x47 */ { NULL, NULL, 0 },
1079 /* 0x48 */ { NULL, NULL, 0 },
1080 /* 0x49 */ { NULL, NULL, 0 },
1081 /* 0x4a */ { NULL, NULL, 0 },
1082 /* 0x4b */ { NULL, NULL, 0 },
1083 /* 0x4c */ { NULL, NULL, 0 },
1084 /* 0x4d */ { NULL, NULL, 0 },
1085 /* 0x4e */ { NULL, NULL, 0 },
1086 /* 0x4f */ { NULL, NULL, 0 },
1087 /* 0x50 */ { NULL, NULL, 0 },
1088 /* 0x51 */ { NULL, NULL, 0 },
1089 /* 0x52 */ { NULL, NULL, 0 },
1090 /* 0x53 */ { NULL, NULL, 0 },
1091 /* 0x54 */ { NULL, NULL, 0 },
1092 /* 0x55 */ { NULL, NULL, 0 },
1093 /* 0x56 */ { NULL, NULL, 0 },
1094 /* 0x57 */ { NULL, NULL, 0 },
1095 /* 0x58 */ { NULL, NULL, 0 },
1096 /* 0x59 */ { NULL, NULL, 0 },
1097 /* 0x5a */ { NULL, NULL, 0 },
1098 /* 0x5b */ { NULL, NULL, 0 },
1099 /* 0x5c */ { NULL, NULL, 0 },
1100 /* 0x5d */ { NULL, NULL, 0 },
1101 /* 0x5e */ { NULL, NULL, 0 },
1102 /* 0x5f */ { NULL, NULL, 0 },
1103 /* 0x60 */ { NULL, NULL, 0 },
1104 /* 0x61 */ { NULL, NULL, 0 },
1105 /* 0x62 */ { NULL, NULL, 0 },
1106 /* 0x63 */ { NULL, NULL, 0 },
1107 /* 0x64 */ { NULL, NULL, 0 },
1108 /* 0x65 */ { NULL, NULL, 0 },
1109 /* 0x66 */ { NULL, NULL, 0 },
1110 /* 0x67 */ { NULL, NULL, 0 },
1111 /* 0x68 */ { NULL, NULL, 0 },
1112 /* 0x69 */ { NULL, NULL, 0 },
1113 /* 0x6a */ { NULL, NULL, 0 },
1114 /* 0x6b */ { NULL, NULL, 0 },
1115 /* 0x6c */ { NULL, NULL, 0 },
1116 /* 0x6d */ { NULL, NULL, 0 },
1117 /* 0x6e */ { NULL, NULL, 0 },
1118 /* 0x6f */ { NULL, NULL, 0 },
1119 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1120 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1121 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1122 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1123 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1124 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1125 /* 0x76 */ { NULL, NULL, 0 },
1126 /* 0x77 */ { NULL, NULL, 0 },
1127 /* 0x78 */ { NULL, NULL, 0 },
1128 /* 0x79 */ { NULL, NULL, 0 },
1129 /* 0x7a */ { NULL, NULL, 0 },
1130 /* 0x7b */ { NULL, NULL, 0 },
1131 /* 0x7c */ { NULL, NULL, 0 },
1132 /* 0x7d */ { NULL, NULL, 0 },
1133 /* 0x7e */ { NULL, NULL, 0 },
1134 /* 0x7f */ { NULL, NULL, 0 },
1135 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1136 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1137 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1138 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1139 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1140 /* 0x85 */ { NULL, NULL, 0 },
1141 /* 0x86 */ { NULL, NULL, 0 },
1142 /* 0x87 */ { NULL, NULL, 0 },
1143 /* 0x88 */ { NULL, NULL, 0 },
1144 /* 0x89 */ { NULL, NULL, 0 },
1145 /* 0x8a */ { NULL, NULL, 0 },
1146 /* 0x8b */ { NULL, NULL, 0 },
1147 /* 0x8c */ { NULL, NULL, 0 },
1148 /* 0x8d */ { NULL, NULL, 0 },
1149 /* 0x8e */ { NULL, NULL, 0 },
1150 /* 0x8f */ { NULL, NULL, 0 },
1151 /* 0x90 */ { NULL, NULL, 0 },
1152 /* 0x91 */ { NULL, NULL, 0 },
1153 /* 0x92 */ { NULL, NULL, 0 },
1154 /* 0x93 */ { NULL, NULL, 0 },
1155 /* 0x94 */ { NULL, NULL, 0 },
1156 /* 0x95 */ { NULL, NULL, 0 },
1157 /* 0x96 */ { NULL, NULL, 0 },
1158 /* 0x97 */ { NULL, NULL, 0 },
1159 /* 0x98 */ { NULL, NULL, 0 },
1160 /* 0x99 */ { NULL, NULL, 0 },
1161 /* 0x9a */ { NULL, NULL, 0 },
1162 /* 0x9b */ { NULL, NULL, 0 },
1163 /* 0x9c */ { NULL, NULL, 0 },
1164 /* 0x9d */ { NULL, NULL, 0 },
1165 /* 0x9e */ { NULL, NULL, 0 },
1166 /* 0x9f */ { NULL, NULL, 0 },
1167 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1168 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1169 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1170 /* 0xa3 */ { NULL, NULL, 0 },
1171 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1172 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1173 /* 0xa6 */ { NULL, NULL, 0 },
1174 /* 0xa7 */ { NULL, NULL, 0 },
1175 /* 0xa8 */ { NULL, NULL, 0 },
1176 /* 0xa9 */ { NULL, NULL, 0 },
1177 /* 0xaa */ { NULL, NULL, 0 },
1178 /* 0xab */ { NULL, NULL, 0 },
1179 /* 0xac */ { NULL, NULL, 0 },
1180 /* 0xad */ { NULL, NULL, 0 },
1181 /* 0xae */ { NULL, NULL, 0 },
1182 /* 0xaf */ { NULL, NULL, 0 },
1183 /* 0xb0 */ { NULL, NULL, 0 },
1184 /* 0xb1 */ { NULL, NULL, 0 },
1185 /* 0xb2 */ { NULL, NULL, 0 },
1186 /* 0xb3 */ { NULL, NULL, 0 },
1187 /* 0xb4 */ { NULL, NULL, 0 },
1188 /* 0xb5 */ { NULL, NULL, 0 },
1189 /* 0xb6 */ { NULL, NULL, 0 },
1190 /* 0xb7 */ { NULL, NULL, 0 },
1191 /* 0xb8 */ { NULL, NULL, 0 },
1192 /* 0xb9 */ { NULL, NULL, 0 },
1193 /* 0xba */ { NULL, NULL, 0 },
1194 /* 0xbb */ { NULL, NULL, 0 },
1195 /* 0xbc */ { NULL, NULL, 0 },
1196 /* 0xbd */ { NULL, NULL, 0 },
1197 /* 0xbe */ { NULL, NULL, 0 },
1198 /* 0xbf */ { NULL, NULL, 0 },
1199 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1200 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1201 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1202 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1203 /* 0xc4 */ { NULL, NULL, 0 },
1204 /* 0xc5 */ { NULL, NULL, 0 },
1205 /* 0xc6 */ { NULL, NULL, 0 },
1206 /* 0xc7 */ { NULL, NULL, 0 },
1207 /* 0xc8 */ { NULL, NULL, 0 },
1208 /* 0xc9 */ { NULL, NULL, 0 },
1209 /* 0xca */ { NULL, NULL, 0 },
1210 /* 0xcb */ { NULL, NULL, 0 },
1211 /* 0xcc */ { NULL, NULL, 0 },
1212 /* 0xcd */ { NULL, NULL, 0 },
1213 /* 0xce */ { NULL, NULL, 0 },
1214 /* 0xcf */ { NULL, NULL, 0 },
1215 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1216 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1217 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1218 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1219 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1220 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1221 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1222 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1223 /* 0xd8 */ { NULL, NULL, 0 },
1224 /* 0xd9 */ { NULL, NULL, 0 },
1225 /* 0xda */ { NULL, NULL, 0 },
1226 /* 0xdb */ { NULL, NULL, 0 },
1227 /* 0xdc */ { NULL, NULL, 0 },
1228 /* 0xdd */ { NULL, NULL, 0 },
1229 /* 0xde */ { NULL, NULL, 0 },
1230 /* 0xdf */ { NULL, NULL, 0 },
1231 /* 0xe0 */ { NULL, NULL, 0 },
1232 /* 0xe1 */ { NULL, NULL, 0 },
1233 /* 0xe2 */ { NULL, NULL, 0 },
1234 /* 0xe3 */ { NULL, NULL, 0 },
1235 /* 0xe4 */ { NULL, NULL, 0 },
1236 /* 0xe5 */ { NULL, NULL, 0 },
1237 /* 0xe6 */ { NULL, NULL, 0 },
1238 /* 0xe7 */ { NULL, NULL, 0 },
1239 /* 0xe8 */ { NULL, NULL, 0 },
1240 /* 0xe9 */ { NULL, NULL, 0 },
1241 /* 0xea */ { NULL, NULL, 0 },
1242 /* 0xeb */ { NULL, NULL, 0 },
1243 /* 0xec */ { NULL, NULL, 0 },
1244 /* 0xed */ { NULL, NULL, 0 },
1245 /* 0xee */ { NULL, NULL, 0 },
1246 /* 0xef */ { NULL, NULL, 0 },
1247 /* 0xf0 */ { NULL, NULL, 0 },
1248 /* 0xf1 */ { NULL, NULL, 0 },
1249 /* 0xf2 */ { NULL, NULL, 0 },
1250 /* 0xf3 */ { NULL, NULL, 0 },
1251 /* 0xf4 */ { NULL, NULL, 0 },
1252 /* 0xf5 */ { NULL, NULL, 0 },
1253 /* 0xf6 */ { NULL, NULL, 0 },
1254 /* 0xf7 */ { NULL, NULL, 0 },
1255 /* 0xf8 */ { NULL, NULL, 0 },
1256 /* 0xf9 */ { NULL, NULL, 0 },
1257 /* 0xfa */ { NULL, NULL, 0 },
1258 /* 0xfb */ { NULL, NULL, 0 },
1259 /* 0xfc */ { NULL, NULL, 0 },
1260 /* 0xfd */ { NULL, NULL, 0 },
1261 /* 0xfe */ { NULL, NULL, 0 },
1262 /* 0xff */ { NULL, NULL, 0 }
1263
1264 };
1265
1266 /*******************************************************************
1267 allocate and initialize a reply packet
1268 ********************************************************************/
1269
1270 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1271 const char *inbuf, char **outbuf, uint8_t num_words,
1272 uint32_t num_bytes)
1273 {
1274 /*
1275 * Protect against integer wrap
1276 */
1277 if ((num_bytes > 0xffffff)
1278 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1279 char *msg;
1280 if (asprintf(&msg, "num_bytes too large: %u",
1281 (unsigned)num_bytes) == -1) {
1282 msg = discard_const_p(char, "num_bytes too large");
1283 }
1284 smb_panic(msg);
1285 }
1286
1287 *outbuf = talloc_array(mem_ctx, char,
1288 smb_size + num_words*2 + num_bytes);
1289 if (*outbuf == NULL) {
1290 return false;
1291 }
1292
1293 construct_reply_common(req, inbuf, *outbuf);
1294 srv_set_message(*outbuf, num_words, num_bytes, false);
1295 /*
1296 * Zero out the word area, the caller has to take care of the bcc area
1297 * himself
1298 */
1299 if (num_words != 0) {
1300 memset(*outbuf + smb_vwv0, 0, num_words*2);
1301 }
1302
1303 return true;
1304 }
1305
1306 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1307 {
1308 char *outbuf;
1309 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1310 num_bytes)) {
1311 smb_panic("could not allocate output buffer\n");
1312 }
1313 req->outbuf = (uint8_t *)outbuf;
1314 }
1315
1316
1317 /*******************************************************************
1318 Dump a packet to a file.
1319 ********************************************************************/
1320
1321 static void smb_dump(const char *name, int type, const char *data)
1322 {
1323 size_t len;
1324 int fd, i;
1325 char *fname = NULL;
1326 if (DEBUGLEVEL < 50) {
1327 return;
1328 }
1329
1330 len = smb_len_tcp(data)+4;
1331 for (i=1;i<100;i++) {
1332 fname = talloc_asprintf(talloc_tos(),
1333 "/tmp/%s.%d.%s",
1334 name,
1335 i,
1336 type ? "req" : "resp");
1337 if (fname == NULL) {
1338 return;
1339 }
1340 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1341 if (fd != -1 || errno != EEXIST) break;
1342 TALLOC_FREE(fname);
1343 }
1344 if (fd != -1) {
1345 ssize_t ret = write(fd, data, len);
1346 if (ret != len)
1347 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1348 close(fd);
1349 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1350 }
1351 TALLOC_FREE(fname);
1352 }
1353
1354 /****************************************************************************
1355 Prepare everything for calling the actual request function, and potentially
1356 call the request function via the "new" interface.
1357
1358 Return False if the "legacy" function needs to be called, everything is
1359 prepared.
1360
1361 Return True if we're done.
1362
1363 I know this API sucks, but it is the one with the least code change I could
1364 find.
1365 ****************************************************************************/
1366
1367 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1368 {
1369 int flags;
1370 uint64_t session_tag;
1371 connection_struct *conn = NULL;
1372 struct smbd_server_connection *sconn = req->sconn;
1373
1374 errno = 0;
1375
1376 if (smb_messages[type].fn == NULL) {
1377 DEBUG(0,("Unknown message type %d!\n",type));
1378 smb_dump("Unknown", 1, (const char *)req->inbuf);
1379 reply_unknown_new(req, type);
1380 return NULL;
1381 }
1382
1383 flags = smb_messages[type].flags;
1384
1385 /* In share mode security we must ignore the vuid. */
1386 session_tag = req->vuid;
1387 conn = req->conn;
1388
1389 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1390 (int)getpid(), (unsigned long)conn));
1391
1392 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1393
1394 /* Ensure this value is replaced in the incoming packet. */
1395 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1396
1397 /*
1398 * Ensure the correct username is in current_user_info. This is a
1399 * really ugly bugfix for problems with multiple session_setup_and_X's
1400 * being done and allowing %U and %G substitutions to work correctly.
1401 * There is a reason this code is done here, don't move it unless you
1402 * know what you're doing... :-).
1403 * JRA.
1404 */
1405
1406 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1407 struct user_struct *vuser = NULL;
1408
1409 sconn->smb1.sessions.last_session_tag = session_tag;
1410 if(session_tag != UID_FIELD_INVALID) {
1411 vuser = get_valid_user_struct(sconn, session_tag);
1412 if (vuser) {
1413 set_current_user_info(
1414 vuser->session_info->unix_info->sanitized_username,
1415 vuser->session_info->unix_info->unix_name,
1416 vuser->session_info->info->domain_name);
1417 }
1418 }
1419 }
1420
1421 /* Does this call need to be run as the connected user? */
1422 if (flags & AS_USER) {
1423
1424 /* Does this call need a valid tree connection? */
1425 if (!conn) {
1426 /*
1427 * Amazingly, the error code depends on the command
1428 * (from Samba4).
1429 */
1430 if (type == SMBntcreateX) {
1431 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1432 } else {
1433 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1434 }
1435 return NULL;
1436 }
1437
1438 if (!change_to_user(conn,session_tag)) {
1439 DEBUG(0, ("Error: Could not change to user. Removing "
1440 "deferred open, mid=%llu.\n",
1441 (unsigned long long)req->mid));
1442 reply_force_doserror(req, ERRSRV, ERRbaduid);
1443 return conn;
1444 }
1445
1446 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1447
1448 /* Does it need write permission? */
1449 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1450 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1451 return conn;
1452 }
1453
1454 /* IPC services are limited */
1455 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1456 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1457 return conn;
1458 }
1459 } else {
1460 /* This call needs to be run as root */
1461 change_to_root_user();
1462 }
1463
1464 /* load service specific parameters */
1465 if (conn) {
1466 if (req->encrypted) {
1467 conn->encrypted_tid = true;
1468 /* encrypted required from now on. */
1469 conn->encrypt_level = Required;
1470 } else if (ENCRYPTION_REQUIRED(conn)) {
1471 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1472 exit_server_cleanly("encryption required "
1473 "on connection");
1474 return conn;
1475 }
1476 }
1477
1478 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1479 (flags & (AS_USER|DO_CHDIR)
1480 ?True:False))) {
1481 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1482 return conn;
1483 }
1484 conn->num_smb_operations++;
1485 }
1486
1487 /*
1488 * Does this protocol need to be run as guest? (Only archane
1489 * messenger service requests have this...)
1490 */
1491 if (flags & AS_GUEST) {
1492 char *raddr;
1493 bool ok;
1494
1495 if (!change_to_guest()) {
1496 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1497 return conn;
1498 }
1499
1500 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1501 talloc_tos());
1502 if (raddr == NULL) {
1503 reply_nterror(req, NT_STATUS_NO_MEMORY);
1504 return conn;
1505 }
1506
1507 /*
1508 * Haven't we checked this in smbd_process already???
1509 */
1510
1511 ok = allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1512 sconn->remote_hostname, raddr);
1513 TALLOC_FREE(raddr);
1514
1515 if (!ok) {
1516 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1517 return conn;
1518 }
1519 }
1520
1521 smb_messages[type].fn(req);
1522 return req->conn;
1523 }
1524
1525 /****************************************************************************
1526 Construct a reply to the incoming packet.
1527 ****************************************************************************/
1528
1529 static void construct_reply(struct smbd_server_connection *sconn,
1530 char *inbuf, int size, size_t unread_bytes,
1531 uint32_t seqnum, bool encrypted,
1532 struct smb_perfcount_data *deferred_pcd)
1533 {
1534 connection_struct *conn;
1535 struct smb_request *req;
1536
1537 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1538 smb_panic("could not allocate smb_request");
1539 }
1540
1541 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1542 encrypted, seqnum)) {
1543 exit_server_cleanly("Invalid SMB request");
1544 }
1545
1546 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1547
1548 /* we popped this message off the queue - keep original perf data */
1549 if (deferred_pcd)
1550 req->pcd = *deferred_pcd;
1551 else {
1552 SMB_PERFCOUNT_START(&req->pcd);
1553 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1554 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1555 }
1556
1557 conn = switch_message(req->cmd, req);
1558
1559 if (req->outbuf == NULL) {
1560 return;
1561 }
1562
1563 if (CVAL(req->outbuf,0) == 0) {
1564 show_msg((char *)req->outbuf);
1565 }
1566
1567 if (!srv_send_smb(req->sconn,
1568 (char *)req->outbuf,
1569 true, req->seqnum+1,
1570 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1571 &req->pcd)) {
1572 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1573 }
1574
1575 TALLOC_FREE(req);
1576
1577 return;
1578 }
1579
1580 static void construct_reply_chain(struct smbd_server_connection *sconn,
1581 char *inbuf, int size, uint32_t seqnum,
1582 bool encrypted,
1583 struct smb_perfcount_data *deferred_pcd)
1584 {
1585 struct smb_request **reqs = NULL;
1586 struct smb_request *req;
1587 unsigned num_reqs;
1588 bool ok;
1589
1590 ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1591 seqnum, &reqs, &num_reqs);
1592 if (!ok) {
1593 char errbuf[smb_size];
1594 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1595 __LINE__, __FILE__);
1596 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1597 NULL)) {
1598 exit_server_cleanly("construct_reply_chain: "
1599 "srv_send_smb failed.");
1600 }
1601 return;
1602 }
1603
1604 req = reqs[0];
1605 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1606
1607 req->conn = switch_message(req->cmd, req);
1608
1609 if (req->outbuf == NULL) {
1610 /*
1611 * Request has suspended itself, will come
1612 * back here.
1613 */
1614 return;
1615 }
1616 smb_request_done(req);
1617 }
1618
1619 /*
1620 * To be called from an async SMB handler that is potentially chained
1621 * when it is finished for shipping.
1622 */
1623
1624 void smb_request_done(struct smb_request *req)
1625 {
1626 struct smb_request **reqs = NULL;
1627 struct smb_request *first_req;
1628 size_t i, num_reqs, next_index;
1629 NTSTATUS status;
1630
1631 if (req->chain == NULL) {
1632 first_req = req;
1633 goto shipit;
1634 }
1635
1636 reqs = req->chain;
1637 num_reqs = talloc_array_length(reqs);
1638
1639 for (i=0; i<num_reqs; i++) {
1640 if (reqs[i] == req) {
1641 break;
1642 }
1643 }
1644 if (i == num_reqs) {
1645 /*
1646 * Invalid chain, should not happen
1647 */
1648 status = NT_STATUS_INTERNAL_ERROR;
1649 goto error;
1650 }
1651 next_index = i+1;
1652
1653 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1654 struct smb_request *next = reqs[next_index];
1655 struct smbXsrv_tcon *tcon;
1656 NTTIME now = timeval_to_nttime(&req->request_time);
1657
1658 next->vuid = SVAL(req->outbuf, smb_uid);
1659 next->tid = SVAL(req->outbuf, smb_tid);
1660 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1661 now, &tcon);
1662 if (NT_STATUS_IS_OK(status)) {
1663 req->conn = tcon->compat;
1664 } else {
1665 req->conn = NULL;
1666 }
1667 next->chain_fsp = req->chain_fsp;
1668 next->inbuf = (uint8_t *)req->inbuf;
1669
1670 req = next;
1671 req->conn = switch_message(req->cmd, req);
1672
1673 if (req->outbuf == NULL) {
1674 /*
1675 * Request has suspended itself, will come
1676 * back here.
1677 */
1678 return;
1679 }
1680 next_index += 1;
1681 }
1682
1683 first_req = reqs[0];
1684
1685 for (i=1; i<next_index; i++) {
1686 bool ok;
1687
1688 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1689 if (!ok) {
1690 status = NT_STATUS_INTERNAL_ERROR;
1691 goto error;
1692 }
1693 }
1694
1695 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1696 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1697
1698 /*
1699 * This scary statement intends to set the
1700 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1701 * to the value last_req->outbuf carries
1702 */
1703 SSVAL(first_req->outbuf, smb_flg2,
1704 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1705 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1706
1707 /*
1708 * Transfer the error codes from the subrequest to the main one
1709 */
1710 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1711 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1712
1713 _smb_setlen_large(
1714 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1715
1716 shipit:
1717 if (!srv_send_smb(first_req->sconn,
1718 (char *)first_req->outbuf,
1719 true, first_req->seqnum+1,
1720 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1721 &first_req->pcd)) {
1722 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1723 "failed.");
1724 }
1725 TALLOC_FREE(req); /* non-chained case */
1726 TALLOC_FREE(reqs); /* chained case */
1727 return;
1728
1729 error:
1730 {
1731 char errbuf[smb_size];
1732 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1733 if (!srv_send_smb(req->sconn, errbuf, true,
1734 req->seqnum+1, req->encrypted,
1735 NULL)) {
1736 exit_server_cleanly("construct_reply_chain: "
1737 "srv_send_smb failed.");
1738 }
1739 }
1740 TALLOC_FREE(req); /* non-chained case */
1741 TALLOC_FREE(reqs); /* chained case */
1742 }
1743
1744 /****************************************************************************
1745 Process an smb from the client
1746 ****************************************************************************/
1747 static void process_smb(struct smbd_server_connection *sconn,
1748 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1749 uint32_t seqnum, bool encrypted,
1750 struct smb_perfcount_data *deferred_pcd)
1751 {
1752 int msg_type = CVAL(inbuf,0);
1753
1754 DO_PROFILE_INC(smb_count);
1755
1756 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1757 smb_len(inbuf) ) );
1758 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1759 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1760
1761 if (msg_type != NBSSmessage) {
1762 /*
1763 * NetBIOS session request, keepalive, etc.
1764 */
1765 reply_special(sconn, (char *)inbuf, nread);
1766 goto done;
1767 }
1768
1769 if (sconn->using_smb2) {
1770 /* At this point we're not really using smb2,
1771 * we make the decision here.. */
1772 if (smbd_is_smb2_header(inbuf, nread)) {
1773 smbd_smb2_first_negprot(sconn, inbuf, nread);
1774 return;
1775 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1776 && CVAL(inbuf, smb_com) != 0x72) {
1777 /* This is a non-negprot SMB1 packet.
1778 Disable SMB2 from now on. */
1779 sconn->using_smb2 = false;
1780 }
1781 }
1782
1783 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1784 * so subtract 4 from it. */
1785 if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1786 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1787 smb_len(inbuf)));
1788
1789 /* special magic for immediate exit */
1790 if ((nread == 9) &&
1791 (IVAL(inbuf, 4) == 0x74697865) &&
1792 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1793 uint8_t exitcode = CVAL(inbuf, 8);
1794 DEBUG(1, ("Exiting immediately with code %d\n",
1795 (int)exitcode));
1796 exit(exitcode);
1797 }
1798
1799 exit_server_cleanly("Non-SMB packet");
1800 }
1801
1802 show_msg((char *)inbuf);
1803
1804 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1805 construct_reply_chain(sconn, (char *)inbuf, nread,
1806 seqnum, encrypted, deferred_pcd);
1807 } else {
1808 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1809 seqnum, encrypted, deferred_pcd);
1810 }
1811
1812 sconn->trans_num++;
1813
1814 done:
1815 sconn->num_requests++;
1816
1817 /* The timeout_processing function isn't run nearly
1818 often enough to implement 'max log size' without
1819 overrunning the size of the file by many megabytes.
1820 This is especially true if we are running at debug
1821 level 10. Checking every 50 SMBs is a nice
1822 tradeoff of performance vs log file size overrun. */
1823
1824 if ((sconn->num_requests % 50) == 0 &&
1825 need_to_check_log_size()) {
1826 change_to_root_user();
1827 check_log_size();
1828 }
1829 }
1830
1831 /****************************************************************************
1832 Return a string containing the function name of a SMB command.
1833 ****************************************************************************/
1834
1835 const char *smb_fn_name(int type)
1836 {
1837 const char *unknown_name = "SMBunknown";
1838
1839 if (smb_messages[type].name == NULL)
1840 return(unknown_name);
1841
1842 return(smb_messages[type].name);
1843 }
1844
1845 /****************************************************************************
1846 Helper functions for contruct_reply.
1847 ****************************************************************************/
1848
1849 void add_to_common_flags2(uint32 v)
1850 {
1851 common_flags2 |= v;
1852 }
1853
1854 void remove_from_common_flags2(uint32 v)
1855 {
1856 common_flags2 &= ~v;
1857 }
1858
1859 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1860 char *outbuf)
1861 {
1862 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1863 uint16_t out_flags2 = common_flags2;
1864
1865 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1866 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1867 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1868
1869 srv_set_message(outbuf,0,0,false);
1870
1871 SCVAL(outbuf, smb_com, req->cmd);
1872 SIVAL(outbuf,smb_rcls,0);
1873 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1874 SSVAL(outbuf,smb_flg2, out_flags2);
1875 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1876 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1877
1878 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1879 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1880 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1881 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1882 }
1883
1884 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1885 {
1886 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1887 }
1888
1889 /**
1890 * @brief Find the smb_cmd offset of the last command pushed
1891 * @param[in] buf The buffer we're building up
1892 * @retval Where can we put our next andx cmd?
1893 *
1894 * While chaining requests, the "next" request we're looking at needs to put
1895 * its SMB_Command before the data the previous request already built up added
1896 * to the chain. Find the offset to the place where we have to put our cmd.
1897 */
1898
1899 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1900 {
1901 uint8_t cmd;
1902 size_t ofs;
1903
1904 cmd = CVAL(buf, smb_com);
1905
1906 if (!is_andx_req(cmd)) {
1907 return false;
1908 }
1909
1910 ofs = smb_vwv0;
1911
1912 while (CVAL(buf, ofs) != 0xff) {
1913
1914 if (!is_andx_req(CVAL(buf, ofs))) {
1915 return false;
1916 }
1917
1918 /*
1919 * ofs is from start of smb header, so add the 4 length
1920 * bytes. The next cmd is right after the wct field.
1921 */
1922 ofs = SVAL(buf, ofs+2) + 4 + 1;
1923
1924 if (ofs+4 >= talloc_get_size(buf)) {
1925 return false;
1926 }
1927 }
1928
1929 *pofs = ofs;
1930 return true;
1931 }
1932
1933 /**
1934 * @brief Do the smb chaining at a buffer level
1935 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1936 * @param[in] andx_buf Buffer to be appended
1937 */
1938
1939 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1940 {
1941 uint8_t smb_command = CVAL(andx_buf, smb_com);
1942 uint8_t wct = CVAL(andx_buf, smb_wct);
1943 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1944 uint32_t num_bytes = smb_buflen(andx_buf);
1945 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1946
1947 uint8_t *outbuf;
1948 size_t old_size, new_size;
1949 size_t ofs;
1950 size_t chain_padding = 0;
1951 size_t andx_cmd_ofs;
1952
1953
1954 old_size = talloc_get_size(*poutbuf);
1955
1956 if ((old_size % 4) != 0) {
1957 /*
1958 * Align the wct field of subsequent requests to a 4-byte
1959 * boundary
1960 */
1961 chain_padding = 4 - (old_size % 4);
1962 }
1963
1964 /*
1965 * After the old request comes the new wct field (1 byte), the vwv's
1966 * and the num_bytes field.
1967 */
1968
1969 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1970 new_size += num_bytes;
1971
1972 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1973 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
1974 (unsigned)new_size));
1975 return false;
1976 }
1977
1978 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1979 if (outbuf == NULL) {
1980 DEBUG(0, ("talloc failed\n"));
1981 return false;
1982 }
1983 *poutbuf = outbuf;
1984
1985 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1986 DEBUG(1, ("invalid command chain\n"));
1987 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
1988 return false;
1989 }
1990
1991 if (chain_padding != 0) {
1992 memset(outbuf + old_size, 0, chain_padding);
1993 old_size += chain_padding;
1994 }
1995
1996 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1997 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1998
1999 ofs = old_size;
2000
2001 /*
2002 * Push the chained request:
2003 *
2004 * wct field
2005 */
2006
2007 SCVAL(outbuf, ofs, wct);
2008 ofs += 1;
2009
2010 /*
2011 * vwv array
2012 */
2013
2014 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2015
2016 /*
2017 * HACK ALERT
2018 *
2019 * Read&X has an offset into its data buffer at
2020 * vwv[6]. reply_read_andx has no idea anymore that it's
2021 * running from within a chain, so we have to fix up the
2022 * offset here.
2023 *
2024 * Although it looks disgusting at this place, I want to keep
2025 * it here. The alternative would be to push knowledge about
2026 * the andx chain down into read&x again.
2027 */
2028
2029 if (smb_command == SMBreadX) {
2030 uint8_t *bytes_addr;
2031
2032 if (wct < 7) {
2033 /*
2034 * Invalid read&x response
2035 */
2036 return false;
2037 }
2038
2039 bytes_addr = outbuf + ofs /* vwv start */
2040 + sizeof(uint16_t) * wct /* vwv array */
2041 + sizeof(uint16_t); /* bcc */
2042
2043 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2044 bytes_addr - outbuf - 4);
2045 }
2046
2047 ofs += sizeof(uint16_t) * wct;
2048
2049 /*
2050 * bcc (byte count)
2051 */
2052
2053 SSVAL(outbuf, ofs, num_bytes);
2054 ofs += sizeof(uint16_t);
2055
2056 /*
2057 * The bytes field
2058 */
2059
2060 memcpy(outbuf + ofs, bytes, num_bytes);
2061
2062 return true;
2063 }
2064
2065 bool smb1_is_chain(const uint8_t *buf)
2066 {
2067 uint8_t cmd, wct, andx_cmd;
2068
2069 cmd = CVAL(buf, smb_com);
2070 if (!is_andx_req(cmd)) {
2071 return false;
2072 }
2073 wct = CVAL(buf, smb_wct);
2074 if (wct < 2) {
2075 return false;
2076 }
2077 andx_cmd = CVAL(buf, smb_vwv);
2078 return (andx_cmd != 0xFF);
2079 }
2080
2081 bool smb1_walk_chain(const uint8_t *buf,
2082 bool (*fn)(uint8_t cmd,
2083 uint8_t wct, const uint16_t *vwv,
2084 uint16_t num_bytes, const uint8_t *bytes,
2085 void *private_data),
2086 void *private_data)
2087 {
2088 size_t smblen = smb_len(buf);
2089 const char *smb_buf = smb_base(buf);
2090 uint8_t cmd, chain_cmd;
2091 uint8_t wct;
2092 const uint16_t *vwv;
2093 uint16_t num_bytes;
2094 const uint8_t *bytes;
2095
2096 cmd = CVAL(buf, smb_com);
2097 wct = CVAL(buf, smb_wct);
2098 vwv = (const uint16_t *)(buf + smb_vwv);
2099 num_bytes = smb_buflen(buf);
2100 bytes = (uint8_t *)smb_buf_const(buf);
2101
2102 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2103 return false;
2104 }
2105
2106 if (!is_andx_req(cmd)) {
2107 return true;
2108 }
2109 if (wct < 2) {
2110 return false;
2111 }
2112
2113 chain_cmd = CVAL(vwv, 0);
2114
2115 while (chain_cmd != 0xff) {
2116 uint32_t chain_offset; /* uint32_t to avoid overflow */
2117 size_t length_needed;
2118 ptrdiff_t vwv_offset;
2119
2120 chain_offset = SVAL(vwv+1, 0);
2121
2122 /*
2123 * Check if the client tries to fool us. The chain
2124 * offset needs to point beyond the current request in
2125 * the chain, it needs to strictly grow. Otherwise we
2126 * might be tricked into an endless loop always
2127 * processing the same request over and over again. We
2128 * used to assume that vwv and the byte buffer array
2129 * in a chain are always attached, but OS/2 the
2130 * Write&X/Read&X chain puts the Read&X vwv array
2131 * right behind the Write&X vwv chain. The Write&X bcc
2132 * array is put behind the Read&X vwv array. So now we
2133 * check whether the chain offset points strictly
2134 * behind the previous vwv array. req->buf points
2135 * right after the vwv array of the previous
2136 * request. See
2137 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2138 * more information.
2139 */
2140
2141 vwv_offset = ((const char *)vwv - smb_buf);
2142 if (chain_offset <= vwv_offset) {
2143 return false;
2144 }
2145
2146 /*
2147 * Next check: Make sure the chain offset does not
2148 * point beyond the overall smb request length.
2149 */
2150
2151 length_needed = chain_offset+1; /* wct */
2152 if (length_needed > smblen) {
2153 return false;
2154 }
2155
2156 /*
2157 * Now comes the pointer magic. Goal here is to set up
2158 * vwv and buf correctly again. The chain offset (the
2159 * former vwv[1]) points at the new wct field.
2160 */
2161
2162 wct = CVAL(smb_buf, chain_offset);
2163
2164 if (is_andx_req(chain_cmd) && (wct < 2)) {
2165 return false;
2166 }
2167
2168 /*
2169 * Next consistency check: Make the new vwv array fits
2170 * in the overall smb request.
2171 */
2172
2173 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2174 if (length_needed > smblen) {
2175 return false;
2176 }
2177 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2178
2179 /*
2180 * Now grab the new byte buffer....
2181 */
2182
2183 num_bytes = SVAL(vwv+wct, 0);
2184
2185 /*
2186 * .. and check that it fits.
2187 */
2188
2189 length_needed += num_bytes;
2190 if (length_needed > smblen) {
2191 return false;
2192 }
2193 bytes = (const uint8_t *)(vwv+wct+1);
2194
2195 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2196 return false;
2197 }
2198
2199 if (!is_andx_req(chain_cmd)) {
2200 return true;
2201 }
2202 chain_cmd = CVAL(vwv, 0);
2203 }
2204 return true;
2205 }
2206
2207 static bool smb1_chain_length_cb(uint8_t cmd,
2208 uint8_t wct, const uint16_t *vwv,
2209 uint16_t num_bytes, const uint8_t *bytes,
2210 void *private_data)
2211 {
2212 unsigned *count = (unsigned *)private_data;
2213 *count += 1;
2214 return true;
2215 }
2216
2217 unsigned smb1_chain_length(const uint8_t *buf)
2218 {
2219 unsigned count = 0;
2220
2221 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2222 return 0;
2223 }
2224 return count;
2225 }
2226
2227 struct smb1_parse_chain_state {
2228 TALLOC_CTX *mem_ctx;
2229 const uint8_t *buf;
2230 struct smbd_server_connection *sconn;
2231 bool encrypted;
2232 uint32_t seqnum;
2233
2234 struct smb_request **reqs;
2235 unsigned num_reqs;
2236 };
2237
2238 static bool smb1_parse_chain_cb(uint8_t cmd,
2239 uint8_t wct, const uint16_t *vwv,
2240 uint16_t num_bytes, const uint8_t *bytes,
2241 void *private_data)
2242 {
2243 struct smb1_parse_chain_state *state =
2244 (struct smb1_parse_chain_state *)private_data;
2245 struct smb_request **reqs;
2246 struct smb_request *req;
2247 bool ok;
2248
2249 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2250 struct smb_request *, state->num_reqs+1);
2251 if (reqs == NULL) {
2252 return false;
2253 }
2254 state->reqs = reqs;
2255
2256 req = talloc(reqs, struct smb_request);
2257 if (req == NULL) {
2258 return false;
2259 }
2260
2261 ok = init_smb_request(req, state->sconn, state->buf, 0,
2262 state->encrypted, state->seqnum);
2263 if (!ok) {
2264 return false;
2265 }
2266 req->cmd = cmd;
2267 req->wct = wct;
2268 req->vwv = vwv;
2269 req->buflen = num_bytes;
2270 req->buf = bytes;
2271
2272 reqs[state->num_reqs] = req;
2273 state->num_reqs += 1;
2274 return true;
2275 }
2276
2277 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2278 struct smbd_server_connection *sconn,
2279 bool encrypted, uint32_t seqnum,
2280 struct smb_request ***reqs, unsigned *num_reqs)
2281 {
2282 struct smb1_parse_chain_state state;
2283 unsigned i;
2284
2285 state.mem_ctx = mem_ctx;
2286 state.buf = buf;
2287 state.sconn = sconn;
2288 state.encrypted = encrypted;
2289 state.seqnum = seqnum;
2290 state.reqs = NULL;
2291 state.num_reqs = 0;
2292
2293 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2294 TALLOC_FREE(state.reqs);
2295 return false;
2296 }
2297 for (i=0; i<state.num_reqs; i++) {
2298 state.reqs[i]->chain = state.reqs;
2299 }
2300 *reqs = state.reqs;
2301 *num_reqs = state.num_reqs;
2302 return true;
2303 }
2304
2305 /****************************************************************************
2306 Check if services need reloading.
2307 ****************************************************************************/
2308
2309 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2310 {
2311
2312 if (last_smb_conf_reload_time == 0) {
2313 last_smb_conf_reload_time = t;
2314 }
2315
2316 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2317 reload_services(sconn, conn_snum_used, true);
2318 last_smb_conf_reload_time = t;
2319 }
2320 }
2321
2322 static bool fd_is_readable(int fd)
2323 {
2324 int ret, revents;
2325
2326 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2327
2328 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2329
2330 }
2331
2332 static void smbd_server_connection_write_handler(
2333 struct smbd_server_connection *sconn)
2334 {
2335 /* TODO: make write nonblocking */
2336 }
2337
2338 static void smbd_server_connection_read_handler(
2339 struct smbd_server_connection *sconn, int fd)
2340 {
2341 uint8_t *inbuf = NULL;
2342 size_t inbuf_len = 0;
2343 size_t unread_bytes = 0;
2344 bool encrypted = false;
2345 TALLOC_CTX *mem_ctx = talloc_tos();
2346 NTSTATUS status;
2347 uint32_t seqnum;
2348
2349 bool from_client;
2350
2351 if (lp_async_smb_echo_handler()
2352 && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2353 /*
2354 * This is the super-ugly hack to prefer the packets
2355 * forwarded by the echo handler over the ones by the
2356 * client directly
2357 */
2358 fd = sconn->smb1.echo_handler.trusted_fd;
2359 }
2360
2361 from_client = (sconn->sock == fd);
2362
2363 if (from_client) {
2364 smbd_lock_socket(sconn);
2365
2366 if (!fd_is_readable(fd)) {
2367 DEBUG(10,("the echo listener was faster\n"));
2368 smbd_unlock_socket(sconn);
2369 return;
2370 }
2371 }
2372
2373 /* TODO: make this completely nonblocking */
2374 status = receive_smb_talloc(mem_ctx, sconn, fd,
2375 (char **)(void *)&inbuf,
2376 0, /* timeout */
2377 &unread_bytes,
2378 &encrypted,
2379 &inbuf_len, &seqnum,
2380 false /* trusted channel */);
2381
2382 if (from_client) {
2383 smbd_unlock_socket(sconn);
2384 }
2385
2386 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2387 goto process;
2388 }
2389 if (NT_STATUS_IS_ERR(status)) {
2390 exit_server_cleanly("failed to receive smb request");
2391 }
2392 if (!NT_STATUS_IS_OK(status)) {
2393 return;
2394 }
2395
2396 process:
2397 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2398 seqnum, encrypted, NULL);
2399 }
2400
2401 static void smbd_server_connection_handler(struct event_context *ev,
2402 struct fd_event *fde,
2403 uint16_t flags,
2404 void *private_data)
2405 {
2406 struct smbd_server_connection *conn = talloc_get_type(private_data,
2407 struct smbd_server_connection);
2408
2409 if (flags & EVENT_FD_WRITE) {
2410 smbd_server_connection_write_handler(conn);
2411 return;
2412 }
2413 if (flags & EVENT_FD_READ) {
2414 smbd_server_connection_read_handler(conn, conn->sock);
2415 return;
2416 }
2417 }
2418
2419 static void smbd_server_echo_handler(struct event_context *ev,
2420 struct fd_event *fde,
2421 uint16_t flags,
2422 void *private_data)
2423 {
2424 struct smbd_server_connection *conn = talloc_get_type(private_data,
2425 struct smbd_server_connection);
2426
2427 if (flags & EVENT_FD_WRITE) {
2428 smbd_server_connection_write_handler(conn);
2429 return;
2430 }
2431 if (flags & EVENT_FD_READ) {
2432 smbd_server_connection_read_handler(
2433 conn, conn->smb1.echo_handler.trusted_fd);
2434 return;
2435 }
2436 }
2437
2438 #ifdef CLUSTER_SUPPORT
2439 /****************************************************************************
2440 received when we should release a specific IP
2441 ****************************************************************************/
2442 static void release_ip(const char *ip, void *priv)
2443 {
2444 const char *addr = (const char *)priv;
2445 const char *p = addr;
2446
2447 if (strncmp("::ffff:", addr, 7) == 0) {
2448 p = addr + 7;
2449 }
2450
2451 DEBUG(10, ("Got release IP message for %s, "
2452 "our address is %s\n", ip, p));
2453
2454 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2455 /* we can't afford to do a clean exit - that involves
2456 database writes, which would potentially mean we
2457 are still running after the failover has finished -
2458 we have to get rid of this process ID straight
2459 away */
2460 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2461 ip));
2462 /* note we must exit with non-zero status so the unclean handler gets
2463 called in the parent, so that the brl database is tickled */
2464 _exit(1);
2465 }
2466 }
2467
2468 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2469 struct sockaddr_storage *client)
2470 {
2471 socklen_t length;
2472 length = sizeof(*server);
2473 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2474 return -1;
2475 }
2476 length = sizeof(*client);
2477 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2478 return -1;
2479 }
2480 return 0;
2481 }
2482 #endif
2483
2484 /*
2485 * Send keepalive packets to our client
2486 */
2487 static bool keepalive_fn(const struct timeval *now, void *private_data)
2488 {
2489 struct smbd_server_connection *sconn = talloc_get_type_abort(
2490 private_data, struct smbd_server_connection);
2491 bool ret;
2492
2493 if (sconn->using_smb2) {
2494 /* Don't do keepalives on an SMB2 connection. */
2495 return false;
2496 }
2497
2498 smbd_lock_socket(sconn);
2499 ret = send_keepalive(sconn->sock);
2500 smbd_unlock_socket(sconn);
2501
2502 if (!ret) {
2503 char addr[INET6_ADDRSTRLEN];
2504 /*
2505 * Try and give an error message saying what
2506 * client failed.
2507 */
2508 DEBUG(0, ("send_keepalive failed for client %s. "
2509 "Error %s - exiting\n",
2510 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2511 strerror(errno)));
2512 return False;
2513 }
2514 return True;
2515 }
2516
2517 /*
2518 * Do the recurring check if we're idle
2519 */
2520 static bool deadtime_fn(const struct timeval *now, void *private_data)
2521 {
2522 struct smbd_server_connection *sconn =
2523 (struct smbd_server_connection *)private_data;
2524
2525 if ((conn_num_open(sconn) == 0)
2526 || (conn_idle_all(sconn, now->tv_sec))) {
2527 DEBUG( 2, ( "Closing idle connection\n" ) );
2528 messaging_send(sconn->msg_ctx,
2529 messaging_server_id(sconn->msg_ctx),
2530 MSG_SHUTDOWN, &data_blob_null);
2531 return False;
2532 }
2533
2534 return True;
2535 }
2536
2537 /*
2538 * Do the recurring log file and smb.conf reload checks.
2539 */
2540
2541 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2542 {
2543 struct smbd_server_connection *sconn = talloc_get_type_abort(
2544 private_data, struct smbd_server_connection);
2545
2546 DEBUG(5, ("housekeeping\n"));
2547
2548 change_to_root_user();
2549
2550 /* update printer queue caches if necessary */
2551 update_monitored_printq_cache(sconn->msg_ctx);
2552
2553 /* check if we need to reload services */
2554 check_reload(sconn, time_mono(NULL));
2555
2556 /* Change machine password if neccessary. */
2557 attempt_machine_password_change();
2558
2559 /*
2560 * Force a log file check.
2561 */
2562 force_check_log_size();
2563 check_log_size();
2564 return true;
2565 }
2566
2567 /*
2568 * Read an smb packet in the echo handler child, giving the parent
2569 * smbd one second to react once the socket becomes readable.
2570 */
2571
2572 struct smbd_echo_read_state {
2573 struct tevent_context *ev;
2574 struct smbd_server_connection *sconn;
2575
2576 char *buf;
2577 size_t buflen;
2578 uint32_t seqnum;
2579 };
2580
2581 static void smbd_echo_read_readable(struct tevent_req *subreq);
2582 static void smbd_echo_read_waited(struct tevent_req *subreq);
2583
2584 static struct tevent_req *smbd_echo_read_send(
2585 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2586 struct smbd_server_connection *sconn)
2587 {
2588 struct tevent_req *req, *subreq;
2589 struct smbd_echo_read_state *state;
2590
2591 req = tevent_req_create(mem_ctx, &state,
2592 struct smbd_echo_read_state);
2593 if (req == NULL) {
2594 return NULL;
2595 }
2596 state->ev = ev;
2597 state->sconn = sconn;
2598
2599 subreq = wait_for_read_send(state, ev, sconn->sock);
2600 if (tevent_req_nomem(subreq, req)) {
2601 return tevent_req_post(req, ev);
2602 }
2603 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2604 return req;
2605 }
2606
2607 static void smbd_echo_read_readable(struct tevent_req *subreq)
2608 {
2609 struct tevent_req *req = tevent_req_callback_data(
2610 subreq, struct tevent_req);
2611 struct smbd_echo_read_state *state = tevent_req_data(
2612 req, struct smbd_echo_read_state);
2613 bool ok;
2614 int err;
2615
2616 ok = wait_for_read_recv(subreq, &err);
2617 TALLOC_FREE(subreq);
2618 if (!ok) {
2619 tevent_req_nterror(req, map_nt_error_from_unix(err));
2620 return;
2621 }
2622
2623 /*
2624 * Give the parent smbd one second to step in
2625 */
2626
2627 subreq = tevent_wakeup_send(
2628 state, state->ev, timeval_current_ofs(1, 0));
2629 if (tevent_req_nomem(subreq, req)) {
2630 return;
2631 }
2632 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2633 }
2634
2635 static void smbd_echo_read_waited(struct tevent_req *subreq)
2636 {
2637 struct tevent_req *req = tevent_req_callback_data(
2638 subreq, struct tevent_req);
2639 struct smbd_echo_read_state *state = tevent_req_data(
2640 req, struct smbd_echo_read_state);
2641 struct smbd_server_connection *sconn = state->sconn;
2642 bool ok;
2643 NTSTATUS status;
2644 size_t unread = 0;
2645 bool encrypted;
2646
2647 ok = tevent_wakeup_recv(subreq);
2648 TALLOC_FREE(subreq);
2649 if (!ok) {
2650 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2651 return;
2652 }
2653
2654 ok = smbd_lock_socket_internal(sconn);
2655 if (!ok) {
2656 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2657 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2658 return;
2659 }
2660
2661 if (!fd_is_readable(sconn->sock)) {
2662 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2663 (int)getpid()));
2664
2665 ok = smbd_unlock_socket_internal(sconn);
2666 if (!ok) {
2667 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2668 DEBUG(1, ("%s: failed to unlock socket\n",
2669 __location__));
2670 return;
2671 }
2672
2673 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2674 if (tevent_req_nomem(subreq, req)) {
2675 return;
2676 }
2677 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2678 return;
2679 }
2680
2681 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2682 0 /* timeout */,
2683 &unread,
2684 &encrypted,
2685 &state->buflen,
2686 &state->seqnum,
2687 false /* trusted_channel*/);
2688
2689 if (tevent_req_nterror(req, status)) {
2690 tevent_req_nterror(req, status);
2691 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2692 (int)getpid(), nt_errstr(status)));
2693 return;
2694 }
2695
2696 ok = smbd_unlock_socket_internal(sconn);
2697 if (!ok) {
2698 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2699 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2700 return;
2701 }
2702 tevent_req_done(req);
2703 }
2704
2705 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2706 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2707 {
2708 struct smbd_echo_read_state *state = tevent_req_data(
2709 req, struct smbd_echo_read_state);
2710 NTSTATUS status;
2711
2712 if (tevent_req_is_nterror(req, &status)) {
2713 return status;
2714 }
2715 *pbuf = talloc_move(mem_ctx, &state->buf);
2716 *pbuflen = state->buflen;
2717 *pseqnum = state->seqnum;
2718 return NT_STATUS_OK;
2719 }
2720
2721 struct smbd_echo_state {
2722 struct tevent_context *ev;
2723 struct iovec *pending;
2724 struct smbd_server_connection *sconn;
2725 int parent_pipe;
2726
2727 struct tevent_fd *parent_fde;
2728
2729 struct tevent_req *write_req;
2730 };
2731
2732 static void smbd_echo_writer_done(struct tevent_req *req);
2733
2734 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2735 {
2736 int num_pending;
2737
2738 if (state->write_req != NULL) {
2739 return;
2740 }
2741
2742 num_pending = talloc_array_length(state->pending);
2743 if (num_pending == 0) {
2744 return;
2745 }
2746
2747 state->write_req = writev_send(state, state->ev, NULL,
2748 state->parent_pipe, false,
2749 state->pending, num_pending);
2750 if (state->write_req == NULL) {
2751 DEBUG(1, ("writev_send failed\n"));
2752 exit(1);
2753 }
2754
2755 talloc_steal(state->write_req, state->pending);
2756 state->pending = NULL;
2757
2758 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2759 state);
2760 }
2761
2762 static void smbd_echo_writer_done(struct tevent_req *req)
2763 {
2764 struct smbd_echo_state *state = tevent_req_callback_data(
2765 req, struct smbd_echo_state);
2766 ssize_t written;
2767 int err;
2768
2769 written = writev_recv(req, &err);
2770 TALLOC_FREE(req);
2771 state->write_req = NULL;
2772 if (written == -1) {
2773 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2774 exit(1);
2775 }
2776 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2777 smbd_echo_activate_writer(state);
2778 }
2779
2780 static bool smbd_echo_reply(struct smbd_echo_state *state,
2781 uint8_t *inbuf, size_t inbuf_len,
2782 uint32_t seqnum)
2783 {
2784 struct smb_request req;
2785 uint16_t num_replies;
2786 char *outbuf;
2787 bool ok;
2788
2789 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2790 DEBUG(10, ("Got netbios keepalive\n"));
2791 /*
2792 * Just swallow it
2793 */
2794 return true;
2795 }
2796
2797 if (inbuf_len < smb_size) {
2798 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2799 return false;
2800 }
2801 if (!valid_smb_header(state->sconn, inbuf)) {
2802 DEBUG(10, ("Got invalid SMB header\n"));
2803 return false;
2804 }
2805
2806 if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2807 seqnum)) {
2808 return false;
2809 }
2810 req.inbuf = inbuf;
2811
2812 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2813 smb_messages[req.cmd].name
2814 ? smb_messages[req.cmd].name : "unknown"));
2815
2816 if (req.cmd != SMBecho) {
2817 return false;
2818 }
2819 if (req.wct < 1) {
2820 return false;
2821 }
2822
2823 num_replies = SVAL(req.vwv+0, 0);
2824 if (num_replies != 1) {
2825 /* Not a Windows "Hey, you're still there?" request */
2826 return false;
2827 }
2828
2829 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2830 1, req.buflen)) {
2831 DEBUG(10, ("create_outbuf failed\n"));
2832 return false;
2833 }
2834 req.outbuf = (uint8_t *)outbuf;
2835
2836 SSVAL(req.outbuf, smb_vwv0, num_replies);
2837
2838 if (req.buflen > 0) {
2839 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2840 }
2841
2842 ok = srv_send_smb(req.sconn,
2843 (char *)outbuf,
2844 true, seqnum+1,
2845 false, &req.pcd);
2846 TALLOC_FREE(outbuf);
2847 if (!ok) {
2848 exit(1);
2849 }
2850
2851 return true;
2852 }
2853
2854 static void smbd_echo_exit(struct tevent_context *ev,
2855 struct tevent_fd *fde, uint16_t flags,
2856 void *private_data)
2857 {
2858 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2859 exit(0);
2860 }
2861
2862 static void smbd_echo_got_packet(struct tevent_req *req);
2863
2864 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2865 int parent_pipe)
2866 {
2867 struct smbd_echo_state *state;
2868 struct tevent_req *read_req;
2869
2870 state = talloc_zero(sconn, struct smbd_echo_state);
2871 if (state == NULL) {
2872 DEBUG(1, ("talloc failed\n"));
2873 return;
2874 }
2875 state->sconn = sconn;
2876 state->parent_pipe = parent_pipe;
2877 state->ev = s3_tevent_context_init(state);
2878 if (state->ev == NULL) {
2879 DEBUG(1, ("tevent_context_init failed\n"));
2880 TALLOC_FREE(state);
2881 return;
2882 }
2883 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2884 TEVENT_FD_READ, smbd_echo_exit,
2885 state);
2886 if (state->parent_fde == NULL) {
2887 DEBUG(1, ("tevent_add_fd failed\n"));
2888 TALLOC_FREE(state);
2889 return;
2890 }
2891
2892 read_req = smbd_echo_read_send(state, state->ev, sconn);
2893 if (read_req == NULL) {
2894 DEBUG(1, ("smbd_echo_read_send failed\n"));
2895 TALLOC_FREE(state);
2896 return;
2897 }
2898 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2899
2900 while (true) {
2901 if (tevent_loop_once(state->ev) == -1) {
2902 DEBUG(1, ("tevent_loop_once failed: %s\n",
2903 strerror(errno)));
2904 break;
2905 }
2906 }
2907 TALLOC_FREE(state);
2908 }
2909
2910 static void smbd_echo_got_packet(struct tevent_req *req)
2911 {
2912 struct smbd_echo_state *state = tevent_req_callback_data(
2913 req, struct smbd_echo_state);
2914 NTSTATUS status;
2915 char *buf = NULL;
2916 size_t buflen = 0;
2917 uint32_t seqnum = 0;
2918 bool reply;
2919
2920 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2921 TALLOC_FREE(req);
2922 if (!NT_STATUS_IS_OK(status)) {
2923 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2924 nt_errstr(status)));
2925 exit(1);
2926 }
2927
2928 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2929 if (!reply) {
2930 size_t num_pending;
2931 struct iovec *tmp;
2932 struct iovec *iov;
2933
2934 num_pending = talloc_array_length(state->pending);
2935 tmp = talloc_realloc(state, state->pending, struct iovec,
2936 num_pending+1);
2937 if (tmp == NULL) {
2938 DEBUG(1, ("talloc_realloc failed\n"));
2939 exit(1);
2940 }
2941 state->pending = tmp;
2942
2943 if (buflen >= smb_size) {
2944 /*
2945 * place the seqnum in the packet so that the main process
2946 * can reply with signing
2947 */
2948 SIVAL(buf, smb_ss_field, seqnum);
2949 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2950 }
2951
2952 iov = &state->pending[num_pending];
2953 iov->iov_base = buf;
2954 iov->iov_len = buflen;
2955
2956 DEBUG(10,("echo_handler[%d]: forward to main\n",
2957 (int)getpid()));
2958 smbd_echo_activate_writer(state);
2959 }
2960
2961 req = smbd_echo_read_send(state, state->ev, state->sconn);
2962 if (req == NULL) {
2963 DEBUG(1, ("smbd_echo_read_send failed\n"));
2964 exit(1);
2965 }
2966 tevent_req_set_callback(req, smbd_echo_got_packet, state);
2967 }
2968
2969
2970 /*
2971 * Handle SMBecho requests in a forked child process
2972 */
2973 bool fork_echo_handler(struct smbd_server_connection *sconn)
2974 {
2975 int listener_pipe[2];
2976 int res;
2977 pid_t child;
2978
2979 res = pipe(listener_pipe);
2980 if (res == -1) {
2981 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2982 return false;
2983 }
2984 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2985 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2986 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2987 goto fail;
2988 }
2989
2990 child = fork();
2991 if (child == 0) {
2992 NTSTATUS status;
2993
2994 close(listener_pipe[0]);
2995 set_blocking(listener_pipe[1], false);
2996
2997 status = reinit_after_fork(sconn->msg_ctx,
2998 sconn->ev_ctx,
2999 false);
3000 if (!NT_STATUS_IS_OK(status)) {
3001 DEBUG(1, ("reinit_after_fork failed: %s\n",
3002 nt_errstr(status)));
3003 exit(1);
3004 }
3005 smbd_echo_loop(sconn, listener_pipe[1]);
3006 exit(0);
3007 }
3008 close(listener_pipe[1]);
3009 listener_pipe[1] = -1;
3010 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3011
3012 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), child));
3013
3014 /*
3015 * Without smb signing this is the same as the normal smbd
3016 * listener. This needs to change once signing comes in.
3017 */
3018 sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3019 sconn,
3020 sconn->smb1.echo_handler.trusted_fd,
3021 TEVENT_FD_READ,
3022 smbd_server_echo_handler,
3023 sconn);
3024 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3025 DEBUG(1, ("event_add_fd failed\n"));
3026 goto fail;
3027 }
3028
3029 return true;
3030
3031 fail:
3032 if (listener_pipe[0] != -1) {
3033 close(listener_pipe[0]);
3034 }
3035 if (listener_pipe[1] != -1) {
3036 close(listener_pipe[1]);
3037 }
3038 sconn->smb1.echo_handler.trusted_fd = -1;
3039 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3040 close(sconn->smb1.echo_handler.socket_lock_fd);
3041 }
3042 sconn->smb1.echo_handler.trusted_fd = -1;
3043 sconn->smb1.echo_handler.socket_lock_fd = -1;
3044 return false;
3045 }
3046
3047 #if CLUSTER_SUPPORT
3048
3049 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
3050 struct sockaddr_storage *srv,
3051 struct sockaddr_storage *clnt)
3052 {
3053 struct ctdbd_connection *cconn;
3054 char tmp_addr[INET6_ADDRSTRLEN];
3055 char *addr;
3056
3057 cconn = messaging_ctdbd_connection();
3058 if (cconn == NULL) {
3059 return NT_STATUS_NO_MEMORY;
3060 }
3061
3062 if (client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr)) == NULL) {
3063 return NT_STATUS_NO_MEMORY;
3064 }
3065 addr = talloc_strdup(cconn, tmp_addr);
3066 if (addr == NULL) {
3067 return NT_STATUS_NO_MEMORY;
3068 }
3069 return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
3070 }
3071
3072 #endif
3073
3074 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3075 {
3076 while (user) {
3077 if (user->session_info &&
3078 (user->session_info->unix_token->uid == uid)) {
3079 return true;
3080 }
3081 user = user->next;
3082 }
3083 return false;
3084 }
3085
3086 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3087 {
3088 while (user) {
3089 if (user->session_info != NULL) {
3090 int i;
3091 struct security_unix_token *utok;
3092
3093 utok = user->session_info->unix_token;
3094 if (utok->gid == gid) {
3095 return true;
3096 }
3097 for(i=0; i<utok->ngroups; i++) {
3098 if (utok->groups[i] == gid) {
3099 return true;
3100 }
3101 }
3102 }
3103 user = user->next;
3104 }
3105 return false;
3106 }
3107
3108 static bool sid_in_use(const struct user_struct *user,
3109 const struct dom_sid *psid)
3110 {
3111 while (user) {
3112 struct security_token *tok;
3113
3114 if (user->session_info == NULL) {
3115 continue;
3116 }
3117 tok = user->session_info->security_token;
3118 if (tok == NULL) {
3119 /*
3120 * Not sure session_info->security_token can
3121 * ever be NULL. This check might be not
3122 * necessary.
3123 */
3124 continue;
3125 }
3126 if (security_token_has_sid(tok, psid)) {
3127 return true;
3128 }
3129 user = user->next;
3130 }
3131 return false;
3132 }
3133
3134 static bool id_in_use(const struct user_struct *user,
3135 const struct id_cache_ref *id)
3136 {
3137 switch(id->type) {
3138 case UID:
3139 return uid_in_use(user, id->id.uid);
3140 case GID:
3141 return gid_in_use(user, id->id.gid);
3142 case SID:
3143 return sid_in_use(user, &id->id.sid);
3144 default:
3145 break;
3146 }
3147 return false;
3148 }
3149
3150 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3151 void *private_data,
3152 uint32_t msg_type,
3153 struct server_id server_id,
3154 DATA_BLOB* data)
3155 {
3156 const char *msg = (data && data->data)
3157 ? (const char *)data->data : "<NULL>";
3158 struct id_cache_ref id;
3159 struct smbd_server_connection *sconn =
3160 talloc_get_type_abort(private_data,
3161 struct smbd_server_connection);
3162
3163 if (!id_cache_ref_parse(msg, &id)) {
3164 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3165 return;
3166 }
3167
3168 if (id_in_use(sconn->users, &id)) {
3169 exit_server_cleanly(msg);
3170 }
3171 id_cache_delete_from_cache(&id);
3172 }
3173
3174 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3175 enum protocol_types protocol)
3176 {
3177 NTSTATUS status;
3178
3179 set_Protocol(protocol);
3180 conn->protocol = protocol;
3181
3182 if (protocol >= PROTOCOL_SMB2_02) {
3183 status = smb2srv_session_table_init(conn);
3184 if (!NT_STATUS_IS_OK(status)) {
3185 return status;
3186 }
3187 } else {
3188 status = smb1srv_session_table_init(conn);
3189 if (!NT_STATUS_IS_OK(status)) {
3190 return status;
3191 }
3192
3193 status = smb1srv_tcon_table_init(conn);
3194 if (!NT_STATUS_IS_OK(status)) {
3195 return status;
3196 }
3197 }
3198
3199 return NT_STATUS_OK;
3200 }
3201
3202 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3203 void *private_data)
3204 {
3205 struct smbXsrv_connection *conn =
3206 talloc_get_type_abort(private_data,
3207 struct smbXsrv_connection);
3208
3209 switch (point) {
3210 case TEVENT_TRACE_BEFORE_WAIT:
3211 /*
3212 * This just removes compiler warning
3213 * without profile support
3214 */
3215 conn->smbd_idle_profstamp = 0;
3216 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3217 break;
3218 case TEVENT_TRACE_AFTER_WAIT:
3219 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3220 break;
3221 }
3222 }
3223
3224 /****************************************************************************
3225 Process commands from the client
3226 ****************************************************************************/
3227
3228 void smbd_process(struct tevent_context *ev_ctx,
3229 struct messaging_context *msg_ctx,
3230 int sock_fd,
3231 bool interactive)
3232 {
3233 TALLOC_CTX *frame = talloc_stackframe();
3234 struct smbXsrv_connection *conn;
3235 struct smbd_server_connection *sconn;
3236 struct sockaddr_storage ss;
3237 struct sockaddr *sa = NULL;
3238 socklen_t sa_socklen;
3239 struct tsocket_address *local_address = NULL;
3240 struct tsocket_address *remote_address = NULL;
3241 const char *locaddr = NULL;
3242 const char *remaddr = NULL;
3243 char *rhost;
3244 int ret;
3245
3246 conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3247 if (conn == NULL) {
3248 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3249 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3250 }
3251
3252 conn->ev_ctx = ev_ctx;
3253 conn->msg_ctx = msg_ctx;
3254
3255 sconn = talloc_zero(conn, struct smbd_server_connection);
3256 if (!sconn) {
3257 exit_server("failed to create smbd_server_connection");
3258 }
3259
3260 conn->sconn = sconn;
3261 sconn->conn = conn;
3262
3263 /*
3264 * TODO: remove this...:-)
3265 */
3266 global_smbXsrv_connection = conn;
3267
3268 sconn->ev_ctx = ev_ctx;
3269 sconn->msg_ctx = msg_ctx;
3270 sconn->sock = sock_fd;
3271 sconn->smb1.echo_handler.trusted_fd = -1;
3272 sconn->smb1.echo_handler.socket_lock_fd = -1;
3273
3274 if (!interactive) {
3275 smbd_setup_sig_term_handler(sconn);
3276 smbd_setup_sig_hup_handler(sconn);
3277
3278 if (!serverid_register(messaging_server_id(msg_ctx),
3279 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3280 |FLAG_MSG_DBWRAP
3281 |FLAG_MSG_PRINT_GENERAL)) {
3282 exit_server_cleanly("Could not register myself in "
3283 "serverid.tdb");
3284 }
3285 }
3286
3287 if (lp_srv_maxprotocol() >= PROTOCOL_SMB2_02) {
3288 /*
3289 * We're not making the decision here,
3290 * we're just allowing the client
3291 * to decide between SMB1 and SMB2
3292 * with the first negprot
3293 * packet.
3294 */
3295 sconn->using_smb2 = true;
3296 }
3297
3298 /* Ensure child is set to blocking mode */
3299 set_blocking(sconn->sock,True);
3300
3301 set_socket_options(sconn->sock, "SO_KEEPALIVE");
3302 set_socket_options(sconn->sock, lp_socket_options());
3303
3304 sa = (struct sockaddr *)(void *)&ss;
3305 sa_socklen = sizeof(ss);
3306 ret = getpeername(sconn->sock, sa, &sa_socklen);
3307 if (ret != 0) {
3308 int level = (errno == ENOTCONN)?2:0;
3309 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3310 exit_server_cleanly("getpeername() failed.\n");
3311 }
3312 ret = tsocket_address_bsd_from_sockaddr(sconn,
3313 sa, sa_socklen,
3314 &remote_address);
3315 if (ret != 0) {
3316 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3317 __location__, strerror(errno)));
3318 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3319 }
3320
3321 sa = (struct sockaddr *)(void *)&ss;
3322 sa_socklen = sizeof(ss);
3323 ret = getsockname(sconn->sock, sa, &sa_socklen);
3324 if (ret != 0) {
3325 int level = (errno == ENOTCONN)?2:0;
3326 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3327 exit_server_cleanly("getsockname() failed.\n");
3328 }
3329 ret = tsocket_address_bsd_from_sockaddr(sconn,
3330 sa, sa_socklen,
3331 &local_address);
3332 if (ret != 0) {
3333 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3334 __location__, strerror(errno)));
3335 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3336 }
3337
3338 sconn->local_address = local_address;
3339 sconn->remote_address = remote_address;
3340
3341 if (tsocket_address_is_inet(local_address, "ip")) {
3342 locaddr = tsocket_address_inet_addr_string(
3343 sconn->local_address,
3344 talloc_tos());
3345 if (locaddr == NULL) {
3346 DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3347 __location__, strerror(errno)));
3348 exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3349 }
3350 } else {
3351 locaddr = "0.0.0.0";
3352 }
3353
3354 if (tsocket_address_is_inet(remote_address, "ip")) {
3355 remaddr = tsocket_address_inet_addr_string(
3356 sconn->remote_address,
3357 talloc_tos());
3358 if (remaddr == NULL) {
3359 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3360 __location__, strerror(errno)));
3361 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3362 }
3363 } else {
3364 remaddr = "0.0.0.0";
3365 }
3366
3367 /* this is needed so that we get decent entries
3368 in smbstatus for port 445 connects */
3369 set_remote_machine_name(remaddr, false);
3370 reload_services(sconn, conn_snum_used, true);
3371
3372 /*
3373 * Before the first packet, check the global hosts allow/ hosts deny
3374 * parameters before doing any parsing of packets passed to us by the
3375 * client. This prevents attacks on our parsing code from hosts not in
3376 * the hosts allow list.
3377 */
3378
3379 ret = get_remote_hostname(remote_address,
3380 &rhost,
3381 talloc_tos());
3382 if (ret < 0) {
3383 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3384 __location__, strerror(errno)));
3385 exit_server_cleanly("get_remote_hostname failed.\n");
3386 }
3387 if (strequal(rhost, "UNKNOWN")) {
3388 rhost = talloc_strdup(talloc_tos(), remaddr);
3389 }
3390 sconn->remote_hostname = talloc_move(sconn, &rhost);
3391
3392 sub_set_socket_ids(remaddr,
3393 sconn->remote_hostname,
3394 locaddr);
3395
3396 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3397 sconn->remote_hostname,
3398 remaddr)) {
3399 /*
3400 * send a negative session response "not listening on calling
3401 * name"
3402 */
3403 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3404 DEBUG( 1, ("Connection denied from %s to %s\n",
3405 tsocket_address_string(remote_address, talloc_tos()),
3406 tsocket_address_string(local_address, talloc_tos())));
3407 (void)srv_send_smb(sconn,(char *)buf, false,
3408 0, false, NULL);
3409 exit_server_cleanly("connection denied");
3410 }
3411
3412 DEBUG(10, ("Connection allowed from %s to %s\n",
3413 tsocket_address_string(remote_address, talloc_tos()),
3414 tsocket_address_string(local_address, talloc_tos())));
3415
3416 if (lp_preload_modules()) {
3417 smb_load_modules(lp_preload_modules());
3418 }
3419
3420 smb_perfcount_init();
3421
3422 if (!init_account_policy()) {
3423 exit_server("Could not open account policy tdb.\n");
3424 }
3425
3426 if (*lp_rootdir()) {
3427 if (chroot(lp_rootdir()) != 0) {
3428 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3429 exit_server("Failed to chroot()");
3430 }
3431 if (chdir("/") == -1) {
3432 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3433 exit_server("Failed to chroot()");
3434 }
3435 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3436 }
3437
3438 if (!srv_init_signing(sconn)) {
3439 exit_server("Failed to init smb_signing");
3440 }
3441
3442 if (!file_init(sconn)) {
3443 exit_server("file_init() failed");
3444 }
3445
3446 /* Setup oplocks */
3447 if (!init_oplocks(sconn))
3448 exit_server("Failed to init oplocks");
3449
3450 /* register our message handlers */
3451 messaging_register(sconn->msg_ctx, sconn,
3452 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3453 messaging_register(sconn->msg_ctx, sconn,
3454 MSG_SMB_CLOSE_FILE, msg_close_file);
3455 messaging_register(sconn->msg_ctx, sconn,
3456 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3457
3458 id_cache_register_msgs(sconn->msg_ctx);
3459 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3460 messaging_register(sconn->msg_ctx, sconn,
3461 ID_CACHE_KILL, smbd_id_cache_kill);
3462
3463 messaging_deregister(sconn->msg_ctx,
3464 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3465 messaging_register(sconn->msg_ctx, sconn,
3466 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3467
3468 /*
3469 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3470 * MSGs to all child processes
3471 */
3472 messaging_deregister(sconn->msg_ctx,
3473 MSG_DEBUG, NULL);
3474 messaging_register(sconn->msg_ctx, NULL,
3475 MSG_DEBUG, debug_message);
3476
3477 if ((lp_keepalive() != 0)
3478 && !(event_add_idle(ev_ctx, NULL,
3479 timeval_set(lp_keepalive(), 0),
3480 "keepalive", keepalive_fn,
3481 sconn))) {
3482 DEBUG(0, ("Could not add keepalive event\n"));
3483 exit(1);
3484 }
3485
3486 if (!(event_add_idle(ev_ctx, NULL,
3487 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3488 "deadtime", deadtime_fn, sconn))) {
3489 DEBUG(0, ("Could not add deadtime event\n"));
3490 exit(1);
3491 }
3492
3493 if (!(event_add_idle(ev_ctx, NULL,
3494 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3495 "housekeeping", housekeeping_fn, sconn))) {
3496 DEBUG(0, ("Could not add housekeeping event\n"));
3497 exit(1);
3498 }
3499
3500 #ifdef CLUSTER_SUPPORT
3501
3502 if (lp_clustering()) {
3503 /*
3504 * We need to tell ctdb about our client's TCP
3505 * connection, so that for failover ctdbd can send
3506 * tickle acks, triggering a reconnection by the
3507 * client.
3508 */
3509
3510 struct sockaddr_storage srv, clnt;
3511
3512 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3513 NTSTATUS status;
3514 status = smbd_register_ips(sconn, &srv, &clnt);
3515 if (!NT_STATUS_IS_OK(status)) {
3516 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3517 nt_errstr(status)));
3518 }
3519 } else
3520 {
3521 DEBUG(0,("Unable to get tcp info for "
3522 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3523 strerror(errno)));
3524 }
3525 }
3526
3527 #endif
3528
3529 sconn->nbt.got_session = false;
3530
3531 sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
3532
3533 sconn->smb1.sessions.done_sesssetup = false;
3534 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3535 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3536
3537 if (!init_dptrs(sconn)) {
3538 exit_server("init_dptrs() failed");
3539 }
3540
3541 sconn->smb1.fde = event_add_fd(ev_ctx,
3542 sconn,
3543 sconn->sock,
3544 EVENT_FD_READ,
3545 smbd_server_connection_handler,
3546 sconn);
3547 if (!sconn->smb1.fde) {
3548 exit_server("failed to create smbd_server_connection fde");
3549 }
3550
3551 sconn->conn->local_address = sconn->local_address;
3552 sconn->conn->remote_address = sconn->remote_address;
3553 sconn->conn->remote_hostname = sconn->remote_hostname;
3554 sconn->conn->protocol = PROTOCOL_NONE;
3555
3556 TALLOC_FREE(frame);
3557
3558 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3559
3560 while (True) {
3561 frame = talloc_stackframe_pool(8192);
3562
3563 errno = 0;
3564 if (tevent_loop_once(ev_ctx) == -1) {
3565 if (errno != EINTR) {
3566 DEBUG(3, ("tevent_loop_once failed: %s,"
3567 " exiting\n", strerror(errno) ));
3568 break;
3569 }
3570 }
3571
3572 TALLOC_FREE(frame);
3573 }
3574
3575 exit_server_cleanly(NULL);
3576 }
3577
3578 bool req_is_in_chain(struct smb_request *req)
3579 {
3580 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3581 /*
3582 * We're right now handling a subsequent request, so we must
3583 * be in a chain
3584 */
3585 return true;
3586 }
3587
3588 if (!is_andx_req(req->cmd)) {
3589 return false;
3590 }
3591
3592 if (req->wct < 2) {
3593 /*
3594 * Okay, an illegal request, but definitely not chained :-)
3595 */
3596 return false;
3597 }
3598
3599 return (CVAL(req->vwv+0, 0) != 0xFF);
3600 }
reg import