?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: use PROTOCOL_SMB2_02 instead PROTOCOL_SMB2
[Samba/gebeck_regimport.git] / source3 / smbd / process.c
blobd3957fe936a5416868e4995cf74f48e2a37c48fa
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/pcap.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38
39 extern bool global_machine_password_needs_changing;
40
41 static void construct_reply_common(struct smb_request *req, const char *inbuf,
42 char *outbuf);
43 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
44
45 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
46 {
47 bool ok;
48
49 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
50 return true;
51 }
52
53 sconn->smb1.echo_handler.ref_count++;
54
55 if (sconn->smb1.echo_handler.ref_count > 1) {
56 return true;
57 }
58
59 DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
60
61 do {
62 ok = fcntl_lock(
63 sconn->smb1.echo_handler.socket_lock_fd,
64 SMB_F_SETLKW, 0, 0, F_WRLCK);
65 } while (!ok && (errno == EINTR));
66
67 if (!ok) {
68 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
69 return false;
70 }
71
72 DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
73
74 return true;
75 }
76
77 void smbd_lock_socket(struct smbd_server_connection *sconn)
78 {
79 if (!smbd_lock_socket_internal(sconn)) {
80 exit_server_cleanly("failed to lock socket");
81 }
82 }
83
84 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
85 {
86 bool ok;
87
88 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
89 return true;
90 }
91
92 sconn->smb1.echo_handler.ref_count--;
93
94 if (sconn->smb1.echo_handler.ref_count > 0) {
95 return true;
96 }
97
98 do {
99 ok = fcntl_lock(
100 sconn->smb1.echo_handler.socket_lock_fd,
101 SMB_F_SETLKW, 0, 0, F_UNLCK);
102 } while (!ok && (errno == EINTR));
103
104 if (!ok) {
105 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
106 return false;
107 }
108
109 DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
110
111 return true;
112 }
113
114 void smbd_unlock_socket(struct smbd_server_connection *sconn)
115 {
116 if (!smbd_unlock_socket_internal(sconn)) {
117 exit_server_cleanly("failed to unlock socket");
118 }
119 }
120
121 /* Accessor function for smb_read_error for smbd functions. */
122
123 /****************************************************************************
124 Send an smb to a fd.
125 ****************************************************************************/
126
127 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
128 bool do_signing, uint32_t seqnum,
129 bool do_encrypt,
130 struct smb_perfcount_data *pcd)
131 {
132 size_t len = 0;
133 size_t nwritten=0;
134 ssize_t ret;
135 char *buf_out = buffer;
136
137 smbd_lock_socket(sconn);
138
139 if (do_signing) {
140 /* Sign the outgoing packet if required. */
141 srv_calculate_sign_mac(sconn, buf_out, seqnum);
142 }
143
144 if (do_encrypt) {
145 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
146 if (!NT_STATUS_IS_OK(status)) {
147 DEBUG(0, ("send_smb: SMB encryption failed "
148 "on outgoing packet! Error %s\n",
149 nt_errstr(status) ));
150 goto out;
151 }
152 }
153
154 len = smb_len(buf_out) + 4;
155
156 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
157 if (ret <= 0) {
158
159 char addr[INET6_ADDRSTRLEN];
160 /*
161 * Try and give an error message saying what
162 * client failed.
163 */
164 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
165 (int)sys_getpid(), (int)len,
166 get_peer_addr(sconn->sock, addr, sizeof(addr)),
167 (int)ret, strerror(errno) ));
168
169 srv_free_enc_buffer(buf_out);
170 goto out;
171 }
172
173 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
174 srv_free_enc_buffer(buf_out);
175 out:
176 SMB_PERFCOUNT_END(pcd);
177
178 smbd_unlock_socket(sconn);
179 return true;
180 }
181
182 /*******************************************************************
183 Setup the word count and byte count for a smb message.
184 ********************************************************************/
185
186 int srv_set_message(char *buf,
187 int num_words,
188 int num_bytes,
189 bool zero)
190 {
191 if (zero && (num_words || num_bytes)) {
192 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
193 }
194 SCVAL(buf,smb_wct,num_words);
195 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
196 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
197 return (smb_size + num_words*2 + num_bytes);
198 }
199
200 static bool valid_smb_header(const uint8_t *inbuf)
201 {
202 if (is_encrypted_packet(inbuf)) {
203 return true;
204 }
205 /*
206 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
207 * but it just looks weird to call strncmp for this one.
208 */
209 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
210 }
211
212 /* Socket functions for smbd packet processing. */
213
214 static bool valid_packet_size(size_t len)
215 {
216 /*
217 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
218 * of header. Don't print the error if this fits.... JRA.
219 */
220
221 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
222 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
223 (unsigned long)len));
224 return false;
225 }
226 return true;
227 }
228
229 static NTSTATUS read_packet_remainder(int fd, char *buffer,
230 unsigned int timeout, ssize_t len)
231 {
232 NTSTATUS status;
233
234 if (len <= 0) {
235 return NT_STATUS_OK;
236 }
237
238 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
239 if (!NT_STATUS_IS_OK(status)) {
240 char addr[INET6_ADDRSTRLEN];
241 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
242 "error = %s.\n",
243 get_peer_addr(fd, addr, sizeof(addr)),
244 nt_errstr(status)));
245 }
246 return status;
247 }
248
249 /****************************************************************************
250 Attempt a zerocopy writeX read. We know here that len > smb_size-4
251 ****************************************************************************/
252
253 /*
254 * Unfortunately, earlier versions of smbclient/libsmbclient
255 * don't send this "standard" writeX header. I've fixed this
256 * for 3.2 but we'll use the old method with earlier versions.
257 * Windows and CIFSFS at least use this standard size. Not
258 * sure about MacOSX.
259 */
260
261 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
262 (2*14) + /* word count (including bcc) */ \
263 1 /* pad byte */)
264
265 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
266 const char lenbuf[4],
267 struct smbd_server_connection *sconn,
268 int sock,
269 char **buffer,
270 unsigned int timeout,
271 size_t *p_unread,
272 size_t *len_ret)
273 {
274 /* Size of a WRITEX call (+4 byte len). */
275 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
276 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
277 ssize_t toread;
278 NTSTATUS status;
279
280 memcpy(writeX_header, lenbuf, 4);
281
282 status = read_fd_with_timeout(
283 sock, writeX_header + 4,
284 STANDARD_WRITE_AND_X_HEADER_SIZE,
285 STANDARD_WRITE_AND_X_HEADER_SIZE,
286 timeout, NULL);
287
288 if (!NT_STATUS_IS_OK(status)) {
289 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
290 "error = %s.\n",
291 tsocket_address_string(sconn->remote_address,
292 talloc_tos()),
293 nt_errstr(status)));
294 return status;
295 }
296
297 /*
298 * Ok - now try and see if this is a possible
299 * valid writeX call.
300 */
301
302 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
303 /*
304 * If the data offset is beyond what
305 * we've read, drain the extra bytes.
306 */
307 uint16_t doff = SVAL(writeX_header,smb_vwv11);
308 ssize_t newlen;
309
310 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
311 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
312 if (drain_socket(sock, drain) != drain) {
313 smb_panic("receive_smb_raw_talloc_partial_read:"
314 " failed to drain pending bytes");
315 }
316 } else {
317 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
318 }
319
320 /* Spoof down the length and null out the bcc. */
321 set_message_bcc(writeX_header, 0);
322 newlen = smb_len(writeX_header);
323
324 /* Copy the header we've written. */
325
326 *buffer = (char *)talloc_memdup(mem_ctx,
327 writeX_header,
328 sizeof(writeX_header));
329
330 if (*buffer == NULL) {
331 DEBUG(0, ("Could not allocate inbuf of length %d\n",
332 (int)sizeof(writeX_header)));
333 return NT_STATUS_NO_MEMORY;
334 }
335
336 /* Work out the remaining bytes. */
337 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
338 *len_ret = newlen + 4;
339 return NT_STATUS_OK;
340 }
341
342 if (!valid_packet_size(len)) {
343 return NT_STATUS_INVALID_PARAMETER;
344 }
345
346 /*
347 * Not a valid writeX call. Just do the standard
348 * talloc and return.
349 */
350
351 *buffer = talloc_array(mem_ctx, char, len+4);
352
353 if (*buffer == NULL) {
354 DEBUG(0, ("Could not allocate inbuf of length %d\n",
355 (int)len+4));
356 return NT_STATUS_NO_MEMORY;
357 }
358
359 /* Copy in what we already read. */
360 memcpy(*buffer,
361 writeX_header,
362 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
363 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
364
365 if(toread > 0) {
366 status = read_packet_remainder(
367 sock,
368 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
369 timeout, toread);
370
371 if (!NT_STATUS_IS_OK(status)) {
372 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
373 nt_errstr(status)));
374 return status;
375 }
376 }
377
378 *len_ret = len + 4;
379 return NT_STATUS_OK;
380 }
381
382 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
383 struct smbd_server_connection *sconn,
384 int sock,
385 char **buffer, unsigned int timeout,
386 size_t *p_unread, size_t *plen)
387 {
388 char lenbuf[4];
389 size_t len;
390 int min_recv_size = lp_min_receive_file_size();
391 NTSTATUS status;
392
393 *p_unread = 0;
394
395 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
396 &len);
397 if (!NT_STATUS_IS_OK(status)) {
398 return status;
399 }
400
401 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
402 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
403 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
404 !srv_is_signing_active(sconn) &&
405 sconn->smb1.echo_handler.trusted_fde == NULL) {
406
407 return receive_smb_raw_talloc_partial_read(
408 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
409 p_unread, plen);
410 }
411
412 if (!valid_packet_size(len)) {
413 return NT_STATUS_INVALID_PARAMETER;
414 }
415
416 /*
417 * The +4 here can't wrap, we've checked the length above already.
418 */
419
420 *buffer = talloc_array(mem_ctx, char, len+4);
421
422 if (*buffer == NULL) {
423 DEBUG(0, ("Could not allocate inbuf of length %d\n",
424 (int)len+4));
425 return NT_STATUS_NO_MEMORY;
426 }
427
428 memcpy(*buffer, lenbuf, sizeof(lenbuf));
429
430 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
431 if (!NT_STATUS_IS_OK(status)) {
432 return status;
433 }
434
435 *plen = len + 4;
436 return NT_STATUS_OK;
437 }
438
439 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
440 struct smbd_server_connection *sconn,
441 int sock,
442 char **buffer, unsigned int timeout,
443 size_t *p_unread, bool *p_encrypted,
444 size_t *p_len,
445 uint32_t *seqnum,
446 bool trusted_channel)
447 {
448 size_t len = 0;
449 NTSTATUS status;
450
451 *p_encrypted = false;
452
453 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
454 p_unread, &len);
455 if (!NT_STATUS_IS_OK(status)) {
456 DEBUG(1, ("read_smb_length_return_keepalive failed for "
457 "client %s read error = %s.\n",
458 tsocket_address_string(sconn->remote_address,
459 talloc_tos()),
460 nt_errstr(status)));
461 return status;
462 }
463
464 if (is_encrypted_packet((uint8_t *)*buffer)) {
465 status = srv_decrypt_buffer(*buffer);
466 if (!NT_STATUS_IS_OK(status)) {
467 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
468 "incoming packet! Error %s\n",
469 nt_errstr(status) ));
470 return status;
471 }
472 *p_encrypted = true;
473 }
474
475 /* Check the incoming SMB signature. */
476 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
477 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
478 "incoming packet!\n"));
479 return NT_STATUS_INVALID_NETWORK_RESPONSE;
480 }
481
482 *p_len = len;
483 return NT_STATUS_OK;
484 }
485
486 /*
487 * Initialize a struct smb_request from an inbuf
488 */
489
490 static bool init_smb_request(struct smb_request *req,
491 struct smbd_server_connection *sconn,
492 const uint8 *inbuf,
493 size_t unread_bytes, bool encrypted,
494 uint32_t seqnum)
495 {
496 size_t req_size = smb_len(inbuf) + 4;
497 /* Ensure we have at least smb_size bytes. */
498 if (req_size < smb_size) {
499 DEBUG(0,("init_smb_request: invalid request size %u\n",
500 (unsigned int)req_size ));
501 return false;
502 }
503 req->cmd = CVAL(inbuf, smb_com);
504 req->flags2 = SVAL(inbuf, smb_flg2);
505 req->smbpid = SVAL(inbuf, smb_pid);
506 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
507 req->seqnum = seqnum;
508 req->vuid = SVAL(inbuf, smb_uid);
509 req->tid = SVAL(inbuf, smb_tid);
510 req->wct = CVAL(inbuf, smb_wct);
511 req->vwv = discard_const_p(uint16_t, (inbuf+smb_vwv));
512 req->buflen = smb_buflen(inbuf);
513 req->buf = (const uint8_t *)smb_buf_const(inbuf);
514 req->unread_bytes = unread_bytes;
515 req->encrypted = encrypted;
516 req->sconn = sconn;
517 req->conn = conn_find(sconn,req->tid);
518 req->chain_fsp = NULL;
519 req->chain_outbuf = NULL;
520 req->done = false;
521 req->smb2req = NULL;
522 smb_init_perfcount_data(&req->pcd);
523
524 /* Ensure we have at least wct words and 2 bytes of bcc. */
525 if (smb_size + req->wct*2 > req_size) {
526 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
527 (unsigned int)req->wct,
528 (unsigned int)req_size));
529 return false;
530 }
531 /* Ensure bcc is correct. */
532 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
533 DEBUG(0,("init_smb_request: invalid bcc number %u "
534 "(wct = %u, size %u)\n",
535 (unsigned int)req->buflen,
536 (unsigned int)req->wct,
537 (unsigned int)req_size));
538 return false;
539 }
540
541 req->outbuf = NULL;
542 return true;
543 }
544
545 static void process_smb(struct smbd_server_connection *conn,
546 uint8_t *inbuf, size_t nread, size_t unread_bytes,
547 uint32_t seqnum, bool encrypted,
548 struct smb_perfcount_data *deferred_pcd);
549
550 static void smbd_deferred_open_timer(struct event_context *ev,
551 struct timed_event *te,
552 struct timeval _tval,
553 void *private_data)
554 {
555 struct pending_message_list *msg = talloc_get_type(private_data,
556 struct pending_message_list);
557 TALLOC_CTX *mem_ctx = talloc_tos();
558 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
559 uint8_t *inbuf;
560
561 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
562 msg->buf.length);
563 if (inbuf == NULL) {
564 exit_server("smbd_deferred_open_timer: talloc failed\n");
565 return;
566 }
567
568 /* We leave this message on the queue so the open code can
569 know this is a retry. */
570 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
571 (unsigned long long)mid ));
572
573 /* Mark the message as processed so this is not
574 * re-processed in error. */
575 msg->processed = true;
576
577 process_smb(smbd_server_conn, inbuf,
578 msg->buf.length, 0,
579 msg->seqnum, msg->encrypted, &msg->pcd);
580
581 /* If it's still there and was processed, remove it. */
582 msg = get_deferred_open_message_smb(mid);
583 if (msg && msg->processed) {
584 remove_deferred_open_message_smb(mid);
585 }
586 }
587
588 /****************************************************************************
589 Function to push a message onto the tail of a linked list of smb messages ready
590 for processing.
591 ****************************************************************************/
592
593 static bool push_queued_message(struct smb_request *req,
594 struct timeval request_time,
595 struct timeval end_time,
596 char *private_data, size_t private_len)
597 {
598 int msg_len = smb_len(req->inbuf) + 4;
599 struct pending_message_list *msg;
600
601 msg = talloc_zero(NULL, struct pending_message_list);
602
603 if(msg == NULL) {
604 DEBUG(0,("push_message: malloc fail (1)\n"));
605 return False;
606 }
607
608 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
609 if(msg->buf.data == NULL) {
610 DEBUG(0,("push_message: malloc fail (2)\n"));
611 TALLOC_FREE(msg);
612 return False;
613 }
614
615 msg->request_time = request_time;
616 msg->seqnum = req->seqnum;
617 msg->encrypted = req->encrypted;
618 msg->processed = false;
619 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
620
621 if (private_data) {
622 msg->private_data = data_blob_talloc(msg, private_data,
623 private_len);
624 if (msg->private_data.data == NULL) {
625 DEBUG(0,("push_message: malloc fail (3)\n"));
626 TALLOC_FREE(msg);
627 return False;
628 }
629 }
630
631 msg->te = event_add_timed(server_event_context(),
632 msg,
633 end_time,
634 smbd_deferred_open_timer,
635 msg);
636 if (!msg->te) {
637 DEBUG(0,("push_message: event_add_timed failed\n"));
638 TALLOC_FREE(msg);
639 return false;
640 }
641
642 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
643
644 DEBUG(10,("push_message: pushed message length %u on "
645 "deferred_open_queue\n", (unsigned int)msg_len));
646
647 return True;
648 }
649
650 /****************************************************************************
651 Function to delete a sharing violation open message by mid.
652 ****************************************************************************/
653
654 void remove_deferred_open_message_smb(uint64_t mid)
655 {
656 struct pending_message_list *pml;
657
658 if (smbd_server_conn->using_smb2) {
659 remove_deferred_open_message_smb2(smbd_server_conn, mid);
660 return;
661 }
662
663 for (pml = deferred_open_queue; pml; pml = pml->next) {
664 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
665 DEBUG(10,("remove_deferred_open_message_smb: "
666 "deleting mid %llu len %u\n",
667 (unsigned long long)mid,
668 (unsigned int)pml->buf.length ));
669 DLIST_REMOVE(deferred_open_queue, pml);
670 TALLOC_FREE(pml);
671 return;
672 }
673 }
674 }
675
676 /****************************************************************************
677 Move a sharing violation open retry message to the front of the list and
678 schedule it for immediate processing.
679 ****************************************************************************/
680
681 void schedule_deferred_open_message_smb(uint64_t mid)
682 {
683 struct pending_message_list *pml;
684 int i = 0;
685
686 if (smbd_server_conn->using_smb2) {
687 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
688 return;
689 }
690
691 for (pml = deferred_open_queue; pml; pml = pml->next) {
692 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
693
694 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
695 "msg_mid = %llu\n",
696 i++,
697 (unsigned long long)msg_mid ));
698
699 if (mid == msg_mid) {
700 struct timed_event *te;
701
702 if (pml->processed) {
703 /* A processed message should not be
704 * rescheduled. */
705 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
706 "message mid %llu was already processed\n",
707 (unsigned long long)msg_mid ));
708 continue;
709 }
710
711 DEBUG(10,("schedule_deferred_open_message_smb: "
712 "scheduling mid %llu\n",
713 (unsigned long long)mid ));
714
715 te = event_add_timed(server_event_context(),
716 pml,
717 timeval_zero(),
718 smbd_deferred_open_timer,
719 pml);
720 if (!te) {
721 DEBUG(10,("schedule_deferred_open_message_smb: "
722 "event_add_timed() failed, "
723 "skipping mid %llu\n",
724 (unsigned long long)msg_mid ));
725 }
726
727 TALLOC_FREE(pml->te);
728 pml->te = te;
729 DLIST_PROMOTE(deferred_open_queue, pml);
730 return;
731 }
732 }
733
734 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
735 "find message mid %llu\n",
736 (unsigned long long)mid ));
737 }
738
739 /****************************************************************************
740 Return true if this mid is on the deferred queue and was not yet processed.
741 ****************************************************************************/
742
743 bool open_was_deferred(uint64_t mid)
744 {
745 struct pending_message_list *pml;
746
747 if (smbd_server_conn->using_smb2) {
748 return open_was_deferred_smb2(smbd_server_conn, mid);
749 }
750
751 for (pml = deferred_open_queue; pml; pml = pml->next) {
752 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
753 return True;
754 }
755 }
756 return False;
757 }
758
759 /****************************************************************************
760 Return the message queued by this mid.
761 ****************************************************************************/
762
763 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
764 {
765 struct pending_message_list *pml;
766
767 for (pml = deferred_open_queue; pml; pml = pml->next) {
768 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
769 return pml;
770 }
771 }
772 return NULL;
773 }
774
775 /****************************************************************************
776 Get the state data queued by this mid.
777 ****************************************************************************/
778
779 bool get_deferred_open_message_state(struct smb_request *smbreq,
780 struct timeval *p_request_time,
781 void **pp_state)
782 {
783 struct pending_message_list *pml;
784
785 if (smbd_server_conn->using_smb2) {
786 return get_deferred_open_message_state_smb2(smbreq->smb2req,
787 p_request_time,
788 pp_state);
789 }
790
791 pml = get_deferred_open_message_smb(smbreq->mid);
792 if (!pml) {
793 return false;
794 }
795 if (p_request_time) {
796 *p_request_time = pml->request_time;
797 }
798 if (pp_state) {
799 *pp_state = (void *)pml->private_data.data;
800 }
801 return true;
802 }
803
804 /****************************************************************************
805 Function to push a deferred open smb message onto a linked list of local smb
806 messages ready for processing.
807 ****************************************************************************/
808
809 bool push_deferred_open_message_smb(struct smb_request *req,
810 struct timeval request_time,
811 struct timeval timeout,
812 struct file_id id,
813 char *private_data, size_t priv_len)
814 {
815 struct timeval end_time;
816
817 if (req->smb2req) {
818 return push_deferred_open_message_smb2(req->smb2req,
819 request_time,
820 timeout,
821 id,
822 private_data,
823 priv_len);
824 }
825
826 if (req->unread_bytes) {
827 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
828 "unread_bytes = %u\n",
829 (unsigned int)req->unread_bytes ));
830 smb_panic("push_deferred_open_message_smb: "
831 "logic error unread_bytes != 0" );
832 }
833
834 end_time = timeval_sum(&request_time, &timeout);
835
836 DEBUG(10,("push_deferred_open_message_smb: pushing message "
837 "len %u mid %llu timeout time [%u.%06u]\n",
838 (unsigned int) smb_len(req->inbuf)+4,
839 (unsigned long long)req->mid,
840 (unsigned int)end_time.tv_sec,
841 (unsigned int)end_time.tv_usec));
842
843 return push_queued_message(req, request_time, end_time,
844 private_data, priv_len);
845 }
846
847 static void smbd_sig_term_handler(struct tevent_context *ev,
848 struct tevent_signal *se,
849 int signum,
850 int count,
851 void *siginfo,
852 void *private_data)
853 {
854 exit_server_cleanly("termination signal");
855 }
856
857 void smbd_setup_sig_term_handler(void)
858 {
859 struct tevent_signal *se;
860
861 se = tevent_add_signal(server_event_context(),
862 server_event_context(),
863 SIGTERM, 0,
864 smbd_sig_term_handler,
865 NULL);
866 if (!se) {
867 exit_server("failed to setup SIGTERM handler");
868 }
869 }
870
871 static void smbd_sig_hup_handler(struct tevent_context *ev,
872 struct tevent_signal *se,
873 int signum,
874 int count,
875 void *siginfo,
876 void *private_data)
877 {
878 struct messaging_context *msg_ctx = talloc_get_type_abort(
879 private_data, struct messaging_context);
880 change_to_root_user();
881 DEBUG(1,("Reloading services after SIGHUP\n"));
882 reload_services(msg_ctx, smbd_server_conn->sock, False);
883 if (am_parent) {
884 pcap_cache_reload(ev, msg_ctx, &reload_pcap_change_notify);
885 }
886 }
887
888 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
889 struct messaging_context *msg_ctx)
890 {
891 struct tevent_signal *se;
892
893 se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
894 msg_ctx);
895 if (!se) {
896 exit_server("failed to setup SIGHUP handler");
897 }
898 }
899
900 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
901 {
902 int timeout;
903 int num_pfds = 0;
904 int ret;
905 bool retry;
906
907 timeout = SMBD_SELECT_TIMEOUT * 1000;
908
909 /*
910 * Are there any timed events waiting ? If so, ensure we don't
911 * select for longer than it would take to wait for them.
912 */
913
914 event_add_to_poll_args(server_event_context(), conn,
915 &conn->pfds, &num_pfds, &timeout);
916
917 /* Process a signal and timed events now... */
918 if (run_events_poll(server_event_context(), 0, NULL, 0)) {
919 return NT_STATUS_RETRY;
920 }
921
922 {
923 int sav;
924 START_PROFILE(smbd_idle);
925
926 ret = sys_poll(conn->pfds, num_pfds, timeout);
927 sav = errno;
928
929 END_PROFILE(smbd_idle);
930 errno = sav;
931 }
932
933 if (ret == -1) {
934 if (errno == EINTR) {
935 return NT_STATUS_RETRY;
936 }
937 return map_nt_error_from_unix(errno);
938 }
939
940 retry = run_events_poll(server_event_context(), ret, conn->pfds,
941 num_pfds);
942 if (retry) {
943 return NT_STATUS_RETRY;
944 }
945
946 /* Did we timeout ? */
947 if (ret == 0) {
948 return NT_STATUS_RETRY;
949 }
950
951 /* should not be reached */
952 return NT_STATUS_INTERNAL_ERROR;
953 }
954
955 /*
956 * Only allow 5 outstanding trans requests. We're allocating memory, so
957 * prevent a DoS.
958 */
959
960 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
961 {
962 int count = 0;
963 for (; list != NULL; list = list->next) {
964
965 if (list->mid == mid) {
966 return NT_STATUS_INVALID_PARAMETER;
967 }
968
969 count += 1;
970 }
971 if (count > 5) {
972 return NT_STATUS_INSUFFICIENT_RESOURCES;
973 }
974
975 return NT_STATUS_OK;
976 }
977
978 /*
979 These flags determine some of the permissions required to do an operation
980
981 Note that I don't set NEED_WRITE on some write operations because they
982 are used by some brain-dead clients when printing, and I don't want to
983 force write permissions on print services.
984 */
985 #define AS_USER (1<<0)
986 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
987 #define TIME_INIT (1<<2)
988 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
989 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
990 #define DO_CHDIR (1<<6)
991
992 /*
993 define a list of possible SMB messages and their corresponding
994 functions. Any message that has a NULL function is unimplemented -
995 please feel free to contribute implementations!
996 */
997 static const struct smb_message_struct {
998 const char *name;
999 void (*fn)(struct smb_request *req);
1000 int flags;
1001 } smb_messages[256] = {
1002
1003 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1004 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1005 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1006 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1007 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1008 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1009 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1010 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1011 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1012 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1013 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1014 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1015 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1016 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1017 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1018 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1019 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1020 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1021 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1022 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1023 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1024 /* 0x15 */ { NULL, NULL, 0 },
1025 /* 0x16 */ { NULL, NULL, 0 },
1026 /* 0x17 */ { NULL, NULL, 0 },
1027 /* 0x18 */ { NULL, NULL, 0 },
1028 /* 0x19 */ { NULL, NULL, 0 },
1029 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1030 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1031 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1032 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1033 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1034 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1035 /* 0x20 */ { "SMBwritec", NULL,0},
1036 /* 0x21 */ { NULL, NULL, 0 },
1037 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1038 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1039 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1040 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1041 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1042 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1043 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1044 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1045 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1046 /* 0x2b */ { "SMBecho",reply_echo,0},
1047 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1048 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1049 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1050 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1051 /* 0x30 */ { NULL, NULL, 0 },
1052 /* 0x31 */ { NULL, NULL, 0 },
1053 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1054 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1055 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1056 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1057 /* 0x36 */ { NULL, NULL, 0 },
1058 /* 0x37 */ { NULL, NULL, 0 },
1059 /* 0x38 */ { NULL, NULL, 0 },
1060 /* 0x39 */ { NULL, NULL, 0 },
1061 /* 0x3a */ { NULL, NULL, 0 },
1062 /* 0x3b */ { NULL, NULL, 0 },
1063 /* 0x3c */ { NULL, NULL, 0 },
1064 /* 0x3d */ { NULL, NULL, 0 },
1065 /* 0x3e */ { NULL, NULL, 0 },
1066 /* 0x3f */ { NULL, NULL, 0 },
1067 /* 0x40 */ { NULL, NULL, 0 },
1068 /* 0x41 */ { NULL, NULL, 0 },
1069 /* 0x42 */ { NULL, NULL, 0 },
1070 /* 0x43 */ { NULL, NULL, 0 },
1071 /* 0x44 */ { NULL, NULL, 0 },
1072 /* 0x45 */ { NULL, NULL, 0 },
1073 /* 0x46 */ { NULL, NULL, 0 },
1074 /* 0x47 */ { NULL, NULL, 0 },
1075 /* 0x48 */ { NULL, NULL, 0 },
1076 /* 0x49 */ { NULL, NULL, 0 },
1077 /* 0x4a */ { NULL, NULL, 0 },
1078 /* 0x4b */ { NULL, NULL, 0 },
1079 /* 0x4c */ { NULL, NULL, 0 },
1080 /* 0x4d */ { NULL, NULL, 0 },
1081 /* 0x4e */ { NULL, NULL, 0 },
1082 /* 0x4f */ { NULL, NULL, 0 },
1083 /* 0x50 */ { NULL, NULL, 0 },
1084 /* 0x51 */ { NULL, NULL, 0 },
1085 /* 0x52 */ { NULL, NULL, 0 },
1086 /* 0x53 */ { NULL, NULL, 0 },
1087 /* 0x54 */ { NULL, NULL, 0 },
1088 /* 0x55 */ { NULL, NULL, 0 },
1089 /* 0x56 */ { NULL, NULL, 0 },
1090 /* 0x57 */ { NULL, NULL, 0 },
1091 /* 0x58 */ { NULL, NULL, 0 },
1092 /* 0x59 */ { NULL, NULL, 0 },
1093 /* 0x5a */ { NULL, NULL, 0 },
1094 /* 0x5b */ { NULL, NULL, 0 },
1095 /* 0x5c */ { NULL, NULL, 0 },
1096 /* 0x5d */ { NULL, NULL, 0 },
1097 /* 0x5e */ { NULL, NULL, 0 },
1098 /* 0x5f */ { NULL, NULL, 0 },
1099 /* 0x60 */ { NULL, NULL, 0 },
1100 /* 0x61 */ { NULL, NULL, 0 },
1101 /* 0x62 */ { NULL, NULL, 0 },
1102 /* 0x63 */ { NULL, NULL, 0 },
1103 /* 0x64 */ { NULL, NULL, 0 },
1104 /* 0x65 */ { NULL, NULL, 0 },
1105 /* 0x66 */ { NULL, NULL, 0 },
1106 /* 0x67 */ { NULL, NULL, 0 },
1107 /* 0x68 */ { NULL, NULL, 0 },
1108 /* 0x69 */ { NULL, NULL, 0 },
1109 /* 0x6a */ { NULL, NULL, 0 },
1110 /* 0x6b */ { NULL, NULL, 0 },
1111 /* 0x6c */ { NULL, NULL, 0 },
1112 /* 0x6d */ { NULL, NULL, 0 },
1113 /* 0x6e */ { NULL, NULL, 0 },
1114 /* 0x6f */ { NULL, NULL, 0 },
1115 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1116 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1117 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1118 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1119 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1120 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1121 /* 0x76 */ { NULL, NULL, 0 },
1122 /* 0x77 */ { NULL, NULL, 0 },
1123 /* 0x78 */ { NULL, NULL, 0 },
1124 /* 0x79 */ { NULL, NULL, 0 },
1125 /* 0x7a */ { NULL, NULL, 0 },
1126 /* 0x7b */ { NULL, NULL, 0 },
1127 /* 0x7c */ { NULL, NULL, 0 },
1128 /* 0x7d */ { NULL, NULL, 0 },
1129 /* 0x7e */ { NULL, NULL, 0 },
1130 /* 0x7f */ { NULL, NULL, 0 },
1131 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1132 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1133 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1134 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1135 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1136 /* 0x85 */ { NULL, NULL, 0 },
1137 /* 0x86 */ { NULL, NULL, 0 },
1138 /* 0x87 */ { NULL, NULL, 0 },
1139 /* 0x88 */ { NULL, NULL, 0 },
1140 /* 0x89 */ { NULL, NULL, 0 },
1141 /* 0x8a */ { NULL, NULL, 0 },
1142 /* 0x8b */ { NULL, NULL, 0 },
1143 /* 0x8c */ { NULL, NULL, 0 },
1144 /* 0x8d */ { NULL, NULL, 0 },
1145 /* 0x8e */ { NULL, NULL, 0 },
1146 /* 0x8f */ { NULL, NULL, 0 },
1147 /* 0x90 */ { NULL, NULL, 0 },
1148 /* 0x91 */ { NULL, NULL, 0 },
1149 /* 0x92 */ { NULL, NULL, 0 },
1150 /* 0x93 */ { NULL, NULL, 0 },
1151 /* 0x94 */ { NULL, NULL, 0 },
1152 /* 0x95 */ { NULL, NULL, 0 },
1153 /* 0x96 */ { NULL, NULL, 0 },
1154 /* 0x97 */ { NULL, NULL, 0 },
1155 /* 0x98 */ { NULL, NULL, 0 },
1156 /* 0x99 */ { NULL, NULL, 0 },
1157 /* 0x9a */ { NULL, NULL, 0 },
1158 /* 0x9b */ { NULL, NULL, 0 },
1159 /* 0x9c */ { NULL, NULL, 0 },
1160 /* 0x9d */ { NULL, NULL, 0 },
1161 /* 0x9e */ { NULL, NULL, 0 },
1162 /* 0x9f */ { NULL, NULL, 0 },
1163 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1164 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1165 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1166 /* 0xa3 */ { NULL, NULL, 0 },
1167 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1168 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1169 /* 0xa6 */ { NULL, NULL, 0 },
1170 /* 0xa7 */ { NULL, NULL, 0 },
1171 /* 0xa8 */ { NULL, NULL, 0 },
1172 /* 0xa9 */ { NULL, NULL, 0 },
1173 /* 0xaa */ { NULL, NULL, 0 },
1174 /* 0xab */ { NULL, NULL, 0 },
1175 /* 0xac */ { NULL, NULL, 0 },
1176 /* 0xad */ { NULL, NULL, 0 },
1177 /* 0xae */ { NULL, NULL, 0 },
1178 /* 0xaf */ { NULL, NULL, 0 },
1179 /* 0xb0 */ { NULL, NULL, 0 },
1180 /* 0xb1 */ { NULL, NULL, 0 },
1181 /* 0xb2 */ { NULL, NULL, 0 },
1182 /* 0xb3 */ { NULL, NULL, 0 },
1183 /* 0xb4 */ { NULL, NULL, 0 },
1184 /* 0xb5 */ { NULL, NULL, 0 },
1185 /* 0xb6 */ { NULL, NULL, 0 },
1186 /* 0xb7 */ { NULL, NULL, 0 },
1187 /* 0xb8 */ { NULL, NULL, 0 },
1188 /* 0xb9 */ { NULL, NULL, 0 },
1189 /* 0xba */ { NULL, NULL, 0 },
1190 /* 0xbb */ { NULL, NULL, 0 },
1191 /* 0xbc */ { NULL, NULL, 0 },
1192 /* 0xbd */ { NULL, NULL, 0 },
1193 /* 0xbe */ { NULL, NULL, 0 },
1194 /* 0xbf */ { NULL, NULL, 0 },
1195 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1196 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1197 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1198 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1199 /* 0xc4 */ { NULL, NULL, 0 },
1200 /* 0xc5 */ { NULL, NULL, 0 },
1201 /* 0xc6 */ { NULL, NULL, 0 },
1202 /* 0xc7 */ { NULL, NULL, 0 },
1203 /* 0xc8 */ { NULL, NULL, 0 },
1204 /* 0xc9 */ { NULL, NULL, 0 },
1205 /* 0xca */ { NULL, NULL, 0 },
1206 /* 0xcb */ { NULL, NULL, 0 },
1207 /* 0xcc */ { NULL, NULL, 0 },
1208 /* 0xcd */ { NULL, NULL, 0 },
1209 /* 0xce */ { NULL, NULL, 0 },
1210 /* 0xcf */ { NULL, NULL, 0 },
1211 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1212 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1213 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1214 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1215 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1216 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1217 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1218 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1219 /* 0xd8 */ { NULL, NULL, 0 },
1220 /* 0xd9 */ { NULL, NULL, 0 },
1221 /* 0xda */ { NULL, NULL, 0 },
1222 /* 0xdb */ { NULL, NULL, 0 },
1223 /* 0xdc */ { NULL, NULL, 0 },
1224 /* 0xdd */ { NULL, NULL, 0 },
1225 /* 0xde */ { NULL, NULL, 0 },
1226 /* 0xdf */ { NULL, NULL, 0 },
1227 /* 0xe0 */ { NULL, NULL, 0 },
1228 /* 0xe1 */ { NULL, NULL, 0 },
1229 /* 0xe2 */ { NULL, NULL, 0 },
1230 /* 0xe3 */ { NULL, NULL, 0 },
1231 /* 0xe4 */ { NULL, NULL, 0 },
1232 /* 0xe5 */ { NULL, NULL, 0 },
1233 /* 0xe6 */ { NULL, NULL, 0 },
1234 /* 0xe7 */ { NULL, NULL, 0 },
1235 /* 0xe8 */ { NULL, NULL, 0 },
1236 /* 0xe9 */ { NULL, NULL, 0 },
1237 /* 0xea */ { NULL, NULL, 0 },
1238 /* 0xeb */ { NULL, NULL, 0 },
1239 /* 0xec */ { NULL, NULL, 0 },
1240 /* 0xed */ { NULL, NULL, 0 },
1241 /* 0xee */ { NULL, NULL, 0 },
1242 /* 0xef */ { NULL, NULL, 0 },
1243 /* 0xf0 */ { NULL, NULL, 0 },
1244 /* 0xf1 */ { NULL, NULL, 0 },
1245 /* 0xf2 */ { NULL, NULL, 0 },
1246 /* 0xf3 */ { NULL, NULL, 0 },
1247 /* 0xf4 */ { NULL, NULL, 0 },
1248 /* 0xf5 */ { NULL, NULL, 0 },
1249 /* 0xf6 */ { NULL, NULL, 0 },
1250 /* 0xf7 */ { NULL, NULL, 0 },
1251 /* 0xf8 */ { NULL, NULL, 0 },
1252 /* 0xf9 */ { NULL, NULL, 0 },
1253 /* 0xfa */ { NULL, NULL, 0 },
1254 /* 0xfb */ { NULL, NULL, 0 },
1255 /* 0xfc */ { NULL, NULL, 0 },
1256 /* 0xfd */ { NULL, NULL, 0 },
1257 /* 0xfe */ { NULL, NULL, 0 },
1258 /* 0xff */ { NULL, NULL, 0 }
1259
1260 };
1261
1262 /*******************************************************************
1263 allocate and initialize a reply packet
1264 ********************************************************************/
1265
1266 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1267 const char *inbuf, char **outbuf, uint8_t num_words,
1268 uint32_t num_bytes)
1269 {
1270 /*
1271 * Protect against integer wrap
1272 */
1273 if ((num_bytes > 0xffffff)
1274 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1275 char *msg;
1276 if (asprintf(&msg, "num_bytes too large: %u",
1277 (unsigned)num_bytes) == -1) {
1278 msg = discard_const_p(char, "num_bytes too large");
1279 }
1280 smb_panic(msg);
1281 }
1282
1283 *outbuf = talloc_array(mem_ctx, char,
1284 smb_size + num_words*2 + num_bytes);
1285 if (*outbuf == NULL) {
1286 return false;
1287 }
1288
1289 construct_reply_common(req, inbuf, *outbuf);
1290 srv_set_message(*outbuf, num_words, num_bytes, false);
1291 /*
1292 * Zero out the word area, the caller has to take care of the bcc area
1293 * himself
1294 */
1295 if (num_words != 0) {
1296 memset(*outbuf + smb_vwv0, 0, num_words*2);
1297 }
1298
1299 return true;
1300 }
1301
1302 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1303 {
1304 char *outbuf;
1305 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1306 num_bytes)) {
1307 smb_panic("could not allocate output buffer\n");
1308 }
1309 req->outbuf = (uint8_t *)outbuf;
1310 }
1311
1312
1313 /*******************************************************************
1314 Dump a packet to a file.
1315 ********************************************************************/
1316
1317 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1318 {
1319 int fd, i;
1320 char *fname = NULL;
1321 if (DEBUGLEVEL < 50) {
1322 return;
1323 }
1324
1325 if (len < 4) len = smb_len(data)+4;
1326 for (i=1;i<100;i++) {
1327 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1328 type ? "req" : "resp") == -1) {
1329 return;
1330 }
1331 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1332 if (fd != -1 || errno != EEXIST) break;
1333 }
1334 if (fd != -1) {
1335 ssize_t ret = write(fd, data, len);
1336 if (ret != len)
1337 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1338 close(fd);
1339 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1340 }
1341 SAFE_FREE(fname);
1342 }
1343
1344 /****************************************************************************
1345 Prepare everything for calling the actual request function, and potentially
1346 call the request function via the "new" interface.
1347
1348 Return False if the "legacy" function needs to be called, everything is
1349 prepared.
1350
1351 Return True if we're done.
1352
1353 I know this API sucks, but it is the one with the least code change I could
1354 find.
1355 ****************************************************************************/
1356
1357 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1358 {
1359 int flags;
1360 uint16 session_tag;
1361 connection_struct *conn = NULL;
1362 struct smbd_server_connection *sconn = req->sconn;
1363 char *raddr;
1364
1365 errno = 0;
1366
1367 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1368 * so subtract 4 from it. */
1369 if (!valid_smb_header(req->inbuf)
1370 || (size < (smb_size - 4))) {
1371 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1372 smb_len(req->inbuf)));
1373 exit_server_cleanly("Non-SMB packet");
1374 }
1375
1376 if (smb_messages[type].fn == NULL) {
1377 DEBUG(0,("Unknown message type %d!\n",type));
1378 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1379 reply_unknown_new(req, type);
1380 return NULL;
1381 }
1382
1383 flags = smb_messages[type].flags;
1384
1385 /* In share mode security we must ignore the vuid. */
1386 session_tag = (lp_security() == SEC_SHARE)
1387 ? UID_FIELD_INVALID : req->vuid;
1388 conn = req->conn;
1389
1390 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1391 (int)sys_getpid(), (unsigned long)conn));
1392
1393 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1394
1395 /* Ensure this value is replaced in the incoming packet. */
1396 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1397
1398 /*
1399 * Ensure the correct username is in current_user_info. This is a
1400 * really ugly bugfix for problems with multiple session_setup_and_X's
1401 * being done and allowing %U and %G substitutions to work correctly.
1402 * There is a reason this code is done here, don't move it unless you
1403 * know what you're doing... :-).
1404 * JRA.
1405 */
1406
1407 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1408 user_struct *vuser = NULL;
1409
1410 sconn->smb1.sessions.last_session_tag = session_tag;
1411 if(session_tag != UID_FIELD_INVALID) {
1412 vuser = get_valid_user_struct(sconn, session_tag);
1413 if (vuser) {
1414 set_current_user_info(
1415 vuser->session_info->sanitized_username,
1416 vuser->session_info->unix_name,
1417 vuser->session_info->info3->base.domain.string);
1418 }
1419 }
1420 }
1421
1422 /* Does this call need to be run as the connected user? */
1423 if (flags & AS_USER) {
1424
1425 /* Does this call need a valid tree connection? */
1426 if (!conn) {
1427 /*
1428 * Amazingly, the error code depends on the command
1429 * (from Samba4).
1430 */
1431 if (type == SMBntcreateX) {
1432 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1433 } else {
1434 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1435 }
1436 return NULL;
1437 }
1438
1439 if (!change_to_user(conn,session_tag)) {
1440 DEBUG(0, ("Error: Could not change to user. Removing "
1441 "deferred open, mid=%llu.\n",
1442 (unsigned long long)req->mid));
1443 reply_force_doserror(req, ERRSRV, ERRbaduid);
1444 return conn;
1445 }
1446
1447 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1448
1449 /* Does it need write permission? */
1450 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1451 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1452 return conn;
1453 }
1454
1455 /* IPC services are limited */
1456 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1457 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1458 return conn;
1459 }
1460 } else {
1461 /* This call needs to be run as root */
1462 change_to_root_user();
1463 }
1464
1465 /* load service specific parameters */
1466 if (conn) {
1467 if (req->encrypted) {
1468 conn->encrypted_tid = true;
1469 /* encrypted required from now on. */
1470 conn->encrypt_level = Required;
1471 } else if (ENCRYPTION_REQUIRED(conn)) {
1472 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1473 exit_server_cleanly("encryption required "
1474 "on connection");
1475 return conn;
1476 }
1477 }
1478
1479 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1480 (flags & (AS_USER|DO_CHDIR)
1481 ?True:False))) {
1482 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1483 return conn;
1484 }
1485 conn->num_smb_operations++;
1486 }
1487
1488 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1489 talloc_tos());
1490 if (raddr == NULL) {
1491 reply_nterror(req, NT_STATUS_NO_MEMORY);
1492 return conn;
1493 }
1494
1495 /* does this protocol need to be run as guest? */
1496 if ((flags & AS_GUEST)
1497 && (!change_to_guest() ||
1498 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1499 sconn->remote_hostname,
1500 raddr))) {
1501 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1502 return conn;
1503 }
1504
1505 smb_messages[type].fn(req);
1506 return req->conn;
1507 }
1508
1509 /****************************************************************************
1510 Construct a reply to the incoming packet.
1511 ****************************************************************************/
1512
1513 static void construct_reply(struct smbd_server_connection *sconn,
1514 char *inbuf, int size, size_t unread_bytes,
1515 uint32_t seqnum, bool encrypted,
1516 struct smb_perfcount_data *deferred_pcd)
1517 {
1518 connection_struct *conn;
1519 struct smb_request *req;
1520
1521 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1522 smb_panic("could not allocate smb_request");
1523 }
1524
1525 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1526 encrypted, seqnum)) {
1527 exit_server_cleanly("Invalid SMB request");
1528 }
1529
1530 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1531
1532 /* we popped this message off the queue - keep original perf data */
1533 if (deferred_pcd)
1534 req->pcd = *deferred_pcd;
1535 else {
1536 SMB_PERFCOUNT_START(&req->pcd);
1537 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1538 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1539 }
1540
1541 conn = switch_message(req->cmd, req, size);
1542
1543 if (req->unread_bytes) {
1544 /* writeX failed. drain socket. */
1545 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1546 req->unread_bytes) {
1547 smb_panic("failed to drain pending bytes");
1548 }
1549 req->unread_bytes = 0;
1550 }
1551
1552 if (req->done) {
1553 TALLOC_FREE(req);
1554 return;
1555 }
1556
1557 if (req->outbuf == NULL) {
1558 return;
1559 }
1560
1561 if (CVAL(req->outbuf,0) == 0) {
1562 show_msg((char *)req->outbuf);
1563 }
1564
1565 if (!srv_send_smb(req->sconn,
1566 (char *)req->outbuf,
1567 true, req->seqnum+1,
1568 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1569 &req->pcd)) {
1570 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1571 }
1572
1573 TALLOC_FREE(req);
1574
1575 return;
1576 }
1577
1578 /****************************************************************************
1579 Process an smb from the client
1580 ****************************************************************************/
1581 static void process_smb(struct smbd_server_connection *sconn,
1582 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1583 uint32_t seqnum, bool encrypted,
1584 struct smb_perfcount_data *deferred_pcd)
1585 {
1586 int msg_type = CVAL(inbuf,0);
1587
1588 DO_PROFILE_INC(smb_count);
1589
1590 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1591 smb_len(inbuf) ) );
1592 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1593 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1594
1595 if (msg_type != 0) {
1596 /*
1597 * NetBIOS session request, keepalive, etc.
1598 */
1599 reply_special(sconn, (char *)inbuf, nread);
1600 goto done;
1601 }
1602
1603 if (sconn->using_smb2) {
1604 /* At this point we're not really using smb2,
1605 * we make the decision here.. */
1606 if (smbd_is_smb2_header(inbuf, nread)) {
1607 smbd_smb2_first_negprot(sconn, inbuf, nread);
1608 return;
1609 } else if (nread >= smb_size && valid_smb_header(inbuf)
1610 && CVAL(inbuf, smb_com) != 0x72) {
1611 /* This is a non-negprot SMB1 packet.
1612 Disable SMB2 from now on. */
1613 sconn->using_smb2 = false;
1614 }
1615 }
1616
1617 show_msg((char *)inbuf);
1618
1619 construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1620 encrypted, deferred_pcd);
1621 sconn->trans_num++;
1622
1623 done:
1624 sconn->num_requests++;
1625
1626 /* The timeout_processing function isn't run nearly
1627 often enough to implement 'max log size' without
1628 overrunning the size of the file by many megabytes.
1629 This is especially true if we are running at debug
1630 level 10. Checking every 50 SMBs is a nice
1631 tradeoff of performance vs log file size overrun. */
1632
1633 if ((sconn->num_requests % 50) == 0 &&
1634 need_to_check_log_size()) {
1635 change_to_root_user();
1636 check_log_size();
1637 }
1638 }
1639
1640 /****************************************************************************
1641 Return a string containing the function name of a SMB command.
1642 ****************************************************************************/
1643
1644 const char *smb_fn_name(int type)
1645 {
1646 const char *unknown_name = "SMBunknown";
1647
1648 if (smb_messages[type].name == NULL)
1649 return(unknown_name);
1650
1651 return(smb_messages[type].name);
1652 }
1653
1654 /****************************************************************************
1655 Helper functions for contruct_reply.
1656 ****************************************************************************/
1657
1658 void add_to_common_flags2(uint32 v)
1659 {
1660 common_flags2 |= v;
1661 }
1662
1663 void remove_from_common_flags2(uint32 v)
1664 {
1665 common_flags2 &= ~v;
1666 }
1667
1668 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1669 char *outbuf)
1670 {
1671 srv_set_message(outbuf,0,0,false);
1672
1673 SCVAL(outbuf, smb_com, req->cmd);
1674 SIVAL(outbuf,smb_rcls,0);
1675 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1676 SSVAL(outbuf,smb_flg2,
1677 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1678 common_flags2);
1679 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1680
1681 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1682 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1683 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1684 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1685 }
1686
1687 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1688 {
1689 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1690 }
1691
1692 /*
1693 * How many bytes have we already accumulated up to the current wct field
1694 * offset?
1695 */
1696
1697 size_t req_wct_ofs(struct smb_request *req)
1698 {
1699 size_t buf_size;
1700
1701 if (req->chain_outbuf == NULL) {
1702 return smb_wct - 4;
1703 }
1704 buf_size = talloc_get_size(req->chain_outbuf);
1705 if ((buf_size % 4) != 0) {
1706 buf_size += (4 - (buf_size % 4));
1707 }
1708 return buf_size - 4;
1709 }
1710
1711 /*
1712 * Hack around reply_nterror & friends not being aware of chained requests,
1713 * generating illegal (i.e. wct==0) chain replies.
1714 */
1715
1716 static void fixup_chain_error_packet(struct smb_request *req)
1717 {
1718 uint8_t *outbuf = req->outbuf;
1719 req->outbuf = NULL;
1720 reply_outbuf(req, 2, 0);
1721 memcpy(req->outbuf, outbuf, smb_wct);
1722 TALLOC_FREE(outbuf);
1723 SCVAL(req->outbuf, smb_vwv0, 0xff);
1724 }
1725
1726 /**
1727 * @brief Find the smb_cmd offset of the last command pushed
1728 * @param[in] buf The buffer we're building up
1729 * @retval Where can we put our next andx cmd?
1730 *
1731 * While chaining requests, the "next" request we're looking at needs to put
1732 * its SMB_Command before the data the previous request already built up added
1733 * to the chain. Find the offset to the place where we have to put our cmd.
1734 */
1735
1736 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1737 {
1738 uint8_t cmd;
1739 size_t ofs;
1740
1741 cmd = CVAL(buf, smb_com);
1742
1743 SMB_ASSERT(is_andx_req(cmd));
1744
1745 ofs = smb_vwv0;
1746
1747 while (CVAL(buf, ofs) != 0xff) {
1748
1749 if (!is_andx_req(CVAL(buf, ofs))) {
1750 return false;
1751 }
1752
1753 /*
1754 * ofs is from start of smb header, so add the 4 length
1755 * bytes. The next cmd is right after the wct field.
1756 */
1757 ofs = SVAL(buf, ofs+2) + 4 + 1;
1758
1759 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1760 }
1761
1762 *pofs = ofs;
1763 return true;
1764 }
1765
1766 /**
1767 * @brief Do the smb chaining at a buffer level
1768 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1769 * @param[in] smb_command The command that we want to issue
1770 * @param[in] wct How many words?
1771 * @param[in] vwv The words, already in network order
1772 * @param[in] bytes_alignment How shall we align "bytes"?
1773 * @param[in] num_bytes How many bytes?
1774 * @param[in] bytes The data the request ships
1775 *
1776 * smb_splice_chain() adds the vwv and bytes to the request already present in
1777 * *poutbuf.
1778 */
1779
1780 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1781 uint8_t wct, const uint16_t *vwv,
1782 size_t bytes_alignment,
1783 uint32_t num_bytes, const uint8_t *bytes)
1784 {
1785 uint8_t *outbuf;
1786 size_t old_size, new_size;
1787 size_t ofs;
1788 size_t chain_padding = 0;
1789 size_t bytes_padding = 0;
1790 bool first_request;
1791
1792 old_size = talloc_get_size(*poutbuf);
1793
1794 /*
1795 * old_size == smb_wct means we're pushing the first request in for
1796 * libsmb/
1797 */
1798
1799 first_request = (old_size == smb_wct);
1800
1801 if (!first_request && ((old_size % 4) != 0)) {
1802 /*
1803 * Align the wct field of subsequent requests to a 4-byte
1804 * boundary
1805 */
1806 chain_padding = 4 - (old_size % 4);
1807 }
1808
1809 /*
1810 * After the old request comes the new wct field (1 byte), the vwv's
1811 * and the num_bytes field. After at we might need to align the bytes
1812 * given to us to "bytes_alignment", increasing the num_bytes value.
1813 */
1814
1815 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1816
1817 if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1818 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1819 }
1820
1821 new_size += bytes_padding + num_bytes;
1822
1823 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1824 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1825 (unsigned)new_size));
1826 return false;
1827 }
1828
1829 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1830 if (outbuf == NULL) {
1831 DEBUG(0, ("talloc failed\n"));
1832 return false;
1833 }
1834 *poutbuf = outbuf;
1835
1836 if (first_request) {
1837 SCVAL(outbuf, smb_com, smb_command);
1838 } else {
1839 size_t andx_cmd_ofs;
1840
1841 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1842 DEBUG(1, ("invalid command chain\n"));
1843 *poutbuf = talloc_realloc(
1844 NULL, *poutbuf, uint8_t, old_size);
1845 return false;
1846 }
1847
1848 if (chain_padding != 0) {
1849 memset(outbuf + old_size, 0, chain_padding);
1850 old_size += chain_padding;
1851 }
1852
1853 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1854 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1855 }
1856
1857 ofs = old_size;
1858
1859 /*
1860 * Push the chained request:
1861 *
1862 * wct field
1863 */
1864
1865 SCVAL(outbuf, ofs, wct);
1866 ofs += 1;
1867
1868 /*
1869 * vwv array
1870 */
1871
1872 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1873 ofs += sizeof(uint16_t) * wct;
1874
1875 /*
1876 * bcc (byte count)
1877 */
1878
1879 SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1880 ofs += sizeof(uint16_t);
1881
1882 /*
1883 * padding
1884 */
1885
1886 if (bytes_padding != 0) {
1887 memset(outbuf + ofs, 0, bytes_padding);
1888 ofs += bytes_padding;
1889 }
1890
1891 /*
1892 * The bytes field
1893 */
1894
1895 memcpy(outbuf + ofs, bytes, num_bytes);
1896
1897 return true;
1898 }
1899
1900 /****************************************************************************
1901 Construct a chained reply and add it to the already made reply
1902 ****************************************************************************/
1903
1904 void chain_reply(struct smb_request *req)
1905 {
1906 size_t smblen = smb_len(req->inbuf);
1907 size_t already_used, length_needed;
1908 uint8_t chain_cmd;
1909 uint32_t chain_offset; /* uint32_t to avoid overflow */
1910
1911 uint8_t wct;
1912 const uint16_t *vwv;
1913 uint16_t buflen;
1914 const uint8_t *buf;
1915
1916 if (IVAL(req->outbuf, smb_rcls) != 0) {
1917 fixup_chain_error_packet(req);
1918 }
1919
1920 /*
1921 * Any of the AndX requests and replies have at least a wct of
1922 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1923 * beginning of the SMB header to the next wct field.
1924 *
1925 * None of the AndX requests put anything valuable in vwv[0] and [1],
1926 * so we can overwrite it here to form the chain.
1927 */
1928
1929 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1930 if (req->chain_outbuf == NULL) {
1931 req->chain_outbuf = talloc_realloc(
1932 req, req->outbuf, uint8_t,
1933 smb_len(req->outbuf) + 4);
1934 if (req->chain_outbuf == NULL) {
1935 smb_panic("talloc failed");
1936 }
1937 }
1938 req->outbuf = NULL;
1939 goto error;
1940 }
1941
1942 /*
1943 * Here we assume that this is the end of the chain. For that we need
1944 * to set "next command" to 0xff and the offset to 0. If we later find
1945 * more commands in the chain, this will be overwritten again.
1946 */
1947
1948 SCVAL(req->outbuf, smb_vwv0, 0xff);
1949 SCVAL(req->outbuf, smb_vwv0+1, 0);
1950 SSVAL(req->outbuf, smb_vwv1, 0);
1951
1952 if (req->chain_outbuf == NULL) {
1953 /*
1954 * In req->chain_outbuf we collect all the replies. Start the
1955 * chain by copying in the first reply.
1956 *
1957 * We do the realloc because later on we depend on
1958 * talloc_get_size to determine the length of
1959 * chain_outbuf. The reply_xxx routines might have
1960 * over-allocated (reply_pipe_read_and_X used to be such an
1961 * example).
1962 */
1963 req->chain_outbuf = talloc_realloc(
1964 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1965 if (req->chain_outbuf == NULL) {
1966 smb_panic("talloc failed");
1967 }
1968 req->outbuf = NULL;
1969 } else {
1970 /*
1971 * Update smb headers where subsequent chained commands
1972 * may have updated them.
1973 */
1974 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1975 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1976
1977 if (!smb_splice_chain(&req->chain_outbuf,
1978 CVAL(req->outbuf, smb_com),
1979 CVAL(req->outbuf, smb_wct),
1980 (uint16_t *)(req->outbuf + smb_vwv),
1981 0, smb_buflen(req->outbuf),
1982 (uint8_t *)smb_buf(req->outbuf))) {
1983 goto error;
1984 }
1985 TALLOC_FREE(req->outbuf);
1986 }
1987
1988 /*
1989 * We use the old request's vwv field to grab the next chained command
1990 * and offset into the chained fields.
1991 */
1992
1993 chain_cmd = CVAL(req->vwv+0, 0);
1994 chain_offset = SVAL(req->vwv+1, 0);
1995
1996 if (chain_cmd == 0xff) {
1997 /*
1998 * End of chain, no more requests from the client. So ship the
1999 * replies.
2000 */
2001 smb_setlen((char *)(req->chain_outbuf),
2002 talloc_get_size(req->chain_outbuf) - 4);
2003
2004 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2005 true, req->seqnum+1,
2006 IS_CONN_ENCRYPTED(req->conn)
2007 ||req->encrypted,
2008 &req->pcd)) {
2009 exit_server_cleanly("chain_reply: srv_send_smb "
2010 "failed.");
2011 }
2012 TALLOC_FREE(req->chain_outbuf);
2013 req->done = true;
2014 return;
2015 }
2016
2017 /* add a new perfcounter for this element of chain */
2018 SMB_PERFCOUNT_ADD(&req->pcd);
2019 SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2020 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2021
2022 /*
2023 * Check if the client tries to fool us. The request so far uses the
2024 * space to the end of the byte buffer in the request just
2025 * processed. The chain_offset can't point into that area. If that was
2026 * the case, we could end up with an endless processing of the chain,
2027 * we would always handle the same request.
2028 */
2029
2030 already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2031 if (chain_offset < already_used) {
2032 goto error;
2033 }
2034
2035 /*
2036 * Next check: Make sure the chain offset does not point beyond the
2037 * overall smb request length.
2038 */
2039
2040 length_needed = chain_offset+1; /* wct */
2041 if (length_needed > smblen) {
2042 goto error;
2043 }
2044
2045 /*
2046 * Now comes the pointer magic. Goal here is to set up req->vwv and
2047 * req->buf correctly again to be able to call the subsequent
2048 * switch_message(). The chain offset (the former vwv[1]) points at
2049 * the new wct field.
2050 */
2051
2052 wct = CVAL(smb_base(req->inbuf), chain_offset);
2053
2054 /*
2055 * Next consistency check: Make the new vwv array fits in the overall
2056 * smb request.
2057 */
2058
2059 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2060 if (length_needed > smblen) {
2061 goto error;
2062 }
2063 vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2064
2065 /*
2066 * Now grab the new byte buffer....
2067 */
2068
2069 buflen = SVAL(vwv+wct, 0);
2070
2071 /*
2072 * .. and check that it fits.
2073 */
2074
2075 length_needed += buflen;
2076 if (length_needed > smblen) {
2077 goto error;
2078 }
2079 buf = (const uint8_t *)(vwv+wct+1);
2080
2081 req->cmd = chain_cmd;
2082 req->wct = wct;
2083 req->vwv = discard_const_p(uint16_t, vwv);
2084 req->buflen = buflen;
2085 req->buf = buf;
2086
2087 switch_message(chain_cmd, req, smblen);
2088
2089 if (req->outbuf == NULL) {
2090 /*
2091 * This happens if the chained command has suspended itself or
2092 * if it has called srv_send_smb() itself.
2093 */
2094 return;
2095 }
2096
2097 /*
2098 * We end up here if the chained command was not itself chained or
2099 * suspended, but for example a close() command. We now need to splice
2100 * the chained commands' outbuf into the already built up chain_outbuf
2101 * and ship the result.
2102 */
2103 goto done;
2104
2105 error:
2106 /*
2107 * We end up here if there's any error in the chain syntax. Report a
2108 * DOS error, just like Windows does.
2109 */
2110 reply_force_doserror(req, ERRSRV, ERRerror);
2111 fixup_chain_error_packet(req);
2112
2113 done:
2114 /*
2115 * This scary statement intends to set the
2116 * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2117 * to the value req->outbuf carries
2118 */
2119 SSVAL(req->chain_outbuf, smb_flg2,
2120 (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2121 | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2122
2123 /*
2124 * Transfer the error codes from the subrequest to the main one
2125 */
2126 SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2127 SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2128
2129 if (!smb_splice_chain(&req->chain_outbuf,
2130 CVAL(req->outbuf, smb_com),
2131 CVAL(req->outbuf, smb_wct),
2132 (uint16_t *)(req->outbuf + smb_vwv),
2133 0, smb_buflen(req->outbuf),
2134 (uint8_t *)smb_buf(req->outbuf))) {
2135 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2136 }
2137 TALLOC_FREE(req->outbuf);
2138
2139 smb_setlen((char *)(req->chain_outbuf),
2140 talloc_get_size(req->chain_outbuf) - 4);
2141
2142 show_msg((char *)(req->chain_outbuf));
2143
2144 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2145 true, req->seqnum+1,
2146 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2147 &req->pcd)) {
2148 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2149 }
2150 TALLOC_FREE(req->chain_outbuf);
2151 req->done = true;
2152 }
2153
2154 /****************************************************************************
2155 Check if services need reloading.
2156 ****************************************************************************/
2157
2158 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2159 {
2160
2161 if (last_smb_conf_reload_time == 0) {
2162 last_smb_conf_reload_time = t;
2163 }
2164
2165 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2166 reload_services(sconn->msg_ctx, sconn->sock, True);
2167 last_smb_conf_reload_time = t;
2168 }
2169 }
2170
2171 static bool fd_is_readable(int fd)
2172 {
2173 int ret, revents;
2174
2175 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2176
2177 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2178
2179 }
2180
2181 static void smbd_server_connection_write_handler(
2182 struct smbd_server_connection *sconn)
2183 {
2184 /* TODO: make write nonblocking */
2185 }
2186
2187 static void smbd_server_connection_read_handler(
2188 struct smbd_server_connection *sconn, int fd)
2189 {
2190 uint8_t *inbuf = NULL;
2191 size_t inbuf_len = 0;
2192 size_t unread_bytes = 0;
2193 bool encrypted = false;
2194 TALLOC_CTX *mem_ctx = talloc_tos();
2195 NTSTATUS status;
2196 uint32_t seqnum;
2197
2198 bool from_client = (sconn->sock == fd);
2199
2200 if (from_client) {
2201 smbd_lock_socket(sconn);
2202
2203 if (lp_async_smb_echo_handler() && !fd_is_readable(fd)) {
2204 DEBUG(10,("the echo listener was faster\n"));
2205 smbd_unlock_socket(sconn);
2206 return;
2207 }
2208
2209 /* TODO: make this completely nonblocking */
2210 status = receive_smb_talloc(mem_ctx, sconn, fd,
2211 (char **)(void *)&inbuf,
2212 0, /* timeout */
2213 &unread_bytes,
2214 &encrypted,
2215 &inbuf_len, &seqnum,
2216 false /* trusted channel */);
2217 smbd_unlock_socket(sconn);
2218 } else {
2219 /* TODO: make this completely nonblocking */
2220 status = receive_smb_talloc(mem_ctx, sconn, fd,
2221 (char **)(void *)&inbuf,
2222 0, /* timeout */
2223 &unread_bytes,
2224 &encrypted,
2225 &inbuf_len, &seqnum,
2226 true /* trusted channel */);
2227 }
2228
2229 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2230 goto process;
2231 }
2232 if (NT_STATUS_IS_ERR(status)) {
2233 exit_server_cleanly("failed to receive smb request");
2234 }
2235 if (!NT_STATUS_IS_OK(status)) {
2236 return;
2237 }
2238
2239 process:
2240 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2241 seqnum, encrypted, NULL);
2242 }
2243
2244 static void smbd_server_connection_handler(struct event_context *ev,
2245 struct fd_event *fde,
2246 uint16_t flags,
2247 void *private_data)
2248 {
2249 struct smbd_server_connection *conn = talloc_get_type(private_data,
2250 struct smbd_server_connection);
2251
2252 if (flags & EVENT_FD_WRITE) {
2253 smbd_server_connection_write_handler(conn);
2254 return;
2255 }
2256 if (flags & EVENT_FD_READ) {
2257 smbd_server_connection_read_handler(conn, conn->sock);
2258 return;
2259 }
2260 }
2261
2262 static void smbd_server_echo_handler(struct event_context *ev,
2263 struct fd_event *fde,
2264 uint16_t flags,
2265 void *private_data)
2266 {
2267 struct smbd_server_connection *conn = talloc_get_type(private_data,
2268 struct smbd_server_connection);
2269
2270 if (flags & EVENT_FD_WRITE) {
2271 smbd_server_connection_write_handler(conn);
2272 return;
2273 }
2274 if (flags & EVENT_FD_READ) {
2275 smbd_server_connection_read_handler(
2276 conn, conn->smb1.echo_handler.trusted_fd);
2277 return;
2278 }
2279 }
2280
2281 #ifdef CLUSTER_SUPPORT
2282 /****************************************************************************
2283 received when we should release a specific IP
2284 ****************************************************************************/
2285 static void release_ip(const char *ip, void *priv)
2286 {
2287 const char *addr = (const char *)priv;
2288 const char *p = addr;
2289
2290 if (strncmp("::ffff:", addr, 7) == 0) {
2291 p = addr + 7;
2292 }
2293
2294 DEBUG(10, ("Got release IP message for %s, "
2295 "our address is %s\n", ip, p));
2296
2297 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2298 /* we can't afford to do a clean exit - that involves
2299 database writes, which would potentially mean we
2300 are still running after the failover has finished -
2301 we have to get rid of this process ID straight
2302 away */
2303 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2304 ip));
2305 /* note we must exit with non-zero status so the unclean handler gets
2306 called in the parent, so that the brl database is tickled */
2307 _exit(1);
2308 }
2309 }
2310
2311 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2312 struct sockaddr_storage *client)
2313 {
2314 socklen_t length;
2315 length = sizeof(*server);
2316 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2317 return -1;
2318 }
2319 length = sizeof(*client);
2320 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2321 return -1;
2322 }
2323 return 0;
2324 }
2325 #endif
2326
2327 /*
2328 * Send keepalive packets to our client
2329 */
2330 static bool keepalive_fn(const struct timeval *now, void *private_data)
2331 {
2332 struct smbd_server_connection *sconn = smbd_server_conn;
2333 bool ret;
2334
2335 if (sconn->using_smb2) {
2336 /* Don't do keepalives on an SMB2 connection. */
2337 return false;
2338 }
2339
2340 smbd_lock_socket(smbd_server_conn);
2341 ret = send_keepalive(sconn->sock);
2342 smbd_unlock_socket(smbd_server_conn);
2343
2344 if (!ret) {
2345 char addr[INET6_ADDRSTRLEN];
2346 /*
2347 * Try and give an error message saying what
2348 * client failed.
2349 */
2350 DEBUG(0, ("send_keepalive failed for client %s. "
2351 "Error %s - exiting\n",
2352 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2353 strerror(errno)));
2354 return False;
2355 }
2356 return True;
2357 }
2358
2359 /*
2360 * Do the recurring check if we're idle
2361 */
2362 static bool deadtime_fn(const struct timeval *now, void *private_data)
2363 {
2364 struct smbd_server_connection *sconn =
2365 (struct smbd_server_connection *)private_data;
2366
2367 if ((conn_num_open(sconn) == 0)
2368 || (conn_idle_all(sconn, now->tv_sec))) {
2369 DEBUG( 2, ( "Closing idle connection\n" ) );
2370 messaging_send(sconn->msg_ctx,
2371 messaging_server_id(sconn->msg_ctx),
2372 MSG_SHUTDOWN, &data_blob_null);
2373 return False;
2374 }
2375
2376 return True;
2377 }
2378
2379 /*
2380 * Do the recurring log file and smb.conf reload checks.
2381 */
2382
2383 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2384 {
2385 struct smbd_server_connection *sconn = talloc_get_type_abort(
2386 private_data, struct smbd_server_connection);
2387
2388 DEBUG(5, ("housekeeping\n"));
2389
2390 change_to_root_user();
2391
2392 /* update printer queue caches if necessary */
2393 update_monitored_printq_cache(sconn->msg_ctx);
2394
2395 /* check if we need to reload services */
2396 check_reload(sconn, time_mono(NULL));
2397
2398 /* Change machine password if neccessary. */
2399 attempt_machine_password_change();
2400
2401 /*
2402 * Force a log file check.
2403 */
2404 force_check_log_size();
2405 check_log_size();
2406 return true;
2407 }
2408
2409 static int create_unlink_tmp(const char *dir)
2410 {
2411 char *fname;
2412 int fd;
2413
2414 fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2415 if (fname == NULL) {
2416 errno = ENOMEM;
2417 return -1;
2418 }
2419 fd = mkstemp(fname);
2420 if (fd == -1) {
2421 TALLOC_FREE(fname);
2422 return -1;
2423 }
2424 if (unlink(fname) == -1) {
2425 int sys_errno = errno;
2426 close(fd);
2427 TALLOC_FREE(fname);
2428 errno = sys_errno;
2429 return -1;
2430 }
2431 TALLOC_FREE(fname);
2432 return fd;
2433 }
2434
2435 struct smbd_echo_state {
2436 struct tevent_context *ev;
2437 struct iovec *pending;
2438 struct smbd_server_connection *sconn;
2439 int parent_pipe;
2440
2441 struct tevent_fd *parent_fde;
2442
2443 struct tevent_fd *read_fde;
2444 struct tevent_req *write_req;
2445 };
2446
2447 static void smbd_echo_writer_done(struct tevent_req *req);
2448
2449 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2450 {
2451 int num_pending;
2452
2453 if (state->write_req != NULL) {
2454 return;
2455 }
2456
2457 num_pending = talloc_array_length(state->pending);
2458 if (num_pending == 0) {
2459 return;
2460 }
2461
2462 state->write_req = writev_send(state, state->ev, NULL,
2463 state->parent_pipe, false,
2464 state->pending, num_pending);
2465 if (state->write_req == NULL) {
2466 DEBUG(1, ("writev_send failed\n"));
2467 exit(1);
2468 }
2469
2470 talloc_steal(state->write_req, state->pending);
2471 state->pending = NULL;
2472
2473 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2474 state);
2475 }
2476
2477 static void smbd_echo_writer_done(struct tevent_req *req)
2478 {
2479 struct smbd_echo_state *state = tevent_req_callback_data(
2480 req, struct smbd_echo_state);
2481 ssize_t written;
2482 int err;
2483
2484 written = writev_recv(req, &err);
2485 TALLOC_FREE(req);
2486 state->write_req = NULL;
2487 if (written == -1) {
2488 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2489 exit(1);
2490 }
2491 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2492 smbd_echo_activate_writer(state);
2493 }
2494
2495 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2496 uint32_t seqnum)
2497 {
2498 struct smb_request req;
2499 uint16_t num_replies;
2500 size_t out_len;
2501 char *outbuf;
2502 bool ok;
2503
2504 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == SMBkeepalive)) {
2505 DEBUG(10, ("Got netbios keepalive\n"));
2506 /*
2507 * Just swallow it
2508 */
2509 return true;
2510 }
2511
2512 if (inbuf_len < smb_size) {
2513 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2514 return false;
2515 }
2516 if (!valid_smb_header(inbuf)) {
2517 DEBUG(10, ("Got invalid SMB header\n"));
2518 return false;
2519 }
2520
2521 if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2522 seqnum)) {
2523 return false;
2524 }
2525 req.inbuf = inbuf;
2526
2527 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2528 smb_messages[req.cmd].name
2529 ? smb_messages[req.cmd].name : "unknown"));
2530
2531 if (req.cmd != SMBecho) {
2532 return false;
2533 }
2534 if (req.wct < 1) {
2535 return false;
2536 }
2537
2538 num_replies = SVAL(req.vwv+0, 0);
2539 if (num_replies != 1) {
2540 /* Not a Windows "Hey, you're still there?" request */
2541 return false;
2542 }
2543
2544 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2545 1, req.buflen)) {
2546 DEBUG(10, ("create_outbuf failed\n"));
2547 return false;
2548 }
2549 req.outbuf = (uint8_t *)outbuf;
2550
2551 SSVAL(req.outbuf, smb_vwv0, num_replies);
2552
2553 if (req.buflen > 0) {
2554 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2555 }
2556
2557 out_len = smb_len(req.outbuf) + 4;
2558
2559 ok = srv_send_smb(req.sconn,
2560 (char *)outbuf,
2561 true, seqnum+1,
2562 false, &req.pcd);
2563 TALLOC_FREE(outbuf);
2564 if (!ok) {
2565 exit(1);
2566 }
2567
2568 return true;
2569 }
2570
2571 static void smbd_echo_exit(struct tevent_context *ev,
2572 struct tevent_fd *fde, uint16_t flags,
2573 void *private_data)
2574 {
2575 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2576 exit(0);
2577 }
2578
2579 static void smbd_echo_reader(struct tevent_context *ev,
2580 struct tevent_fd *fde, uint16_t flags,
2581 void *private_data)
2582 {
2583 struct smbd_echo_state *state = talloc_get_type_abort(
2584 private_data, struct smbd_echo_state);
2585 struct smbd_server_connection *sconn = state->sconn;
2586 size_t unread, num_pending;
2587 NTSTATUS status;
2588 struct iovec *tmp;
2589 size_t iov_len;
2590 uint32_t seqnum = 0;
2591 bool reply;
2592 bool ok;
2593 bool encrypted = false;
2594
2595 smb_msleep(1000);
2596
2597 ok = smbd_lock_socket_internal(sconn);
2598 if (!ok) {
2599 DEBUG(0, ("%s: failed to lock socket\n",
2600 __location__));
2601 exit(1);
2602 }
2603
2604 if (!fd_is_readable(sconn->sock)) {
2605 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2606 (int)sys_getpid()));
2607 ok = smbd_unlock_socket_internal(sconn);
2608 if (!ok) {
2609 DEBUG(1, ("%s: failed to unlock socket in\n",
2610 __location__));
2611 exit(1);
2612 }
2613 return;
2614 }
2615
2616 num_pending = talloc_array_length(state->pending);
2617 tmp = talloc_realloc(state, state->pending, struct iovec,
2618 num_pending+1);
2619 if (tmp == NULL) {
2620 DEBUG(1, ("talloc_realloc failed\n"));
2621 exit(1);
2622 }
2623 state->pending = tmp;
2624
2625 DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2626
2627 status = receive_smb_talloc(state->pending, sconn, sconn->sock,
2628 (char **)(void *)&state->pending[num_pending].iov_base,
2629 0 /* timeout */,
2630 &unread,
2631 &encrypted,
2632 &iov_len,
2633 &seqnum,
2634 false /* trusted_channel*/);
2635 if (!NT_STATUS_IS_OK(status)) {
2636 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2637 (int)sys_getpid(), nt_errstr(status)));
2638 exit(1);
2639 }
2640 state->pending[num_pending].iov_len = iov_len;
2641
2642 ok = smbd_unlock_socket_internal(sconn);
2643 if (!ok) {
2644 DEBUG(1, ("%s: failed to unlock socket in\n",
2645 __location__));
2646 exit(1);
2647 }
2648
2649 reply = smbd_echo_reply((uint8_t *)state->pending[num_pending].iov_base,
2650 state->pending[num_pending].iov_len,
2651 seqnum);
2652 if (reply) {
2653 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2654 /* no check, shrinking by some bytes does not fail */
2655 state->pending = talloc_realloc(state, state->pending,
2656 struct iovec,
2657 num_pending);
2658 return;
2659 }
2660
2661 if (state->pending[num_pending].iov_len >= smb_size) {
2662 /*
2663 * place the seqnum in the packet so that the main process
2664 * can reply with signing
2665 */
2666 SIVAL((uint8_t *)state->pending[num_pending].iov_base,
2667 smb_ss_field, seqnum);
2668 SIVAL((uint8_t *)state->pending[num_pending].iov_base,
2669 smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2670 }
2671
2672 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2673 smbd_echo_activate_writer(state);
2674 }
2675
2676 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2677 int parent_pipe)
2678 {
2679 struct smbd_echo_state *state;
2680
2681 state = talloc_zero(sconn, struct smbd_echo_state);
2682 if (state == NULL) {
2683 DEBUG(1, ("talloc failed\n"));
2684 return;
2685 }
2686 state->sconn = sconn;
2687 state->parent_pipe = parent_pipe;
2688 state->ev = s3_tevent_context_init(state);
2689 if (state->ev == NULL) {
2690 DEBUG(1, ("tevent_context_init failed\n"));
2691 TALLOC_FREE(state);
2692 return;
2693 }
2694 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2695 TEVENT_FD_READ, smbd_echo_exit,
2696 state);
2697 if (state->parent_fde == NULL) {
2698 DEBUG(1, ("tevent_add_fd failed\n"));
2699 TALLOC_FREE(state);
2700 return;
2701 }
2702 state->read_fde = tevent_add_fd(state->ev, state, sconn->sock,
2703 TEVENT_FD_READ, smbd_echo_reader,
2704 state);
2705 if (state->read_fde == NULL) {
2706 DEBUG(1, ("tevent_add_fd failed\n"));
2707 TALLOC_FREE(state);
2708 return;
2709 }
2710
2711 while (true) {
2712 if (tevent_loop_once(state->ev) == -1) {
2713 DEBUG(1, ("tevent_loop_once failed: %s\n",
2714 strerror(errno)));
2715 break;
2716 }
2717 }
2718 TALLOC_FREE(state);
2719 }
2720
2721 /*
2722 * Handle SMBecho requests in a forked child process
2723 */
2724 bool fork_echo_handler(struct smbd_server_connection *sconn)
2725 {
2726 int listener_pipe[2];
2727 int res;
2728 pid_t child;
2729
2730 res = pipe(listener_pipe);
2731 if (res == -1) {
2732 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2733 return false;
2734 }
2735 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2736 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2737 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2738 goto fail;
2739 }
2740
2741 child = sys_fork();
2742 if (child == 0) {
2743 NTSTATUS status;
2744
2745 close(listener_pipe[0]);
2746 set_blocking(listener_pipe[1], false);
2747
2748 status = reinit_after_fork(sconn->msg_ctx,
2749 server_event_context(),
2750 procid_self(), false);
2751 if (!NT_STATUS_IS_OK(status)) {
2752 DEBUG(1, ("reinit_after_fork failed: %s\n",
2753 nt_errstr(status)));
2754 exit(1);
2755 }
2756 smbd_echo_loop(sconn, listener_pipe[1]);
2757 exit(0);
2758 }
2759 close(listener_pipe[1]);
2760 listener_pipe[1] = -1;
2761 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2762
2763 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2764
2765 /*
2766 * Without smb signing this is the same as the normal smbd
2767 * listener. This needs to change once signing comes in.
2768 */
2769 sconn->smb1.echo_handler.trusted_fde = event_add_fd(server_event_context(),
2770 sconn,
2771 sconn->smb1.echo_handler.trusted_fd,
2772 EVENT_FD_READ,
2773 smbd_server_echo_handler,
2774 sconn);
2775 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2776 DEBUG(1, ("event_add_fd failed\n"));
2777 goto fail;
2778 }
2779
2780 return true;
2781
2782 fail:
2783 if (listener_pipe[0] != -1) {
2784 close(listener_pipe[0]);
2785 }
2786 if (listener_pipe[1] != -1) {
2787 close(listener_pipe[1]);
2788 }
2789 sconn->smb1.echo_handler.trusted_fd = -1;
2790 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2791 close(sconn->smb1.echo_handler.socket_lock_fd);
2792 }
2793 sconn->smb1.echo_handler.trusted_fd = -1;
2794 sconn->smb1.echo_handler.socket_lock_fd = -1;
2795 return false;
2796 }
2797
2798 #if CLUSTER_SUPPORT
2799
2800 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2801 struct sockaddr_storage *srv,
2802 struct sockaddr_storage *clnt)
2803 {
2804 struct ctdbd_connection *cconn;
2805 char tmp_addr[INET6_ADDRSTRLEN];
2806 char *addr;
2807
2808 cconn = messaging_ctdbd_connection();
2809 if (cconn == NULL) {
2810 return NT_STATUS_NO_MEMORY;
2811 }
2812
2813 client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2814 addr = talloc_strdup(cconn, tmp_addr);
2815 if (addr == NULL) {
2816 return NT_STATUS_NO_MEMORY;
2817 }
2818 return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2819 }
2820
2821 #endif
2822
2823 /****************************************************************************
2824 Process commands from the client
2825 ****************************************************************************/
2826
2827 void smbd_process(struct smbd_server_connection *sconn)
2828 {
2829 TALLOC_CTX *frame = talloc_stackframe();
2830 struct sockaddr_storage ss;
2831 struct sockaddr *sa = NULL;
2832 socklen_t sa_socklen;
2833 struct tsocket_address *local_address = NULL;
2834 struct tsocket_address *remote_address = NULL;
2835 const char *remaddr = NULL;
2836 char *rhost;
2837 int ret;
2838
2839 if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
2840 /*
2841 * We're not making the decision here,
2842 * we're just allowing the client
2843 * to decide between SMB1 and SMB2
2844 * with the first negprot
2845 * packet.
2846 */
2847 sconn->using_smb2 = true;
2848 }
2849
2850 /* Ensure child is set to blocking mode */
2851 set_blocking(sconn->sock,True);
2852
2853 set_socket_options(sconn->sock, "SO_KEEPALIVE");
2854 set_socket_options(sconn->sock, lp_socket_options());
2855
2856 sa = (struct sockaddr *)(void *)&ss;
2857 sa_socklen = sizeof(ss);
2858 ret = getpeername(sconn->sock, sa, &sa_socklen);
2859 if (ret != 0) {
2860 int level = (errno == ENOTCONN)?2:0;
2861 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2862 exit_server_cleanly("getpeername() failed.\n");
2863 }
2864 ret = tsocket_address_bsd_from_sockaddr(sconn,
2865 sa, sa_socklen,
2866 &remote_address);
2867 if (ret != 0) {
2868 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2869 __location__, strerror(errno)));
2870 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2871 }
2872
2873 sa = (struct sockaddr *)(void *)&ss;
2874 sa_socklen = sizeof(ss);
2875 ret = getsockname(sconn->sock, sa, &sa_socklen);
2876 if (ret != 0) {
2877 int level = (errno == ENOTCONN)?2:0;
2878 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2879 exit_server_cleanly("getsockname() failed.\n");
2880 }
2881 ret = tsocket_address_bsd_from_sockaddr(sconn,
2882 sa, sa_socklen,
2883 &local_address);
2884 if (ret != 0) {
2885 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2886 __location__, strerror(errno)));
2887 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2888 }
2889
2890 sconn->local_address = local_address;
2891 sconn->remote_address = remote_address;
2892
2893 if (tsocket_address_is_inet(remote_address, "ip")) {
2894 remaddr = tsocket_address_inet_addr_string(
2895 sconn->remote_address,
2896 talloc_tos());
2897 if (remaddr == NULL) {
2898 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
2899 __location__, strerror(errno)));
2900 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
2901 }
2902 } else {
2903 remaddr = "0.0.0.0";
2904 }
2905
2906 /* this is needed so that we get decent entries
2907 in smbstatus for port 445 connects */
2908 set_remote_machine_name(remaddr, false);
2909 reload_services(sconn->msg_ctx, sconn->sock, true);
2910
2911 /*
2912 * Before the first packet, check the global hosts allow/ hosts deny
2913 * parameters before doing any parsing of packets passed to us by the
2914 * client. This prevents attacks on our parsing code from hosts not in
2915 * the hosts allow list.
2916 */
2917
2918 ret = get_remote_hostname(remote_address,
2919 &rhost,
2920 talloc_tos());
2921 if (ret < 0) {
2922 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
2923 __location__, strerror(errno)));
2924 exit_server_cleanly("get_remote_hostname failed.\n");
2925 }
2926 if (strequal(rhost, "UNKNOWN")) {
2927 rhost = talloc_strdup(talloc_tos(), remaddr);
2928 }
2929 sconn->remote_hostname = talloc_move(sconn, &rhost);
2930
2931 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
2932 sconn->remote_hostname,
2933 remaddr)) {
2934 /*
2935 * send a negative session response "not listening on calling
2936 * name"
2937 */
2938 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2939 DEBUG( 1, ("Connection denied from %s to %s\n",
2940 tsocket_address_string(remote_address, talloc_tos()),
2941 tsocket_address_string(local_address, talloc_tos())));
2942 (void)srv_send_smb(sconn,(char *)buf, false,
2943 0, false, NULL);
2944 exit_server_cleanly("connection denied");
2945 }
2946
2947 DEBUG(10, ("Connection allowed from %s to %s\n",
2948 tsocket_address_string(remote_address, talloc_tos()),
2949 tsocket_address_string(local_address, talloc_tos())));
2950
2951 init_modules();
2952
2953 smb_perfcount_init();
2954
2955 if (!init_account_policy()) {
2956 exit_server("Could not open account policy tdb.\n");
2957 }
2958
2959 if (*lp_rootdir()) {
2960 if (chroot(lp_rootdir()) != 0) {
2961 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2962 exit_server("Failed to chroot()");
2963 }
2964 if (chdir("/") == -1) {
2965 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2966 exit_server("Failed to chroot()");
2967 }
2968 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2969 }
2970
2971 if (!srv_init_signing(sconn)) {
2972 exit_server("Failed to init smb_signing");
2973 }
2974
2975 /* Setup oplocks */
2976 if (!init_oplocks(sconn->msg_ctx))
2977 exit_server("Failed to init oplocks");
2978
2979 /* register our message handlers */
2980 messaging_register(sconn->msg_ctx, NULL,
2981 MSG_SMB_FORCE_TDIS, msg_force_tdis);
2982 messaging_register(sconn->msg_ctx, NULL,
2983 MSG_SMB_CLOSE_FILE, msg_close_file);
2984
2985 /*
2986 * Use the default MSG_DEBUG handler to avoid rebroadcasting
2987 * MSGs to all child processes
2988 */
2989 messaging_deregister(sconn->msg_ctx,
2990 MSG_DEBUG, NULL);
2991 messaging_register(sconn->msg_ctx, NULL,
2992 MSG_DEBUG, debug_message);
2993
2994 if ((lp_keepalive() != 0)
2995 && !(event_add_idle(server_event_context(), NULL,
2996 timeval_set(lp_keepalive(), 0),
2997 "keepalive", keepalive_fn,
2998 NULL))) {
2999 DEBUG(0, ("Could not add keepalive event\n"));
3000 exit(1);
3001 }
3002
3003 if (!(event_add_idle(server_event_context(), NULL,
3004 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3005 "deadtime", deadtime_fn, sconn))) {
3006 DEBUG(0, ("Could not add deadtime event\n"));
3007 exit(1);
3008 }
3009
3010 if (!(event_add_idle(server_event_context(), NULL,
3011 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3012 "housekeeping", housekeeping_fn, sconn))) {
3013 DEBUG(0, ("Could not add housekeeping event\n"));
3014 exit(1);
3015 }
3016
3017 #ifdef CLUSTER_SUPPORT
3018
3019 if (lp_clustering()) {
3020 /*
3021 * We need to tell ctdb about our client's TCP
3022 * connection, so that for failover ctdbd can send
3023 * tickle acks, triggering a reconnection by the
3024 * client.
3025 */
3026
3027 struct sockaddr_storage srv, clnt;
3028
3029 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3030 NTSTATUS status;
3031 status = smbd_register_ips(sconn, &srv, &clnt);
3032 if (!NT_STATUS_IS_OK(status)) {
3033 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3034 nt_errstr(status)));
3035 }
3036 } else
3037 {
3038 DEBUG(0,("Unable to get tcp info for "
3039 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3040 strerror(errno)));
3041 }
3042 }
3043
3044 #endif
3045
3046 sconn->nbt.got_session = false;
3047
3048 sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3049
3050 sconn->smb1.sessions.done_sesssetup = false;
3051 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3052 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3053 /* users from session setup */
3054 sconn->smb1.sessions.session_userlist = NULL;
3055 /* workgroup from session setup. */
3056 sconn->smb1.sessions.session_workgroup = NULL;
3057 /* this holds info on user ids that are already validated for this VC */
3058 sconn->smb1.sessions.validated_users = NULL;
3059 sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3060 sconn->smb1.sessions.num_validated_vuids = 0;
3061
3062 conn_init(sconn);
3063 if (!init_dptrs(sconn)) {
3064 exit_server("init_dptrs() failed");
3065 }
3066
3067 sconn->smb1.fde = event_add_fd(server_event_context(),
3068 sconn,
3069 sconn->sock,
3070 EVENT_FD_READ,
3071 smbd_server_connection_handler,
3072 sconn);
3073 if (!sconn->smb1.fde) {
3074 exit_server("failed to create smbd_server_connection fde");
3075 }
3076
3077 TALLOC_FREE(frame);
3078
3079 while (True) {
3080 NTSTATUS status;
3081
3082 frame = talloc_stackframe_pool(8192);
3083
3084 errno = 0;
3085
3086 status = smbd_server_connection_loop_once(sconn);
3087 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3088 !NT_STATUS_IS_OK(status)) {
3089 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3090 " exiting\n", nt_errstr(status)));
3091 break;
3092 }
3093
3094 TALLOC_FREE(frame);
3095 }
3096
3097 exit_server_cleanly(NULL);
3098 }
3099
3100 bool req_is_in_chain(struct smb_request *req)
3101 {
3102 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3103 /*
3104 * We're right now handling a subsequent request, so we must
3105 * be in a chain
3106 */
3107 return true;
3108 }
3109
3110 if (!is_andx_req(req->cmd)) {
3111 return false;
3112 }
3113
3114 if (req->wct < 2) {
3115 /*
3116 * Okay, an illegal request, but definitely not chained :-)
3117 */
3118 return false;
3119 }
3120
3121 return (CVAL(req->vwv+0, 0) != 0xFF);
3122 }
reg import