?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Remove unused smbd_echo_reader()
[Samba/id10ts.git] / source3 / smbd / process.c
blob5e9392bddbb8bfcf07c97e3713ee0c45f3a22fae
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/pcap.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39
40 extern bool global_machine_password_needs_changing;
41
42 static void construct_reply_common(struct smb_request *req, const char *inbuf,
43 char *outbuf);
44 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
45
46 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
47 {
48 bool ok;
49
50 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
51 return true;
52 }
53
54 sconn->smb1.echo_handler.ref_count++;
55
56 if (sconn->smb1.echo_handler.ref_count > 1) {
57 return true;
58 }
59
60 DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
61
62 do {
63 ok = fcntl_lock(
64 sconn->smb1.echo_handler.socket_lock_fd,
65 SMB_F_SETLKW, 0, 0, F_WRLCK);
66 } while (!ok && (errno == EINTR));
67
68 if (!ok) {
69 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
70 return false;
71 }
72
73 DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
74
75 return true;
76 }
77
78 void smbd_lock_socket(struct smbd_server_connection *sconn)
79 {
80 if (!smbd_lock_socket_internal(sconn)) {
81 exit_server_cleanly("failed to lock socket");
82 }
83 }
84
85 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
86 {
87 bool ok;
88
89 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
90 return true;
91 }
92
93 sconn->smb1.echo_handler.ref_count--;
94
95 if (sconn->smb1.echo_handler.ref_count > 0) {
96 return true;
97 }
98
99 do {
100 ok = fcntl_lock(
101 sconn->smb1.echo_handler.socket_lock_fd,
102 SMB_F_SETLKW, 0, 0, F_UNLCK);
103 } while (!ok && (errno == EINTR));
104
105 if (!ok) {
106 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
107 return false;
108 }
109
110 DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
111
112 return true;
113 }
114
115 void smbd_unlock_socket(struct smbd_server_connection *sconn)
116 {
117 if (!smbd_unlock_socket_internal(sconn)) {
118 exit_server_cleanly("failed to unlock socket");
119 }
120 }
121
122 /* Accessor function for smb_read_error for smbd functions. */
123
124 /****************************************************************************
125 Send an smb to a fd.
126 ****************************************************************************/
127
128 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
129 bool do_signing, uint32_t seqnum,
130 bool do_encrypt,
131 struct smb_perfcount_data *pcd)
132 {
133 size_t len = 0;
134 size_t nwritten=0;
135 ssize_t ret;
136 char *buf_out = buffer;
137
138 smbd_lock_socket(sconn);
139
140 if (do_signing) {
141 /* Sign the outgoing packet if required. */
142 srv_calculate_sign_mac(sconn, buf_out, seqnum);
143 }
144
145 if (do_encrypt) {
146 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
147 if (!NT_STATUS_IS_OK(status)) {
148 DEBUG(0, ("send_smb: SMB encryption failed "
149 "on outgoing packet! Error %s\n",
150 nt_errstr(status) ));
151 goto out;
152 }
153 }
154
155 len = smb_len(buf_out) + 4;
156
157 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
158 if (ret <= 0) {
159
160 char addr[INET6_ADDRSTRLEN];
161 /*
162 * Try and give an error message saying what
163 * client failed.
164 */
165 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
166 (int)sys_getpid(), (int)len,
167 get_peer_addr(sconn->sock, addr, sizeof(addr)),
168 (int)ret, strerror(errno) ));
169
170 srv_free_enc_buffer(buf_out);
171 goto out;
172 }
173
174 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
175 srv_free_enc_buffer(buf_out);
176 out:
177 SMB_PERFCOUNT_END(pcd);
178
179 smbd_unlock_socket(sconn);
180 return true;
181 }
182
183 /*******************************************************************
184 Setup the word count and byte count for a smb message.
185 ********************************************************************/
186
187 int srv_set_message(char *buf,
188 int num_words,
189 int num_bytes,
190 bool zero)
191 {
192 if (zero && (num_words || num_bytes)) {
193 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
194 }
195 SCVAL(buf,smb_wct,num_words);
196 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
197 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
198 return (smb_size + num_words*2 + num_bytes);
199 }
200
201 static bool valid_smb_header(const uint8_t *inbuf)
202 {
203 if (is_encrypted_packet(inbuf)) {
204 return true;
205 }
206 /*
207 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
208 * but it just looks weird to call strncmp for this one.
209 */
210 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
211 }
212
213 /* Socket functions for smbd packet processing. */
214
215 static bool valid_packet_size(size_t len)
216 {
217 /*
218 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
219 * of header. Don't print the error if this fits.... JRA.
220 */
221
222 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
223 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
224 (unsigned long)len));
225 return false;
226 }
227 return true;
228 }
229
230 static NTSTATUS read_packet_remainder(int fd, char *buffer,
231 unsigned int timeout, ssize_t len)
232 {
233 NTSTATUS status;
234
235 if (len <= 0) {
236 return NT_STATUS_OK;
237 }
238
239 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
240 if (!NT_STATUS_IS_OK(status)) {
241 char addr[INET6_ADDRSTRLEN];
242 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
243 "error = %s.\n",
244 get_peer_addr(fd, addr, sizeof(addr)),
245 nt_errstr(status)));
246 }
247 return status;
248 }
249
250 /****************************************************************************
251 Attempt a zerocopy writeX read. We know here that len > smb_size-4
252 ****************************************************************************/
253
254 /*
255 * Unfortunately, earlier versions of smbclient/libsmbclient
256 * don't send this "standard" writeX header. I've fixed this
257 * for 3.2 but we'll use the old method with earlier versions.
258 * Windows and CIFSFS at least use this standard size. Not
259 * sure about MacOSX.
260 */
261
262 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
263 (2*14) + /* word count (including bcc) */ \
264 1 /* pad byte */)
265
266 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
267 const char lenbuf[4],
268 struct smbd_server_connection *sconn,
269 int sock,
270 char **buffer,
271 unsigned int timeout,
272 size_t *p_unread,
273 size_t *len_ret)
274 {
275 /* Size of a WRITEX call (+4 byte len). */
276 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
277 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
278 ssize_t toread;
279 NTSTATUS status;
280
281 memcpy(writeX_header, lenbuf, 4);
282
283 status = read_fd_with_timeout(
284 sock, writeX_header + 4,
285 STANDARD_WRITE_AND_X_HEADER_SIZE,
286 STANDARD_WRITE_AND_X_HEADER_SIZE,
287 timeout, NULL);
288
289 if (!NT_STATUS_IS_OK(status)) {
290 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
291 "error = %s.\n",
292 tsocket_address_string(sconn->remote_address,
293 talloc_tos()),
294 nt_errstr(status)));
295 return status;
296 }
297
298 /*
299 * Ok - now try and see if this is a possible
300 * valid writeX call.
301 */
302
303 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
304 /*
305 * If the data offset is beyond what
306 * we've read, drain the extra bytes.
307 */
308 uint16_t doff = SVAL(writeX_header,smb_vwv11);
309 ssize_t newlen;
310
311 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
312 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
313 if (drain_socket(sock, drain) != drain) {
314 smb_panic("receive_smb_raw_talloc_partial_read:"
315 " failed to drain pending bytes");
316 }
317 } else {
318 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
319 }
320
321 /* Spoof down the length and null out the bcc. */
322 set_message_bcc(writeX_header, 0);
323 newlen = smb_len(writeX_header);
324
325 /* Copy the header we've written. */
326
327 *buffer = (char *)talloc_memdup(mem_ctx,
328 writeX_header,
329 sizeof(writeX_header));
330
331 if (*buffer == NULL) {
332 DEBUG(0, ("Could not allocate inbuf of length %d\n",
333 (int)sizeof(writeX_header)));
334 return NT_STATUS_NO_MEMORY;
335 }
336
337 /* Work out the remaining bytes. */
338 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
339 *len_ret = newlen + 4;
340 return NT_STATUS_OK;
341 }
342
343 if (!valid_packet_size(len)) {
344 return NT_STATUS_INVALID_PARAMETER;
345 }
346
347 /*
348 * Not a valid writeX call. Just do the standard
349 * talloc and return.
350 */
351
352 *buffer = talloc_array(mem_ctx, char, len+4);
353
354 if (*buffer == NULL) {
355 DEBUG(0, ("Could not allocate inbuf of length %d\n",
356 (int)len+4));
357 return NT_STATUS_NO_MEMORY;
358 }
359
360 /* Copy in what we already read. */
361 memcpy(*buffer,
362 writeX_header,
363 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
364 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
365
366 if(toread > 0) {
367 status = read_packet_remainder(
368 sock,
369 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
370 timeout, toread);
371
372 if (!NT_STATUS_IS_OK(status)) {
373 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
374 nt_errstr(status)));
375 return status;
376 }
377 }
378
379 *len_ret = len + 4;
380 return NT_STATUS_OK;
381 }
382
383 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
384 struct smbd_server_connection *sconn,
385 int sock,
386 char **buffer, unsigned int timeout,
387 size_t *p_unread, size_t *plen)
388 {
389 char lenbuf[4];
390 size_t len;
391 int min_recv_size = lp_min_receive_file_size();
392 NTSTATUS status;
393
394 *p_unread = 0;
395
396 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
397 &len);
398 if (!NT_STATUS_IS_OK(status)) {
399 return status;
400 }
401
402 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
403 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
404 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
405 !srv_is_signing_active(sconn) &&
406 sconn->smb1.echo_handler.trusted_fde == NULL) {
407
408 return receive_smb_raw_talloc_partial_read(
409 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
410 p_unread, plen);
411 }
412
413 if (!valid_packet_size(len)) {
414 return NT_STATUS_INVALID_PARAMETER;
415 }
416
417 /*
418 * The +4 here can't wrap, we've checked the length above already.
419 */
420
421 *buffer = talloc_array(mem_ctx, char, len+4);
422
423 if (*buffer == NULL) {
424 DEBUG(0, ("Could not allocate inbuf of length %d\n",
425 (int)len+4));
426 return NT_STATUS_NO_MEMORY;
427 }
428
429 memcpy(*buffer, lenbuf, sizeof(lenbuf));
430
431 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
432 if (!NT_STATUS_IS_OK(status)) {
433 return status;
434 }
435
436 *plen = len + 4;
437 return NT_STATUS_OK;
438 }
439
440 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
441 struct smbd_server_connection *sconn,
442 int sock,
443 char **buffer, unsigned int timeout,
444 size_t *p_unread, bool *p_encrypted,
445 size_t *p_len,
446 uint32_t *seqnum,
447 bool trusted_channel)
448 {
449 size_t len = 0;
450 NTSTATUS status;
451
452 *p_encrypted = false;
453
454 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
455 p_unread, &len);
456 if (!NT_STATUS_IS_OK(status)) {
457 DEBUG(1, ("read_smb_length_return_keepalive failed for "
458 "client %s read error = %s.\n",
459 tsocket_address_string(sconn->remote_address,
460 talloc_tos()),
461 nt_errstr(status)));
462 return status;
463 }
464
465 if (is_encrypted_packet((uint8_t *)*buffer)) {
466 status = srv_decrypt_buffer(*buffer);
467 if (!NT_STATUS_IS_OK(status)) {
468 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
469 "incoming packet! Error %s\n",
470 nt_errstr(status) ));
471 return status;
472 }
473 *p_encrypted = true;
474 }
475
476 /* Check the incoming SMB signature. */
477 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
478 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
479 "incoming packet!\n"));
480 return NT_STATUS_INVALID_NETWORK_RESPONSE;
481 }
482
483 *p_len = len;
484 return NT_STATUS_OK;
485 }
486
487 /*
488 * Initialize a struct smb_request from an inbuf
489 */
490
491 static bool init_smb_request(struct smb_request *req,
492 struct smbd_server_connection *sconn,
493 const uint8 *inbuf,
494 size_t unread_bytes, bool encrypted,
495 uint32_t seqnum)
496 {
497 size_t req_size = smb_len(inbuf) + 4;
498 /* Ensure we have at least smb_size bytes. */
499 if (req_size < smb_size) {
500 DEBUG(0,("init_smb_request: invalid request size %u\n",
501 (unsigned int)req_size ));
502 return false;
503 }
504 req->cmd = CVAL(inbuf, smb_com);
505 req->flags2 = SVAL(inbuf, smb_flg2);
506 req->smbpid = SVAL(inbuf, smb_pid);
507 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
508 req->seqnum = seqnum;
509 req->vuid = SVAL(inbuf, smb_uid);
510 req->tid = SVAL(inbuf, smb_tid);
511 req->wct = CVAL(inbuf, smb_wct);
512 req->vwv = discard_const_p(uint16_t, (inbuf+smb_vwv));
513 req->buflen = smb_buflen(inbuf);
514 req->buf = (const uint8_t *)smb_buf_const(inbuf);
515 req->unread_bytes = unread_bytes;
516 req->encrypted = encrypted;
517 req->sconn = sconn;
518 req->conn = conn_find(sconn,req->tid);
519 req->chain_fsp = NULL;
520 req->chain_outbuf = NULL;
521 req->done = false;
522 req->smb2req = NULL;
523 smb_init_perfcount_data(&req->pcd);
524
525 /* Ensure we have at least wct words and 2 bytes of bcc. */
526 if (smb_size + req->wct*2 > req_size) {
527 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
528 (unsigned int)req->wct,
529 (unsigned int)req_size));
530 return false;
531 }
532 /* Ensure bcc is correct. */
533 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
534 DEBUG(0,("init_smb_request: invalid bcc number %u "
535 "(wct = %u, size %u)\n",
536 (unsigned int)req->buflen,
537 (unsigned int)req->wct,
538 (unsigned int)req_size));
539 return false;
540 }
541
542 req->outbuf = NULL;
543 return true;
544 }
545
546 static void process_smb(struct smbd_server_connection *conn,
547 uint8_t *inbuf, size_t nread, size_t unread_bytes,
548 uint32_t seqnum, bool encrypted,
549 struct smb_perfcount_data *deferred_pcd);
550
551 static void smbd_deferred_open_timer(struct event_context *ev,
552 struct timed_event *te,
553 struct timeval _tval,
554 void *private_data)
555 {
556 struct pending_message_list *msg = talloc_get_type(private_data,
557 struct pending_message_list);
558 TALLOC_CTX *mem_ctx = talloc_tos();
559 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
560 uint8_t *inbuf;
561
562 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
563 msg->buf.length);
564 if (inbuf == NULL) {
565 exit_server("smbd_deferred_open_timer: talloc failed\n");
566 return;
567 }
568
569 /* We leave this message on the queue so the open code can
570 know this is a retry. */
571 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
572 (unsigned long long)mid ));
573
574 /* Mark the message as processed so this is not
575 * re-processed in error. */
576 msg->processed = true;
577
578 process_smb(smbd_server_conn, inbuf,
579 msg->buf.length, 0,
580 msg->seqnum, msg->encrypted, &msg->pcd);
581
582 /* If it's still there and was processed, remove it. */
583 msg = get_deferred_open_message_smb(mid);
584 if (msg && msg->processed) {
585 remove_deferred_open_message_smb(mid);
586 }
587 }
588
589 /****************************************************************************
590 Function to push a message onto the tail of a linked list of smb messages ready
591 for processing.
592 ****************************************************************************/
593
594 static bool push_queued_message(struct smb_request *req,
595 struct timeval request_time,
596 struct timeval end_time,
597 char *private_data, size_t private_len)
598 {
599 int msg_len = smb_len(req->inbuf) + 4;
600 struct pending_message_list *msg;
601
602 msg = talloc_zero(NULL, struct pending_message_list);
603
604 if(msg == NULL) {
605 DEBUG(0,("push_message: malloc fail (1)\n"));
606 return False;
607 }
608
609 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
610 if(msg->buf.data == NULL) {
611 DEBUG(0,("push_message: malloc fail (2)\n"));
612 TALLOC_FREE(msg);
613 return False;
614 }
615
616 msg->request_time = request_time;
617 msg->seqnum = req->seqnum;
618 msg->encrypted = req->encrypted;
619 msg->processed = false;
620 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
621
622 if (private_data) {
623 msg->private_data = data_blob_talloc(msg, private_data,
624 private_len);
625 if (msg->private_data.data == NULL) {
626 DEBUG(0,("push_message: malloc fail (3)\n"));
627 TALLOC_FREE(msg);
628 return False;
629 }
630 }
631
632 msg->te = event_add_timed(server_event_context(),
633 msg,
634 end_time,
635 smbd_deferred_open_timer,
636 msg);
637 if (!msg->te) {
638 DEBUG(0,("push_message: event_add_timed failed\n"));
639 TALLOC_FREE(msg);
640 return false;
641 }
642
643 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
644
645 DEBUG(10,("push_message: pushed message length %u on "
646 "deferred_open_queue\n", (unsigned int)msg_len));
647
648 return True;
649 }
650
651 /****************************************************************************
652 Function to delete a sharing violation open message by mid.
653 ****************************************************************************/
654
655 void remove_deferred_open_message_smb(uint64_t mid)
656 {
657 struct pending_message_list *pml;
658
659 if (smbd_server_conn->using_smb2) {
660 remove_deferred_open_message_smb2(smbd_server_conn, mid);
661 return;
662 }
663
664 for (pml = deferred_open_queue; pml; pml = pml->next) {
665 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
666 DEBUG(10,("remove_deferred_open_message_smb: "
667 "deleting mid %llu len %u\n",
668 (unsigned long long)mid,
669 (unsigned int)pml->buf.length ));
670 DLIST_REMOVE(deferred_open_queue, pml);
671 TALLOC_FREE(pml);
672 return;
673 }
674 }
675 }
676
677 /****************************************************************************
678 Move a sharing violation open retry message to the front of the list and
679 schedule it for immediate processing.
680 ****************************************************************************/
681
682 void schedule_deferred_open_message_smb(uint64_t mid)
683 {
684 struct pending_message_list *pml;
685 int i = 0;
686
687 if (smbd_server_conn->using_smb2) {
688 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
689 return;
690 }
691
692 for (pml = deferred_open_queue; pml; pml = pml->next) {
693 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
694
695 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
696 "msg_mid = %llu\n",
697 i++,
698 (unsigned long long)msg_mid ));
699
700 if (mid == msg_mid) {
701 struct timed_event *te;
702
703 if (pml->processed) {
704 /* A processed message should not be
705 * rescheduled. */
706 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
707 "message mid %llu was already processed\n",
708 (unsigned long long)msg_mid ));
709 continue;
710 }
711
712 DEBUG(10,("schedule_deferred_open_message_smb: "
713 "scheduling mid %llu\n",
714 (unsigned long long)mid ));
715
716 te = event_add_timed(server_event_context(),
717 pml,
718 timeval_zero(),
719 smbd_deferred_open_timer,
720 pml);
721 if (!te) {
722 DEBUG(10,("schedule_deferred_open_message_smb: "
723 "event_add_timed() failed, "
724 "skipping mid %llu\n",
725 (unsigned long long)msg_mid ));
726 }
727
728 TALLOC_FREE(pml->te);
729 pml->te = te;
730 DLIST_PROMOTE(deferred_open_queue, pml);
731 return;
732 }
733 }
734
735 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
736 "find message mid %llu\n",
737 (unsigned long long)mid ));
738 }
739
740 /****************************************************************************
741 Return true if this mid is on the deferred queue and was not yet processed.
742 ****************************************************************************/
743
744 bool open_was_deferred(uint64_t mid)
745 {
746 struct pending_message_list *pml;
747
748 if (smbd_server_conn->using_smb2) {
749 return open_was_deferred_smb2(smbd_server_conn, mid);
750 }
751
752 for (pml = deferred_open_queue; pml; pml = pml->next) {
753 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
754 return True;
755 }
756 }
757 return False;
758 }
759
760 /****************************************************************************
761 Return the message queued by this mid.
762 ****************************************************************************/
763
764 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
765 {
766 struct pending_message_list *pml;
767
768 for (pml = deferred_open_queue; pml; pml = pml->next) {
769 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
770 return pml;
771 }
772 }
773 return NULL;
774 }
775
776 /****************************************************************************
777 Get the state data queued by this mid.
778 ****************************************************************************/
779
780 bool get_deferred_open_message_state(struct smb_request *smbreq,
781 struct timeval *p_request_time,
782 void **pp_state)
783 {
784 struct pending_message_list *pml;
785
786 if (smbd_server_conn->using_smb2) {
787 return get_deferred_open_message_state_smb2(smbreq->smb2req,
788 p_request_time,
789 pp_state);
790 }
791
792 pml = get_deferred_open_message_smb(smbreq->mid);
793 if (!pml) {
794 return false;
795 }
796 if (p_request_time) {
797 *p_request_time = pml->request_time;
798 }
799 if (pp_state) {
800 *pp_state = (void *)pml->private_data.data;
801 }
802 return true;
803 }
804
805 /****************************************************************************
806 Function to push a deferred open smb message onto a linked list of local smb
807 messages ready for processing.
808 ****************************************************************************/
809
810 bool push_deferred_open_message_smb(struct smb_request *req,
811 struct timeval request_time,
812 struct timeval timeout,
813 struct file_id id,
814 char *private_data, size_t priv_len)
815 {
816 struct timeval end_time;
817
818 if (req->smb2req) {
819 return push_deferred_open_message_smb2(req->smb2req,
820 request_time,
821 timeout,
822 id,
823 private_data,
824 priv_len);
825 }
826
827 if (req->unread_bytes) {
828 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
829 "unread_bytes = %u\n",
830 (unsigned int)req->unread_bytes ));
831 smb_panic("push_deferred_open_message_smb: "
832 "logic error unread_bytes != 0" );
833 }
834
835 end_time = timeval_sum(&request_time, &timeout);
836
837 DEBUG(10,("push_deferred_open_message_smb: pushing message "
838 "len %u mid %llu timeout time [%u.%06u]\n",
839 (unsigned int) smb_len(req->inbuf)+4,
840 (unsigned long long)req->mid,
841 (unsigned int)end_time.tv_sec,
842 (unsigned int)end_time.tv_usec));
843
844 return push_queued_message(req, request_time, end_time,
845 private_data, priv_len);
846 }
847
848 static void smbd_sig_term_handler(struct tevent_context *ev,
849 struct tevent_signal *se,
850 int signum,
851 int count,
852 void *siginfo,
853 void *private_data)
854 {
855 exit_server_cleanly("termination signal");
856 }
857
858 void smbd_setup_sig_term_handler(void)
859 {
860 struct tevent_signal *se;
861
862 se = tevent_add_signal(server_event_context(),
863 server_event_context(),
864 SIGTERM, 0,
865 smbd_sig_term_handler,
866 NULL);
867 if (!se) {
868 exit_server("failed to setup SIGTERM handler");
869 }
870 }
871
872 static void smbd_sig_hup_handler(struct tevent_context *ev,
873 struct tevent_signal *se,
874 int signum,
875 int count,
876 void *siginfo,
877 void *private_data)
878 {
879 struct messaging_context *msg_ctx = talloc_get_type_abort(
880 private_data, struct messaging_context);
881 change_to_root_user();
882 DEBUG(1,("Reloading services after SIGHUP\n"));
883 reload_services(msg_ctx, smbd_server_conn->sock, False);
884 if (am_parent) {
885 pcap_cache_reload(ev, msg_ctx, &reload_pcap_change_notify);
886 }
887 }
888
889 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
890 struct messaging_context *msg_ctx)
891 {
892 struct tevent_signal *se;
893
894 se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
895 msg_ctx);
896 if (!se) {
897 exit_server("failed to setup SIGHUP handler");
898 }
899 }
900
901 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
902 {
903 int timeout;
904 int num_pfds = 0;
905 int ret;
906 bool retry;
907
908 timeout = SMBD_SELECT_TIMEOUT * 1000;
909
910 /*
911 * Are there any timed events waiting ? If so, ensure we don't
912 * select for longer than it would take to wait for them.
913 */
914
915 event_add_to_poll_args(server_event_context(), conn,
916 &conn->pfds, &num_pfds, &timeout);
917
918 /* Process a signal and timed events now... */
919 if (run_events_poll(server_event_context(), 0, NULL, 0)) {
920 return NT_STATUS_RETRY;
921 }
922
923 {
924 int sav;
925 START_PROFILE(smbd_idle);
926
927 ret = sys_poll(conn->pfds, num_pfds, timeout);
928 sav = errno;
929
930 END_PROFILE(smbd_idle);
931 errno = sav;
932 }
933
934 if (ret == -1) {
935 if (errno == EINTR) {
936 return NT_STATUS_RETRY;
937 }
938 return map_nt_error_from_unix(errno);
939 }
940
941 retry = run_events_poll(server_event_context(), ret, conn->pfds,
942 num_pfds);
943 if (retry) {
944 return NT_STATUS_RETRY;
945 }
946
947 /* Did we timeout ? */
948 if (ret == 0) {
949 return NT_STATUS_RETRY;
950 }
951
952 /* should not be reached */
953 return NT_STATUS_INTERNAL_ERROR;
954 }
955
956 /*
957 * Only allow 5 outstanding trans requests. We're allocating memory, so
958 * prevent a DoS.
959 */
960
961 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
962 {
963 int count = 0;
964 for (; list != NULL; list = list->next) {
965
966 if (list->mid == mid) {
967 return NT_STATUS_INVALID_PARAMETER;
968 }
969
970 count += 1;
971 }
972 if (count > 5) {
973 return NT_STATUS_INSUFFICIENT_RESOURCES;
974 }
975
976 return NT_STATUS_OK;
977 }
978
979 /*
980 These flags determine some of the permissions required to do an operation
981
982 Note that I don't set NEED_WRITE on some write operations because they
983 are used by some brain-dead clients when printing, and I don't want to
984 force write permissions on print services.
985 */
986 #define AS_USER (1<<0)
987 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
988 #define TIME_INIT (1<<2)
989 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
990 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
991 #define DO_CHDIR (1<<6)
992
993 /*
994 define a list of possible SMB messages and their corresponding
995 functions. Any message that has a NULL function is unimplemented -
996 please feel free to contribute implementations!
997 */
998 static const struct smb_message_struct {
999 const char *name;
1000 void (*fn)(struct smb_request *req);
1001 int flags;
1002 } smb_messages[256] = {
1003
1004 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1005 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1006 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1007 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1008 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1009 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1010 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1011 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1012 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1013 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1014 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1015 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1016 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1017 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1018 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1019 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1020 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1021 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1022 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1023 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1024 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1025 /* 0x15 */ { NULL, NULL, 0 },
1026 /* 0x16 */ { NULL, NULL, 0 },
1027 /* 0x17 */ { NULL, NULL, 0 },
1028 /* 0x18 */ { NULL, NULL, 0 },
1029 /* 0x19 */ { NULL, NULL, 0 },
1030 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1031 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1032 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1033 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1034 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1035 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1036 /* 0x20 */ { "SMBwritec", NULL,0},
1037 /* 0x21 */ { NULL, NULL, 0 },
1038 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1039 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1040 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1041 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1042 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1043 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1044 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1045 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1046 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1047 /* 0x2b */ { "SMBecho",reply_echo,0},
1048 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1049 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1050 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1051 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1052 /* 0x30 */ { NULL, NULL, 0 },
1053 /* 0x31 */ { NULL, NULL, 0 },
1054 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1055 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1056 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1057 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1058 /* 0x36 */ { NULL, NULL, 0 },
1059 /* 0x37 */ { NULL, NULL, 0 },
1060 /* 0x38 */ { NULL, NULL, 0 },
1061 /* 0x39 */ { NULL, NULL, 0 },
1062 /* 0x3a */ { NULL, NULL, 0 },
1063 /* 0x3b */ { NULL, NULL, 0 },
1064 /* 0x3c */ { NULL, NULL, 0 },
1065 /* 0x3d */ { NULL, NULL, 0 },
1066 /* 0x3e */ { NULL, NULL, 0 },
1067 /* 0x3f */ { NULL, NULL, 0 },
1068 /* 0x40 */ { NULL, NULL, 0 },
1069 /* 0x41 */ { NULL, NULL, 0 },
1070 /* 0x42 */ { NULL, NULL, 0 },
1071 /* 0x43 */ { NULL, NULL, 0 },
1072 /* 0x44 */ { NULL, NULL, 0 },
1073 /* 0x45 */ { NULL, NULL, 0 },
1074 /* 0x46 */ { NULL, NULL, 0 },
1075 /* 0x47 */ { NULL, NULL, 0 },
1076 /* 0x48 */ { NULL, NULL, 0 },
1077 /* 0x49 */ { NULL, NULL, 0 },
1078 /* 0x4a */ { NULL, NULL, 0 },
1079 /* 0x4b */ { NULL, NULL, 0 },
1080 /* 0x4c */ { NULL, NULL, 0 },
1081 /* 0x4d */ { NULL, NULL, 0 },
1082 /* 0x4e */ { NULL, NULL, 0 },
1083 /* 0x4f */ { NULL, NULL, 0 },
1084 /* 0x50 */ { NULL, NULL, 0 },
1085 /* 0x51 */ { NULL, NULL, 0 },
1086 /* 0x52 */ { NULL, NULL, 0 },
1087 /* 0x53 */ { NULL, NULL, 0 },
1088 /* 0x54 */ { NULL, NULL, 0 },
1089 /* 0x55 */ { NULL, NULL, 0 },
1090 /* 0x56 */ { NULL, NULL, 0 },
1091 /* 0x57 */ { NULL, NULL, 0 },
1092 /* 0x58 */ { NULL, NULL, 0 },
1093 /* 0x59 */ { NULL, NULL, 0 },
1094 /* 0x5a */ { NULL, NULL, 0 },
1095 /* 0x5b */ { NULL, NULL, 0 },
1096 /* 0x5c */ { NULL, NULL, 0 },
1097 /* 0x5d */ { NULL, NULL, 0 },
1098 /* 0x5e */ { NULL, NULL, 0 },
1099 /* 0x5f */ { NULL, NULL, 0 },
1100 /* 0x60 */ { NULL, NULL, 0 },
1101 /* 0x61 */ { NULL, NULL, 0 },
1102 /* 0x62 */ { NULL, NULL, 0 },
1103 /* 0x63 */ { NULL, NULL, 0 },
1104 /* 0x64 */ { NULL, NULL, 0 },
1105 /* 0x65 */ { NULL, NULL, 0 },
1106 /* 0x66 */ { NULL, NULL, 0 },
1107 /* 0x67 */ { NULL, NULL, 0 },
1108 /* 0x68 */ { NULL, NULL, 0 },
1109 /* 0x69 */ { NULL, NULL, 0 },
1110 /* 0x6a */ { NULL, NULL, 0 },
1111 /* 0x6b */ { NULL, NULL, 0 },
1112 /* 0x6c */ { NULL, NULL, 0 },
1113 /* 0x6d */ { NULL, NULL, 0 },
1114 /* 0x6e */ { NULL, NULL, 0 },
1115 /* 0x6f */ { NULL, NULL, 0 },
1116 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1117 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1118 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1119 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1120 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1121 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1122 /* 0x76 */ { NULL, NULL, 0 },
1123 /* 0x77 */ { NULL, NULL, 0 },
1124 /* 0x78 */ { NULL, NULL, 0 },
1125 /* 0x79 */ { NULL, NULL, 0 },
1126 /* 0x7a */ { NULL, NULL, 0 },
1127 /* 0x7b */ { NULL, NULL, 0 },
1128 /* 0x7c */ { NULL, NULL, 0 },
1129 /* 0x7d */ { NULL, NULL, 0 },
1130 /* 0x7e */ { NULL, NULL, 0 },
1131 /* 0x7f */ { NULL, NULL, 0 },
1132 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1133 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1134 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1135 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1136 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1137 /* 0x85 */ { NULL, NULL, 0 },
1138 /* 0x86 */ { NULL, NULL, 0 },
1139 /* 0x87 */ { NULL, NULL, 0 },
1140 /* 0x88 */ { NULL, NULL, 0 },
1141 /* 0x89 */ { NULL, NULL, 0 },
1142 /* 0x8a */ { NULL, NULL, 0 },
1143 /* 0x8b */ { NULL, NULL, 0 },
1144 /* 0x8c */ { NULL, NULL, 0 },
1145 /* 0x8d */ { NULL, NULL, 0 },
1146 /* 0x8e */ { NULL, NULL, 0 },
1147 /* 0x8f */ { NULL, NULL, 0 },
1148 /* 0x90 */ { NULL, NULL, 0 },
1149 /* 0x91 */ { NULL, NULL, 0 },
1150 /* 0x92 */ { NULL, NULL, 0 },
1151 /* 0x93 */ { NULL, NULL, 0 },
1152 /* 0x94 */ { NULL, NULL, 0 },
1153 /* 0x95 */ { NULL, NULL, 0 },
1154 /* 0x96 */ { NULL, NULL, 0 },
1155 /* 0x97 */ { NULL, NULL, 0 },
1156 /* 0x98 */ { NULL, NULL, 0 },
1157 /* 0x99 */ { NULL, NULL, 0 },
1158 /* 0x9a */ { NULL, NULL, 0 },
1159 /* 0x9b */ { NULL, NULL, 0 },
1160 /* 0x9c */ { NULL, NULL, 0 },
1161 /* 0x9d */ { NULL, NULL, 0 },
1162 /* 0x9e */ { NULL, NULL, 0 },
1163 /* 0x9f */ { NULL, NULL, 0 },
1164 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1165 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1166 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1167 /* 0xa3 */ { NULL, NULL, 0 },
1168 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1169 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1170 /* 0xa6 */ { NULL, NULL, 0 },
1171 /* 0xa7 */ { NULL, NULL, 0 },
1172 /* 0xa8 */ { NULL, NULL, 0 },
1173 /* 0xa9 */ { NULL, NULL, 0 },
1174 /* 0xaa */ { NULL, NULL, 0 },
1175 /* 0xab */ { NULL, NULL, 0 },
1176 /* 0xac */ { NULL, NULL, 0 },
1177 /* 0xad */ { NULL, NULL, 0 },
1178 /* 0xae */ { NULL, NULL, 0 },
1179 /* 0xaf */ { NULL, NULL, 0 },
1180 /* 0xb0 */ { NULL, NULL, 0 },
1181 /* 0xb1 */ { NULL, NULL, 0 },
1182 /* 0xb2 */ { NULL, NULL, 0 },
1183 /* 0xb3 */ { NULL, NULL, 0 },
1184 /* 0xb4 */ { NULL, NULL, 0 },
1185 /* 0xb5 */ { NULL, NULL, 0 },
1186 /* 0xb6 */ { NULL, NULL, 0 },
1187 /* 0xb7 */ { NULL, NULL, 0 },
1188 /* 0xb8 */ { NULL, NULL, 0 },
1189 /* 0xb9 */ { NULL, NULL, 0 },
1190 /* 0xba */ { NULL, NULL, 0 },
1191 /* 0xbb */ { NULL, NULL, 0 },
1192 /* 0xbc */ { NULL, NULL, 0 },
1193 /* 0xbd */ { NULL, NULL, 0 },
1194 /* 0xbe */ { NULL, NULL, 0 },
1195 /* 0xbf */ { NULL, NULL, 0 },
1196 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1197 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1198 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1199 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1200 /* 0xc4 */ { NULL, NULL, 0 },
1201 /* 0xc5 */ { NULL, NULL, 0 },
1202 /* 0xc6 */ { NULL, NULL, 0 },
1203 /* 0xc7 */ { NULL, NULL, 0 },
1204 /* 0xc8 */ { NULL, NULL, 0 },
1205 /* 0xc9 */ { NULL, NULL, 0 },
1206 /* 0xca */ { NULL, NULL, 0 },
1207 /* 0xcb */ { NULL, NULL, 0 },
1208 /* 0xcc */ { NULL, NULL, 0 },
1209 /* 0xcd */ { NULL, NULL, 0 },
1210 /* 0xce */ { NULL, NULL, 0 },
1211 /* 0xcf */ { NULL, NULL, 0 },
1212 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1213 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1214 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1215 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1216 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1217 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1218 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1219 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1220 /* 0xd8 */ { NULL, NULL, 0 },
1221 /* 0xd9 */ { NULL, NULL, 0 },
1222 /* 0xda */ { NULL, NULL, 0 },
1223 /* 0xdb */ { NULL, NULL, 0 },
1224 /* 0xdc */ { NULL, NULL, 0 },
1225 /* 0xdd */ { NULL, NULL, 0 },
1226 /* 0xde */ { NULL, NULL, 0 },
1227 /* 0xdf */ { NULL, NULL, 0 },
1228 /* 0xe0 */ { NULL, NULL, 0 },
1229 /* 0xe1 */ { NULL, NULL, 0 },
1230 /* 0xe2 */ { NULL, NULL, 0 },
1231 /* 0xe3 */ { NULL, NULL, 0 },
1232 /* 0xe4 */ { NULL, NULL, 0 },
1233 /* 0xe5 */ { NULL, NULL, 0 },
1234 /* 0xe6 */ { NULL, NULL, 0 },
1235 /* 0xe7 */ { NULL, NULL, 0 },
1236 /* 0xe8 */ { NULL, NULL, 0 },
1237 /* 0xe9 */ { NULL, NULL, 0 },
1238 /* 0xea */ { NULL, NULL, 0 },
1239 /* 0xeb */ { NULL, NULL, 0 },
1240 /* 0xec */ { NULL, NULL, 0 },
1241 /* 0xed */ { NULL, NULL, 0 },
1242 /* 0xee */ { NULL, NULL, 0 },
1243 /* 0xef */ { NULL, NULL, 0 },
1244 /* 0xf0 */ { NULL, NULL, 0 },
1245 /* 0xf1 */ { NULL, NULL, 0 },
1246 /* 0xf2 */ { NULL, NULL, 0 },
1247 /* 0xf3 */ { NULL, NULL, 0 },
1248 /* 0xf4 */ { NULL, NULL, 0 },
1249 /* 0xf5 */ { NULL, NULL, 0 },
1250 /* 0xf6 */ { NULL, NULL, 0 },
1251 /* 0xf7 */ { NULL, NULL, 0 },
1252 /* 0xf8 */ { NULL, NULL, 0 },
1253 /* 0xf9 */ { NULL, NULL, 0 },
1254 /* 0xfa */ { NULL, NULL, 0 },
1255 /* 0xfb */ { NULL, NULL, 0 },
1256 /* 0xfc */ { NULL, NULL, 0 },
1257 /* 0xfd */ { NULL, NULL, 0 },
1258 /* 0xfe */ { NULL, NULL, 0 },
1259 /* 0xff */ { NULL, NULL, 0 }
1260
1261 };
1262
1263 /*******************************************************************
1264 allocate and initialize a reply packet
1265 ********************************************************************/
1266
1267 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1268 const char *inbuf, char **outbuf, uint8_t num_words,
1269 uint32_t num_bytes)
1270 {
1271 /*
1272 * Protect against integer wrap
1273 */
1274 if ((num_bytes > 0xffffff)
1275 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1276 char *msg;
1277 if (asprintf(&msg, "num_bytes too large: %u",
1278 (unsigned)num_bytes) == -1) {
1279 msg = discard_const_p(char, "num_bytes too large");
1280 }
1281 smb_panic(msg);
1282 }
1283
1284 *outbuf = talloc_array(mem_ctx, char,
1285 smb_size + num_words*2 + num_bytes);
1286 if (*outbuf == NULL) {
1287 return false;
1288 }
1289
1290 construct_reply_common(req, inbuf, *outbuf);
1291 srv_set_message(*outbuf, num_words, num_bytes, false);
1292 /*
1293 * Zero out the word area, the caller has to take care of the bcc area
1294 * himself
1295 */
1296 if (num_words != 0) {
1297 memset(*outbuf + smb_vwv0, 0, num_words*2);
1298 }
1299
1300 return true;
1301 }
1302
1303 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1304 {
1305 char *outbuf;
1306 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1307 num_bytes)) {
1308 smb_panic("could not allocate output buffer\n");
1309 }
1310 req->outbuf = (uint8_t *)outbuf;
1311 }
1312
1313
1314 /*******************************************************************
1315 Dump a packet to a file.
1316 ********************************************************************/
1317
1318 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1319 {
1320 int fd, i;
1321 char *fname = NULL;
1322 if (DEBUGLEVEL < 50) {
1323 return;
1324 }
1325
1326 if (len < 4) len = smb_len(data)+4;
1327 for (i=1;i<100;i++) {
1328 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1329 type ? "req" : "resp") == -1) {
1330 return;
1331 }
1332 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1333 if (fd != -1 || errno != EEXIST) break;
1334 }
1335 if (fd != -1) {
1336 ssize_t ret = write(fd, data, len);
1337 if (ret != len)
1338 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1339 close(fd);
1340 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1341 }
1342 SAFE_FREE(fname);
1343 }
1344
1345 /****************************************************************************
1346 Prepare everything for calling the actual request function, and potentially
1347 call the request function via the "new" interface.
1348
1349 Return False if the "legacy" function needs to be called, everything is
1350 prepared.
1351
1352 Return True if we're done.
1353
1354 I know this API sucks, but it is the one with the least code change I could
1355 find.
1356 ****************************************************************************/
1357
1358 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1359 {
1360 int flags;
1361 uint16 session_tag;
1362 connection_struct *conn = NULL;
1363 struct smbd_server_connection *sconn = req->sconn;
1364 char *raddr;
1365
1366 errno = 0;
1367
1368 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1369 * so subtract 4 from it. */
1370 if (!valid_smb_header(req->inbuf)
1371 || (size < (smb_size - 4))) {
1372 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1373 smb_len(req->inbuf)));
1374 exit_server_cleanly("Non-SMB packet");
1375 }
1376
1377 if (smb_messages[type].fn == NULL) {
1378 DEBUG(0,("Unknown message type %d!\n",type));
1379 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1380 reply_unknown_new(req, type);
1381 return NULL;
1382 }
1383
1384 flags = smb_messages[type].flags;
1385
1386 /* In share mode security we must ignore the vuid. */
1387 session_tag = (lp_security() == SEC_SHARE)
1388 ? UID_FIELD_INVALID : req->vuid;
1389 conn = req->conn;
1390
1391 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1392 (int)sys_getpid(), (unsigned long)conn));
1393
1394 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1395
1396 /* Ensure this value is replaced in the incoming packet. */
1397 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1398
1399 /*
1400 * Ensure the correct username is in current_user_info. This is a
1401 * really ugly bugfix for problems with multiple session_setup_and_X's
1402 * being done and allowing %U and %G substitutions to work correctly.
1403 * There is a reason this code is done here, don't move it unless you
1404 * know what you're doing... :-).
1405 * JRA.
1406 */
1407
1408 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1409 user_struct *vuser = NULL;
1410
1411 sconn->smb1.sessions.last_session_tag = session_tag;
1412 if(session_tag != UID_FIELD_INVALID) {
1413 vuser = get_valid_user_struct(sconn, session_tag);
1414 if (vuser) {
1415 set_current_user_info(
1416 vuser->session_info->unix_info->sanitized_username,
1417 vuser->session_info->unix_info->unix_name,
1418 vuser->session_info->info->domain_name);
1419 }
1420 }
1421 }
1422
1423 /* Does this call need to be run as the connected user? */
1424 if (flags & AS_USER) {
1425
1426 /* Does this call need a valid tree connection? */
1427 if (!conn) {
1428 /*
1429 * Amazingly, the error code depends on the command
1430 * (from Samba4).
1431 */
1432 if (type == SMBntcreateX) {
1433 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1434 } else {
1435 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1436 }
1437 return NULL;
1438 }
1439
1440 if (!change_to_user(conn,session_tag)) {
1441 DEBUG(0, ("Error: Could not change to user. Removing "
1442 "deferred open, mid=%llu.\n",
1443 (unsigned long long)req->mid));
1444 reply_force_doserror(req, ERRSRV, ERRbaduid);
1445 return conn;
1446 }
1447
1448 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1449
1450 /* Does it need write permission? */
1451 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1452 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1453 return conn;
1454 }
1455
1456 /* IPC services are limited */
1457 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1458 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1459 return conn;
1460 }
1461 } else {
1462 /* This call needs to be run as root */
1463 change_to_root_user();
1464 }
1465
1466 /* load service specific parameters */
1467 if (conn) {
1468 if (req->encrypted) {
1469 conn->encrypted_tid = true;
1470 /* encrypted required from now on. */
1471 conn->encrypt_level = Required;
1472 } else if (ENCRYPTION_REQUIRED(conn)) {
1473 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1474 exit_server_cleanly("encryption required "
1475 "on connection");
1476 return conn;
1477 }
1478 }
1479
1480 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1481 (flags & (AS_USER|DO_CHDIR)
1482 ?True:False))) {
1483 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1484 return conn;
1485 }
1486 conn->num_smb_operations++;
1487 }
1488
1489 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1490 talloc_tos());
1491 if (raddr == NULL) {
1492 reply_nterror(req, NT_STATUS_NO_MEMORY);
1493 return conn;
1494 }
1495
1496 /* does this protocol need to be run as guest? */
1497 if ((flags & AS_GUEST)
1498 && (!change_to_guest() ||
1499 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1500 sconn->remote_hostname,
1501 raddr))) {
1502 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1503 return conn;
1504 }
1505
1506 smb_messages[type].fn(req);
1507 return req->conn;
1508 }
1509
1510 /****************************************************************************
1511 Construct a reply to the incoming packet.
1512 ****************************************************************************/
1513
1514 static void construct_reply(struct smbd_server_connection *sconn,
1515 char *inbuf, int size, size_t unread_bytes,
1516 uint32_t seqnum, bool encrypted,
1517 struct smb_perfcount_data *deferred_pcd)
1518 {
1519 connection_struct *conn;
1520 struct smb_request *req;
1521
1522 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1523 smb_panic("could not allocate smb_request");
1524 }
1525
1526 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1527 encrypted, seqnum)) {
1528 exit_server_cleanly("Invalid SMB request");
1529 }
1530
1531 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1532
1533 /* we popped this message off the queue - keep original perf data */
1534 if (deferred_pcd)
1535 req->pcd = *deferred_pcd;
1536 else {
1537 SMB_PERFCOUNT_START(&req->pcd);
1538 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1539 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1540 }
1541
1542 conn = switch_message(req->cmd, req, size);
1543
1544 if (req->unread_bytes) {
1545 /* writeX failed. drain socket. */
1546 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1547 req->unread_bytes) {
1548 smb_panic("failed to drain pending bytes");
1549 }
1550 req->unread_bytes = 0;
1551 }
1552
1553 if (req->done) {
1554 TALLOC_FREE(req);
1555 return;
1556 }
1557
1558 if (req->outbuf == NULL) {
1559 return;
1560 }
1561
1562 if (CVAL(req->outbuf,0) == 0) {
1563 show_msg((char *)req->outbuf);
1564 }
1565
1566 if (!srv_send_smb(req->sconn,
1567 (char *)req->outbuf,
1568 true, req->seqnum+1,
1569 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1570 &req->pcd)) {
1571 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1572 }
1573
1574 TALLOC_FREE(req);
1575
1576 return;
1577 }
1578
1579 /****************************************************************************
1580 Process an smb from the client
1581 ****************************************************************************/
1582 static void process_smb(struct smbd_server_connection *sconn,
1583 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1584 uint32_t seqnum, bool encrypted,
1585 struct smb_perfcount_data *deferred_pcd)
1586 {
1587 int msg_type = CVAL(inbuf,0);
1588
1589 DO_PROFILE_INC(smb_count);
1590
1591 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1592 smb_len(inbuf) ) );
1593 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1594 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1595
1596 if (msg_type != NBSSmessage) {
1597 /*
1598 * NetBIOS session request, keepalive, etc.
1599 */
1600 reply_special(sconn, (char *)inbuf, nread);
1601 goto done;
1602 }
1603
1604 if (sconn->using_smb2) {
1605 /* At this point we're not really using smb2,
1606 * we make the decision here.. */
1607 if (smbd_is_smb2_header(inbuf, nread)) {
1608 smbd_smb2_first_negprot(sconn, inbuf, nread);
1609 return;
1610 } else if (nread >= smb_size && valid_smb_header(inbuf)
1611 && CVAL(inbuf, smb_com) != 0x72) {
1612 /* This is a non-negprot SMB1 packet.
1613 Disable SMB2 from now on. */
1614 sconn->using_smb2 = false;
1615 }
1616 }
1617
1618 show_msg((char *)inbuf);
1619
1620 construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1621 encrypted, deferred_pcd);
1622 sconn->trans_num++;
1623
1624 done:
1625 sconn->num_requests++;
1626
1627 /* The timeout_processing function isn't run nearly
1628 often enough to implement 'max log size' without
1629 overrunning the size of the file by many megabytes.
1630 This is especially true if we are running at debug
1631 level 10. Checking every 50 SMBs is a nice
1632 tradeoff of performance vs log file size overrun. */
1633
1634 if ((sconn->num_requests % 50) == 0 &&
1635 need_to_check_log_size()) {
1636 change_to_root_user();
1637 check_log_size();
1638 }
1639 }
1640
1641 /****************************************************************************
1642 Return a string containing the function name of a SMB command.
1643 ****************************************************************************/
1644
1645 const char *smb_fn_name(int type)
1646 {
1647 const char *unknown_name = "SMBunknown";
1648
1649 if (smb_messages[type].name == NULL)
1650 return(unknown_name);
1651
1652 return(smb_messages[type].name);
1653 }
1654
1655 /****************************************************************************
1656 Helper functions for contruct_reply.
1657 ****************************************************************************/
1658
1659 void add_to_common_flags2(uint32 v)
1660 {
1661 common_flags2 |= v;
1662 }
1663
1664 void remove_from_common_flags2(uint32 v)
1665 {
1666 common_flags2 &= ~v;
1667 }
1668
1669 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1670 char *outbuf)
1671 {
1672 srv_set_message(outbuf,0,0,false);
1673
1674 SCVAL(outbuf, smb_com, req->cmd);
1675 SIVAL(outbuf,smb_rcls,0);
1676 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1677 SSVAL(outbuf,smb_flg2,
1678 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1679 common_flags2);
1680 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1681
1682 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1683 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1684 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1685 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1686 }
1687
1688 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1689 {
1690 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1691 }
1692
1693 /*
1694 * How many bytes have we already accumulated up to the current wct field
1695 * offset?
1696 */
1697
1698 size_t req_wct_ofs(struct smb_request *req)
1699 {
1700 size_t buf_size;
1701
1702 if (req->chain_outbuf == NULL) {
1703 return smb_wct - 4;
1704 }
1705 buf_size = talloc_get_size(req->chain_outbuf);
1706 if ((buf_size % 4) != 0) {
1707 buf_size += (4 - (buf_size % 4));
1708 }
1709 return buf_size - 4;
1710 }
1711
1712 /*
1713 * Hack around reply_nterror & friends not being aware of chained requests,
1714 * generating illegal (i.e. wct==0) chain replies.
1715 */
1716
1717 static void fixup_chain_error_packet(struct smb_request *req)
1718 {
1719 uint8_t *outbuf = req->outbuf;
1720 req->outbuf = NULL;
1721 reply_outbuf(req, 2, 0);
1722 memcpy(req->outbuf, outbuf, smb_wct);
1723 TALLOC_FREE(outbuf);
1724 SCVAL(req->outbuf, smb_vwv0, 0xff);
1725 }
1726
1727 /**
1728 * @brief Find the smb_cmd offset of the last command pushed
1729 * @param[in] buf The buffer we're building up
1730 * @retval Where can we put our next andx cmd?
1731 *
1732 * While chaining requests, the "next" request we're looking at needs to put
1733 * its SMB_Command before the data the previous request already built up added
1734 * to the chain. Find the offset to the place where we have to put our cmd.
1735 */
1736
1737 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1738 {
1739 uint8_t cmd;
1740 size_t ofs;
1741
1742 cmd = CVAL(buf, smb_com);
1743
1744 SMB_ASSERT(is_andx_req(cmd));
1745
1746 ofs = smb_vwv0;
1747
1748 while (CVAL(buf, ofs) != 0xff) {
1749
1750 if (!is_andx_req(CVAL(buf, ofs))) {
1751 return false;
1752 }
1753
1754 /*
1755 * ofs is from start of smb header, so add the 4 length
1756 * bytes. The next cmd is right after the wct field.
1757 */
1758 ofs = SVAL(buf, ofs+2) + 4 + 1;
1759
1760 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1761 }
1762
1763 *pofs = ofs;
1764 return true;
1765 }
1766
1767 /**
1768 * @brief Do the smb chaining at a buffer level
1769 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1770 * @param[in] smb_command The command that we want to issue
1771 * @param[in] wct How many words?
1772 * @param[in] vwv The words, already in network order
1773 * @param[in] bytes_alignment How shall we align "bytes"?
1774 * @param[in] num_bytes How many bytes?
1775 * @param[in] bytes The data the request ships
1776 *
1777 * smb_splice_chain() adds the vwv and bytes to the request already present in
1778 * *poutbuf.
1779 */
1780
1781 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1782 uint8_t wct, const uint16_t *vwv,
1783 size_t bytes_alignment,
1784 uint32_t num_bytes, const uint8_t *bytes)
1785 {
1786 uint8_t *outbuf;
1787 size_t old_size, new_size;
1788 size_t ofs;
1789 size_t chain_padding = 0;
1790 size_t bytes_padding = 0;
1791 bool first_request;
1792
1793 old_size = talloc_get_size(*poutbuf);
1794
1795 /*
1796 * old_size == smb_wct means we're pushing the first request in for
1797 * libsmb/
1798 */
1799
1800 first_request = (old_size == smb_wct);
1801
1802 if (!first_request && ((old_size % 4) != 0)) {
1803 /*
1804 * Align the wct field of subsequent requests to a 4-byte
1805 * boundary
1806 */
1807 chain_padding = 4 - (old_size % 4);
1808 }
1809
1810 /*
1811 * After the old request comes the new wct field (1 byte), the vwv's
1812 * and the num_bytes field. After at we might need to align the bytes
1813 * given to us to "bytes_alignment", increasing the num_bytes value.
1814 */
1815
1816 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1817
1818 if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1819 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1820 }
1821
1822 new_size += bytes_padding + num_bytes;
1823
1824 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1825 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1826 (unsigned)new_size));
1827 return false;
1828 }
1829
1830 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1831 if (outbuf == NULL) {
1832 DEBUG(0, ("talloc failed\n"));
1833 return false;
1834 }
1835 *poutbuf = outbuf;
1836
1837 if (first_request) {
1838 SCVAL(outbuf, smb_com, smb_command);
1839 } else {
1840 size_t andx_cmd_ofs;
1841
1842 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1843 DEBUG(1, ("invalid command chain\n"));
1844 *poutbuf = talloc_realloc(
1845 NULL, *poutbuf, uint8_t, old_size);
1846 return false;
1847 }
1848
1849 if (chain_padding != 0) {
1850 memset(outbuf + old_size, 0, chain_padding);
1851 old_size += chain_padding;
1852 }
1853
1854 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1855 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1856 }
1857
1858 ofs = old_size;
1859
1860 /*
1861 * Push the chained request:
1862 *
1863 * wct field
1864 */
1865
1866 SCVAL(outbuf, ofs, wct);
1867 ofs += 1;
1868
1869 /*
1870 * vwv array
1871 */
1872
1873 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1874 ofs += sizeof(uint16_t) * wct;
1875
1876 /*
1877 * bcc (byte count)
1878 */
1879
1880 SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1881 ofs += sizeof(uint16_t);
1882
1883 /*
1884 * padding
1885 */
1886
1887 if (bytes_padding != 0) {
1888 memset(outbuf + ofs, 0, bytes_padding);
1889 ofs += bytes_padding;
1890 }
1891
1892 /*
1893 * The bytes field
1894 */
1895
1896 memcpy(outbuf + ofs, bytes, num_bytes);
1897
1898 return true;
1899 }
1900
1901 /****************************************************************************
1902 Construct a chained reply and add it to the already made reply
1903 ****************************************************************************/
1904
1905 void chain_reply(struct smb_request *req)
1906 {
1907 size_t smblen = smb_len(req->inbuf);
1908 size_t already_used, length_needed;
1909 uint8_t chain_cmd;
1910 uint32_t chain_offset; /* uint32_t to avoid overflow */
1911
1912 uint8_t wct;
1913 const uint16_t *vwv;
1914 uint16_t buflen;
1915 const uint8_t *buf;
1916
1917 if (IVAL(req->outbuf, smb_rcls) != 0) {
1918 fixup_chain_error_packet(req);
1919 }
1920
1921 /*
1922 * Any of the AndX requests and replies have at least a wct of
1923 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1924 * beginning of the SMB header to the next wct field.
1925 *
1926 * None of the AndX requests put anything valuable in vwv[0] and [1],
1927 * so we can overwrite it here to form the chain.
1928 */
1929
1930 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1931 if (req->chain_outbuf == NULL) {
1932 req->chain_outbuf = talloc_realloc(
1933 req, req->outbuf, uint8_t,
1934 smb_len(req->outbuf) + 4);
1935 if (req->chain_outbuf == NULL) {
1936 smb_panic("talloc failed");
1937 }
1938 }
1939 req->outbuf = NULL;
1940 goto error;
1941 }
1942
1943 /*
1944 * Here we assume that this is the end of the chain. For that we need
1945 * to set "next command" to 0xff and the offset to 0. If we later find
1946 * more commands in the chain, this will be overwritten again.
1947 */
1948
1949 SCVAL(req->outbuf, smb_vwv0, 0xff);
1950 SCVAL(req->outbuf, smb_vwv0+1, 0);
1951 SSVAL(req->outbuf, smb_vwv1, 0);
1952
1953 if (req->chain_outbuf == NULL) {
1954 /*
1955 * In req->chain_outbuf we collect all the replies. Start the
1956 * chain by copying in the first reply.
1957 *
1958 * We do the realloc because later on we depend on
1959 * talloc_get_size to determine the length of
1960 * chain_outbuf. The reply_xxx routines might have
1961 * over-allocated (reply_pipe_read_and_X used to be such an
1962 * example).
1963 */
1964 req->chain_outbuf = talloc_realloc(
1965 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1966 if (req->chain_outbuf == NULL) {
1967 smb_panic("talloc failed");
1968 }
1969 req->outbuf = NULL;
1970 } else {
1971 /*
1972 * Update smb headers where subsequent chained commands
1973 * may have updated them.
1974 */
1975 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1976 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1977
1978 if (!smb_splice_chain(&req->chain_outbuf,
1979 CVAL(req->outbuf, smb_com),
1980 CVAL(req->outbuf, smb_wct),
1981 (uint16_t *)(req->outbuf + smb_vwv),
1982 0, smb_buflen(req->outbuf),
1983 (uint8_t *)smb_buf(req->outbuf))) {
1984 goto error;
1985 }
1986 TALLOC_FREE(req->outbuf);
1987 }
1988
1989 /*
1990 * We use the old request's vwv field to grab the next chained command
1991 * and offset into the chained fields.
1992 */
1993
1994 chain_cmd = CVAL(req->vwv+0, 0);
1995 chain_offset = SVAL(req->vwv+1, 0);
1996
1997 if (chain_cmd == 0xff) {
1998 /*
1999 * End of chain, no more requests from the client. So ship the
2000 * replies.
2001 */
2002 smb_setlen((char *)(req->chain_outbuf),
2003 talloc_get_size(req->chain_outbuf) - 4);
2004
2005 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2006 true, req->seqnum+1,
2007 IS_CONN_ENCRYPTED(req->conn)
2008 ||req->encrypted,
2009 &req->pcd)) {
2010 exit_server_cleanly("chain_reply: srv_send_smb "
2011 "failed.");
2012 }
2013 TALLOC_FREE(req->chain_outbuf);
2014 req->done = true;
2015 return;
2016 }
2017
2018 /* add a new perfcounter for this element of chain */
2019 SMB_PERFCOUNT_ADD(&req->pcd);
2020 SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2021 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2022
2023 /*
2024 * Check if the client tries to fool us. The request so far uses the
2025 * space to the end of the byte buffer in the request just
2026 * processed. The chain_offset can't point into that area. If that was
2027 * the case, we could end up with an endless processing of the chain,
2028 * we would always handle the same request.
2029 */
2030
2031 already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2032 if (chain_offset < already_used) {
2033 goto error;
2034 }
2035
2036 /*
2037 * Next check: Make sure the chain offset does not point beyond the
2038 * overall smb request length.
2039 */
2040
2041 length_needed = chain_offset+1; /* wct */
2042 if (length_needed > smblen) {
2043 goto error;
2044 }
2045
2046 /*
2047 * Now comes the pointer magic. Goal here is to set up req->vwv and
2048 * req->buf correctly again to be able to call the subsequent
2049 * switch_message(). The chain offset (the former vwv[1]) points at
2050 * the new wct field.
2051 */
2052
2053 wct = CVAL(smb_base(req->inbuf), chain_offset);
2054
2055 /*
2056 * Next consistency check: Make the new vwv array fits in the overall
2057 * smb request.
2058 */
2059
2060 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2061 if (length_needed > smblen) {
2062 goto error;
2063 }
2064 vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2065
2066 /*
2067 * Now grab the new byte buffer....
2068 */
2069
2070 buflen = SVAL(vwv+wct, 0);
2071
2072 /*
2073 * .. and check that it fits.
2074 */
2075
2076 length_needed += buflen;
2077 if (length_needed > smblen) {
2078 goto error;
2079 }
2080 buf = (const uint8_t *)(vwv+wct+1);
2081
2082 req->cmd = chain_cmd;
2083 req->wct = wct;
2084 req->vwv = discard_const_p(uint16_t, vwv);
2085 req->buflen = buflen;
2086 req->buf = buf;
2087
2088 switch_message(chain_cmd, req, smblen);
2089
2090 if (req->outbuf == NULL) {
2091 /*
2092 * This happens if the chained command has suspended itself or
2093 * if it has called srv_send_smb() itself.
2094 */
2095 return;
2096 }
2097
2098 /*
2099 * We end up here if the chained command was not itself chained or
2100 * suspended, but for example a close() command. We now need to splice
2101 * the chained commands' outbuf into the already built up chain_outbuf
2102 * and ship the result.
2103 */
2104 goto done;
2105
2106 error:
2107 /*
2108 * We end up here if there's any error in the chain syntax. Report a
2109 * DOS error, just like Windows does.
2110 */
2111 reply_force_doserror(req, ERRSRV, ERRerror);
2112 fixup_chain_error_packet(req);
2113
2114 done:
2115 /*
2116 * This scary statement intends to set the
2117 * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2118 * to the value req->outbuf carries
2119 */
2120 SSVAL(req->chain_outbuf, smb_flg2,
2121 (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2122 | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2123
2124 /*
2125 * Transfer the error codes from the subrequest to the main one
2126 */
2127 SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2128 SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2129
2130 if (!smb_splice_chain(&req->chain_outbuf,
2131 CVAL(req->outbuf, smb_com),
2132 CVAL(req->outbuf, smb_wct),
2133 (uint16_t *)(req->outbuf + smb_vwv),
2134 0, smb_buflen(req->outbuf),
2135 (uint8_t *)smb_buf(req->outbuf))) {
2136 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2137 }
2138 TALLOC_FREE(req->outbuf);
2139
2140 smb_setlen((char *)(req->chain_outbuf),
2141 talloc_get_size(req->chain_outbuf) - 4);
2142
2143 show_msg((char *)(req->chain_outbuf));
2144
2145 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2146 true, req->seqnum+1,
2147 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2148 &req->pcd)) {
2149 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2150 }
2151 TALLOC_FREE(req->chain_outbuf);
2152 req->done = true;
2153 }
2154
2155 /****************************************************************************
2156 Check if services need reloading.
2157 ****************************************************************************/
2158
2159 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2160 {
2161
2162 if (last_smb_conf_reload_time == 0) {
2163 last_smb_conf_reload_time = t;
2164 }
2165
2166 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2167 reload_services(sconn->msg_ctx, sconn->sock, True);
2168 last_smb_conf_reload_time = t;
2169 }
2170 }
2171
2172 static bool fd_is_readable(int fd)
2173 {
2174 int ret, revents;
2175
2176 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2177
2178 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2179
2180 }
2181
2182 static void smbd_server_connection_write_handler(
2183 struct smbd_server_connection *sconn)
2184 {
2185 /* TODO: make write nonblocking */
2186 }
2187
2188 static void smbd_server_connection_read_handler(
2189 struct smbd_server_connection *sconn, int fd)
2190 {
2191 uint8_t *inbuf = NULL;
2192 size_t inbuf_len = 0;
2193 size_t unread_bytes = 0;
2194 bool encrypted = false;
2195 TALLOC_CTX *mem_ctx = talloc_tos();
2196 NTSTATUS status;
2197 uint32_t seqnum;
2198
2199 bool from_client = (sconn->sock == fd);
2200
2201 if (from_client) {
2202 smbd_lock_socket(sconn);
2203
2204 if (lp_async_smb_echo_handler() && !fd_is_readable(fd)) {
2205 DEBUG(10,("the echo listener was faster\n"));
2206 smbd_unlock_socket(sconn);
2207 return;
2208 }
2209
2210 /* TODO: make this completely nonblocking */
2211 status = receive_smb_talloc(mem_ctx, sconn, fd,
2212 (char **)(void *)&inbuf,
2213 0, /* timeout */
2214 &unread_bytes,
2215 &encrypted,
2216 &inbuf_len, &seqnum,
2217 false /* trusted channel */);
2218 smbd_unlock_socket(sconn);
2219 } else {
2220 /* TODO: make this completely nonblocking */
2221 status = receive_smb_talloc(mem_ctx, sconn, fd,
2222 (char **)(void *)&inbuf,
2223 0, /* timeout */
2224 &unread_bytes,
2225 &encrypted,
2226 &inbuf_len, &seqnum,
2227 true /* trusted channel */);
2228 }
2229
2230 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2231 goto process;
2232 }
2233 if (NT_STATUS_IS_ERR(status)) {
2234 exit_server_cleanly("failed to receive smb request");
2235 }
2236 if (!NT_STATUS_IS_OK(status)) {
2237 return;
2238 }
2239
2240 process:
2241 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2242 seqnum, encrypted, NULL);
2243 }
2244
2245 static void smbd_server_connection_handler(struct event_context *ev,
2246 struct fd_event *fde,
2247 uint16_t flags,
2248 void *private_data)
2249 {
2250 struct smbd_server_connection *conn = talloc_get_type(private_data,
2251 struct smbd_server_connection);
2252
2253 if (flags & EVENT_FD_WRITE) {
2254 smbd_server_connection_write_handler(conn);
2255 return;
2256 }
2257 if (flags & EVENT_FD_READ) {
2258 smbd_server_connection_read_handler(conn, conn->sock);
2259 return;
2260 }
2261 }
2262
2263 static void smbd_server_echo_handler(struct event_context *ev,
2264 struct fd_event *fde,
2265 uint16_t flags,
2266 void *private_data)
2267 {
2268 struct smbd_server_connection *conn = talloc_get_type(private_data,
2269 struct smbd_server_connection);
2270
2271 if (flags & EVENT_FD_WRITE) {
2272 smbd_server_connection_write_handler(conn);
2273 return;
2274 }
2275 if (flags & EVENT_FD_READ) {
2276 smbd_server_connection_read_handler(
2277 conn, conn->smb1.echo_handler.trusted_fd);
2278 return;
2279 }
2280 }
2281
2282 #ifdef CLUSTER_SUPPORT
2283 /****************************************************************************
2284 received when we should release a specific IP
2285 ****************************************************************************/
2286 static void release_ip(const char *ip, void *priv)
2287 {
2288 const char *addr = (const char *)priv;
2289 const char *p = addr;
2290
2291 if (strncmp("::ffff:", addr, 7) == 0) {
2292 p = addr + 7;
2293 }
2294
2295 DEBUG(10, ("Got release IP message for %s, "
2296 "our address is %s\n", ip, p));
2297
2298 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2299 /* we can't afford to do a clean exit - that involves
2300 database writes, which would potentially mean we
2301 are still running after the failover has finished -
2302 we have to get rid of this process ID straight
2303 away */
2304 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2305 ip));
2306 /* note we must exit with non-zero status so the unclean handler gets
2307 called in the parent, so that the brl database is tickled */
2308 _exit(1);
2309 }
2310 }
2311
2312 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2313 struct sockaddr_storage *client)
2314 {
2315 socklen_t length;
2316 length = sizeof(*server);
2317 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2318 return -1;
2319 }
2320 length = sizeof(*client);
2321 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2322 return -1;
2323 }
2324 return 0;
2325 }
2326 #endif
2327
2328 /*
2329 * Send keepalive packets to our client
2330 */
2331 static bool keepalive_fn(const struct timeval *now, void *private_data)
2332 {
2333 struct smbd_server_connection *sconn = smbd_server_conn;
2334 bool ret;
2335
2336 if (sconn->using_smb2) {
2337 /* Don't do keepalives on an SMB2 connection. */
2338 return false;
2339 }
2340
2341 smbd_lock_socket(smbd_server_conn);
2342 ret = send_keepalive(sconn->sock);
2343 smbd_unlock_socket(smbd_server_conn);
2344
2345 if (!ret) {
2346 char addr[INET6_ADDRSTRLEN];
2347 /*
2348 * Try and give an error message saying what
2349 * client failed.
2350 */
2351 DEBUG(0, ("send_keepalive failed for client %s. "
2352 "Error %s - exiting\n",
2353 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2354 strerror(errno)));
2355 return False;
2356 }
2357 return True;
2358 }
2359
2360 /*
2361 * Do the recurring check if we're idle
2362 */
2363 static bool deadtime_fn(const struct timeval *now, void *private_data)
2364 {
2365 struct smbd_server_connection *sconn =
2366 (struct smbd_server_connection *)private_data;
2367
2368 if ((conn_num_open(sconn) == 0)
2369 || (conn_idle_all(sconn, now->tv_sec))) {
2370 DEBUG( 2, ( "Closing idle connection\n" ) );
2371 messaging_send(sconn->msg_ctx,
2372 messaging_server_id(sconn->msg_ctx),
2373 MSG_SHUTDOWN, &data_blob_null);
2374 return False;
2375 }
2376
2377 return True;
2378 }
2379
2380 /*
2381 * Do the recurring log file and smb.conf reload checks.
2382 */
2383
2384 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2385 {
2386 struct smbd_server_connection *sconn = talloc_get_type_abort(
2387 private_data, struct smbd_server_connection);
2388
2389 DEBUG(5, ("housekeeping\n"));
2390
2391 change_to_root_user();
2392
2393 /* update printer queue caches if necessary */
2394 update_monitored_printq_cache(sconn->msg_ctx);
2395
2396 /* check if we need to reload services */
2397 check_reload(sconn, time_mono(NULL));
2398
2399 /* Change machine password if neccessary. */
2400 attempt_machine_password_change();
2401
2402 /*
2403 * Force a log file check.
2404 */
2405 force_check_log_size();
2406 check_log_size();
2407 return true;
2408 }
2409
2410 static int create_unlink_tmp(const char *dir)
2411 {
2412 char *fname;
2413 int fd;
2414
2415 fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2416 if (fname == NULL) {
2417 errno = ENOMEM;
2418 return -1;
2419 }
2420 fd = mkstemp(fname);
2421 if (fd == -1) {
2422 TALLOC_FREE(fname);
2423 return -1;
2424 }
2425 if (unlink(fname) == -1) {
2426 int sys_errno = errno;
2427 close(fd);
2428 TALLOC_FREE(fname);
2429 errno = sys_errno;
2430 return -1;
2431 }
2432 TALLOC_FREE(fname);
2433 return fd;
2434 }
2435
2436 /*
2437 * Read an smb packet in the echo handler child, giving the parent
2438 * smbd one second to react once the socket becomes readable.
2439 */
2440
2441 struct smbd_echo_read_state {
2442 struct tevent_context *ev;
2443 struct smbd_server_connection *sconn;
2444
2445 char *buf;
2446 size_t buflen;
2447 uint32_t seqnum;
2448 };
2449
2450 static void smbd_echo_read_readable(struct tevent_req *subreq);
2451 static void smbd_echo_read_waited(struct tevent_req *subreq);
2452
2453 static struct tevent_req *smbd_echo_read_send(
2454 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2455 struct smbd_server_connection *sconn)
2456 {
2457 struct tevent_req *req, *subreq;
2458 struct smbd_echo_read_state *state;
2459
2460 req = tevent_req_create(mem_ctx, &state,
2461 struct smbd_echo_read_state);
2462 if (req == NULL) {
2463 return NULL;
2464 }
2465 state->ev = ev;
2466 state->sconn = sconn;
2467
2468 subreq = wait_for_read_send(state, ev, sconn->sock);
2469 if (tevent_req_nomem(subreq, req)) {
2470 return tevent_req_post(req, ev);
2471 }
2472 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2473 return req;
2474 }
2475
2476 static void smbd_echo_read_readable(struct tevent_req *subreq)
2477 {
2478 struct tevent_req *req = tevent_req_callback_data(
2479 subreq, struct tevent_req);
2480 struct smbd_echo_read_state *state = tevent_req_data(
2481 req, struct smbd_echo_read_state);
2482 bool ok;
2483 int err;
2484
2485 ok = wait_for_read_recv(subreq, &err);
2486 TALLOC_FREE(subreq);
2487 if (!ok) {
2488 tevent_req_nterror(req, map_nt_error_from_unix(err));
2489 return;
2490 }
2491
2492 /*
2493 * Give the parent smbd one second to step in
2494 */
2495
2496 subreq = tevent_wakeup_send(
2497 state, state->ev, timeval_current_ofs(1, 0));
2498 if (tevent_req_nomem(subreq, req)) {
2499 return;
2500 }
2501 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2502 }
2503
2504 static void smbd_echo_read_waited(struct tevent_req *subreq)
2505 {
2506 struct tevent_req *req = tevent_req_callback_data(
2507 subreq, struct tevent_req);
2508 struct smbd_echo_read_state *state = tevent_req_data(
2509 req, struct smbd_echo_read_state);
2510 struct smbd_server_connection *sconn = state->sconn;
2511 bool ok;
2512 NTSTATUS status;
2513 size_t unread = 0;
2514 bool encrypted;
2515
2516 ok = tevent_wakeup_recv(subreq);
2517 TALLOC_FREE(subreq);
2518 if (!ok) {
2519 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2520 return;
2521 }
2522
2523 ok = smbd_lock_socket_internal(sconn);
2524 if (!ok) {
2525 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2526 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2527 return;
2528 }
2529
2530 if (!fd_is_readable(sconn->sock)) {
2531 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2532 (int)sys_getpid()));
2533
2534 ok = smbd_unlock_socket_internal(sconn);
2535 if (!ok) {
2536 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2537 DEBUG(1, ("%s: failed to unlock socket\n",
2538 __location__));
2539 return;
2540 }
2541
2542 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2543 if (tevent_req_nomem(subreq, req)) {
2544 return;
2545 }
2546 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2547 return;
2548 }
2549
2550 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2551 0 /* timeout */,
2552 &unread,
2553 &encrypted,
2554 &state->buflen,
2555 &state->seqnum,
2556 false /* trusted_channel*/);
2557
2558 if (tevent_req_nterror(req, status)) {
2559 tevent_req_nterror(req, status);
2560 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2561 (int)sys_getpid(), nt_errstr(status)));
2562 return;
2563 }
2564
2565 ok = smbd_unlock_socket_internal(sconn);
2566 if (!ok) {
2567 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2568 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2569 return;
2570 }
2571 tevent_req_done(req);
2572 }
2573
2574 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2575 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2576 {
2577 struct smbd_echo_read_state *state = tevent_req_data(
2578 req, struct smbd_echo_read_state);
2579 NTSTATUS status;
2580
2581 if (tevent_req_is_nterror(req, &status)) {
2582 return status;
2583 }
2584 *pbuf = talloc_move(mem_ctx, &state->buf);
2585 *pbuflen = state->buflen;
2586 *pseqnum = state->seqnum;
2587 return NT_STATUS_OK;
2588 }
2589
2590 struct smbd_echo_state {
2591 struct tevent_context *ev;
2592 struct iovec *pending;
2593 struct smbd_server_connection *sconn;
2594 int parent_pipe;
2595
2596 struct tevent_fd *parent_fde;
2597
2598 struct tevent_req *write_req;
2599 };
2600
2601 static void smbd_echo_writer_done(struct tevent_req *req);
2602
2603 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2604 {
2605 int num_pending;
2606
2607 if (state->write_req != NULL) {
2608 return;
2609 }
2610
2611 num_pending = talloc_array_length(state->pending);
2612 if (num_pending == 0) {
2613 return;
2614 }
2615
2616 state->write_req = writev_send(state, state->ev, NULL,
2617 state->parent_pipe, false,
2618 state->pending, num_pending);
2619 if (state->write_req == NULL) {
2620 DEBUG(1, ("writev_send failed\n"));
2621 exit(1);
2622 }
2623
2624 talloc_steal(state->write_req, state->pending);
2625 state->pending = NULL;
2626
2627 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2628 state);
2629 }
2630
2631 static void smbd_echo_writer_done(struct tevent_req *req)
2632 {
2633 struct smbd_echo_state *state = tevent_req_callback_data(
2634 req, struct smbd_echo_state);
2635 ssize_t written;
2636 int err;
2637
2638 written = writev_recv(req, &err);
2639 TALLOC_FREE(req);
2640 state->write_req = NULL;
2641 if (written == -1) {
2642 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2643 exit(1);
2644 }
2645 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2646 smbd_echo_activate_writer(state);
2647 }
2648
2649 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2650 uint32_t seqnum)
2651 {
2652 struct smb_request req;
2653 uint16_t num_replies;
2654 size_t out_len;
2655 char *outbuf;
2656 bool ok;
2657
2658 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2659 DEBUG(10, ("Got netbios keepalive\n"));
2660 /*
2661 * Just swallow it
2662 */
2663 return true;
2664 }
2665
2666 if (inbuf_len < smb_size) {
2667 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2668 return false;
2669 }
2670 if (!valid_smb_header(inbuf)) {
2671 DEBUG(10, ("Got invalid SMB header\n"));
2672 return false;
2673 }
2674
2675 if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2676 seqnum)) {
2677 return false;
2678 }
2679 req.inbuf = inbuf;
2680
2681 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2682 smb_messages[req.cmd].name
2683 ? smb_messages[req.cmd].name : "unknown"));
2684
2685 if (req.cmd != SMBecho) {
2686 return false;
2687 }
2688 if (req.wct < 1) {
2689 return false;
2690 }
2691
2692 num_replies = SVAL(req.vwv+0, 0);
2693 if (num_replies != 1) {
2694 /* Not a Windows "Hey, you're still there?" request */
2695 return false;
2696 }
2697
2698 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2699 1, req.buflen)) {
2700 DEBUG(10, ("create_outbuf failed\n"));
2701 return false;
2702 }
2703 req.outbuf = (uint8_t *)outbuf;
2704
2705 SSVAL(req.outbuf, smb_vwv0, num_replies);
2706
2707 if (req.buflen > 0) {
2708 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2709 }
2710
2711 out_len = smb_len(req.outbuf) + 4;
2712
2713 ok = srv_send_smb(req.sconn,
2714 (char *)outbuf,
2715 true, seqnum+1,
2716 false, &req.pcd);
2717 TALLOC_FREE(outbuf);
2718 if (!ok) {
2719 exit(1);
2720 }
2721
2722 return true;
2723 }
2724
2725 static void smbd_echo_exit(struct tevent_context *ev,
2726 struct tevent_fd *fde, uint16_t flags,
2727 void *private_data)
2728 {
2729 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2730 exit(0);
2731 }
2732
2733 static void smbd_echo_got_packet(struct tevent_req *req);
2734
2735 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2736 int parent_pipe)
2737 {
2738 struct smbd_echo_state *state;
2739 struct tevent_req *read_req;
2740
2741 state = talloc_zero(sconn, struct smbd_echo_state);
2742 if (state == NULL) {
2743 DEBUG(1, ("talloc failed\n"));
2744 return;
2745 }
2746 state->sconn = sconn;
2747 state->parent_pipe = parent_pipe;
2748 state->ev = s3_tevent_context_init(state);
2749 if (state->ev == NULL) {
2750 DEBUG(1, ("tevent_context_init failed\n"));
2751 TALLOC_FREE(state);
2752 return;
2753 }
2754 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2755 TEVENT_FD_READ, smbd_echo_exit,
2756 state);
2757 if (state->parent_fde == NULL) {
2758 DEBUG(1, ("tevent_add_fd failed\n"));
2759 TALLOC_FREE(state);
2760 return;
2761 }
2762
2763 read_req = smbd_echo_read_send(state, state->ev, sconn);
2764 if (read_req == NULL) {
2765 DEBUG(1, ("smbd_echo_read_send failed\n"));
2766 TALLOC_FREE(state);
2767 return;
2768 }
2769 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2770
2771 while (true) {
2772 if (tevent_loop_once(state->ev) == -1) {
2773 DEBUG(1, ("tevent_loop_once failed: %s\n",
2774 strerror(errno)));
2775 break;
2776 }
2777 }
2778 TALLOC_FREE(state);
2779 }
2780
2781 static void smbd_echo_got_packet(struct tevent_req *req)
2782 {
2783 struct smbd_echo_state *state = tevent_req_callback_data(
2784 req, struct smbd_echo_state);
2785 NTSTATUS status;
2786 char *buf = NULL;
2787 size_t buflen = 0;
2788 uint32_t seqnum = 0;
2789 bool reply;
2790
2791 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2792 TALLOC_FREE(req);
2793 if (!NT_STATUS_IS_OK(status)) {
2794 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2795 nt_errstr(status)));
2796 exit(1);
2797 }
2798
2799 reply = smbd_echo_reply((uint8_t *)buf, buflen, seqnum);
2800 if (!reply) {
2801 size_t num_pending;
2802 struct iovec *tmp;
2803 struct iovec *iov;
2804
2805 num_pending = talloc_array_length(state->pending);
2806 tmp = talloc_realloc(state, state->pending, struct iovec,
2807 num_pending+1);
2808 if (tmp == NULL) {
2809 DEBUG(1, ("talloc_realloc failed\n"));
2810 exit(1);
2811 }
2812 state->pending = tmp;
2813
2814 if (buflen >= smb_size) {
2815 /*
2816 * place the seqnum in the packet so that the main process
2817 * can reply with signing
2818 */
2819 SIVAL(buf, smb_ss_field, seqnum);
2820 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2821 }
2822
2823 iov = &state->pending[num_pending];
2824 iov->iov_base = buf;
2825 iov->iov_len = buflen;
2826
2827 DEBUG(10,("echo_handler[%d]: forward to main\n",
2828 (int)sys_getpid()));
2829 smbd_echo_activate_writer(state);
2830 }
2831
2832 req = smbd_echo_read_send(state, state->ev, state->sconn);
2833 if (req == NULL) {
2834 DEBUG(1, ("smbd_echo_read_send failed\n"));
2835 exit(1);
2836 }
2837 tevent_req_set_callback(req, smbd_echo_got_packet, state);
2838 }
2839
2840
2841 /*
2842 * Handle SMBecho requests in a forked child process
2843 */
2844 bool fork_echo_handler(struct smbd_server_connection *sconn)
2845 {
2846 int listener_pipe[2];
2847 int res;
2848 pid_t child;
2849
2850 res = pipe(listener_pipe);
2851 if (res == -1) {
2852 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2853 return false;
2854 }
2855 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2856 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2857 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2858 goto fail;
2859 }
2860
2861 child = sys_fork();
2862 if (child == 0) {
2863 NTSTATUS status;
2864
2865 close(listener_pipe[0]);
2866 set_blocking(listener_pipe[1], false);
2867
2868 status = reinit_after_fork(sconn->msg_ctx,
2869 server_event_context(),
2870 procid_self(), false);
2871 if (!NT_STATUS_IS_OK(status)) {
2872 DEBUG(1, ("reinit_after_fork failed: %s\n",
2873 nt_errstr(status)));
2874 exit(1);
2875 }
2876 smbd_echo_loop(sconn, listener_pipe[1]);
2877 exit(0);
2878 }
2879 close(listener_pipe[1]);
2880 listener_pipe[1] = -1;
2881 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2882
2883 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2884
2885 /*
2886 * Without smb signing this is the same as the normal smbd
2887 * listener. This needs to change once signing comes in.
2888 */
2889 sconn->smb1.echo_handler.trusted_fde = event_add_fd(server_event_context(),
2890 sconn,
2891 sconn->smb1.echo_handler.trusted_fd,
2892 EVENT_FD_READ,
2893 smbd_server_echo_handler,
2894 sconn);
2895 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2896 DEBUG(1, ("event_add_fd failed\n"));
2897 goto fail;
2898 }
2899
2900 return true;
2901
2902 fail:
2903 if (listener_pipe[0] != -1) {
2904 close(listener_pipe[0]);
2905 }
2906 if (listener_pipe[1] != -1) {
2907 close(listener_pipe[1]);
2908 }
2909 sconn->smb1.echo_handler.trusted_fd = -1;
2910 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2911 close(sconn->smb1.echo_handler.socket_lock_fd);
2912 }
2913 sconn->smb1.echo_handler.trusted_fd = -1;
2914 sconn->smb1.echo_handler.socket_lock_fd = -1;
2915 return false;
2916 }
2917
2918 #if CLUSTER_SUPPORT
2919
2920 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2921 struct sockaddr_storage *srv,
2922 struct sockaddr_storage *clnt)
2923 {
2924 struct ctdbd_connection *cconn;
2925 char tmp_addr[INET6_ADDRSTRLEN];
2926 char *addr;
2927
2928 cconn = messaging_ctdbd_connection();
2929 if (cconn == NULL) {
2930 return NT_STATUS_NO_MEMORY;
2931 }
2932
2933 client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2934 addr = talloc_strdup(cconn, tmp_addr);
2935 if (addr == NULL) {
2936 return NT_STATUS_NO_MEMORY;
2937 }
2938 return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2939 }
2940
2941 #endif
2942
2943 /****************************************************************************
2944 Process commands from the client
2945 ****************************************************************************/
2946
2947 void smbd_process(struct smbd_server_connection *sconn)
2948 {
2949 TALLOC_CTX *frame = talloc_stackframe();
2950 struct sockaddr_storage ss;
2951 struct sockaddr *sa = NULL;
2952 socklen_t sa_socklen;
2953 struct tsocket_address *local_address = NULL;
2954 struct tsocket_address *remote_address = NULL;
2955 const char *remaddr = NULL;
2956 char *rhost;
2957 int ret;
2958
2959 if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
2960 /*
2961 * We're not making the decision here,
2962 * we're just allowing the client
2963 * to decide between SMB1 and SMB2
2964 * with the first negprot
2965 * packet.
2966 */
2967 sconn->using_smb2 = true;
2968 }
2969
2970 /* Ensure child is set to blocking mode */
2971 set_blocking(sconn->sock,True);
2972
2973 set_socket_options(sconn->sock, "SO_KEEPALIVE");
2974 set_socket_options(sconn->sock, lp_socket_options());
2975
2976 sa = (struct sockaddr *)(void *)&ss;
2977 sa_socklen = sizeof(ss);
2978 ret = getpeername(sconn->sock, sa, &sa_socklen);
2979 if (ret != 0) {
2980 int level = (errno == ENOTCONN)?2:0;
2981 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2982 exit_server_cleanly("getpeername() failed.\n");
2983 }
2984 ret = tsocket_address_bsd_from_sockaddr(sconn,
2985 sa, sa_socklen,
2986 &remote_address);
2987 if (ret != 0) {
2988 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2989 __location__, strerror(errno)));
2990 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2991 }
2992
2993 sa = (struct sockaddr *)(void *)&ss;
2994 sa_socklen = sizeof(ss);
2995 ret = getsockname(sconn->sock, sa, &sa_socklen);
2996 if (ret != 0) {
2997 int level = (errno == ENOTCONN)?2:0;
2998 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2999 exit_server_cleanly("getsockname() failed.\n");
3000 }
3001 ret = tsocket_address_bsd_from_sockaddr(sconn,
3002 sa, sa_socklen,
3003 &local_address);
3004 if (ret != 0) {
3005 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3006 __location__, strerror(errno)));
3007 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3008 }
3009
3010 sconn->local_address = local_address;
3011 sconn->remote_address = remote_address;
3012
3013 if (tsocket_address_is_inet(remote_address, "ip")) {
3014 remaddr = tsocket_address_inet_addr_string(
3015 sconn->remote_address,
3016 talloc_tos());
3017 if (remaddr == NULL) {
3018 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3019 __location__, strerror(errno)));
3020 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3021 }
3022 } else {
3023 remaddr = "0.0.0.0";
3024 }
3025
3026 /* this is needed so that we get decent entries
3027 in smbstatus for port 445 connects */
3028 set_remote_machine_name(remaddr, false);
3029 reload_services(sconn->msg_ctx, sconn->sock, true);
3030
3031 /*
3032 * Before the first packet, check the global hosts allow/ hosts deny
3033 * parameters before doing any parsing of packets passed to us by the
3034 * client. This prevents attacks on our parsing code from hosts not in
3035 * the hosts allow list.
3036 */
3037
3038 ret = get_remote_hostname(remote_address,
3039 &rhost,
3040 talloc_tos());
3041 if (ret < 0) {
3042 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3043 __location__, strerror(errno)));
3044 exit_server_cleanly("get_remote_hostname failed.\n");
3045 }
3046 if (strequal(rhost, "UNKNOWN")) {
3047 rhost = talloc_strdup(talloc_tos(), remaddr);
3048 }
3049 sconn->remote_hostname = talloc_move(sconn, &rhost);
3050
3051 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3052 sconn->remote_hostname,
3053 remaddr)) {
3054 /*
3055 * send a negative session response "not listening on calling
3056 * name"
3057 */
3058 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3059 DEBUG( 1, ("Connection denied from %s to %s\n",
3060 tsocket_address_string(remote_address, talloc_tos()),
3061 tsocket_address_string(local_address, talloc_tos())));
3062 (void)srv_send_smb(sconn,(char *)buf, false,
3063 0, false, NULL);
3064 exit_server_cleanly("connection denied");
3065 }
3066
3067 DEBUG(10, ("Connection allowed from %s to %s\n",
3068 tsocket_address_string(remote_address, talloc_tos()),
3069 tsocket_address_string(local_address, talloc_tos())));
3070
3071 init_modules();
3072
3073 smb_perfcount_init();
3074
3075 if (!init_account_policy()) {
3076 exit_server("Could not open account policy tdb.\n");
3077 }
3078
3079 if (*lp_rootdir()) {
3080 if (chroot(lp_rootdir()) != 0) {
3081 DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3082 exit_server("Failed to chroot()");
3083 }
3084 if (chdir("/") == -1) {
3085 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3086 exit_server("Failed to chroot()");
3087 }
3088 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3089 }
3090
3091 if (!srv_init_signing(sconn)) {
3092 exit_server("Failed to init smb_signing");
3093 }
3094
3095 /* Setup oplocks */
3096 if (!init_oplocks(sconn->msg_ctx))
3097 exit_server("Failed to init oplocks");
3098
3099 /* register our message handlers */
3100 messaging_register(sconn->msg_ctx, NULL,
3101 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3102 messaging_register(sconn->msg_ctx, NULL,
3103 MSG_SMB_CLOSE_FILE, msg_close_file);
3104
3105 /*
3106 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3107 * MSGs to all child processes
3108 */
3109 messaging_deregister(sconn->msg_ctx,
3110 MSG_DEBUG, NULL);
3111 messaging_register(sconn->msg_ctx, NULL,
3112 MSG_DEBUG, debug_message);
3113
3114 if ((lp_keepalive() != 0)
3115 && !(event_add_idle(server_event_context(), NULL,
3116 timeval_set(lp_keepalive(), 0),
3117 "keepalive", keepalive_fn,
3118 NULL))) {
3119 DEBUG(0, ("Could not add keepalive event\n"));
3120 exit(1);
3121 }
3122
3123 if (!(event_add_idle(server_event_context(), NULL,
3124 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3125 "deadtime", deadtime_fn, sconn))) {
3126 DEBUG(0, ("Could not add deadtime event\n"));
3127 exit(1);
3128 }
3129
3130 if (!(event_add_idle(server_event_context(), NULL,
3131 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3132 "housekeeping", housekeeping_fn, sconn))) {
3133 DEBUG(0, ("Could not add housekeeping event\n"));
3134 exit(1);
3135 }
3136
3137 #ifdef CLUSTER_SUPPORT
3138
3139 if (lp_clustering()) {
3140 /*
3141 * We need to tell ctdb about our client's TCP
3142 * connection, so that for failover ctdbd can send
3143 * tickle acks, triggering a reconnection by the
3144 * client.
3145 */
3146
3147 struct sockaddr_storage srv, clnt;
3148
3149 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3150 NTSTATUS status;
3151 status = smbd_register_ips(sconn, &srv, &clnt);
3152 if (!NT_STATUS_IS_OK(status)) {
3153 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3154 nt_errstr(status)));
3155 }
3156 } else
3157 {
3158 DEBUG(0,("Unable to get tcp info for "
3159 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3160 strerror(errno)));
3161 }
3162 }
3163
3164 #endif
3165
3166 sconn->nbt.got_session = false;
3167
3168 sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3169
3170 sconn->smb1.sessions.done_sesssetup = false;
3171 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3172 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3173 /* users from session setup */
3174 sconn->smb1.sessions.session_userlist = NULL;
3175 /* workgroup from session setup. */
3176 sconn->smb1.sessions.session_workgroup = NULL;
3177 /* this holds info on user ids that are already validated for this VC */
3178 sconn->smb1.sessions.validated_users = NULL;
3179 sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3180 sconn->smb1.sessions.num_validated_vuids = 0;
3181
3182 conn_init(sconn);
3183 if (!init_dptrs(sconn)) {
3184 exit_server("init_dptrs() failed");
3185 }
3186
3187 sconn->smb1.fde = event_add_fd(server_event_context(),
3188 sconn,
3189 sconn->sock,
3190 EVENT_FD_READ,
3191 smbd_server_connection_handler,
3192 sconn);
3193 if (!sconn->smb1.fde) {
3194 exit_server("failed to create smbd_server_connection fde");
3195 }
3196
3197 TALLOC_FREE(frame);
3198
3199 while (True) {
3200 NTSTATUS status;
3201
3202 frame = talloc_stackframe_pool(8192);
3203
3204 errno = 0;
3205
3206 status = smbd_server_connection_loop_once(sconn);
3207 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3208 !NT_STATUS_IS_OK(status)) {
3209 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3210 " exiting\n", nt_errstr(status)));
3211 break;
3212 }
3213
3214 TALLOC_FREE(frame);
3215 }
3216
3217 exit_server_cleanly(NULL);
3218 }
3219
3220 bool req_is_in_chain(struct smb_request *req)
3221 {
3222 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3223 /*
3224 * We're right now handling a subsequent request, so we must
3225 * be in a chain
3226 */
3227 return true;
3228 }
3229
3230 if (!is_andx_req(req->cmd)) {
3231 return false;
3232 }
3233
3234 if (req->wct < 2) {
3235 /*
3236 * Okay, an illegal request, but definitely not chained :-)
3237 */
3238 return false;
3239 }
3240
3241 return (CVAL(req->vwv+0, 0) != 0xFF);
3242 }
Working branch of Samba for id10ts