?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:lib: only loop over the server_ids we need to verify in serverids_exist()
[Samba/vl.git] / source3 / smbd / process.c
blobfd2c6a4b4a88d14b1453b4e5f9cb020a904f027d
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "librpc/gen_ndr/netlogon.h"
27 #include "../lib/async_req/async_sock.h"
28 #include "ctdbd_conn.h"
29 #include "../lib/util/select.h"
30 #include "printing/queue_process.h"
31 #include "system/select.h"
32 #include "passdb.h"
33 #include "auth.h"
34 #include "messages.h"
35 #include "smbprofile.h"
36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
37 #include "libsmb/libsmb.h"
38 #include "../lib/util/tevent_ntstatus.h"
39 #include "../libcli/security/dom_sid.h"
40 #include "../libcli/security/security_token.h"
41 #include "lib/id_cache.h"
42 #include "serverid.h"
43
44 /* Internal message queue for deferred opens. */
45 struct pending_message_list {
46 struct pending_message_list *next, *prev;
47 struct timeval request_time; /* When was this first issued? */
48 struct smbd_server_connection *sconn;
49 struct timed_event *te;
50 struct smb_perfcount_data pcd;
51 uint32_t seqnum;
52 bool encrypted;
53 bool processed;
54 DATA_BLOB buf;
55 DATA_BLOB private_data;
56 };
57
58 static void construct_reply_common(struct smb_request *req, const char *inbuf,
59 char *outbuf);
60 static struct pending_message_list *get_deferred_open_message_smb(
61 struct smbd_server_connection *sconn, uint64_t mid);
62 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
63
64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
65 {
66 bool ok;
67
68 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
69 return true;
70 }
71
72 sconn->smb1.echo_handler.ref_count++;
73
74 if (sconn->smb1.echo_handler.ref_count > 1) {
75 return true;
76 }
77
78 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
79
80 do {
81 ok = fcntl_lock(
82 sconn->smb1.echo_handler.socket_lock_fd,
83 F_SETLKW, 0, 0, F_WRLCK);
84 } while (!ok && (errno == EINTR));
85
86 if (!ok) {
87 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
88 return false;
89 }
90
91 DEBUG(10,("pid[%d] got for socket lock\n", (int)getpid()));
92
93 return true;
94 }
95
96 void smbd_lock_socket(struct smbd_server_connection *sconn)
97 {
98 if (!smbd_lock_socket_internal(sconn)) {
99 exit_server_cleanly("failed to lock socket");
100 }
101 }
102
103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
104 {
105 bool ok;
106
107 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
108 return true;
109 }
110
111 sconn->smb1.echo_handler.ref_count--;
112
113 if (sconn->smb1.echo_handler.ref_count > 0) {
114 return true;
115 }
116
117 do {
118 ok = fcntl_lock(
119 sconn->smb1.echo_handler.socket_lock_fd,
120 F_SETLKW, 0, 0, F_UNLCK);
121 } while (!ok && (errno == EINTR));
122
123 if (!ok) {
124 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
125 return false;
126 }
127
128 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
129
130 return true;
131 }
132
133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
134 {
135 if (!smbd_unlock_socket_internal(sconn)) {
136 exit_server_cleanly("failed to unlock socket");
137 }
138 }
139
140 /* Accessor function for smb_read_error for smbd functions. */
141
142 /****************************************************************************
143 Send an smb to a fd.
144 ****************************************************************************/
145
146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
147 bool do_signing, uint32_t seqnum,
148 bool do_encrypt,
149 struct smb_perfcount_data *pcd)
150 {
151 size_t len = 0;
152 size_t nwritten=0;
153 ssize_t ret;
154 char *buf_out = buffer;
155
156 smbd_lock_socket(sconn);
157
158 if (do_signing) {
159 /* Sign the outgoing packet if required. */
160 srv_calculate_sign_mac(sconn, buf_out, seqnum);
161 }
162
163 if (do_encrypt) {
164 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
165 if (!NT_STATUS_IS_OK(status)) {
166 DEBUG(0, ("send_smb: SMB encryption failed "
167 "on outgoing packet! Error %s\n",
168 nt_errstr(status) ));
169 goto out;
170 }
171 }
172
173 len = smb_len(buf_out) + 4;
174
175 ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
176 if (ret <= 0) {
177
178 char addr[INET6_ADDRSTRLEN];
179 /*
180 * Try and give an error message saying what
181 * client failed.
182 */
183 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
184 (int)getpid(), (int)len,
185 get_peer_addr(sconn->sock, addr, sizeof(addr)),
186 (int)ret, strerror(errno) ));
187
188 srv_free_enc_buffer(sconn, buf_out);
189 goto out;
190 }
191
192 SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
193 srv_free_enc_buffer(sconn, buf_out);
194 out:
195 SMB_PERFCOUNT_END(pcd);
196
197 smbd_unlock_socket(sconn);
198 return true;
199 }
200
201 /*******************************************************************
202 Setup the word count and byte count for a smb message.
203 ********************************************************************/
204
205 int srv_set_message(char *buf,
206 int num_words,
207 int num_bytes,
208 bool zero)
209 {
210 if (zero && (num_words || num_bytes)) {
211 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
212 }
213 SCVAL(buf,smb_wct,num_words);
214 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
215 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
216 return (smb_size + num_words*2 + num_bytes);
217 }
218
219 static bool valid_smb_header(struct smbd_server_connection *sconn,
220 const uint8_t *inbuf)
221 {
222 if (is_encrypted_packet(sconn, inbuf)) {
223 return true;
224 }
225 /*
226 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
227 * but it just looks weird to call strncmp for this one.
228 */
229 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
230 }
231
232 /* Socket functions for smbd packet processing. */
233
234 static bool valid_packet_size(size_t len)
235 {
236 /*
237 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
238 * of header. Don't print the error if this fits.... JRA.
239 */
240
241 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
242 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
243 (unsigned long)len));
244 return false;
245 }
246 return true;
247 }
248
249 static NTSTATUS read_packet_remainder(int fd, char *buffer,
250 unsigned int timeout, ssize_t len)
251 {
252 NTSTATUS status;
253
254 if (len <= 0) {
255 return NT_STATUS_OK;
256 }
257
258 status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
259 if (!NT_STATUS_IS_OK(status)) {
260 char addr[INET6_ADDRSTRLEN];
261 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
262 "error = %s.\n",
263 get_peer_addr(fd, addr, sizeof(addr)),
264 nt_errstr(status)));
265 }
266 return status;
267 }
268
269 /****************************************************************************
270 Attempt a zerocopy writeX read. We know here that len > smb_size-4
271 ****************************************************************************/
272
273 /*
274 * Unfortunately, earlier versions of smbclient/libsmbclient
275 * don't send this "standard" writeX header. I've fixed this
276 * for 3.2 but we'll use the old method with earlier versions.
277 * Windows and CIFSFS at least use this standard size. Not
278 * sure about MacOSX.
279 */
280
281 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
282 (2*14) + /* word count (including bcc) */ \
283 1 /* pad byte */)
284
285 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
286 const char lenbuf[4],
287 struct smbd_server_connection *sconn,
288 int sock,
289 char **buffer,
290 unsigned int timeout,
291 size_t *p_unread,
292 size_t *len_ret)
293 {
294 /* Size of a WRITEX call (+4 byte len). */
295 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
296 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
297 ssize_t toread;
298 NTSTATUS status;
299
300 memcpy(writeX_header, lenbuf, 4);
301
302 status = read_fd_with_timeout(
303 sock, writeX_header + 4,
304 STANDARD_WRITE_AND_X_HEADER_SIZE,
305 STANDARD_WRITE_AND_X_HEADER_SIZE,
306 timeout, NULL);
307
308 if (!NT_STATUS_IS_OK(status)) {
309 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
310 "error = %s.\n",
311 tsocket_address_string(sconn->remote_address,
312 talloc_tos()),
313 nt_errstr(status)));
314 return status;
315 }
316
317 /*
318 * Ok - now try and see if this is a possible
319 * valid writeX call.
320 */
321
322 if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
323 /*
324 * If the data offset is beyond what
325 * we've read, drain the extra bytes.
326 */
327 uint16_t doff = SVAL(writeX_header,smb_vwv11);
328 ssize_t newlen;
329
330 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
331 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
332 if (drain_socket(sock, drain) != drain) {
333 smb_panic("receive_smb_raw_talloc_partial_read:"
334 " failed to drain pending bytes");
335 }
336 } else {
337 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
338 }
339
340 /* Spoof down the length and null out the bcc. */
341 set_message_bcc(writeX_header, 0);
342 newlen = smb_len(writeX_header);
343
344 /* Copy the header we've written. */
345
346 *buffer = (char *)talloc_memdup(mem_ctx,
347 writeX_header,
348 sizeof(writeX_header));
349
350 if (*buffer == NULL) {
351 DEBUG(0, ("Could not allocate inbuf of length %d\n",
352 (int)sizeof(writeX_header)));
353 return NT_STATUS_NO_MEMORY;
354 }
355
356 /* Work out the remaining bytes. */
357 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
358 *len_ret = newlen + 4;
359 return NT_STATUS_OK;
360 }
361
362 if (!valid_packet_size(len)) {
363 return NT_STATUS_INVALID_PARAMETER;
364 }
365
366 /*
367 * Not a valid writeX call. Just do the standard
368 * talloc and return.
369 */
370
371 *buffer = talloc_array(mem_ctx, char, len+4);
372
373 if (*buffer == NULL) {
374 DEBUG(0, ("Could not allocate inbuf of length %d\n",
375 (int)len+4));
376 return NT_STATUS_NO_MEMORY;
377 }
378
379 /* Copy in what we already read. */
380 memcpy(*buffer,
381 writeX_header,
382 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
383 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
384
385 if(toread > 0) {
386 status = read_packet_remainder(
387 sock,
388 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
389 timeout, toread);
390
391 if (!NT_STATUS_IS_OK(status)) {
392 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
393 nt_errstr(status)));
394 return status;
395 }
396 }
397
398 *len_ret = len + 4;
399 return NT_STATUS_OK;
400 }
401
402 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
403 struct smbd_server_connection *sconn,
404 int sock,
405 char **buffer, unsigned int timeout,
406 size_t *p_unread, size_t *plen)
407 {
408 char lenbuf[4];
409 size_t len;
410 int min_recv_size = lp_min_receive_file_size();
411 NTSTATUS status;
412
413 *p_unread = 0;
414
415 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
416 &len);
417 if (!NT_STATUS_IS_OK(status)) {
418 return status;
419 }
420
421 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
422 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
423 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
424 !srv_is_signing_active(sconn) &&
425 sconn->smb1.echo_handler.trusted_fde == NULL) {
426
427 return receive_smb_raw_talloc_partial_read(
428 mem_ctx, lenbuf, sconn, sock, buffer, timeout,
429 p_unread, plen);
430 }
431
432 if (!valid_packet_size(len)) {
433 return NT_STATUS_INVALID_PARAMETER;
434 }
435
436 /*
437 * The +4 here can't wrap, we've checked the length above already.
438 */
439
440 *buffer = talloc_array(mem_ctx, char, len+4);
441
442 if (*buffer == NULL) {
443 DEBUG(0, ("Could not allocate inbuf of length %d\n",
444 (int)len+4));
445 return NT_STATUS_NO_MEMORY;
446 }
447
448 memcpy(*buffer, lenbuf, sizeof(lenbuf));
449
450 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
451 if (!NT_STATUS_IS_OK(status)) {
452 return status;
453 }
454
455 *plen = len + 4;
456 return NT_STATUS_OK;
457 }
458
459 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
460 struct smbd_server_connection *sconn,
461 int sock,
462 char **buffer, unsigned int timeout,
463 size_t *p_unread, bool *p_encrypted,
464 size_t *p_len,
465 uint32_t *seqnum,
466 bool trusted_channel)
467 {
468 size_t len = 0;
469 NTSTATUS status;
470
471 *p_encrypted = false;
472
473 status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
474 p_unread, &len);
475 if (!NT_STATUS_IS_OK(status)) {
476 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
477 ("receive_smb_raw_talloc failed for client %s "
478 "read error = %s.\n",
479 tsocket_address_string(sconn->remote_address,
480 talloc_tos()),
481 nt_errstr(status)) );
482 return status;
483 }
484
485 if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
486 status = srv_decrypt_buffer(sconn, *buffer);
487 if (!NT_STATUS_IS_OK(status)) {
488 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
489 "incoming packet! Error %s\n",
490 nt_errstr(status) ));
491 return status;
492 }
493 *p_encrypted = true;
494 }
495
496 /* Check the incoming SMB signature. */
497 if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
498 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
499 "incoming packet!\n"));
500 return NT_STATUS_INVALID_NETWORK_RESPONSE;
501 }
502
503 *p_len = len;
504 return NT_STATUS_OK;
505 }
506
507 /*
508 * Initialize a struct smb_request from an inbuf
509 */
510
511 static bool init_smb_request(struct smb_request *req,
512 struct smbd_server_connection *sconn,
513 const uint8 *inbuf,
514 size_t unread_bytes, bool encrypted,
515 uint32_t seqnum)
516 {
517 struct smbXsrv_tcon *tcon;
518 NTSTATUS status;
519 NTTIME now;
520 size_t req_size = smb_len(inbuf) + 4;
521
522 /* Ensure we have at least smb_size bytes. */
523 if (req_size < smb_size) {
524 DEBUG(0,("init_smb_request: invalid request size %u\n",
525 (unsigned int)req_size ));
526 return false;
527 }
528
529 req->request_time = timeval_current();
530 now = timeval_to_nttime(&req->request_time);
531
532 req->cmd = CVAL(inbuf, smb_com);
533 req->flags2 = SVAL(inbuf, smb_flg2);
534 req->smbpid = SVAL(inbuf, smb_pid);
535 req->mid = (uint64_t)SVAL(inbuf, smb_mid);
536 req->seqnum = seqnum;
537 req->vuid = SVAL(inbuf, smb_uid);
538 req->tid = SVAL(inbuf, smb_tid);
539 req->wct = CVAL(inbuf, smb_wct);
540 req->vwv = (const uint16_t *)(inbuf+smb_vwv);
541 req->buflen = smb_buflen(inbuf);
542 req->buf = (const uint8_t *)smb_buf_const(inbuf);
543 req->unread_bytes = unread_bytes;
544 req->encrypted = encrypted;
545 req->sconn = sconn;
546 status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
547 if (NT_STATUS_IS_OK(status)) {
548 req->conn = tcon->compat;
549 } else {
550 req->conn = NULL;
551 }
552 req->chain_fsp = NULL;
553 req->smb2req = NULL;
554 req->priv_paths = NULL;
555 req->chain = NULL;
556 smb_init_perfcount_data(&req->pcd);
557
558 /* Ensure we have at least wct words and 2 bytes of bcc. */
559 if (smb_size + req->wct*2 > req_size) {
560 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
561 (unsigned int)req->wct,
562 (unsigned int)req_size));
563 return false;
564 }
565 /* Ensure bcc is correct. */
566 if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
567 DEBUG(0,("init_smb_request: invalid bcc number %u "
568 "(wct = %u, size %u)\n",
569 (unsigned int)req->buflen,
570 (unsigned int)req->wct,
571 (unsigned int)req_size));
572 return false;
573 }
574
575 req->outbuf = NULL;
576 return true;
577 }
578
579 static void process_smb(struct smbd_server_connection *conn,
580 uint8_t *inbuf, size_t nread, size_t unread_bytes,
581 uint32_t seqnum, bool encrypted,
582 struct smb_perfcount_data *deferred_pcd);
583
584 static void smbd_deferred_open_timer(struct event_context *ev,
585 struct timed_event *te,
586 struct timeval _tval,
587 void *private_data)
588 {
589 struct pending_message_list *msg = talloc_get_type(private_data,
590 struct pending_message_list);
591 struct smbd_server_connection *sconn = msg->sconn;
592 TALLOC_CTX *mem_ctx = talloc_tos();
593 uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
594 uint8_t *inbuf;
595
596 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
597 msg->buf.length);
598 if (inbuf == NULL) {
599 exit_server("smbd_deferred_open_timer: talloc failed\n");
600 return;
601 }
602
603 /* We leave this message on the queue so the open code can
604 know this is a retry. */
605 DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
606 (unsigned long long)mid ));
607
608 /* Mark the message as processed so this is not
609 * re-processed in error. */
610 msg->processed = true;
611
612 process_smb(sconn, inbuf,
613 msg->buf.length, 0,
614 msg->seqnum, msg->encrypted, &msg->pcd);
615
616 /* If it's still there and was processed, remove it. */
617 msg = get_deferred_open_message_smb(sconn, mid);
618 if (msg && msg->processed) {
619 remove_deferred_open_message_smb(sconn, mid);
620 }
621 }
622
623 /****************************************************************************
624 Function to push a message onto the tail of a linked list of smb messages ready
625 for processing.
626 ****************************************************************************/
627
628 static bool push_queued_message(struct smb_request *req,
629 struct timeval request_time,
630 struct timeval end_time,
631 char *private_data, size_t private_len)
632 {
633 int msg_len = smb_len(req->inbuf) + 4;
634 struct pending_message_list *msg;
635
636 msg = talloc_zero(NULL, struct pending_message_list);
637
638 if(msg == NULL) {
639 DEBUG(0,("push_message: malloc fail (1)\n"));
640 return False;
641 }
642 msg->sconn = req->sconn;
643
644 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
645 if(msg->buf.data == NULL) {
646 DEBUG(0,("push_message: malloc fail (2)\n"));
647 TALLOC_FREE(msg);
648 return False;
649 }
650
651 msg->request_time = request_time;
652 msg->seqnum = req->seqnum;
653 msg->encrypted = req->encrypted;
654 msg->processed = false;
655 SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
656
657 if (private_data) {
658 msg->private_data = data_blob_talloc(msg, private_data,
659 private_len);
660 if (msg->private_data.data == NULL) {
661 DEBUG(0,("push_message: malloc fail (3)\n"));
662 TALLOC_FREE(msg);
663 return False;
664 }
665 }
666
667 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
668 msg,
669 end_time,
670 smbd_deferred_open_timer,
671 msg);
672 if (!msg->te) {
673 DEBUG(0,("push_message: event_add_timed failed\n"));
674 TALLOC_FREE(msg);
675 return false;
676 }
677
678 DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
679 struct pending_message_list *);
680
681 DEBUG(10,("push_message: pushed message length %u on "
682 "deferred_open_queue\n", (unsigned int)msg_len));
683
684 return True;
685 }
686
687 /****************************************************************************
688 Function to delete a sharing violation open message by mid.
689 ****************************************************************************/
690
691 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
692 uint64_t mid)
693 {
694 struct pending_message_list *pml;
695
696 if (sconn->using_smb2) {
697 remove_deferred_open_message_smb2(sconn, mid);
698 return;
699 }
700
701 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
702 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
703 DEBUG(10,("remove_deferred_open_message_smb: "
704 "deleting mid %llu len %u\n",
705 (unsigned long long)mid,
706 (unsigned int)pml->buf.length ));
707 DLIST_REMOVE(sconn->deferred_open_queue, pml);
708 TALLOC_FREE(pml);
709 return;
710 }
711 }
712 }
713
714 /****************************************************************************
715 Move a sharing violation open retry message to the front of the list and
716 schedule it for immediate processing.
717 ****************************************************************************/
718
719 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
720 uint64_t mid)
721 {
722 struct pending_message_list *pml;
723 int i = 0;
724
725 if (sconn->using_smb2) {
726 return schedule_deferred_open_message_smb2(sconn, mid);
727 }
728
729 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
730 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
731
732 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
733 "msg_mid = %llu\n",
734 i++,
735 (unsigned long long)msg_mid ));
736
737 if (mid == msg_mid) {
738 struct timed_event *te;
739
740 if (pml->processed) {
741 /* A processed message should not be
742 * rescheduled. */
743 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
744 "message mid %llu was already processed\n",
745 (unsigned long long)msg_mid ));
746 continue;
747 }
748
749 DEBUG(10,("schedule_deferred_open_message_smb: "
750 "scheduling mid %llu\n",
751 (unsigned long long)mid ));
752
753 te = tevent_add_timer(pml->sconn->ev_ctx,
754 pml,
755 timeval_zero(),
756 smbd_deferred_open_timer,
757 pml);
758 if (!te) {
759 DEBUG(10,("schedule_deferred_open_message_smb: "
760 "event_add_timed() failed, "
761 "skipping mid %llu\n",
762 (unsigned long long)msg_mid ));
763 }
764
765 TALLOC_FREE(pml->te);
766 pml->te = te;
767 DLIST_PROMOTE(sconn->deferred_open_queue, pml);
768 return true;
769 }
770 }
771
772 DEBUG(10,("schedule_deferred_open_message_smb: failed to "
773 "find message mid %llu\n",
774 (unsigned long long)mid ));
775
776 return false;
777 }
778
779 /****************************************************************************
780 Return true if this mid is on the deferred queue and was not yet processed.
781 ****************************************************************************/
782
783 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
784 {
785 struct pending_message_list *pml;
786
787 if (sconn->using_smb2) {
788 return open_was_deferred_smb2(sconn, mid);
789 }
790
791 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
792 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
793 return True;
794 }
795 }
796 return False;
797 }
798
799 /****************************************************************************
800 Return the message queued by this mid.
801 ****************************************************************************/
802
803 static struct pending_message_list *get_deferred_open_message_smb(
804 struct smbd_server_connection *sconn, uint64_t mid)
805 {
806 struct pending_message_list *pml;
807
808 for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
809 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
810 return pml;
811 }
812 }
813 return NULL;
814 }
815
816 /****************************************************************************
817 Get the state data queued by this mid.
818 ****************************************************************************/
819
820 bool get_deferred_open_message_state(struct smb_request *smbreq,
821 struct timeval *p_request_time,
822 void **pp_state)
823 {
824 struct pending_message_list *pml;
825
826 if (smbreq->sconn->using_smb2) {
827 return get_deferred_open_message_state_smb2(smbreq->smb2req,
828 p_request_time,
829 pp_state);
830 }
831
832 pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
833 if (!pml) {
834 return false;
835 }
836 if (p_request_time) {
837 *p_request_time = pml->request_time;
838 }
839 if (pp_state) {
840 *pp_state = (void *)pml->private_data.data;
841 }
842 return true;
843 }
844
845 /****************************************************************************
846 Function to push a deferred open smb message onto a linked list of local smb
847 messages ready for processing.
848 ****************************************************************************/
849
850 bool push_deferred_open_message_smb(struct smb_request *req,
851 struct timeval request_time,
852 struct timeval timeout,
853 struct file_id id,
854 char *private_data, size_t priv_len)
855 {
856 struct timeval end_time;
857
858 if (req->smb2req) {
859 return push_deferred_open_message_smb2(req->smb2req,
860 request_time,
861 timeout,
862 id,
863 private_data,
864 priv_len);
865 }
866
867 if (req->unread_bytes) {
868 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
869 "unread_bytes = %u\n",
870 (unsigned int)req->unread_bytes ));
871 smb_panic("push_deferred_open_message_smb: "
872 "logic error unread_bytes != 0" );
873 }
874
875 end_time = timeval_sum(&request_time, &timeout);
876
877 DEBUG(10,("push_deferred_open_message_smb: pushing message "
878 "len %u mid %llu timeout time [%u.%06u]\n",
879 (unsigned int) smb_len(req->inbuf)+4,
880 (unsigned long long)req->mid,
881 (unsigned int)end_time.tv_sec,
882 (unsigned int)end_time.tv_usec));
883
884 return push_queued_message(req, request_time, end_time,
885 private_data, priv_len);
886 }
887
888 static void smbd_sig_term_handler(struct tevent_context *ev,
889 struct tevent_signal *se,
890 int signum,
891 int count,
892 void *siginfo,
893 void *private_data)
894 {
895 exit_server_cleanly("termination signal");
896 }
897
898 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
899 {
900 struct tevent_signal *se;
901
902 se = tevent_add_signal(sconn->ev_ctx,
903 sconn,
904 SIGTERM, 0,
905 smbd_sig_term_handler,
906 sconn);
907 if (!se) {
908 exit_server("failed to setup SIGTERM handler");
909 }
910 }
911
912 static void smbd_sig_hup_handler(struct tevent_context *ev,
913 struct tevent_signal *se,
914 int signum,
915 int count,
916 void *siginfo,
917 void *private_data)
918 {
919 struct smbd_server_connection *sconn =
920 talloc_get_type_abort(private_data,
921 struct smbd_server_connection);
922
923 change_to_root_user();
924 DEBUG(1,("Reloading services after SIGHUP\n"));
925 reload_services(sconn, conn_snum_used, false);
926 }
927
928 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
929 {
930 struct tevent_signal *se;
931
932 se = tevent_add_signal(sconn->ev_ctx,
933 sconn,
934 SIGHUP, 0,
935 smbd_sig_hup_handler,
936 sconn);
937 if (!se) {
938 exit_server("failed to setup SIGHUP handler");
939 }
940 }
941
942 static void smbd_conf_updated(struct messaging_context *msg,
943 void *private_data,
944 uint32_t msg_type,
945 struct server_id server_id,
946 DATA_BLOB *data)
947 {
948 struct smbd_server_connection *sconn =
949 talloc_get_type_abort(private_data,
950 struct smbd_server_connection);
951
952 DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
953 "updated. Reloading.\n"));
954 change_to_root_user();
955 reload_services(sconn, conn_snum_used, false);
956 }
957
958 /*
959 * Only allow 5 outstanding trans requests. We're allocating memory, so
960 * prevent a DoS.
961 */
962
963 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
964 {
965 int count = 0;
966 for (; list != NULL; list = list->next) {
967
968 if (list->mid == mid) {
969 return NT_STATUS_INVALID_PARAMETER;
970 }
971
972 count += 1;
973 }
974 if (count > 5) {
975 return NT_STATUS_INSUFFICIENT_RESOURCES;
976 }
977
978 return NT_STATUS_OK;
979 }
980
981 /*
982 These flags determine some of the permissions required to do an operation
983
984 Note that I don't set NEED_WRITE on some write operations because they
985 are used by some brain-dead clients when printing, and I don't want to
986 force write permissions on print services.
987 */
988 #define AS_USER (1<<0)
989 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
990 #define TIME_INIT (1<<2)
991 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
992 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
993 #define DO_CHDIR (1<<6)
994
995 /*
996 define a list of possible SMB messages and their corresponding
997 functions. Any message that has a NULL function is unimplemented -
998 please feel free to contribute implementations!
999 */
1000 static const struct smb_message_struct {
1001 const char *name;
1002 void (*fn)(struct smb_request *req);
1003 int flags;
1004 } smb_messages[256] = {
1005
1006 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1007 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1008 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1009 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1010 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1011 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1012 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1013 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1014 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1015 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1016 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1017 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1018 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1019 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1020 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1021 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1022 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1023 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1024 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1025 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1026 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1027 /* 0x15 */ { NULL, NULL, 0 },
1028 /* 0x16 */ { NULL, NULL, 0 },
1029 /* 0x17 */ { NULL, NULL, 0 },
1030 /* 0x18 */ { NULL, NULL, 0 },
1031 /* 0x19 */ { NULL, NULL, 0 },
1032 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1033 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1034 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1035 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1036 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1037 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1038 /* 0x20 */ { "SMBwritec", NULL,0},
1039 /* 0x21 */ { NULL, NULL, 0 },
1040 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1041 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1042 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1043 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1044 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1045 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1046 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1047 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1048 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1049 /* 0x2b */ { "SMBecho",reply_echo,0},
1050 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1051 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1052 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1053 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1054 /* 0x30 */ { NULL, NULL, 0 },
1055 /* 0x31 */ { NULL, NULL, 0 },
1056 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1057 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1058 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1059 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1060 /* 0x36 */ { NULL, NULL, 0 },
1061 /* 0x37 */ { NULL, NULL, 0 },
1062 /* 0x38 */ { NULL, NULL, 0 },
1063 /* 0x39 */ { NULL, NULL, 0 },
1064 /* 0x3a */ { NULL, NULL, 0 },
1065 /* 0x3b */ { NULL, NULL, 0 },
1066 /* 0x3c */ { NULL, NULL, 0 },
1067 /* 0x3d */ { NULL, NULL, 0 },
1068 /* 0x3e */ { NULL, NULL, 0 },
1069 /* 0x3f */ { NULL, NULL, 0 },
1070 /* 0x40 */ { NULL, NULL, 0 },
1071 /* 0x41 */ { NULL, NULL, 0 },
1072 /* 0x42 */ { NULL, NULL, 0 },
1073 /* 0x43 */ { NULL, NULL, 0 },
1074 /* 0x44 */ { NULL, NULL, 0 },
1075 /* 0x45 */ { NULL, NULL, 0 },
1076 /* 0x46 */ { NULL, NULL, 0 },
1077 /* 0x47 */ { NULL, NULL, 0 },
1078 /* 0x48 */ { NULL, NULL, 0 },
1079 /* 0x49 */ { NULL, NULL, 0 },
1080 /* 0x4a */ { NULL, NULL, 0 },
1081 /* 0x4b */ { NULL, NULL, 0 },
1082 /* 0x4c */ { NULL, NULL, 0 },
1083 /* 0x4d */ { NULL, NULL, 0 },
1084 /* 0x4e */ { NULL, NULL, 0 },
1085 /* 0x4f */ { NULL, NULL, 0 },
1086 /* 0x50 */ { NULL, NULL, 0 },
1087 /* 0x51 */ { NULL, NULL, 0 },
1088 /* 0x52 */ { NULL, NULL, 0 },
1089 /* 0x53 */ { NULL, NULL, 0 },
1090 /* 0x54 */ { NULL, NULL, 0 },
1091 /* 0x55 */ { NULL, NULL, 0 },
1092 /* 0x56 */ { NULL, NULL, 0 },
1093 /* 0x57 */ { NULL, NULL, 0 },
1094 /* 0x58 */ { NULL, NULL, 0 },
1095 /* 0x59 */ { NULL, NULL, 0 },
1096 /* 0x5a */ { NULL, NULL, 0 },
1097 /* 0x5b */ { NULL, NULL, 0 },
1098 /* 0x5c */ { NULL, NULL, 0 },
1099 /* 0x5d */ { NULL, NULL, 0 },
1100 /* 0x5e */ { NULL, NULL, 0 },
1101 /* 0x5f */ { NULL, NULL, 0 },
1102 /* 0x60 */ { NULL, NULL, 0 },
1103 /* 0x61 */ { NULL, NULL, 0 },
1104 /* 0x62 */ { NULL, NULL, 0 },
1105 /* 0x63 */ { NULL, NULL, 0 },
1106 /* 0x64 */ { NULL, NULL, 0 },
1107 /* 0x65 */ { NULL, NULL, 0 },
1108 /* 0x66 */ { NULL, NULL, 0 },
1109 /* 0x67 */ { NULL, NULL, 0 },
1110 /* 0x68 */ { NULL, NULL, 0 },
1111 /* 0x69 */ { NULL, NULL, 0 },
1112 /* 0x6a */ { NULL, NULL, 0 },
1113 /* 0x6b */ { NULL, NULL, 0 },
1114 /* 0x6c */ { NULL, NULL, 0 },
1115 /* 0x6d */ { NULL, NULL, 0 },
1116 /* 0x6e */ { NULL, NULL, 0 },
1117 /* 0x6f */ { NULL, NULL, 0 },
1118 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1119 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1120 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1121 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1122 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1123 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1124 /* 0x76 */ { NULL, NULL, 0 },
1125 /* 0x77 */ { NULL, NULL, 0 },
1126 /* 0x78 */ { NULL, NULL, 0 },
1127 /* 0x79 */ { NULL, NULL, 0 },
1128 /* 0x7a */ { NULL, NULL, 0 },
1129 /* 0x7b */ { NULL, NULL, 0 },
1130 /* 0x7c */ { NULL, NULL, 0 },
1131 /* 0x7d */ { NULL, NULL, 0 },
1132 /* 0x7e */ { NULL, NULL, 0 },
1133 /* 0x7f */ { NULL, NULL, 0 },
1134 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1135 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1136 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1137 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1138 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1139 /* 0x85 */ { NULL, NULL, 0 },
1140 /* 0x86 */ { NULL, NULL, 0 },
1141 /* 0x87 */ { NULL, NULL, 0 },
1142 /* 0x88 */ { NULL, NULL, 0 },
1143 /* 0x89 */ { NULL, NULL, 0 },
1144 /* 0x8a */ { NULL, NULL, 0 },
1145 /* 0x8b */ { NULL, NULL, 0 },
1146 /* 0x8c */ { NULL, NULL, 0 },
1147 /* 0x8d */ { NULL, NULL, 0 },
1148 /* 0x8e */ { NULL, NULL, 0 },
1149 /* 0x8f */ { NULL, NULL, 0 },
1150 /* 0x90 */ { NULL, NULL, 0 },
1151 /* 0x91 */ { NULL, NULL, 0 },
1152 /* 0x92 */ { NULL, NULL, 0 },
1153 /* 0x93 */ { NULL, NULL, 0 },
1154 /* 0x94 */ { NULL, NULL, 0 },
1155 /* 0x95 */ { NULL, NULL, 0 },
1156 /* 0x96 */ { NULL, NULL, 0 },
1157 /* 0x97 */ { NULL, NULL, 0 },
1158 /* 0x98 */ { NULL, NULL, 0 },
1159 /* 0x99 */ { NULL, NULL, 0 },
1160 /* 0x9a */ { NULL, NULL, 0 },
1161 /* 0x9b */ { NULL, NULL, 0 },
1162 /* 0x9c */ { NULL, NULL, 0 },
1163 /* 0x9d */ { NULL, NULL, 0 },
1164 /* 0x9e */ { NULL, NULL, 0 },
1165 /* 0x9f */ { NULL, NULL, 0 },
1166 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1167 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1168 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1169 /* 0xa3 */ { NULL, NULL, 0 },
1170 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1171 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1172 /* 0xa6 */ { NULL, NULL, 0 },
1173 /* 0xa7 */ { NULL, NULL, 0 },
1174 /* 0xa8 */ { NULL, NULL, 0 },
1175 /* 0xa9 */ { NULL, NULL, 0 },
1176 /* 0xaa */ { NULL, NULL, 0 },
1177 /* 0xab */ { NULL, NULL, 0 },
1178 /* 0xac */ { NULL, NULL, 0 },
1179 /* 0xad */ { NULL, NULL, 0 },
1180 /* 0xae */ { NULL, NULL, 0 },
1181 /* 0xaf */ { NULL, NULL, 0 },
1182 /* 0xb0 */ { NULL, NULL, 0 },
1183 /* 0xb1 */ { NULL, NULL, 0 },
1184 /* 0xb2 */ { NULL, NULL, 0 },
1185 /* 0xb3 */ { NULL, NULL, 0 },
1186 /* 0xb4 */ { NULL, NULL, 0 },
1187 /* 0xb5 */ { NULL, NULL, 0 },
1188 /* 0xb6 */ { NULL, NULL, 0 },
1189 /* 0xb7 */ { NULL, NULL, 0 },
1190 /* 0xb8 */ { NULL, NULL, 0 },
1191 /* 0xb9 */ { NULL, NULL, 0 },
1192 /* 0xba */ { NULL, NULL, 0 },
1193 /* 0xbb */ { NULL, NULL, 0 },
1194 /* 0xbc */ { NULL, NULL, 0 },
1195 /* 0xbd */ { NULL, NULL, 0 },
1196 /* 0xbe */ { NULL, NULL, 0 },
1197 /* 0xbf */ { NULL, NULL, 0 },
1198 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1199 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1200 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1201 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1202 /* 0xc4 */ { NULL, NULL, 0 },
1203 /* 0xc5 */ { NULL, NULL, 0 },
1204 /* 0xc6 */ { NULL, NULL, 0 },
1205 /* 0xc7 */ { NULL, NULL, 0 },
1206 /* 0xc8 */ { NULL, NULL, 0 },
1207 /* 0xc9 */ { NULL, NULL, 0 },
1208 /* 0xca */ { NULL, NULL, 0 },
1209 /* 0xcb */ { NULL, NULL, 0 },
1210 /* 0xcc */ { NULL, NULL, 0 },
1211 /* 0xcd */ { NULL, NULL, 0 },
1212 /* 0xce */ { NULL, NULL, 0 },
1213 /* 0xcf */ { NULL, NULL, 0 },
1214 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1215 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1216 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1217 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1218 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1219 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1220 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1221 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1222 /* 0xd8 */ { NULL, NULL, 0 },
1223 /* 0xd9 */ { NULL, NULL, 0 },
1224 /* 0xda */ { NULL, NULL, 0 },
1225 /* 0xdb */ { NULL, NULL, 0 },
1226 /* 0xdc */ { NULL, NULL, 0 },
1227 /* 0xdd */ { NULL, NULL, 0 },
1228 /* 0xde */ { NULL, NULL, 0 },
1229 /* 0xdf */ { NULL, NULL, 0 },
1230 /* 0xe0 */ { NULL, NULL, 0 },
1231 /* 0xe1 */ { NULL, NULL, 0 },
1232 /* 0xe2 */ { NULL, NULL, 0 },
1233 /* 0xe3 */ { NULL, NULL, 0 },
1234 /* 0xe4 */ { NULL, NULL, 0 },
1235 /* 0xe5 */ { NULL, NULL, 0 },
1236 /* 0xe6 */ { NULL, NULL, 0 },
1237 /* 0xe7 */ { NULL, NULL, 0 },
1238 /* 0xe8 */ { NULL, NULL, 0 },
1239 /* 0xe9 */ { NULL, NULL, 0 },
1240 /* 0xea */ { NULL, NULL, 0 },
1241 /* 0xeb */ { NULL, NULL, 0 },
1242 /* 0xec */ { NULL, NULL, 0 },
1243 /* 0xed */ { NULL, NULL, 0 },
1244 /* 0xee */ { NULL, NULL, 0 },
1245 /* 0xef */ { NULL, NULL, 0 },
1246 /* 0xf0 */ { NULL, NULL, 0 },
1247 /* 0xf1 */ { NULL, NULL, 0 },
1248 /* 0xf2 */ { NULL, NULL, 0 },
1249 /* 0xf3 */ { NULL, NULL, 0 },
1250 /* 0xf4 */ { NULL, NULL, 0 },
1251 /* 0xf5 */ { NULL, NULL, 0 },
1252 /* 0xf6 */ { NULL, NULL, 0 },
1253 /* 0xf7 */ { NULL, NULL, 0 },
1254 /* 0xf8 */ { NULL, NULL, 0 },
1255 /* 0xf9 */ { NULL, NULL, 0 },
1256 /* 0xfa */ { NULL, NULL, 0 },
1257 /* 0xfb */ { NULL, NULL, 0 },
1258 /* 0xfc */ { NULL, NULL, 0 },
1259 /* 0xfd */ { NULL, NULL, 0 },
1260 /* 0xfe */ { NULL, NULL, 0 },
1261 /* 0xff */ { NULL, NULL, 0 }
1262
1263 };
1264
1265 /*******************************************************************
1266 allocate and initialize a reply packet
1267 ********************************************************************/
1268
1269 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1270 const char *inbuf, char **outbuf, uint8_t num_words,
1271 uint32_t num_bytes)
1272 {
1273 /*
1274 * Protect against integer wrap
1275 */
1276 if ((num_bytes > 0xffffff)
1277 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1278 char *msg;
1279 if (asprintf(&msg, "num_bytes too large: %u",
1280 (unsigned)num_bytes) == -1) {
1281 msg = discard_const_p(char, "num_bytes too large");
1282 }
1283 smb_panic(msg);
1284 }
1285
1286 *outbuf = talloc_array(mem_ctx, char,
1287 smb_size + num_words*2 + num_bytes);
1288 if (*outbuf == NULL) {
1289 return false;
1290 }
1291
1292 construct_reply_common(req, inbuf, *outbuf);
1293 srv_set_message(*outbuf, num_words, num_bytes, false);
1294 /*
1295 * Zero out the word area, the caller has to take care of the bcc area
1296 * himself
1297 */
1298 if (num_words != 0) {
1299 memset(*outbuf + smb_vwv0, 0, num_words*2);
1300 }
1301
1302 return true;
1303 }
1304
1305 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1306 {
1307 char *outbuf;
1308 if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1309 num_bytes)) {
1310 smb_panic("could not allocate output buffer\n");
1311 }
1312 req->outbuf = (uint8_t *)outbuf;
1313 }
1314
1315
1316 /*******************************************************************
1317 Dump a packet to a file.
1318 ********************************************************************/
1319
1320 static void smb_dump(const char *name, int type, const char *data)
1321 {
1322 size_t len;
1323 int fd, i;
1324 char *fname = NULL;
1325 if (DEBUGLEVEL < 50) {
1326 return;
1327 }
1328
1329 len = smb_len_tcp(data)+4;
1330 for (i=1;i<100;i++) {
1331 fname = talloc_asprintf(talloc_tos(),
1332 "/tmp/%s.%d.%s",
1333 name,
1334 i,
1335 type ? "req" : "resp");
1336 if (fname == NULL) {
1337 return;
1338 }
1339 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1340 if (fd != -1 || errno != EEXIST) break;
1341 TALLOC_FREE(fname);
1342 }
1343 if (fd != -1) {
1344 ssize_t ret = write(fd, data, len);
1345 if (ret != len)
1346 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1347 close(fd);
1348 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1349 }
1350 TALLOC_FREE(fname);
1351 }
1352
1353 /****************************************************************************
1354 Prepare everything for calling the actual request function, and potentially
1355 call the request function via the "new" interface.
1356
1357 Return False if the "legacy" function needs to be called, everything is
1358 prepared.
1359
1360 Return True if we're done.
1361
1362 I know this API sucks, but it is the one with the least code change I could
1363 find.
1364 ****************************************************************************/
1365
1366 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1367 {
1368 int flags;
1369 uint64_t session_tag;
1370 connection_struct *conn = NULL;
1371 struct smbd_server_connection *sconn = req->sconn;
1372 NTTIME now = timeval_to_nttime(&req->request_time);
1373 struct smbXsrv_session *session = NULL;
1374 NTSTATUS status;
1375
1376 errno = 0;
1377
1378 if (smb_messages[type].fn == NULL) {
1379 DEBUG(0,("Unknown message type %d!\n",type));
1380 smb_dump("Unknown", 1, (const char *)req->inbuf);
1381 reply_unknown_new(req, type);
1382 return NULL;
1383 }
1384
1385 flags = smb_messages[type].flags;
1386
1387 /* In share mode security we must ignore the vuid. */
1388 session_tag = req->vuid;
1389 conn = req->conn;
1390
1391 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1392 (int)getpid(), (unsigned long)conn));
1393
1394 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1395
1396 /* Ensure this value is replaced in the incoming packet. */
1397 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1398
1399 /*
1400 * Ensure the correct username is in current_user_info. This is a
1401 * really ugly bugfix for problems with multiple session_setup_and_X's
1402 * being done and allowing %U and %G substitutions to work correctly.
1403 * There is a reason this code is done here, don't move it unless you
1404 * know what you're doing... :-).
1405 * JRA.
1406 */
1407
1408 /*
1409 * lookup an existing session
1410 *
1411 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1412 * here, the main check is still in change_to_user()
1413 */
1414 status = smb1srv_session_lookup(sconn->conn,
1415 session_tag,
1416 now,
1417 &session);
1418 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1419 switch (type) {
1420 case SMBsesssetupX:
1421 status = NT_STATUS_OK;
1422 break;
1423 default:
1424 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1425 (unsigned long long)session_tag,
1426 (unsigned long long)req->mid));
1427 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1428 return conn;
1429 }
1430 }
1431
1432 if (session_tag != sconn->smb1.sessions.last_session_tag) {
1433 struct user_struct *vuser = NULL;
1434
1435 sconn->smb1.sessions.last_session_tag = session_tag;
1436 if (session) {
1437 vuser = session->compat;
1438 }
1439 if (vuser) {
1440 set_current_user_info(
1441 vuser->session_info->unix_info->sanitized_username,
1442 vuser->session_info->unix_info->unix_name,
1443 vuser->session_info->info->domain_name);
1444 }
1445 }
1446
1447 /* Does this call need to be run as the connected user? */
1448 if (flags & AS_USER) {
1449
1450 /* Does this call need a valid tree connection? */
1451 if (!conn) {
1452 /*
1453 * Amazingly, the error code depends on the command
1454 * (from Samba4).
1455 */
1456 if (type == SMBntcreateX) {
1457 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1458 } else {
1459 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1460 }
1461 return NULL;
1462 }
1463
1464 if (!change_to_user(conn,session_tag)) {
1465 DEBUG(0, ("Error: Could not change to user. Removing "
1466 "deferred open, mid=%llu.\n",
1467 (unsigned long long)req->mid));
1468 reply_force_doserror(req, ERRSRV, ERRbaduid);
1469 return conn;
1470 }
1471
1472 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1473
1474 /* Does it need write permission? */
1475 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1476 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1477 return conn;
1478 }
1479
1480 /* IPC services are limited */
1481 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1482 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1483 return conn;
1484 }
1485 } else {
1486 /* This call needs to be run as root */
1487 change_to_root_user();
1488 }
1489
1490 /* load service specific parameters */
1491 if (conn) {
1492 if (req->encrypted) {
1493 conn->encrypted_tid = true;
1494 /* encrypted required from now on. */
1495 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1496 } else if (ENCRYPTION_REQUIRED(conn)) {
1497 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1498 DEBUG(1,("service[%s] requires encryption"
1499 "%s ACCESS_DENIED. mid=%llu\n",
1500 lp_servicename(talloc_tos(), SNUM(conn)),
1501 smb_fn_name(type),
1502 (unsigned long long)req->mid));
1503 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1504 return conn;
1505 }
1506 }
1507
1508 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1509 (flags & (AS_USER|DO_CHDIR)
1510 ?True:False))) {
1511 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1512 return conn;
1513 }
1514 conn->num_smb_operations++;
1515 }
1516
1517 /*
1518 * Does this protocol need to be run as guest? (Only archane
1519 * messenger service requests have this...)
1520 */
1521 if (flags & AS_GUEST) {
1522 char *raddr;
1523 bool ok;
1524
1525 if (!change_to_guest()) {
1526 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1527 return conn;
1528 }
1529
1530 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1531 talloc_tos());
1532 if (raddr == NULL) {
1533 reply_nterror(req, NT_STATUS_NO_MEMORY);
1534 return conn;
1535 }
1536
1537 /*
1538 * Haven't we checked this in smbd_process already???
1539 */
1540
1541 ok = allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1542 sconn->remote_hostname, raddr);
1543 TALLOC_FREE(raddr);
1544
1545 if (!ok) {
1546 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1547 return conn;
1548 }
1549 }
1550
1551 smb_messages[type].fn(req);
1552 return req->conn;
1553 }
1554
1555 /****************************************************************************
1556 Construct a reply to the incoming packet.
1557 ****************************************************************************/
1558
1559 static void construct_reply(struct smbd_server_connection *sconn,
1560 char *inbuf, int size, size_t unread_bytes,
1561 uint32_t seqnum, bool encrypted,
1562 struct smb_perfcount_data *deferred_pcd)
1563 {
1564 connection_struct *conn;
1565 struct smb_request *req;
1566
1567 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1568 smb_panic("could not allocate smb_request");
1569 }
1570
1571 if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1572 encrypted, seqnum)) {
1573 exit_server_cleanly("Invalid SMB request");
1574 }
1575
1576 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1577
1578 /* we popped this message off the queue - keep original perf data */
1579 if (deferred_pcd)
1580 req->pcd = *deferred_pcd;
1581 else {
1582 SMB_PERFCOUNT_START(&req->pcd);
1583 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1584 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1585 }
1586
1587 conn = switch_message(req->cmd, req);
1588
1589 if (req->outbuf == NULL) {
1590 return;
1591 }
1592
1593 if (CVAL(req->outbuf,0) == 0) {
1594 show_msg((char *)req->outbuf);
1595 }
1596
1597 if (!srv_send_smb(req->sconn,
1598 (char *)req->outbuf,
1599 true, req->seqnum+1,
1600 IS_CONN_ENCRYPTED(conn)||req->encrypted,
1601 &req->pcd)) {
1602 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1603 }
1604
1605 TALLOC_FREE(req);
1606
1607 return;
1608 }
1609
1610 static void construct_reply_chain(struct smbd_server_connection *sconn,
1611 char *inbuf, int size, uint32_t seqnum,
1612 bool encrypted,
1613 struct smb_perfcount_data *deferred_pcd)
1614 {
1615 struct smb_request **reqs = NULL;
1616 struct smb_request *req;
1617 unsigned num_reqs;
1618 bool ok;
1619
1620 ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1621 seqnum, &reqs, &num_reqs);
1622 if (!ok) {
1623 char errbuf[smb_size];
1624 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1625 __LINE__, __FILE__);
1626 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1627 NULL)) {
1628 exit_server_cleanly("construct_reply_chain: "
1629 "srv_send_smb failed.");
1630 }
1631 return;
1632 }
1633
1634 req = reqs[0];
1635 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1636
1637 req->conn = switch_message(req->cmd, req);
1638
1639 if (req->outbuf == NULL) {
1640 /*
1641 * Request has suspended itself, will come
1642 * back here.
1643 */
1644 return;
1645 }
1646 smb_request_done(req);
1647 }
1648
1649 /*
1650 * To be called from an async SMB handler that is potentially chained
1651 * when it is finished for shipping.
1652 */
1653
1654 void smb_request_done(struct smb_request *req)
1655 {
1656 struct smb_request **reqs = NULL;
1657 struct smb_request *first_req;
1658 size_t i, num_reqs, next_index;
1659 NTSTATUS status;
1660
1661 if (req->chain == NULL) {
1662 first_req = req;
1663 goto shipit;
1664 }
1665
1666 reqs = req->chain;
1667 num_reqs = talloc_array_length(reqs);
1668
1669 for (i=0; i<num_reqs; i++) {
1670 if (reqs[i] == req) {
1671 break;
1672 }
1673 }
1674 if (i == num_reqs) {
1675 /*
1676 * Invalid chain, should not happen
1677 */
1678 status = NT_STATUS_INTERNAL_ERROR;
1679 goto error;
1680 }
1681 next_index = i+1;
1682
1683 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1684 struct smb_request *next = reqs[next_index];
1685 struct smbXsrv_tcon *tcon;
1686 NTTIME now = timeval_to_nttime(&req->request_time);
1687
1688 next->vuid = SVAL(req->outbuf, smb_uid);
1689 next->tid = SVAL(req->outbuf, smb_tid);
1690 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1691 now, &tcon);
1692 if (NT_STATUS_IS_OK(status)) {
1693 req->conn = tcon->compat;
1694 } else {
1695 req->conn = NULL;
1696 }
1697 next->chain_fsp = req->chain_fsp;
1698 next->inbuf = (uint8_t *)req->inbuf;
1699
1700 req = next;
1701 req->conn = switch_message(req->cmd, req);
1702
1703 if (req->outbuf == NULL) {
1704 /*
1705 * Request has suspended itself, will come
1706 * back here.
1707 */
1708 return;
1709 }
1710 next_index += 1;
1711 }
1712
1713 first_req = reqs[0];
1714
1715 for (i=1; i<next_index; i++) {
1716 bool ok;
1717
1718 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1719 if (!ok) {
1720 status = NT_STATUS_INTERNAL_ERROR;
1721 goto error;
1722 }
1723 }
1724
1725 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1726 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1727
1728 /*
1729 * This scary statement intends to set the
1730 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1731 * to the value last_req->outbuf carries
1732 */
1733 SSVAL(first_req->outbuf, smb_flg2,
1734 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1735 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1736
1737 /*
1738 * Transfer the error codes from the subrequest to the main one
1739 */
1740 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1741 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1742
1743 _smb_setlen_large(
1744 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1745
1746 shipit:
1747 if (!srv_send_smb(first_req->sconn,
1748 (char *)first_req->outbuf,
1749 true, first_req->seqnum+1,
1750 IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1751 &first_req->pcd)) {
1752 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1753 "failed.");
1754 }
1755 TALLOC_FREE(req); /* non-chained case */
1756 TALLOC_FREE(reqs); /* chained case */
1757 return;
1758
1759 error:
1760 {
1761 char errbuf[smb_size];
1762 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1763 if (!srv_send_smb(req->sconn, errbuf, true,
1764 req->seqnum+1, req->encrypted,
1765 NULL)) {
1766 exit_server_cleanly("construct_reply_chain: "
1767 "srv_send_smb failed.");
1768 }
1769 }
1770 TALLOC_FREE(req); /* non-chained case */
1771 TALLOC_FREE(reqs); /* chained case */
1772 }
1773
1774 /****************************************************************************
1775 Process an smb from the client
1776 ****************************************************************************/
1777 static void process_smb(struct smbd_server_connection *sconn,
1778 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1779 uint32_t seqnum, bool encrypted,
1780 struct smb_perfcount_data *deferred_pcd)
1781 {
1782 int msg_type = CVAL(inbuf,0);
1783
1784 DO_PROFILE_INC(smb_count);
1785
1786 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1787 smb_len(inbuf) ) );
1788 DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1789 sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1790
1791 if (msg_type != NBSSmessage) {
1792 /*
1793 * NetBIOS session request, keepalive, etc.
1794 */
1795 reply_special(sconn, (char *)inbuf, nread);
1796 goto done;
1797 }
1798
1799 if (sconn->using_smb2) {
1800 /* At this point we're not really using smb2,
1801 * we make the decision here.. */
1802 if (smbd_is_smb2_header(inbuf, nread)) {
1803 smbd_smb2_first_negprot(sconn, inbuf, nread);
1804 return;
1805 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1806 && CVAL(inbuf, smb_com) != 0x72) {
1807 /* This is a non-negprot SMB1 packet.
1808 Disable SMB2 from now on. */
1809 sconn->using_smb2 = false;
1810 }
1811 }
1812
1813 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1814 * so subtract 4 from it. */
1815 if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1816 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1817 smb_len(inbuf)));
1818
1819 /* special magic for immediate exit */
1820 if ((nread == 9) &&
1821 (IVAL(inbuf, 4) == 0x74697865) &&
1822 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1823 uint8_t exitcode = CVAL(inbuf, 8);
1824 DEBUG(1, ("Exiting immediately with code %d\n",
1825 (int)exitcode));
1826 exit(exitcode);
1827 }
1828
1829 exit_server_cleanly("Non-SMB packet");
1830 }
1831
1832 show_msg((char *)inbuf);
1833
1834 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1835 construct_reply_chain(sconn, (char *)inbuf, nread,
1836 seqnum, encrypted, deferred_pcd);
1837 } else {
1838 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1839 seqnum, encrypted, deferred_pcd);
1840 }
1841
1842 sconn->trans_num++;
1843
1844 done:
1845 sconn->num_requests++;
1846
1847 /* The timeout_processing function isn't run nearly
1848 often enough to implement 'max log size' without
1849 overrunning the size of the file by many megabytes.
1850 This is especially true if we are running at debug
1851 level 10. Checking every 50 SMBs is a nice
1852 tradeoff of performance vs log file size overrun. */
1853
1854 if ((sconn->num_requests % 50) == 0 &&
1855 need_to_check_log_size()) {
1856 change_to_root_user();
1857 check_log_size();
1858 }
1859 }
1860
1861 /****************************************************************************
1862 Return a string containing the function name of a SMB command.
1863 ****************************************************************************/
1864
1865 const char *smb_fn_name(int type)
1866 {
1867 const char *unknown_name = "SMBunknown";
1868
1869 if (smb_messages[type].name == NULL)
1870 return(unknown_name);
1871
1872 return(smb_messages[type].name);
1873 }
1874
1875 /****************************************************************************
1876 Helper functions for contruct_reply.
1877 ****************************************************************************/
1878
1879 void add_to_common_flags2(uint32 v)
1880 {
1881 common_flags2 |= v;
1882 }
1883
1884 void remove_from_common_flags2(uint32 v)
1885 {
1886 common_flags2 &= ~v;
1887 }
1888
1889 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1890 char *outbuf)
1891 {
1892 uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1893 uint16_t out_flags2 = common_flags2;
1894
1895 out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1896 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1897 out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1898
1899 srv_set_message(outbuf,0,0,false);
1900
1901 SCVAL(outbuf, smb_com, req->cmd);
1902 SIVAL(outbuf,smb_rcls,0);
1903 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1904 SSVAL(outbuf,smb_flg2, out_flags2);
1905 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1906 memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1907
1908 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1909 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1910 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1911 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1912 }
1913
1914 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1915 {
1916 construct_reply_common(req, (const char *)req->inbuf, outbuf);
1917 }
1918
1919 /**
1920 * @brief Find the smb_cmd offset of the last command pushed
1921 * @param[in] buf The buffer we're building up
1922 * @retval Where can we put our next andx cmd?
1923 *
1924 * While chaining requests, the "next" request we're looking at needs to put
1925 * its SMB_Command before the data the previous request already built up added
1926 * to the chain. Find the offset to the place where we have to put our cmd.
1927 */
1928
1929 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1930 {
1931 uint8_t cmd;
1932 size_t ofs;
1933
1934 cmd = CVAL(buf, smb_com);
1935
1936 if (!is_andx_req(cmd)) {
1937 return false;
1938 }
1939
1940 ofs = smb_vwv0;
1941
1942 while (CVAL(buf, ofs) != 0xff) {
1943
1944 if (!is_andx_req(CVAL(buf, ofs))) {
1945 return false;
1946 }
1947
1948 /*
1949 * ofs is from start of smb header, so add the 4 length
1950 * bytes. The next cmd is right after the wct field.
1951 */
1952 ofs = SVAL(buf, ofs+2) + 4 + 1;
1953
1954 if (ofs+4 >= talloc_get_size(buf)) {
1955 return false;
1956 }
1957 }
1958
1959 *pofs = ofs;
1960 return true;
1961 }
1962
1963 /**
1964 * @brief Do the smb chaining at a buffer level
1965 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1966 * @param[in] andx_buf Buffer to be appended
1967 */
1968
1969 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1970 {
1971 uint8_t smb_command = CVAL(andx_buf, smb_com);
1972 uint8_t wct = CVAL(andx_buf, smb_wct);
1973 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1974 uint32_t num_bytes = smb_buflen(andx_buf);
1975 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1976
1977 uint8_t *outbuf;
1978 size_t old_size, new_size;
1979 size_t ofs;
1980 size_t chain_padding = 0;
1981 size_t andx_cmd_ofs;
1982
1983
1984 old_size = talloc_get_size(*poutbuf);
1985
1986 if ((old_size % 4) != 0) {
1987 /*
1988 * Align the wct field of subsequent requests to a 4-byte
1989 * boundary
1990 */
1991 chain_padding = 4 - (old_size % 4);
1992 }
1993
1994 /*
1995 * After the old request comes the new wct field (1 byte), the vwv's
1996 * and the num_bytes field.
1997 */
1998
1999 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2000 new_size += num_bytes;
2001
2002 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2003 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2004 (unsigned)new_size));
2005 return false;
2006 }
2007
2008 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2009 if (outbuf == NULL) {
2010 DEBUG(0, ("talloc failed\n"));
2011 return false;
2012 }
2013 *poutbuf = outbuf;
2014
2015 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2016 DEBUG(1, ("invalid command chain\n"));
2017 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2018 return false;
2019 }
2020
2021 if (chain_padding != 0) {
2022 memset(outbuf + old_size, 0, chain_padding);
2023 old_size += chain_padding;
2024 }
2025
2026 SCVAL(outbuf, andx_cmd_ofs, smb_command);
2027 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2028
2029 ofs = old_size;
2030
2031 /*
2032 * Push the chained request:
2033 *
2034 * wct field
2035 */
2036
2037 SCVAL(outbuf, ofs, wct);
2038 ofs += 1;
2039
2040 /*
2041 * vwv array
2042 */
2043
2044 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2045
2046 /*
2047 * HACK ALERT
2048 *
2049 * Read&X has an offset into its data buffer at
2050 * vwv[6]. reply_read_andx has no idea anymore that it's
2051 * running from within a chain, so we have to fix up the
2052 * offset here.
2053 *
2054 * Although it looks disgusting at this place, I want to keep
2055 * it here. The alternative would be to push knowledge about
2056 * the andx chain down into read&x again.
2057 */
2058
2059 if (smb_command == SMBreadX) {
2060 uint8_t *bytes_addr;
2061
2062 if (wct < 7) {
2063 /*
2064 * Invalid read&x response
2065 */
2066 return false;
2067 }
2068
2069 bytes_addr = outbuf + ofs /* vwv start */
2070 + sizeof(uint16_t) * wct /* vwv array */
2071 + sizeof(uint16_t); /* bcc */
2072
2073 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2074 bytes_addr - outbuf - 4);
2075 }
2076
2077 ofs += sizeof(uint16_t) * wct;
2078
2079 /*
2080 * bcc (byte count)
2081 */
2082
2083 SSVAL(outbuf, ofs, num_bytes);
2084 ofs += sizeof(uint16_t);
2085
2086 /*
2087 * The bytes field
2088 */
2089
2090 memcpy(outbuf + ofs, bytes, num_bytes);
2091
2092 return true;
2093 }
2094
2095 bool smb1_is_chain(const uint8_t *buf)
2096 {
2097 uint8_t cmd, wct, andx_cmd;
2098
2099 cmd = CVAL(buf, smb_com);
2100 if (!is_andx_req(cmd)) {
2101 return false;
2102 }
2103 wct = CVAL(buf, smb_wct);
2104 if (wct < 2) {
2105 return false;
2106 }
2107 andx_cmd = CVAL(buf, smb_vwv);
2108 return (andx_cmd != 0xFF);
2109 }
2110
2111 bool smb1_walk_chain(const uint8_t *buf,
2112 bool (*fn)(uint8_t cmd,
2113 uint8_t wct, const uint16_t *vwv,
2114 uint16_t num_bytes, const uint8_t *bytes,
2115 void *private_data),
2116 void *private_data)
2117 {
2118 size_t smblen = smb_len(buf);
2119 const char *smb_buf = smb_base(buf);
2120 uint8_t cmd, chain_cmd;
2121 uint8_t wct;
2122 const uint16_t *vwv;
2123 uint16_t num_bytes;
2124 const uint8_t *bytes;
2125
2126 cmd = CVAL(buf, smb_com);
2127 wct = CVAL(buf, smb_wct);
2128 vwv = (const uint16_t *)(buf + smb_vwv);
2129 num_bytes = smb_buflen(buf);
2130 bytes = (uint8_t *)smb_buf_const(buf);
2131
2132 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2133 return false;
2134 }
2135
2136 if (!is_andx_req(cmd)) {
2137 return true;
2138 }
2139 if (wct < 2) {
2140 return false;
2141 }
2142
2143 chain_cmd = CVAL(vwv, 0);
2144
2145 while (chain_cmd != 0xff) {
2146 uint32_t chain_offset; /* uint32_t to avoid overflow */
2147 size_t length_needed;
2148 ptrdiff_t vwv_offset;
2149
2150 chain_offset = SVAL(vwv+1, 0);
2151
2152 /*
2153 * Check if the client tries to fool us. The chain
2154 * offset needs to point beyond the current request in
2155 * the chain, it needs to strictly grow. Otherwise we
2156 * might be tricked into an endless loop always
2157 * processing the same request over and over again. We
2158 * used to assume that vwv and the byte buffer array
2159 * in a chain are always attached, but OS/2 the
2160 * Write&X/Read&X chain puts the Read&X vwv array
2161 * right behind the Write&X vwv chain. The Write&X bcc
2162 * array is put behind the Read&X vwv array. So now we
2163 * check whether the chain offset points strictly
2164 * behind the previous vwv array. req->buf points
2165 * right after the vwv array of the previous
2166 * request. See
2167 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2168 * more information.
2169 */
2170
2171 vwv_offset = ((const char *)vwv - smb_buf);
2172 if (chain_offset <= vwv_offset) {
2173 return false;
2174 }
2175
2176 /*
2177 * Next check: Make sure the chain offset does not
2178 * point beyond the overall smb request length.
2179 */
2180
2181 length_needed = chain_offset+1; /* wct */
2182 if (length_needed > smblen) {
2183 return false;
2184 }
2185
2186 /*
2187 * Now comes the pointer magic. Goal here is to set up
2188 * vwv and buf correctly again. The chain offset (the
2189 * former vwv[1]) points at the new wct field.
2190 */
2191
2192 wct = CVAL(smb_buf, chain_offset);
2193
2194 if (is_andx_req(chain_cmd) && (wct < 2)) {
2195 return false;
2196 }
2197
2198 /*
2199 * Next consistency check: Make the new vwv array fits
2200 * in the overall smb request.
2201 */
2202
2203 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2204 if (length_needed > smblen) {
2205 return false;
2206 }
2207 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2208
2209 /*
2210 * Now grab the new byte buffer....
2211 */
2212
2213 num_bytes = SVAL(vwv+wct, 0);
2214
2215 /*
2216 * .. and check that it fits.
2217 */
2218
2219 length_needed += num_bytes;
2220 if (length_needed > smblen) {
2221 return false;
2222 }
2223 bytes = (const uint8_t *)(vwv+wct+1);
2224
2225 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2226 return false;
2227 }
2228
2229 if (!is_andx_req(chain_cmd)) {
2230 return true;
2231 }
2232 chain_cmd = CVAL(vwv, 0);
2233 }
2234 return true;
2235 }
2236
2237 static bool smb1_chain_length_cb(uint8_t cmd,
2238 uint8_t wct, const uint16_t *vwv,
2239 uint16_t num_bytes, const uint8_t *bytes,
2240 void *private_data)
2241 {
2242 unsigned *count = (unsigned *)private_data;
2243 *count += 1;
2244 return true;
2245 }
2246
2247 unsigned smb1_chain_length(const uint8_t *buf)
2248 {
2249 unsigned count = 0;
2250
2251 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2252 return 0;
2253 }
2254 return count;
2255 }
2256
2257 struct smb1_parse_chain_state {
2258 TALLOC_CTX *mem_ctx;
2259 const uint8_t *buf;
2260 struct smbd_server_connection *sconn;
2261 bool encrypted;
2262 uint32_t seqnum;
2263
2264 struct smb_request **reqs;
2265 unsigned num_reqs;
2266 };
2267
2268 static bool smb1_parse_chain_cb(uint8_t cmd,
2269 uint8_t wct, const uint16_t *vwv,
2270 uint16_t num_bytes, const uint8_t *bytes,
2271 void *private_data)
2272 {
2273 struct smb1_parse_chain_state *state =
2274 (struct smb1_parse_chain_state *)private_data;
2275 struct smb_request **reqs;
2276 struct smb_request *req;
2277 bool ok;
2278
2279 reqs = talloc_realloc(state->mem_ctx, state->reqs,
2280 struct smb_request *, state->num_reqs+1);
2281 if (reqs == NULL) {
2282 return false;
2283 }
2284 state->reqs = reqs;
2285
2286 req = talloc(reqs, struct smb_request);
2287 if (req == NULL) {
2288 return false;
2289 }
2290
2291 ok = init_smb_request(req, state->sconn, state->buf, 0,
2292 state->encrypted, state->seqnum);
2293 if (!ok) {
2294 return false;
2295 }
2296 req->cmd = cmd;
2297 req->wct = wct;
2298 req->vwv = vwv;
2299 req->buflen = num_bytes;
2300 req->buf = bytes;
2301
2302 reqs[state->num_reqs] = req;
2303 state->num_reqs += 1;
2304 return true;
2305 }
2306
2307 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2308 struct smbd_server_connection *sconn,
2309 bool encrypted, uint32_t seqnum,
2310 struct smb_request ***reqs, unsigned *num_reqs)
2311 {
2312 struct smb1_parse_chain_state state;
2313 unsigned i;
2314
2315 state.mem_ctx = mem_ctx;
2316 state.buf = buf;
2317 state.sconn = sconn;
2318 state.encrypted = encrypted;
2319 state.seqnum = seqnum;
2320 state.reqs = NULL;
2321 state.num_reqs = 0;
2322
2323 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2324 TALLOC_FREE(state.reqs);
2325 return false;
2326 }
2327 for (i=0; i<state.num_reqs; i++) {
2328 state.reqs[i]->chain = state.reqs;
2329 }
2330 *reqs = state.reqs;
2331 *num_reqs = state.num_reqs;
2332 return true;
2333 }
2334
2335 /****************************************************************************
2336 Check if services need reloading.
2337 ****************************************************************************/
2338
2339 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2340 {
2341
2342 if (last_smb_conf_reload_time == 0) {
2343 last_smb_conf_reload_time = t;
2344 }
2345
2346 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2347 reload_services(sconn, conn_snum_used, true);
2348 last_smb_conf_reload_time = t;
2349 }
2350 }
2351
2352 static bool fd_is_readable(int fd)
2353 {
2354 int ret, revents;
2355
2356 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2357
2358 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2359
2360 }
2361
2362 static void smbd_server_connection_write_handler(
2363 struct smbd_server_connection *sconn)
2364 {
2365 /* TODO: make write nonblocking */
2366 }
2367
2368 static void smbd_server_connection_read_handler(
2369 struct smbd_server_connection *sconn, int fd)
2370 {
2371 uint8_t *inbuf = NULL;
2372 size_t inbuf_len = 0;
2373 size_t unread_bytes = 0;
2374 bool encrypted = false;
2375 TALLOC_CTX *mem_ctx = talloc_tos();
2376 NTSTATUS status;
2377 uint32_t seqnum;
2378
2379 bool from_client;
2380
2381 if (lp_async_smb_echo_handler()
2382 && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2383 /*
2384 * This is the super-ugly hack to prefer the packets
2385 * forwarded by the echo handler over the ones by the
2386 * client directly
2387 */
2388 fd = sconn->smb1.echo_handler.trusted_fd;
2389 }
2390
2391 from_client = (sconn->sock == fd);
2392
2393 if (from_client) {
2394 smbd_lock_socket(sconn);
2395
2396 if (!fd_is_readable(fd)) {
2397 DEBUG(10,("the echo listener was faster\n"));
2398 smbd_unlock_socket(sconn);
2399 return;
2400 }
2401 }
2402
2403 /* TODO: make this completely nonblocking */
2404 status = receive_smb_talloc(mem_ctx, sconn, fd,
2405 (char **)(void *)&inbuf,
2406 0, /* timeout */
2407 &unread_bytes,
2408 &encrypted,
2409 &inbuf_len, &seqnum,
2410 false /* trusted channel */);
2411
2412 if (from_client) {
2413 smbd_unlock_socket(sconn);
2414 }
2415
2416 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2417 goto process;
2418 }
2419 if (NT_STATUS_IS_ERR(status)) {
2420 exit_server_cleanly("failed to receive smb request");
2421 }
2422 if (!NT_STATUS_IS_OK(status)) {
2423 return;
2424 }
2425
2426 process:
2427 process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2428 seqnum, encrypted, NULL);
2429 }
2430
2431 static void smbd_server_connection_handler(struct event_context *ev,
2432 struct fd_event *fde,
2433 uint16_t flags,
2434 void *private_data)
2435 {
2436 struct smbd_server_connection *conn = talloc_get_type(private_data,
2437 struct smbd_server_connection);
2438
2439 if (flags & EVENT_FD_WRITE) {
2440 smbd_server_connection_write_handler(conn);
2441 return;
2442 }
2443 if (flags & EVENT_FD_READ) {
2444 smbd_server_connection_read_handler(conn, conn->sock);
2445 return;
2446 }
2447 }
2448
2449 static void smbd_server_echo_handler(struct event_context *ev,
2450 struct fd_event *fde,
2451 uint16_t flags,
2452 void *private_data)
2453 {
2454 struct smbd_server_connection *conn = talloc_get_type(private_data,
2455 struct smbd_server_connection);
2456
2457 if (flags & EVENT_FD_WRITE) {
2458 smbd_server_connection_write_handler(conn);
2459 return;
2460 }
2461 if (flags & EVENT_FD_READ) {
2462 smbd_server_connection_read_handler(
2463 conn, conn->smb1.echo_handler.trusted_fd);
2464 return;
2465 }
2466 }
2467
2468 #ifdef CLUSTER_SUPPORT
2469
2470 struct smbd_release_ip_state {
2471 struct smbd_server_connection *sconn;
2472 char addr[INET6_ADDRSTRLEN];
2473 };
2474
2475 /****************************************************************************
2476 received when we should release a specific IP
2477 ****************************************************************************/
2478 static void release_ip(const char *ip, void *priv)
2479 {
2480 struct smbd_release_ip_state *state =
2481 talloc_get_type_abort(priv,
2482 struct smbd_release_ip_state);
2483 const char *addr = state->addr;
2484 const char *p = addr;
2485
2486 if (strncmp("::ffff:", addr, 7) == 0) {
2487 p = addr + 7;
2488 }
2489
2490 DEBUG(10, ("Got release IP message for %s, "
2491 "our address is %s\n", ip, p));
2492
2493 if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2494 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2495 ip));
2496 /*
2497 * With SMB2 we should do a clean disconnect,
2498 * the previous_session_id in the session setup
2499 * will cleanup the old session, tcons and opens.
2500 *
2501 * A clean disconnect is needed in order to support
2502 * durable handles.
2503 *
2504 * Note: typically this is never triggered
2505 * as we got a TCP RST (triggered by ctdb event scripts)
2506 * before we get CTDB_SRVID_RELEASE_IP.
2507 *
2508 * We used to call _exit(1) here, but as this was mostly never
2509 * triggered and has implication on our process model,
2510 * we can just use smbd_server_connection_terminate()
2511 * (also for SMB1).
2512 */
2513 smbd_server_connection_terminate(state->sconn,
2514 "CTDB_SRVID_RELEASE_IP");
2515 return;
2516 }
2517 }
2518
2519 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2520 struct sockaddr_storage *srv,
2521 struct sockaddr_storage *clnt)
2522 {
2523 struct smbd_release_ip_state *state;
2524 struct ctdbd_connection *cconn;
2525
2526 cconn = messaging_ctdbd_connection();
2527 if (cconn == NULL) {
2528 return NT_STATUS_NO_MEMORY;
2529 }
2530
2531 state = talloc_zero(sconn, struct smbd_release_ip_state);
2532 if (state == NULL) {
2533 return NT_STATUS_NO_MEMORY;
2534 }
2535 state->sconn = sconn;
2536 if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2537 return NT_STATUS_NO_MEMORY;
2538 }
2539
2540 return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2541 }
2542
2543 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2544 struct sockaddr_storage *client)
2545 {
2546 socklen_t length;
2547 length = sizeof(*server);
2548 if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2549 return -1;
2550 }
2551 length = sizeof(*client);
2552 if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2553 return -1;
2554 }
2555 return 0;
2556 }
2557 #endif
2558
2559 /*
2560 * Send keepalive packets to our client
2561 */
2562 static bool keepalive_fn(const struct timeval *now, void *private_data)
2563 {
2564 struct smbd_server_connection *sconn = talloc_get_type_abort(
2565 private_data, struct smbd_server_connection);
2566 bool ret;
2567
2568 if (sconn->using_smb2) {
2569 /* Don't do keepalives on an SMB2 connection. */
2570 return false;
2571 }
2572
2573 smbd_lock_socket(sconn);
2574 ret = send_keepalive(sconn->sock);
2575 smbd_unlock_socket(sconn);
2576
2577 if (!ret) {
2578 char addr[INET6_ADDRSTRLEN];
2579 /*
2580 * Try and give an error message saying what
2581 * client failed.
2582 */
2583 DEBUG(0, ("send_keepalive failed for client %s. "
2584 "Error %s - exiting\n",
2585 get_peer_addr(sconn->sock, addr, sizeof(addr)),
2586 strerror(errno)));
2587 return False;
2588 }
2589 return True;
2590 }
2591
2592 /*
2593 * Do the recurring check if we're idle
2594 */
2595 static bool deadtime_fn(const struct timeval *now, void *private_data)
2596 {
2597 struct smbd_server_connection *sconn =
2598 (struct smbd_server_connection *)private_data;
2599
2600 if ((conn_num_open(sconn) == 0)
2601 || (conn_idle_all(sconn, now->tv_sec))) {
2602 DEBUG( 2, ( "Closing idle connection\n" ) );
2603 messaging_send(sconn->msg_ctx,
2604 messaging_server_id(sconn->msg_ctx),
2605 MSG_SHUTDOWN, &data_blob_null);
2606 return False;
2607 }
2608
2609 return True;
2610 }
2611
2612 /*
2613 * Do the recurring log file and smb.conf reload checks.
2614 */
2615
2616 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2617 {
2618 struct smbd_server_connection *sconn = talloc_get_type_abort(
2619 private_data, struct smbd_server_connection);
2620
2621 DEBUG(5, ("housekeeping\n"));
2622
2623 change_to_root_user();
2624
2625 /* update printer queue caches if necessary */
2626 update_monitored_printq_cache(sconn->msg_ctx);
2627
2628 /* check if we need to reload services */
2629 check_reload(sconn, time_mono(NULL));
2630
2631 /*
2632 * Force a log file check.
2633 */
2634 force_check_log_size();
2635 check_log_size();
2636 return true;
2637 }
2638
2639 /*
2640 * Read an smb packet in the echo handler child, giving the parent
2641 * smbd one second to react once the socket becomes readable.
2642 */
2643
2644 struct smbd_echo_read_state {
2645 struct tevent_context *ev;
2646 struct smbd_server_connection *sconn;
2647
2648 char *buf;
2649 size_t buflen;
2650 uint32_t seqnum;
2651 };
2652
2653 static void smbd_echo_read_readable(struct tevent_req *subreq);
2654 static void smbd_echo_read_waited(struct tevent_req *subreq);
2655
2656 static struct tevent_req *smbd_echo_read_send(
2657 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2658 struct smbd_server_connection *sconn)
2659 {
2660 struct tevent_req *req, *subreq;
2661 struct smbd_echo_read_state *state;
2662
2663 req = tevent_req_create(mem_ctx, &state,
2664 struct smbd_echo_read_state);
2665 if (req == NULL) {
2666 return NULL;
2667 }
2668 state->ev = ev;
2669 state->sconn = sconn;
2670
2671 subreq = wait_for_read_send(state, ev, sconn->sock);
2672 if (tevent_req_nomem(subreq, req)) {
2673 return tevent_req_post(req, ev);
2674 }
2675 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2676 return req;
2677 }
2678
2679 static void smbd_echo_read_readable(struct tevent_req *subreq)
2680 {
2681 struct tevent_req *req = tevent_req_callback_data(
2682 subreq, struct tevent_req);
2683 struct smbd_echo_read_state *state = tevent_req_data(
2684 req, struct smbd_echo_read_state);
2685 bool ok;
2686 int err;
2687
2688 ok = wait_for_read_recv(subreq, &err);
2689 TALLOC_FREE(subreq);
2690 if (!ok) {
2691 tevent_req_nterror(req, map_nt_error_from_unix(err));
2692 return;
2693 }
2694
2695 /*
2696 * Give the parent smbd one second to step in
2697 */
2698
2699 subreq = tevent_wakeup_send(
2700 state, state->ev, timeval_current_ofs(1, 0));
2701 if (tevent_req_nomem(subreq, req)) {
2702 return;
2703 }
2704 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2705 }
2706
2707 static void smbd_echo_read_waited(struct tevent_req *subreq)
2708 {
2709 struct tevent_req *req = tevent_req_callback_data(
2710 subreq, struct tevent_req);
2711 struct smbd_echo_read_state *state = tevent_req_data(
2712 req, struct smbd_echo_read_state);
2713 struct smbd_server_connection *sconn = state->sconn;
2714 bool ok;
2715 NTSTATUS status;
2716 size_t unread = 0;
2717 bool encrypted;
2718
2719 ok = tevent_wakeup_recv(subreq);
2720 TALLOC_FREE(subreq);
2721 if (!ok) {
2722 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2723 return;
2724 }
2725
2726 ok = smbd_lock_socket_internal(sconn);
2727 if (!ok) {
2728 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2729 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2730 return;
2731 }
2732
2733 if (!fd_is_readable(sconn->sock)) {
2734 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2735 (int)getpid()));
2736
2737 ok = smbd_unlock_socket_internal(sconn);
2738 if (!ok) {
2739 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2740 DEBUG(1, ("%s: failed to unlock socket\n",
2741 __location__));
2742 return;
2743 }
2744
2745 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2746 if (tevent_req_nomem(subreq, req)) {
2747 return;
2748 }
2749 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2750 return;
2751 }
2752
2753 status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2754 0 /* timeout */,
2755 &unread,
2756 &encrypted,
2757 &state->buflen,
2758 &state->seqnum,
2759 false /* trusted_channel*/);
2760
2761 if (tevent_req_nterror(req, status)) {
2762 tevent_req_nterror(req, status);
2763 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2764 (int)getpid(), nt_errstr(status)));
2765 return;
2766 }
2767
2768 ok = smbd_unlock_socket_internal(sconn);
2769 if (!ok) {
2770 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2771 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2772 return;
2773 }
2774 tevent_req_done(req);
2775 }
2776
2777 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2778 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2779 {
2780 struct smbd_echo_read_state *state = tevent_req_data(
2781 req, struct smbd_echo_read_state);
2782 NTSTATUS status;
2783
2784 if (tevent_req_is_nterror(req, &status)) {
2785 return status;
2786 }
2787 *pbuf = talloc_move(mem_ctx, &state->buf);
2788 *pbuflen = state->buflen;
2789 *pseqnum = state->seqnum;
2790 return NT_STATUS_OK;
2791 }
2792
2793 struct smbd_echo_state {
2794 struct tevent_context *ev;
2795 struct iovec *pending;
2796 struct smbd_server_connection *sconn;
2797 int parent_pipe;
2798
2799 struct tevent_fd *parent_fde;
2800
2801 struct tevent_req *write_req;
2802 };
2803
2804 static void smbd_echo_writer_done(struct tevent_req *req);
2805
2806 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2807 {
2808 int num_pending;
2809
2810 if (state->write_req != NULL) {
2811 return;
2812 }
2813
2814 num_pending = talloc_array_length(state->pending);
2815 if (num_pending == 0) {
2816 return;
2817 }
2818
2819 state->write_req = writev_send(state, state->ev, NULL,
2820 state->parent_pipe, false,
2821 state->pending, num_pending);
2822 if (state->write_req == NULL) {
2823 DEBUG(1, ("writev_send failed\n"));
2824 exit(1);
2825 }
2826
2827 talloc_steal(state->write_req, state->pending);
2828 state->pending = NULL;
2829
2830 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2831 state);
2832 }
2833
2834 static void smbd_echo_writer_done(struct tevent_req *req)
2835 {
2836 struct smbd_echo_state *state = tevent_req_callback_data(
2837 req, struct smbd_echo_state);
2838 ssize_t written;
2839 int err;
2840
2841 written = writev_recv(req, &err);
2842 TALLOC_FREE(req);
2843 state->write_req = NULL;
2844 if (written == -1) {
2845 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2846 exit(1);
2847 }
2848 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2849 smbd_echo_activate_writer(state);
2850 }
2851
2852 static bool smbd_echo_reply(struct smbd_echo_state *state,
2853 uint8_t *inbuf, size_t inbuf_len,
2854 uint32_t seqnum)
2855 {
2856 struct smb_request req;
2857 uint16_t num_replies;
2858 char *outbuf;
2859 bool ok;
2860
2861 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2862 DEBUG(10, ("Got netbios keepalive\n"));
2863 /*
2864 * Just swallow it
2865 */
2866 return true;
2867 }
2868
2869 if (inbuf_len < smb_size) {
2870 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2871 return false;
2872 }
2873 if (!valid_smb_header(state->sconn, inbuf)) {
2874 DEBUG(10, ("Got invalid SMB header\n"));
2875 return false;
2876 }
2877
2878 if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2879 seqnum)) {
2880 return false;
2881 }
2882 req.inbuf = inbuf;
2883
2884 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2885 smb_messages[req.cmd].name
2886 ? smb_messages[req.cmd].name : "unknown"));
2887
2888 if (req.cmd != SMBecho) {
2889 return false;
2890 }
2891 if (req.wct < 1) {
2892 return false;
2893 }
2894
2895 num_replies = SVAL(req.vwv+0, 0);
2896 if (num_replies != 1) {
2897 /* Not a Windows "Hey, you're still there?" request */
2898 return false;
2899 }
2900
2901 if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2902 1, req.buflen)) {
2903 DEBUG(10, ("create_outbuf failed\n"));
2904 return false;
2905 }
2906 req.outbuf = (uint8_t *)outbuf;
2907
2908 SSVAL(req.outbuf, smb_vwv0, num_replies);
2909
2910 if (req.buflen > 0) {
2911 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2912 }
2913
2914 ok = srv_send_smb(req.sconn,
2915 (char *)outbuf,
2916 true, seqnum+1,
2917 false, &req.pcd);
2918 TALLOC_FREE(outbuf);
2919 if (!ok) {
2920 exit(1);
2921 }
2922
2923 return true;
2924 }
2925
2926 static void smbd_echo_exit(struct tevent_context *ev,
2927 struct tevent_fd *fde, uint16_t flags,
2928 void *private_data)
2929 {
2930 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2931 exit(0);
2932 }
2933
2934 static void smbd_echo_got_packet(struct tevent_req *req);
2935
2936 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2937 int parent_pipe)
2938 {
2939 struct smbd_echo_state *state;
2940 struct tevent_req *read_req;
2941
2942 state = talloc_zero(sconn, struct smbd_echo_state);
2943 if (state == NULL) {
2944 DEBUG(1, ("talloc failed\n"));
2945 return;
2946 }
2947 state->sconn = sconn;
2948 state->parent_pipe = parent_pipe;
2949 state->ev = s3_tevent_context_init(state);
2950 if (state->ev == NULL) {
2951 DEBUG(1, ("tevent_context_init failed\n"));
2952 TALLOC_FREE(state);
2953 return;
2954 }
2955 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2956 TEVENT_FD_READ, smbd_echo_exit,
2957 state);
2958 if (state->parent_fde == NULL) {
2959 DEBUG(1, ("tevent_add_fd failed\n"));
2960 TALLOC_FREE(state);
2961 return;
2962 }
2963
2964 read_req = smbd_echo_read_send(state, state->ev, sconn);
2965 if (read_req == NULL) {
2966 DEBUG(1, ("smbd_echo_read_send failed\n"));
2967 TALLOC_FREE(state);
2968 return;
2969 }
2970 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2971
2972 while (true) {
2973 if (tevent_loop_once(state->ev) == -1) {
2974 DEBUG(1, ("tevent_loop_once failed: %s\n",
2975 strerror(errno)));
2976 break;
2977 }
2978 }
2979 TALLOC_FREE(state);
2980 }
2981
2982 static void smbd_echo_got_packet(struct tevent_req *req)
2983 {
2984 struct smbd_echo_state *state = tevent_req_callback_data(
2985 req, struct smbd_echo_state);
2986 NTSTATUS status;
2987 char *buf = NULL;
2988 size_t buflen = 0;
2989 uint32_t seqnum = 0;
2990 bool reply;
2991
2992 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2993 TALLOC_FREE(req);
2994 if (!NT_STATUS_IS_OK(status)) {
2995 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2996 nt_errstr(status)));
2997 exit(1);
2998 }
2999
3000 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3001 if (!reply) {
3002 size_t num_pending;
3003 struct iovec *tmp;
3004 struct iovec *iov;
3005
3006 num_pending = talloc_array_length(state->pending);
3007 tmp = talloc_realloc(state, state->pending, struct iovec,
3008 num_pending+1);
3009 if (tmp == NULL) {
3010 DEBUG(1, ("talloc_realloc failed\n"));
3011 exit(1);
3012 }
3013 state->pending = tmp;
3014
3015 if (buflen >= smb_size) {
3016 /*
3017 * place the seqnum in the packet so that the main process
3018 * can reply with signing
3019 */
3020 SIVAL(buf, smb_ss_field, seqnum);
3021 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3022 }
3023
3024 iov = &state->pending[num_pending];
3025 iov->iov_base = buf;
3026 iov->iov_len = buflen;
3027
3028 DEBUG(10,("echo_handler[%d]: forward to main\n",
3029 (int)getpid()));
3030 smbd_echo_activate_writer(state);
3031 }
3032
3033 req = smbd_echo_read_send(state, state->ev, state->sconn);
3034 if (req == NULL) {
3035 DEBUG(1, ("smbd_echo_read_send failed\n"));
3036 exit(1);
3037 }
3038 tevent_req_set_callback(req, smbd_echo_got_packet, state);
3039 }
3040
3041
3042 /*
3043 * Handle SMBecho requests in a forked child process
3044 */
3045 bool fork_echo_handler(struct smbd_server_connection *sconn)
3046 {
3047 int listener_pipe[2];
3048 int res;
3049 pid_t child;
3050
3051 res = pipe(listener_pipe);
3052 if (res == -1) {
3053 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3054 return false;
3055 }
3056 sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
3057 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3058 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
3059 goto fail;
3060 }
3061
3062 child = fork();
3063 if (child == 0) {
3064 NTSTATUS status;
3065
3066 close(listener_pipe[0]);
3067 set_blocking(listener_pipe[1], false);
3068
3069 status = reinit_after_fork(sconn->msg_ctx,
3070 sconn->ev_ctx,
3071 false);
3072 if (!NT_STATUS_IS_OK(status)) {
3073 DEBUG(1, ("reinit_after_fork failed: %s\n",
3074 nt_errstr(status)));
3075 exit(1);
3076 }
3077 smbd_echo_loop(sconn, listener_pipe[1]);
3078 exit(0);
3079 }
3080 close(listener_pipe[1]);
3081 listener_pipe[1] = -1;
3082 sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3083
3084 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), child));
3085
3086 /*
3087 * Without smb signing this is the same as the normal smbd
3088 * listener. This needs to change once signing comes in.
3089 */
3090 sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3091 sconn,
3092 sconn->smb1.echo_handler.trusted_fd,
3093 TEVENT_FD_READ,
3094 smbd_server_echo_handler,
3095 sconn);
3096 if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3097 DEBUG(1, ("event_add_fd failed\n"));
3098 goto fail;
3099 }
3100
3101 return true;
3102
3103 fail:
3104 if (listener_pipe[0] != -1) {
3105 close(listener_pipe[0]);
3106 }
3107 if (listener_pipe[1] != -1) {
3108 close(listener_pipe[1]);
3109 }
3110 sconn->smb1.echo_handler.trusted_fd = -1;
3111 if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3112 close(sconn->smb1.echo_handler.socket_lock_fd);
3113 }
3114 sconn->smb1.echo_handler.trusted_fd = -1;
3115 sconn->smb1.echo_handler.socket_lock_fd = -1;
3116 return false;
3117 }
3118
3119 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3120 {
3121 while (user) {
3122 if (user->session_info &&
3123 (user->session_info->unix_token->uid == uid)) {
3124 return true;
3125 }
3126 user = user->next;
3127 }
3128 return false;
3129 }
3130
3131 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3132 {
3133 while (user) {
3134 if (user->session_info != NULL) {
3135 int i;
3136 struct security_unix_token *utok;
3137
3138 utok = user->session_info->unix_token;
3139 if (utok->gid == gid) {
3140 return true;
3141 }
3142 for(i=0; i<utok->ngroups; i++) {
3143 if (utok->groups[i] == gid) {
3144 return true;
3145 }
3146 }
3147 }
3148 user = user->next;
3149 }
3150 return false;
3151 }
3152
3153 static bool sid_in_use(const struct user_struct *user,
3154 const struct dom_sid *psid)
3155 {
3156 while (user) {
3157 struct security_token *tok;
3158
3159 if (user->session_info == NULL) {
3160 continue;
3161 }
3162 tok = user->session_info->security_token;
3163 if (tok == NULL) {
3164 /*
3165 * Not sure session_info->security_token can
3166 * ever be NULL. This check might be not
3167 * necessary.
3168 */
3169 continue;
3170 }
3171 if (security_token_has_sid(tok, psid)) {
3172 return true;
3173 }
3174 user = user->next;
3175 }
3176 return false;
3177 }
3178
3179 static bool id_in_use(const struct user_struct *user,
3180 const struct id_cache_ref *id)
3181 {
3182 switch(id->type) {
3183 case UID:
3184 return uid_in_use(user, id->id.uid);
3185 case GID:
3186 return gid_in_use(user, id->id.gid);
3187 case SID:
3188 return sid_in_use(user, &id->id.sid);
3189 default:
3190 break;
3191 }
3192 return false;
3193 }
3194
3195 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3196 void *private_data,
3197 uint32_t msg_type,
3198 struct server_id server_id,
3199 DATA_BLOB* data)
3200 {
3201 const char *msg = (data && data->data)
3202 ? (const char *)data->data : "<NULL>";
3203 struct id_cache_ref id;
3204 struct smbd_server_connection *sconn =
3205 talloc_get_type_abort(private_data,
3206 struct smbd_server_connection);
3207
3208 if (!id_cache_ref_parse(msg, &id)) {
3209 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3210 return;
3211 }
3212
3213 if (id_in_use(sconn->users, &id)) {
3214 exit_server_cleanly(msg);
3215 }
3216 id_cache_delete_from_cache(&id);
3217 }
3218
3219 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3220 enum protocol_types protocol)
3221 {
3222 NTSTATUS status;
3223
3224 set_Protocol(protocol);
3225 conn->protocol = protocol;
3226
3227 if (protocol >= PROTOCOL_SMB2_02) {
3228 status = smb2srv_session_table_init(conn);
3229 if (!NT_STATUS_IS_OK(status)) {
3230 return status;
3231 }
3232
3233 status = smb2srv_open_table_init(conn);
3234 if (!NT_STATUS_IS_OK(status)) {
3235 return status;
3236 }
3237 } else {
3238 status = smb1srv_session_table_init(conn);
3239 if (!NT_STATUS_IS_OK(status)) {
3240 return status;
3241 }
3242
3243 status = smb1srv_tcon_table_init(conn);
3244 if (!NT_STATUS_IS_OK(status)) {
3245 return status;
3246 }
3247
3248 status = smb1srv_open_table_init(conn);
3249 if (!NT_STATUS_IS_OK(status)) {
3250 return status;
3251 }
3252 }
3253
3254 return NT_STATUS_OK;
3255 }
3256
3257 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3258 void *private_data)
3259 {
3260 struct smbXsrv_connection *conn =
3261 talloc_get_type_abort(private_data,
3262 struct smbXsrv_connection);
3263
3264 switch (point) {
3265 case TEVENT_TRACE_BEFORE_WAIT:
3266 /*
3267 * This just removes compiler warning
3268 * without profile support
3269 */
3270 conn->smbd_idle_profstamp = 0;
3271 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3272 break;
3273 case TEVENT_TRACE_AFTER_WAIT:
3274 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3275 break;
3276 }
3277 }
3278
3279 /****************************************************************************
3280 Process commands from the client
3281 ****************************************************************************/
3282
3283 void smbd_process(struct tevent_context *ev_ctx,
3284 struct messaging_context *msg_ctx,
3285 int sock_fd,
3286 bool interactive)
3287 {
3288 TALLOC_CTX *frame = talloc_stackframe();
3289 struct smbXsrv_connection *conn;
3290 struct smbd_server_connection *sconn;
3291 struct sockaddr_storage ss;
3292 struct sockaddr *sa = NULL;
3293 socklen_t sa_socklen;
3294 struct tsocket_address *local_address = NULL;
3295 struct tsocket_address *remote_address = NULL;
3296 const char *locaddr = NULL;
3297 const char *remaddr = NULL;
3298 char *rhost;
3299 int ret;
3300
3301 conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3302 if (conn == NULL) {
3303 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3304 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3305 }
3306
3307 conn->ev_ctx = ev_ctx;
3308 conn->msg_ctx = msg_ctx;
3309
3310 sconn = talloc_zero(conn, struct smbd_server_connection);
3311 if (!sconn) {
3312 exit_server("failed to create smbd_server_connection");
3313 }
3314
3315 conn->sconn = sconn;
3316 sconn->conn = conn;
3317
3318 /*
3319 * TODO: remove this...:-)
3320 */
3321 global_smbXsrv_connection = conn;
3322
3323 sconn->ev_ctx = ev_ctx;
3324 sconn->msg_ctx = msg_ctx;
3325 sconn->sock = sock_fd;
3326 sconn->smb1.echo_handler.trusted_fd = -1;
3327 sconn->smb1.echo_handler.socket_lock_fd = -1;
3328
3329 if (!interactive) {
3330 smbd_setup_sig_term_handler(sconn);
3331 smbd_setup_sig_hup_handler(sconn);
3332
3333 if (!serverid_register(messaging_server_id(msg_ctx),
3334 FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3335 |FLAG_MSG_DBWRAP
3336 |FLAG_MSG_PRINT_GENERAL)) {
3337 exit_server_cleanly("Could not register myself in "
3338 "serverid.tdb");
3339 }
3340 }
3341
3342 if (lp_srv_maxprotocol() >= PROTOCOL_SMB2_02) {
3343 /*
3344 * We're not making the decision here,
3345 * we're just allowing the client
3346 * to decide between SMB1 and SMB2
3347 * with the first negprot
3348 * packet.
3349 */
3350 sconn->using_smb2 = true;
3351 }
3352
3353 /* Ensure child is set to blocking mode */
3354 set_blocking(sconn->sock,True);
3355
3356 set_socket_options(sconn->sock, "SO_KEEPALIVE");
3357 set_socket_options(sconn->sock, lp_socket_options());
3358
3359 sa = (struct sockaddr *)(void *)&ss;
3360 sa_socklen = sizeof(ss);
3361 ret = getpeername(sconn->sock, sa, &sa_socklen);
3362 if (ret != 0) {
3363 int level = (errno == ENOTCONN)?2:0;
3364 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3365 exit_server_cleanly("getpeername() failed.\n");
3366 }
3367 ret = tsocket_address_bsd_from_sockaddr(sconn,
3368 sa, sa_socklen,
3369 &remote_address);
3370 if (ret != 0) {
3371 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3372 __location__, strerror(errno)));
3373 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3374 }
3375
3376 sa = (struct sockaddr *)(void *)&ss;
3377 sa_socklen = sizeof(ss);
3378 ret = getsockname(sconn->sock, sa, &sa_socklen);
3379 if (ret != 0) {
3380 int level = (errno == ENOTCONN)?2:0;
3381 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3382 exit_server_cleanly("getsockname() failed.\n");
3383 }
3384 ret = tsocket_address_bsd_from_sockaddr(sconn,
3385 sa, sa_socklen,
3386 &local_address);
3387 if (ret != 0) {
3388 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3389 __location__, strerror(errno)));
3390 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3391 }
3392
3393 sconn->local_address = local_address;
3394 sconn->remote_address = remote_address;
3395
3396 if (tsocket_address_is_inet(local_address, "ip")) {
3397 locaddr = tsocket_address_inet_addr_string(
3398 sconn->local_address,
3399 talloc_tos());
3400 if (locaddr == NULL) {
3401 DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3402 __location__, strerror(errno)));
3403 exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3404 }
3405 } else {
3406 locaddr = "0.0.0.0";
3407 }
3408
3409 if (tsocket_address_is_inet(remote_address, "ip")) {
3410 remaddr = tsocket_address_inet_addr_string(
3411 sconn->remote_address,
3412 talloc_tos());
3413 if (remaddr == NULL) {
3414 DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3415 __location__, strerror(errno)));
3416 exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3417 }
3418 } else {
3419 remaddr = "0.0.0.0";
3420 }
3421
3422 /* this is needed so that we get decent entries
3423 in smbstatus for port 445 connects */
3424 set_remote_machine_name(remaddr, false);
3425 reload_services(sconn, conn_snum_used, true);
3426
3427 /*
3428 * Before the first packet, check the global hosts allow/ hosts deny
3429 * parameters before doing any parsing of packets passed to us by the
3430 * client. This prevents attacks on our parsing code from hosts not in
3431 * the hosts allow list.
3432 */
3433
3434 ret = get_remote_hostname(remote_address,
3435 &rhost,
3436 talloc_tos());
3437 if (ret < 0) {
3438 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3439 __location__, strerror(errno)));
3440 exit_server_cleanly("get_remote_hostname failed.\n");
3441 }
3442 if (strequal(rhost, "UNKNOWN")) {
3443 rhost = talloc_strdup(talloc_tos(), remaddr);
3444 }
3445 sconn->remote_hostname = talloc_move(sconn, &rhost);
3446
3447 sub_set_socket_ids(remaddr,
3448 sconn->remote_hostname,
3449 locaddr);
3450
3451 if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3452 sconn->remote_hostname,
3453 remaddr)) {
3454 /*
3455 * send a negative session response "not listening on calling
3456 * name"
3457 */
3458 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3459 DEBUG( 1, ("Connection denied from %s to %s\n",
3460 tsocket_address_string(remote_address, talloc_tos()),
3461 tsocket_address_string(local_address, talloc_tos())));
3462 (void)srv_send_smb(sconn,(char *)buf, false,
3463 0, false, NULL);
3464 exit_server_cleanly("connection denied");
3465 }
3466
3467 DEBUG(10, ("Connection allowed from %s to %s\n",
3468 tsocket_address_string(remote_address, talloc_tos()),
3469 tsocket_address_string(local_address, talloc_tos())));
3470
3471 if (lp_preload_modules()) {
3472 smb_load_modules(lp_preload_modules());
3473 }
3474
3475 smb_perfcount_init();
3476
3477 if (!init_account_policy()) {
3478 exit_server("Could not open account policy tdb.\n");
3479 }
3480
3481 if (*lp_rootdir(talloc_tos())) {
3482 if (chroot(lp_rootdir(talloc_tos())) != 0) {
3483 DEBUG(0,("Failed to change root to %s\n",
3484 lp_rootdir(talloc_tos())));
3485 exit_server("Failed to chroot()");
3486 }
3487 if (chdir("/") == -1) {
3488 DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir(talloc_tos())));
3489 exit_server("Failed to chroot()");
3490 }
3491 DEBUG(0,("Changed root to %s\n", lp_rootdir(talloc_tos())));
3492 }
3493
3494 if (!srv_init_signing(sconn)) {
3495 exit_server("Failed to init smb_signing");
3496 }
3497
3498 if (!file_init(sconn)) {
3499 exit_server("file_init() failed");
3500 }
3501
3502 /* Setup oplocks */
3503 if (!init_oplocks(sconn))
3504 exit_server("Failed to init oplocks");
3505
3506 /* register our message handlers */
3507 messaging_register(sconn->msg_ctx, sconn,
3508 MSG_SMB_FORCE_TDIS, msg_force_tdis);
3509 messaging_register(sconn->msg_ctx, sconn,
3510 MSG_SMB_CLOSE_FILE, msg_close_file);
3511 messaging_register(sconn->msg_ctx, sconn,
3512 MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3513
3514 id_cache_register_msgs(sconn->msg_ctx);
3515 messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3516 messaging_register(sconn->msg_ctx, sconn,
3517 ID_CACHE_KILL, smbd_id_cache_kill);
3518
3519 messaging_deregister(sconn->msg_ctx,
3520 MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3521 messaging_register(sconn->msg_ctx, sconn,
3522 MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3523
3524 /*
3525 * Use the default MSG_DEBUG handler to avoid rebroadcasting
3526 * MSGs to all child processes
3527 */
3528 messaging_deregister(sconn->msg_ctx,
3529 MSG_DEBUG, NULL);
3530 messaging_register(sconn->msg_ctx, NULL,
3531 MSG_DEBUG, debug_message);
3532
3533 if ((lp_keepalive() != 0)
3534 && !(event_add_idle(ev_ctx, NULL,
3535 timeval_set(lp_keepalive(), 0),
3536 "keepalive", keepalive_fn,
3537 sconn))) {
3538 DEBUG(0, ("Could not add keepalive event\n"));
3539 exit(1);
3540 }
3541
3542 if (!(event_add_idle(ev_ctx, NULL,
3543 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3544 "deadtime", deadtime_fn, sconn))) {
3545 DEBUG(0, ("Could not add deadtime event\n"));
3546 exit(1);
3547 }
3548
3549 if (!(event_add_idle(ev_ctx, NULL,
3550 timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3551 "housekeeping", housekeeping_fn, sconn))) {
3552 DEBUG(0, ("Could not add housekeeping event\n"));
3553 exit(1);
3554 }
3555
3556 #ifdef CLUSTER_SUPPORT
3557
3558 if (lp_clustering()) {
3559 /*
3560 * We need to tell ctdb about our client's TCP
3561 * connection, so that for failover ctdbd can send
3562 * tickle acks, triggering a reconnection by the
3563 * client.
3564 */
3565
3566 struct sockaddr_storage srv, clnt;
3567
3568 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3569 NTSTATUS status;
3570 status = smbd_register_ips(sconn, &srv, &clnt);
3571 if (!NT_STATUS_IS_OK(status)) {
3572 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3573 nt_errstr(status)));
3574 }
3575 } else
3576 {
3577 DEBUG(0,("Unable to get tcp info for "
3578 "CTDB_CONTROL_TCP_CLIENT: %s\n",
3579 strerror(errno)));
3580 }
3581 }
3582
3583 #endif
3584
3585 sconn->nbt.got_session = false;
3586
3587 sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
3588
3589 sconn->smb1.sessions.done_sesssetup = false;
3590 sconn->smb1.sessions.max_send = BUFFER_SIZE;
3591 sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3592
3593 if (!init_dptrs(sconn)) {
3594 exit_server("init_dptrs() failed");
3595 }
3596
3597 sconn->smb1.fde = event_add_fd(ev_ctx,
3598 sconn,
3599 sconn->sock,
3600 EVENT_FD_READ,
3601 smbd_server_connection_handler,
3602 sconn);
3603 if (!sconn->smb1.fde) {
3604 exit_server("failed to create smbd_server_connection fde");
3605 }
3606
3607 sconn->conn->local_address = sconn->local_address;
3608 sconn->conn->remote_address = sconn->remote_address;
3609 sconn->conn->remote_hostname = sconn->remote_hostname;
3610 sconn->conn->protocol = PROTOCOL_NONE;
3611
3612 TALLOC_FREE(frame);
3613
3614 tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3615
3616 while (True) {
3617 frame = talloc_stackframe_pool(8192);
3618
3619 errno = 0;
3620 if (tevent_loop_once(ev_ctx) == -1) {
3621 if (errno != EINTR) {
3622 DEBUG(3, ("tevent_loop_once failed: %s,"
3623 " exiting\n", strerror(errno) ));
3624 break;
3625 }
3626 }
3627
3628 TALLOC_FREE(frame);
3629 }
3630
3631 exit_server_cleanly(NULL);
3632 }
3633
3634 bool req_is_in_chain(struct smb_request *req)
3635 {
3636 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3637 /*
3638 * We're right now handling a subsequent request, so we must
3639 * be in a chain
3640 */
3641 return true;
3642 }
3643
3644 if (!is_andx_req(req->cmd)) {
3645 return false;
3646 }
3647
3648 if (req->wct < 2) {
3649 /*
3650 * Okay, an illegal request, but definitely not chained :-)
3651 */
3652 return false;
3653 }
3654
3655 return (CVAL(req->vwv+0, 0) != 0xFF);
3656 }