?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
python: models: rename argument ldb to samdb
[samba.git] / source3 / smbd / smb1_process.c
blob9b5a1bb16023bd08592c5bf8112061402f766ef2
1 /*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/tsocket/tsocket.h"
23 #include "system/filesys.h"
24 #include "smbd/smbd.h"
25 #include "smbd/globals.h"
26 #include "source3/smbd/smbXsrv_session.h"
27 #include "smbd/smbXsrv_open.h"
28 #include "librpc/gen_ndr/netlogon.h"
29 #include "../lib/async_req/async_sock.h"
30 #include "ctdbd_conn.h"
31 #include "../lib/util/select.h"
32 #include "printing/queue_process.h"
33 #include "system/select.h"
34 #include "passdb.h"
35 #include "auth.h"
36 #include "messages.h"
37 #include "lib/messages_ctdb.h"
38 #include "smbprofile.h"
39 #include "rpc_server/spoolss/srv_spoolss_nt.h"
40 #include "../lib/util/tevent_ntstatus.h"
41 #include "../libcli/security/dom_sid.h"
42 #include "../libcli/security/security_token.h"
43 #include "lib/id_cache.h"
44 #include "lib/util/sys_rw_data.h"
45 #include "system/threads.h"
46 #include "lib/pthreadpool/pthreadpool_tevent.h"
47 #include "util_event.h"
48 #include "libcli/smb/smbXcli_base.h"
49 #include "lib/util/time_basic.h"
50 #include "source3/lib/substitute.h"
51 #include "lib/util/util_process.h"
52
53 /* Internal message queue for deferred opens. */
54 struct pending_message_list {
55 struct pending_message_list *next, *prev;
56 struct timeval request_time; /* When was this first issued? */
57 struct smbd_server_connection *sconn;
58 struct smbXsrv_connection *xconn;
59 struct tevent_timer *te;
60 uint32_t seqnum;
61 bool encrypted;
62 bool processed;
63 DATA_BLOB buf;
64 struct deferred_open_record *open_rec;
65 };
66
67 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
68
69 void smbd_echo_init(struct smbXsrv_connection *xconn)
70 {
71 xconn->smb1.echo_handler.trusted_fd = -1;
72 xconn->smb1.echo_handler.socket_lock_fd = -1;
73 #ifdef HAVE_ROBUST_MUTEXES
74 xconn->smb1.echo_handler.socket_mutex = NULL;
75 #endif
76 }
77
78 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
79 {
80 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
81 return true;
82 }
83
84 #ifdef HAVE_ROBUST_MUTEXES
85 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
86 return true;
87 }
88 #endif
89
90 return false;
91 }
92
93 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
94 {
95 if (!smbd_echo_active(xconn)) {
96 return true;
97 }
98
99 xconn->smb1.echo_handler.ref_count++;
100
101 if (xconn->smb1.echo_handler.ref_count > 1) {
102 return true;
103 }
104
105 DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
106
107 #ifdef HAVE_ROBUST_MUTEXES
108 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
109 int ret = EINTR;
110
111 while (ret == EINTR) {
112 ret = pthread_mutex_lock(
113 xconn->smb1.echo_handler.socket_mutex);
114 if (ret == 0) {
115 break;
116 }
117 }
118 if (ret != 0) {
119 DEBUG(1, ("pthread_mutex_lock failed: %s\n",
120 strerror(ret)));
121 return false;
122 }
123 }
124 #endif
125
126 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
127 bool ok;
128
129 do {
130 ok = fcntl_lock(
131 xconn->smb1.echo_handler.socket_lock_fd,
132 F_SETLKW, 0, 0, F_WRLCK);
133 } while (!ok && (errno == EINTR));
134
135 if (!ok) {
136 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
137 return false;
138 }
139 }
140
141 DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
142
143 return true;
144 }
145
146 void smbd_lock_socket(struct smbXsrv_connection *xconn)
147 {
148 if (!smbd_lock_socket_internal(xconn)) {
149 exit_server_cleanly("failed to lock socket");
150 }
151 }
152
153 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
154 {
155 if (!smbd_echo_active(xconn)) {
156 return true;
157 }
158
159 xconn->smb1.echo_handler.ref_count--;
160
161 if (xconn->smb1.echo_handler.ref_count > 0) {
162 return true;
163 }
164
165 #ifdef HAVE_ROBUST_MUTEXES
166 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
167 int ret;
168 ret = pthread_mutex_unlock(
169 xconn->smb1.echo_handler.socket_mutex);
170 if (ret != 0) {
171 DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
172 strerror(ret)));
173 return false;
174 }
175 }
176 #endif
177
178 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
179 bool ok;
180
181 do {
182 ok = fcntl_lock(
183 xconn->smb1.echo_handler.socket_lock_fd,
184 F_SETLKW, 0, 0, F_UNLCK);
185 } while (!ok && (errno == EINTR));
186
187 if (!ok) {
188 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
189 return false;
190 }
191 }
192
193 DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
194
195 return true;
196 }
197
198 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
199 {
200 if (!smbd_unlock_socket_internal(xconn)) {
201 exit_server_cleanly("failed to unlock socket");
202 }
203 }
204
205 /* Accessor function for smb_read_error for smbd functions. */
206
207 /****************************************************************************
208 Send an smb to a fd.
209 ****************************************************************************/
210
211 bool smb1_srv_send(struct smbXsrv_connection *xconn,
212 char *buffer,
213 bool do_signing,
214 uint32_t seqnum,
215 bool do_encrypt)
216 {
217 size_t len = 0;
218 ssize_t ret;
219 char *buf_out = buffer;
220
221 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
222 /*
223 * we're not supposed to do any io
224 */
225 return true;
226 }
227
228 smbd_lock_socket(xconn);
229
230 if (do_signing) {
231 NTSTATUS status;
232
233 /* Sign the outgoing packet if required. */
234 status = smb1_srv_calculate_sign_mac(xconn, buf_out, seqnum);
235 if (!NT_STATUS_IS_OK(status)) {
236 DBG_ERR("Failed to calculate signing mac: %s\n",
237 nt_errstr(status));
238 return false;
239 }
240 }
241
242 if (do_encrypt) {
243 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
244 if (!NT_STATUS_IS_OK(status)) {
245 DEBUG(0, ("send_smb: SMB encryption failed "
246 "on outgoing packet! Error %s\n",
247 nt_errstr(status) ));
248 ret = -1;
249 goto out;
250 }
251 }
252
253 len = smb_len_large(buf_out) + 4;
254
255 ret = write_data(xconn->transport.sock, buf_out, len);
256 if (ret <= 0) {
257 int saved_errno = errno;
258 /*
259 * Try and give an error message saying what
260 * client failed.
261 */
262 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
263 (int)getpid(), (int)len,
264 smbXsrv_connection_dbg(xconn),
265 (int)ret, strerror(saved_errno)));
266 errno = saved_errno;
267
268 srv_free_enc_buffer(xconn, buf_out);
269 goto out;
270 }
271
272 srv_free_enc_buffer(xconn, buf_out);
273 out:
274 smbd_unlock_socket(xconn);
275 return (ret > 0);
276 }
277
278 /* Socket functions for smbd packet processing. */
279
280 static bool valid_packet_size(size_t len)
281 {
282 /*
283 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
284 * of header. Don't print the error if this fits.... JRA.
285 */
286
287 if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
288 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
289 (unsigned long)len));
290 return false;
291 }
292 return true;
293 }
294
295 /****************************************************************************
296 Attempt a zerocopy writeX read. We know here that len > smb_size-4
297 ****************************************************************************/
298
299 /*
300 * Unfortunately, earlier versions of smbclient/libsmbclient
301 * don't send this "standard" writeX header. I've fixed this
302 * for 3.2 but we'll use the old method with earlier versions.
303 * Windows and CIFSFS at least use this standard size. Not
304 * sure about MacOSX.
305 */
306
307 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
308 (2*14) + /* word count (including bcc) */ \
309 1 /* pad byte */)
310
311 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
312 const char lenbuf[4],
313 struct smbXsrv_connection *xconn,
314 int sock,
315 char **buffer,
316 unsigned int timeout,
317 size_t *p_unread,
318 size_t *len_ret)
319 {
320 /* Size of a WRITEX call (+4 byte len). */
321 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
322 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
323 ssize_t toread;
324 NTSTATUS status;
325
326 memcpy(writeX_header, lenbuf, 4);
327
328 status = read_fd_with_timeout(
329 sock, writeX_header + 4,
330 STANDARD_WRITE_AND_X_HEADER_SIZE,
331 STANDARD_WRITE_AND_X_HEADER_SIZE,
332 timeout, NULL);
333
334 if (!NT_STATUS_IS_OK(status)) {
335 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
336 "error = %s.\n",
337 smbXsrv_connection_dbg(xconn),
338 nt_errstr(status)));
339 return status;
340 }
341
342 /*
343 * Ok - now try and see if this is a possible
344 * valid writeX call.
345 */
346
347 if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
348 /*
349 * If the data offset is beyond what
350 * we've read, drain the extra bytes.
351 */
352 uint16_t doff = SVAL(writeX_header,smb_vwv11);
353 ssize_t newlen;
354
355 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
356 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
357 if (drain_socket(sock, drain) != drain) {
358 smb_panic("receive_smb_raw_talloc_partial_read:"
359 " failed to drain pending bytes");
360 }
361 } else {
362 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
363 }
364
365 /* Spoof down the length and null out the bcc. */
366 set_message_bcc(writeX_header, 0);
367 newlen = smb_len(writeX_header);
368
369 /* Copy the header we've written. */
370
371 *buffer = (char *)talloc_memdup(mem_ctx,
372 writeX_header,
373 sizeof(writeX_header));
374
375 if (*buffer == NULL) {
376 DEBUG(0, ("Could not allocate inbuf of length %d\n",
377 (int)sizeof(writeX_header)));
378 return NT_STATUS_NO_MEMORY;
379 }
380
381 /* Work out the remaining bytes. */
382 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
383 *len_ret = newlen + 4;
384 return NT_STATUS_OK;
385 }
386
387 if (!valid_packet_size(len)) {
388 return NT_STATUS_INVALID_PARAMETER;
389 }
390
391 /*
392 * Not a valid writeX call. Just do the standard
393 * talloc and return.
394 */
395
396 *buffer = talloc_array(mem_ctx, char, len+4);
397
398 if (*buffer == NULL) {
399 DEBUG(0, ("Could not allocate inbuf of length %d\n",
400 (int)len+4));
401 return NT_STATUS_NO_MEMORY;
402 }
403
404 /* Copy in what we already read. */
405 memcpy(*buffer,
406 writeX_header,
407 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
408 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
409
410 if(toread > 0) {
411 status = read_packet_remainder(
412 sock,
413 (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
414 timeout, toread);
415
416 if (!NT_STATUS_IS_OK(status)) {
417 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
418 nt_errstr(status)));
419 return status;
420 }
421 }
422
423 *len_ret = len + 4;
424 return NT_STATUS_OK;
425 }
426
427 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
428 struct smbXsrv_connection *xconn,
429 int sock,
430 char **buffer, unsigned int timeout,
431 size_t *p_unread, size_t *plen)
432 {
433 char lenbuf[4];
434 size_t len;
435 int min_recv_size = lp_min_receive_file_size();
436 NTSTATUS status;
437
438 *p_unread = 0;
439
440 status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
441 &len);
442 if (!NT_STATUS_IS_OK(status)) {
443 return status;
444 }
445
446 if (CVAL(lenbuf,0) == 0 && min_recv_size &&
447 (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
448 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
449 !smb1_srv_is_signing_active(xconn) &&
450 xconn->smb1.echo_handler.trusted_fde == NULL) {
451
452 return receive_smb_raw_talloc_partial_read(
453 mem_ctx, lenbuf, xconn, sock, buffer, timeout,
454 p_unread, plen);
455 }
456
457 if (!valid_packet_size(len)) {
458 return NT_STATUS_INVALID_PARAMETER;
459 }
460
461 /*
462 * The +4 here can't wrap, we've checked the length above already.
463 */
464
465 *buffer = talloc_array(mem_ctx, char, len+4);
466
467 if (*buffer == NULL) {
468 DEBUG(0, ("Could not allocate inbuf of length %d\n",
469 (int)len+4));
470 return NT_STATUS_NO_MEMORY;
471 }
472
473 memcpy(*buffer, lenbuf, sizeof(lenbuf));
474
475 status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
476 if (!NT_STATUS_IS_OK(status)) {
477 return status;
478 }
479
480 *plen = len + 4;
481 return NT_STATUS_OK;
482 }
483
484 NTSTATUS smb1_receive_talloc(TALLOC_CTX *mem_ctx,
485 struct smbXsrv_connection *xconn,
486 int sock,
487 char **buffer, unsigned int timeout,
488 size_t *p_unread, bool *p_encrypted,
489 size_t *p_len,
490 uint32_t *seqnum,
491 bool trusted_channel)
492 {
493 size_t len = 0;
494 NTSTATUS status;
495
496 *p_encrypted = false;
497
498 status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
499 p_unread, &len);
500 if (!NT_STATUS_IS_OK(status)) {
501 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
502 ("receive_smb_raw_talloc failed for client %s "
503 "read error = %s.\n",
504 smbXsrv_connection_dbg(xconn),
505 nt_errstr(status)) );
506 return status;
507 }
508
509 if (is_encrypted_packet((uint8_t *)*buffer)) {
510 status = srv_decrypt_buffer(xconn, *buffer);
511 if (!NT_STATUS_IS_OK(status)) {
512 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
513 "incoming packet! Error %s\n",
514 nt_errstr(status) ));
515 return status;
516 }
517 *p_encrypted = true;
518 }
519
520 /* Check the incoming SMB signature. */
521 if (!smb1_srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
522 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
523 "incoming packet!\n"));
524 return NT_STATUS_INVALID_NETWORK_RESPONSE;
525 }
526
527 *p_len = len;
528 return NT_STATUS_OK;
529 }
530
531 /****************************************************************************
532 Function to push a message onto the tail of a linked list of smb messages ready
533 for processing.
534 ****************************************************************************/
535
536 static bool push_queued_message(struct smb_request *req,
537 struct timeval request_time,
538 struct timeval end_time,
539 struct deferred_open_record *open_rec)
540 {
541 int msg_len = smb_len(req->inbuf) + 4;
542 struct pending_message_list *msg;
543
544 msg = talloc_zero(NULL, struct pending_message_list);
545
546 if(msg == NULL) {
547 DEBUG(0,("push_message: malloc fail (1)\n"));
548 return False;
549 }
550 msg->sconn = req->sconn;
551 msg->xconn = req->xconn;
552
553 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
554 if(msg->buf.data == NULL) {
555 DEBUG(0,("push_message: malloc fail (2)\n"));
556 TALLOC_FREE(msg);
557 return False;
558 }
559
560 msg->request_time = request_time;
561 msg->seqnum = req->seqnum;
562 msg->encrypted = req->encrypted;
563 msg->processed = false;
564
565 if (open_rec) {
566 msg->open_rec = talloc_move(msg, &open_rec);
567 }
568
569 #if 0
570 msg->te = tevent_add_timer(msg->sconn->ev_ctx,
571 msg,
572 end_time,
573 smbd_deferred_open_timer,
574 msg);
575 if (!msg->te) {
576 DEBUG(0,("push_message: event_add_timed failed\n"));
577 TALLOC_FREE(msg);
578 return false;
579 }
580 #endif
581
582 DLIST_ADD_END(req->sconn->deferred_open_queue, msg);
583
584 DEBUG(10,("push_message: pushed message length %u on "
585 "deferred_open_queue\n", (unsigned int)msg_len));
586
587 return True;
588 }
589
590 /****************************************************************************
591 Function to push a deferred open smb message onto a linked list of local smb
592 messages ready for processing.
593 ****************************************************************************/
594
595 bool push_deferred_open_message_smb1(struct smb_request *req,
596 struct timeval timeout,
597 struct file_id id,
598 struct deferred_open_record *open_rec)
599 {
600 struct timeval_buf tvbuf;
601 struct timeval end_time;
602
603 if (req->unread_bytes) {
604 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
605 "unread_bytes = %u\n",
606 (unsigned int)req->unread_bytes ));
607 smb_panic("push_deferred_open_message_smb: "
608 "logic error unread_bytes != 0" );
609 }
610
611 end_time = timeval_sum(&req->request_time, &timeout);
612
613 DBG_DEBUG("pushing message len %u mid %"PRIu64" timeout time [%s]\n",
614 (unsigned int) smb_len(req->inbuf)+4,
615 req->mid,
616 timeval_str_buf(&end_time, false, true, &tvbuf));
617
618 return push_queued_message(req, req->request_time, end_time, open_rec);
619 }
620
621 /*
622 * Only allow 5 outstanding trans requests. We're allocating memory, so
623 * prevent a DoS.
624 */
625
626 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
627 {
628 int count = 0;
629 for (; list != NULL; list = list->next) {
630
631 if (list->mid == mid) {
632 return NT_STATUS_INVALID_PARAMETER;
633 }
634
635 count += 1;
636 }
637 if (count > 5) {
638 return NT_STATUS_INSUFFICIENT_RESOURCES;
639 }
640
641 return NT_STATUS_OK;
642 }
643
644 /*
645 These flags determine some of the permissions required to do an operation
646
647 Note that I don't set NEED_WRITE on some write operations because they
648 are used by some brain-dead clients when printing, and I don't want to
649 force write permissions on print services.
650 */
651 #define AS_USER (1<<0)
652 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
653 #define TIME_INIT (1<<2)
654 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
655 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
656 #define DO_CHDIR (1<<6)
657
658 /*
659 define a list of possible SMB messages and their corresponding
660 functions. Any message that has a NULL function is unimplemented -
661 please feel free to contribute implementations!
662 */
663 static const struct smb_message_struct {
664 const char *name;
665 void (*fn)(struct smb_request *req);
666 int flags;
667 } smb_messages[256] = {
668
669 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
670 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
671 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
672 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
673 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
674 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
675 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
676 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
677 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
678 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
679 /* 0x0a */ { "SMBread",reply_read,AS_USER},
680 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
681 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
682 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
683 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
684 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
685 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
686 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
687 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
688 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
689 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
690 /* 0x15 */ { NULL, NULL, 0 },
691 /* 0x16 */ { NULL, NULL, 0 },
692 /* 0x17 */ { NULL, NULL, 0 },
693 /* 0x18 */ { NULL, NULL, 0 },
694 /* 0x19 */ { NULL, NULL, 0 },
695 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
696 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
697 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
698 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
699 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
700 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
701 /* 0x20 */ { "SMBwritec", NULL,0},
702 /* 0x21 */ { NULL, NULL, 0 },
703 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
704 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
705 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
706 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
707 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
708 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
709 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
710 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
711 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
712 /* 0x2b */ { "SMBecho",reply_echo,0},
713 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
714 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
715 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
716 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
717 /* 0x30 */ { NULL, NULL, 0 },
718 /* 0x31 */ { NULL, NULL, 0 },
719 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
720 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
721 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
722 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
723 /* 0x36 */ { NULL, NULL, 0 },
724 /* 0x37 */ { NULL, NULL, 0 },
725 /* 0x38 */ { NULL, NULL, 0 },
726 /* 0x39 */ { NULL, NULL, 0 },
727 /* 0x3a */ { NULL, NULL, 0 },
728 /* 0x3b */ { NULL, NULL, 0 },
729 /* 0x3c */ { NULL, NULL, 0 },
730 /* 0x3d */ { NULL, NULL, 0 },
731 /* 0x3e */ { NULL, NULL, 0 },
732 /* 0x3f */ { NULL, NULL, 0 },
733 /* 0x40 */ { NULL, NULL, 0 },
734 /* 0x41 */ { NULL, NULL, 0 },
735 /* 0x42 */ { NULL, NULL, 0 },
736 /* 0x43 */ { NULL, NULL, 0 },
737 /* 0x44 */ { NULL, NULL, 0 },
738 /* 0x45 */ { NULL, NULL, 0 },
739 /* 0x46 */ { NULL, NULL, 0 },
740 /* 0x47 */ { NULL, NULL, 0 },
741 /* 0x48 */ { NULL, NULL, 0 },
742 /* 0x49 */ { NULL, NULL, 0 },
743 /* 0x4a */ { NULL, NULL, 0 },
744 /* 0x4b */ { NULL, NULL, 0 },
745 /* 0x4c */ { NULL, NULL, 0 },
746 /* 0x4d */ { NULL, NULL, 0 },
747 /* 0x4e */ { NULL, NULL, 0 },
748 /* 0x4f */ { NULL, NULL, 0 },
749 /* 0x50 */ { NULL, NULL, 0 },
750 /* 0x51 */ { NULL, NULL, 0 },
751 /* 0x52 */ { NULL, NULL, 0 },
752 /* 0x53 */ { NULL, NULL, 0 },
753 /* 0x54 */ { NULL, NULL, 0 },
754 /* 0x55 */ { NULL, NULL, 0 },
755 /* 0x56 */ { NULL, NULL, 0 },
756 /* 0x57 */ { NULL, NULL, 0 },
757 /* 0x58 */ { NULL, NULL, 0 },
758 /* 0x59 */ { NULL, NULL, 0 },
759 /* 0x5a */ { NULL, NULL, 0 },
760 /* 0x5b */ { NULL, NULL, 0 },
761 /* 0x5c */ { NULL, NULL, 0 },
762 /* 0x5d */ { NULL, NULL, 0 },
763 /* 0x5e */ { NULL, NULL, 0 },
764 /* 0x5f */ { NULL, NULL, 0 },
765 /* 0x60 */ { NULL, NULL, 0 },
766 /* 0x61 */ { NULL, NULL, 0 },
767 /* 0x62 */ { NULL, NULL, 0 },
768 /* 0x63 */ { NULL, NULL, 0 },
769 /* 0x64 */ { NULL, NULL, 0 },
770 /* 0x65 */ { NULL, NULL, 0 },
771 /* 0x66 */ { NULL, NULL, 0 },
772 /* 0x67 */ { NULL, NULL, 0 },
773 /* 0x68 */ { NULL, NULL, 0 },
774 /* 0x69 */ { NULL, NULL, 0 },
775 /* 0x6a */ { NULL, NULL, 0 },
776 /* 0x6b */ { NULL, NULL, 0 },
777 /* 0x6c */ { NULL, NULL, 0 },
778 /* 0x6d */ { NULL, NULL, 0 },
779 /* 0x6e */ { NULL, NULL, 0 },
780 /* 0x6f */ { NULL, NULL, 0 },
781 /* 0x70 */ { "SMBtcon",reply_tcon,0},
782 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
783 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
784 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
785 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
786 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
787 /* 0x76 */ { NULL, NULL, 0 },
788 /* 0x77 */ { NULL, NULL, 0 },
789 /* 0x78 */ { NULL, NULL, 0 },
790 /* 0x79 */ { NULL, NULL, 0 },
791 /* 0x7a */ { NULL, NULL, 0 },
792 /* 0x7b */ { NULL, NULL, 0 },
793 /* 0x7c */ { NULL, NULL, 0 },
794 /* 0x7d */ { NULL, NULL, 0 },
795 /* 0x7e */ { NULL, NULL, 0 },
796 /* 0x7f */ { NULL, NULL, 0 },
797 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
798 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
799 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
800 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
801 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
802 /* 0x85 */ { NULL, NULL, 0 },
803 /* 0x86 */ { NULL, NULL, 0 },
804 /* 0x87 */ { NULL, NULL, 0 },
805 /* 0x88 */ { NULL, NULL, 0 },
806 /* 0x89 */ { NULL, NULL, 0 },
807 /* 0x8a */ { NULL, NULL, 0 },
808 /* 0x8b */ { NULL, NULL, 0 },
809 /* 0x8c */ { NULL, NULL, 0 },
810 /* 0x8d */ { NULL, NULL, 0 },
811 /* 0x8e */ { NULL, NULL, 0 },
812 /* 0x8f */ { NULL, NULL, 0 },
813 /* 0x90 */ { NULL, NULL, 0 },
814 /* 0x91 */ { NULL, NULL, 0 },
815 /* 0x92 */ { NULL, NULL, 0 },
816 /* 0x93 */ { NULL, NULL, 0 },
817 /* 0x94 */ { NULL, NULL, 0 },
818 /* 0x95 */ { NULL, NULL, 0 },
819 /* 0x96 */ { NULL, NULL, 0 },
820 /* 0x97 */ { NULL, NULL, 0 },
821 /* 0x98 */ { NULL, NULL, 0 },
822 /* 0x99 */ { NULL, NULL, 0 },
823 /* 0x9a */ { NULL, NULL, 0 },
824 /* 0x9b */ { NULL, NULL, 0 },
825 /* 0x9c */ { NULL, NULL, 0 },
826 /* 0x9d */ { NULL, NULL, 0 },
827 /* 0x9e */ { NULL, NULL, 0 },
828 /* 0x9f */ { NULL, NULL, 0 },
829 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
830 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
831 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
832 /* 0xa3 */ { NULL, NULL, 0 },
833 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
834 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
835 /* 0xa6 */ { NULL, NULL, 0 },
836 /* 0xa7 */ { NULL, NULL, 0 },
837 /* 0xa8 */ { NULL, NULL, 0 },
838 /* 0xa9 */ { NULL, NULL, 0 },
839 /* 0xaa */ { NULL, NULL, 0 },
840 /* 0xab */ { NULL, NULL, 0 },
841 /* 0xac */ { NULL, NULL, 0 },
842 /* 0xad */ { NULL, NULL, 0 },
843 /* 0xae */ { NULL, NULL, 0 },
844 /* 0xaf */ { NULL, NULL, 0 },
845 /* 0xb0 */ { NULL, NULL, 0 },
846 /* 0xb1 */ { NULL, NULL, 0 },
847 /* 0xb2 */ { NULL, NULL, 0 },
848 /* 0xb3 */ { NULL, NULL, 0 },
849 /* 0xb4 */ { NULL, NULL, 0 },
850 /* 0xb5 */ { NULL, NULL, 0 },
851 /* 0xb6 */ { NULL, NULL, 0 },
852 /* 0xb7 */ { NULL, NULL, 0 },
853 /* 0xb8 */ { NULL, NULL, 0 },
854 /* 0xb9 */ { NULL, NULL, 0 },
855 /* 0xba */ { NULL, NULL, 0 },
856 /* 0xbb */ { NULL, NULL, 0 },
857 /* 0xbc */ { NULL, NULL, 0 },
858 /* 0xbd */ { NULL, NULL, 0 },
859 /* 0xbe */ { NULL, NULL, 0 },
860 /* 0xbf */ { NULL, NULL, 0 },
861 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
862 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
863 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
864 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
865 /* 0xc4 */ { NULL, NULL, 0 },
866 /* 0xc5 */ { NULL, NULL, 0 },
867 /* 0xc6 */ { NULL, NULL, 0 },
868 /* 0xc7 */ { NULL, NULL, 0 },
869 /* 0xc8 */ { NULL, NULL, 0 },
870 /* 0xc9 */ { NULL, NULL, 0 },
871 /* 0xca */ { NULL, NULL, 0 },
872 /* 0xcb */ { NULL, NULL, 0 },
873 /* 0xcc */ { NULL, NULL, 0 },
874 /* 0xcd */ { NULL, NULL, 0 },
875 /* 0xce */ { NULL, NULL, 0 },
876 /* 0xcf */ { NULL, NULL, 0 },
877 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
878 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
879 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
880 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
881 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
882 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
883 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
884 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
885 /* 0xd8 */ { NULL, NULL, 0 },
886 /* 0xd9 */ { NULL, NULL, 0 },
887 /* 0xda */ { NULL, NULL, 0 },
888 /* 0xdb */ { NULL, NULL, 0 },
889 /* 0xdc */ { NULL, NULL, 0 },
890 /* 0xdd */ { NULL, NULL, 0 },
891 /* 0xde */ { NULL, NULL, 0 },
892 /* 0xdf */ { NULL, NULL, 0 },
893 /* 0xe0 */ { NULL, NULL, 0 },
894 /* 0xe1 */ { NULL, NULL, 0 },
895 /* 0xe2 */ { NULL, NULL, 0 },
896 /* 0xe3 */ { NULL, NULL, 0 },
897 /* 0xe4 */ { NULL, NULL, 0 },
898 /* 0xe5 */ { NULL, NULL, 0 },
899 /* 0xe6 */ { NULL, NULL, 0 },
900 /* 0xe7 */ { NULL, NULL, 0 },
901 /* 0xe8 */ { NULL, NULL, 0 },
902 /* 0xe9 */ { NULL, NULL, 0 },
903 /* 0xea */ { NULL, NULL, 0 },
904 /* 0xeb */ { NULL, NULL, 0 },
905 /* 0xec */ { NULL, NULL, 0 },
906 /* 0xed */ { NULL, NULL, 0 },
907 /* 0xee */ { NULL, NULL, 0 },
908 /* 0xef */ { NULL, NULL, 0 },
909 /* 0xf0 */ { NULL, NULL, 0 },
910 /* 0xf1 */ { NULL, NULL, 0 },
911 /* 0xf2 */ { NULL, NULL, 0 },
912 /* 0xf3 */ { NULL, NULL, 0 },
913 /* 0xf4 */ { NULL, NULL, 0 },
914 /* 0xf5 */ { NULL, NULL, 0 },
915 /* 0xf6 */ { NULL, NULL, 0 },
916 /* 0xf7 */ { NULL, NULL, 0 },
917 /* 0xf8 */ { NULL, NULL, 0 },
918 /* 0xf9 */ { NULL, NULL, 0 },
919 /* 0xfa */ { NULL, NULL, 0 },
920 /* 0xfb */ { NULL, NULL, 0 },
921 /* 0xfc */ { NULL, NULL, 0 },
922 /* 0xfd */ { NULL, NULL, 0 },
923 /* 0xfe */ { NULL, NULL, 0 },
924 /* 0xff */ { NULL, NULL, 0 }
925
926 };
927
928
929 /*******************************************************************
930 Dump a packet to a file.
931 ********************************************************************/
932
933 static void smb_dump(const char *name, int type, const char *data)
934 {
935 size_t len;
936 int fd, i;
937 char *fname = NULL;
938 if (DEBUGLEVEL < 50) {
939 return;
940 }
941
942 len = smb_len_tcp(data)+4;
943 for (i=1;i<100;i++) {
944 fname = talloc_asprintf(talloc_tos(),
945 "/tmp/%s.%d.%s",
946 name,
947 i,
948 type ? "req" : "resp");
949 if (fname == NULL) {
950 return;
951 }
952 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
953 if (fd != -1 || errno != EEXIST) break;
954 TALLOC_FREE(fname);
955 }
956 if (fd != -1) {
957 ssize_t ret = write(fd, data, len);
958 if (ret != len)
959 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
960 close(fd);
961 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
962 }
963 TALLOC_FREE(fname);
964 }
965
966 static void smb1srv_update_crypto_flags(struct smbXsrv_session *session,
967 struct smb_request *req,
968 uint8_t type,
969 bool *update_session_globalp,
970 bool *update_tcon_globalp)
971 {
972 connection_struct *conn = req->conn;
973 struct smbXsrv_tcon *tcon = conn ? conn->tcon : NULL;
974 uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
975 uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
976 bool update_session = false;
977 bool update_tcon = false;
978
979 if (req->encrypted) {
980 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
981 }
982
983 if (smb1_srv_is_signing_active(req->xconn)) {
984 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
985 } else if ((type == SMBecho) || (type == SMBsesssetupX)) {
986 /*
987 * echo can be unsigned. Session setup except final
988 * session setup response too
989 */
990 sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
991 }
992
993 update_session |= smbXsrv_set_crypto_flag(
994 &session->global->encryption_flags, encrypt_flag);
995 update_session |= smbXsrv_set_crypto_flag(
996 &session->global->signing_flags, sign_flag);
997
998 if (tcon) {
999 update_tcon |= smbXsrv_set_crypto_flag(
1000 &tcon->global->encryption_flags, encrypt_flag);
1001 update_tcon |= smbXsrv_set_crypto_flag(
1002 &tcon->global->signing_flags, sign_flag);
1003 }
1004
1005 if (update_session) {
1006 session->global->channels[0].encryption_cipher = SMB_ENCRYPTION_GSSAPI;
1007 }
1008
1009 *update_session_globalp = update_session;
1010 *update_tcon_globalp = update_tcon;
1011 return;
1012 }
1013
1014 static void set_current_case_sensitive(connection_struct *conn, uint16_t flags)
1015 {
1016 int snum;
1017 enum remote_arch_types ra_type;
1018
1019 SMB_ASSERT(conn != NULL);
1020 SMB_ASSERT(!conn_using_smb2(conn->sconn));
1021
1022 snum = SNUM(conn);
1023
1024 /*
1025 * Obey the client case sensitivity requests - only for clients that
1026 * support it. */
1027 switch (lp_case_sensitive(snum)) {
1028 case Auto:
1029 /*
1030 * We need this ugliness due to DOS/Win9x clients that lie
1031 * about case insensitivity. */
1032 ra_type = get_remote_arch();
1033 if ((ra_type != RA_SAMBA) && (ra_type != RA_CIFSFS)) {
1034 /*
1035 * Client can't support per-packet case sensitive
1036 * pathnames. */
1037 conn->case_sensitive = false;
1038 } else {
1039 conn->case_sensitive =
1040 !(flags & FLAG_CASELESS_PATHNAMES);
1041 }
1042 break;
1043 case True:
1044 conn->case_sensitive = true;
1045 break;
1046 default:
1047 conn->case_sensitive = false;
1048 break;
1049 }
1050 }
1051
1052 /****************************************************************************
1053 Prepare everything for calling the actual request function, and potentially
1054 call the request function via the "new" interface.
1055
1056 Return False if the "legacy" function needs to be called, everything is
1057 prepared.
1058
1059 Return True if we're done.
1060
1061 I know this API sucks, but it is the one with the least code change I could
1062 find.
1063 ****************************************************************************/
1064
1065 static connection_struct *switch_message(uint8_t type, struct smb_request *req)
1066 {
1067 const struct loadparm_substitution *lp_sub =
1068 loadparm_s3_global_substitution();
1069 int flags;
1070 uint64_t session_tag;
1071 connection_struct *conn = NULL;
1072 struct smbXsrv_connection *xconn = req->xconn;
1073 NTTIME now = timeval_to_nttime(&req->request_time);
1074 struct smbXsrv_session *session = NULL;
1075 NTSTATUS status;
1076
1077 errno = 0;
1078
1079 if (!xconn->smb1.negprot.done) {
1080 switch (type) {
1081 /*
1082 * Without a negprot the request must
1083 * either be a negprot, or one of the
1084 * evil old SMB mailslot messaging types.
1085 */
1086 case SMBnegprot:
1087 case SMBsendstrt:
1088 case SMBsendend:
1089 case SMBsendtxt:
1090 break;
1091 default:
1092 exit_server_cleanly("The first request "
1093 "should be a negprot");
1094 }
1095 }
1096
1097 if (smb_messages[type].fn == NULL) {
1098 DEBUG(0,("Unknown message type %d!\n",type));
1099 smb_dump("Unknown", 1, (const char *)req->inbuf);
1100 reply_unknown_new(req, type);
1101 return NULL;
1102 }
1103
1104 flags = smb_messages[type].flags;
1105
1106 /* In share mode security we must ignore the vuid. */
1107 session_tag = req->vuid;
1108 conn = req->conn;
1109
1110 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1111 (int)getpid(), (unsigned long)conn));
1112
1113 smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1114
1115 /* Ensure this value is replaced in the incoming packet. */
1116 SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1117
1118 /*
1119 * Ensure the correct username is in current_user_info. This is a
1120 * really ugly bugfix for problems with multiple session_setup_and_X's
1121 * being done and allowing %U and %G substitutions to work correctly.
1122 * There is a reason this code is done here, don't move it unless you
1123 * know what you're doing... :-).
1124 * JRA.
1125 */
1126
1127 /*
1128 * lookup an existing session
1129 *
1130 * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1131 * here, the main check is still in change_to_user()
1132 */
1133 status = smb1srv_session_lookup(xconn,
1134 session_tag,
1135 now,
1136 &session);
1137 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1138 switch (type) {
1139 case SMBsesssetupX:
1140 status = NT_STATUS_OK;
1141 break;
1142 default:
1143 DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1144 (unsigned long long)session_tag,
1145 (unsigned long long)req->mid));
1146 reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1147 return conn;
1148 }
1149 }
1150
1151 if (session != NULL &&
1152 session->global->auth_session_info != NULL &&
1153 !(flags & AS_USER))
1154 {
1155 /*
1156 * change_to_user() implies set_current_user_info()
1157 * and chdir_connect_service().
1158 *
1159 * So we only call set_current_user_info if
1160 * we don't have AS_USER specified.
1161 */
1162 set_current_user_info(
1163 session->global->auth_session_info->unix_info->sanitized_username,
1164 session->global->auth_session_info->unix_info->unix_name,
1165 session->global->auth_session_info->info->domain_name);
1166 }
1167
1168 /* Does this call need to be run as the connected user? */
1169 if (flags & AS_USER) {
1170
1171 /* Does this call need a valid tree connection? */
1172 if (!conn) {
1173 /*
1174 * Amazingly, the error code depends on the command
1175 * (from Samba4).
1176 */
1177 if (type == SMBntcreateX) {
1178 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1179 } else {
1180 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1181 }
1182 return NULL;
1183 }
1184
1185 set_current_case_sensitive(conn, SVAL(req->inbuf,smb_flg));
1186
1187 /*
1188 * change_to_user() implies set_current_user_info()
1189 * and chdir_connect_service().
1190 */
1191 if (!change_to_user_and_service(conn,session_tag)) {
1192 DEBUG(0, ("Error: Could not change to user. Removing "
1193 "deferred open, mid=%llu.\n",
1194 (unsigned long long)req->mid));
1195 reply_force_doserror(req, ERRSRV, ERRbaduid);
1196 return conn;
1197 }
1198
1199 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1200
1201 /* Does it need write permission? */
1202 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1203 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1204 return conn;
1205 }
1206
1207 /* IPC services are limited */
1208 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1209 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1210 return conn;
1211 }
1212 } else if (flags & AS_GUEST) {
1213 /*
1214 * Does this protocol need to be run as guest? (Only archane
1215 * messenger service requests have this...)
1216 */
1217 if (!change_to_guest()) {
1218 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1219 return conn;
1220 }
1221 } else {
1222 /* This call needs to be run as root */
1223 change_to_root_user();
1224 }
1225
1226 /* load service specific parameters */
1227 if (conn) {
1228 if (req->encrypted) {
1229 conn->encrypted_tid = true;
1230 /* encrypted required from now on. */
1231 conn->encrypt_level = SMB_SIGNING_REQUIRED;
1232 } else if (ENCRYPTION_REQUIRED(conn)) {
1233 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1234 DEBUG(1,("service[%s] requires encryption"
1235 "%s ACCESS_DENIED. mid=%llu\n",
1236 lp_servicename(talloc_tos(), lp_sub, SNUM(conn)),
1237 smb_fn_name(type),
1238 (unsigned long long)req->mid));
1239 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1240 return conn;
1241 }
1242 }
1243
1244 if (flags & DO_CHDIR) {
1245 bool ok;
1246
1247 ok = chdir_current_service(conn);
1248 if (!ok) {
1249 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1250 return conn;
1251 }
1252 }
1253 conn->num_smb_operations++;
1254 }
1255
1256 /*
1257 * Update encryption and signing state tracking flags that are
1258 * used by smbstatus to display signing and encryption status.
1259 */
1260 if (session != NULL) {
1261 bool update_session_global = false;
1262 bool update_tcon_global = false;
1263
1264 req->session = session;
1265
1266 smb1srv_update_crypto_flags(session, req, type,
1267 &update_session_global,
1268 &update_tcon_global);
1269
1270 if (update_session_global) {
1271 status = smbXsrv_session_update(session);
1272 if (!NT_STATUS_IS_OK(status)) {
1273 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1274 return conn;
1275 }
1276 }
1277
1278 if (update_tcon_global) {
1279 status = smbXsrv_tcon_update(req->conn->tcon);
1280 if (!NT_STATUS_IS_OK(status)) {
1281 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1282 return conn;
1283 }
1284 }
1285 }
1286
1287 smb_messages[type].fn(req);
1288 return req->conn;
1289 }
1290
1291 /****************************************************************************
1292 Construct a reply to the incoming packet.
1293 ****************************************************************************/
1294
1295 void construct_reply(struct smbXsrv_connection *xconn,
1296 char *inbuf,
1297 int size,
1298 size_t unread_bytes,
1299 uint32_t seqnum,
1300 bool encrypted)
1301 {
1302 struct smbd_server_connection *sconn = xconn->client->sconn;
1303 struct smb_request *req;
1304
1305 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1306 smb_panic("could not allocate smb_request");
1307 }
1308
1309 if (!init_smb1_request(req, sconn, xconn, (uint8_t *)inbuf, unread_bytes,
1310 encrypted, seqnum)) {
1311 exit_server_cleanly("Invalid SMB request");
1312 }
1313
1314 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1315
1316 req->conn = switch_message(req->cmd, req);
1317
1318 if (req->outbuf == NULL) {
1319 /*
1320 * Request has suspended itself, will come
1321 * back here.
1322 */
1323 return;
1324 }
1325 if (CVAL(req->outbuf,0) == 0) {
1326 show_msg((char *)req->outbuf);
1327 }
1328 smb_request_done(req);
1329 }
1330
1331 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1332 char *inbuf,
1333 int size,
1334 uint32_t seqnum,
1335 bool encrypted)
1336 {
1337 struct smb_request **reqs = NULL;
1338 struct smb_request *req;
1339 unsigned num_reqs;
1340 bool ok;
1341
1342 ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted,
1343 seqnum, &reqs, &num_reqs);
1344 if (!ok) {
1345 char errbuf[smb_size];
1346 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1347 __LINE__, __FILE__);
1348 if (!smb1_srv_send(xconn, errbuf, true, seqnum, encrypted)) {
1349 exit_server_cleanly("construct_reply_chain: "
1350 "smb1_srv_send failed.");
1351 }
1352 return;
1353 }
1354
1355 req = reqs[0];
1356 req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1357
1358 req->conn = switch_message(req->cmd, req);
1359
1360 if (req->outbuf == NULL) {
1361 /*
1362 * Request has suspended itself, will come
1363 * back here.
1364 */
1365 return;
1366 }
1367 smb_request_done(req);
1368 }
1369
1370 /*
1371 * To be called from an async SMB handler that is potentially chained
1372 * when it is finished for shipping.
1373 */
1374
1375 void smb_request_done(struct smb_request *req)
1376 {
1377 struct smb_request **reqs = NULL;
1378 struct smb_request *first_req;
1379 size_t i, num_reqs, next_index;
1380 NTSTATUS status;
1381
1382 if (req->chain == NULL) {
1383 first_req = req;
1384 goto shipit;
1385 }
1386
1387 reqs = req->chain;
1388 num_reqs = talloc_array_length(reqs);
1389
1390 for (i=0; i<num_reqs; i++) {
1391 if (reqs[i] == req) {
1392 break;
1393 }
1394 }
1395 if (i == num_reqs) {
1396 /*
1397 * Invalid chain, should not happen
1398 */
1399 status = NT_STATUS_INTERNAL_ERROR;
1400 goto error;
1401 }
1402 next_index = i+1;
1403
1404 while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1405 struct smb_request *next = reqs[next_index];
1406 struct smbXsrv_tcon *tcon;
1407 NTTIME now = timeval_to_nttime(&req->request_time);
1408
1409 next->vuid = SVAL(req->outbuf, smb_uid);
1410 next->tid = SVAL(req->outbuf, smb_tid);
1411 status = smb1srv_tcon_lookup(req->xconn, next->tid,
1412 now, &tcon);
1413
1414 if (NT_STATUS_IS_OK(status)) {
1415 next->conn = tcon->compat;
1416 } else {
1417 next->conn = NULL;
1418 }
1419 next->chain_fsp = req->chain_fsp;
1420 next->inbuf = req->inbuf;
1421
1422 req = next;
1423 req->conn = switch_message(req->cmd, req);
1424
1425 if (req->outbuf == NULL) {
1426 /*
1427 * Request has suspended itself, will come
1428 * back here.
1429 */
1430 return;
1431 }
1432 next_index += 1;
1433 }
1434
1435 first_req = reqs[0];
1436
1437 for (i=1; i<next_index; i++) {
1438 bool ok;
1439
1440 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1441 if (!ok) {
1442 status = NT_STATUS_INTERNAL_ERROR;
1443 goto error;
1444 }
1445 }
1446
1447 SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1448 SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1449
1450 /*
1451 * This scary statement intends to set the
1452 * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1453 * to the value last_req->outbuf carries
1454 */
1455 SSVAL(first_req->outbuf, smb_flg2,
1456 (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1457 |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1458
1459 /*
1460 * Transfer the error codes from the subrequest to the main one
1461 */
1462 SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1463 SSVAL(first_req->outbuf, smb_err, SVAL(req->outbuf, smb_err));
1464
1465 _smb_setlen_large(
1466 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1467
1468 shipit:
1469 if (!smb1_srv_send(first_req->xconn,
1470 (char *)first_req->outbuf,
1471 true,
1472 first_req->seqnum + 1,
1473 IS_CONN_ENCRYPTED(req->conn) ||
1474 first_req->encrypted)) {
1475 exit_server_cleanly("construct_reply_chain: smb1_srv_send "
1476 "failed.");
1477 }
1478 TALLOC_FREE(req); /* non-chained case */
1479 TALLOC_FREE(reqs); /* chained case */
1480 return;
1481
1482 error:
1483 {
1484 char errbuf[smb_size];
1485 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1486 if (!smb1_srv_send(req->xconn,
1487 errbuf,
1488 true,
1489 req->seqnum + 1,
1490 req->encrypted)) {
1491 exit_server_cleanly("construct_reply_chain: "
1492 "smb1_srv_send failed.");
1493 }
1494 }
1495 TALLOC_FREE(req); /* non-chained case */
1496 TALLOC_FREE(reqs); /* chained case */
1497 }
1498
1499 /****************************************************************************
1500 Process an smb from the client
1501 ****************************************************************************/
1502
1503 void process_smb1(struct smbXsrv_connection *xconn,
1504 uint8_t *inbuf,
1505 size_t nread,
1506 size_t unread_bytes,
1507 uint32_t seqnum,
1508 bool encrypted)
1509 {
1510 struct smbd_server_connection *sconn = xconn->client->sconn;
1511
1512 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1513 * so subtract 4 from it. */
1514 if ((nread < (smb_size - 4)) || !valid_smb1_header(inbuf)) {
1515 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1516 smb_len(inbuf)));
1517
1518 /* special magic for immediate exit */
1519 if ((nread == 9) &&
1520 (IVAL(inbuf, 4) == SMB_SUICIDE_PACKET) &&
1521 lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1522 uint8_t exitcode = CVAL(inbuf, 8);
1523 DBG_WARNING("SUICIDE: Exiting immediately with code %d\n",
1524 (int)exitcode);
1525 exit(exitcode);
1526 }
1527
1528 exit_server_cleanly("Non-SMB packet");
1529 }
1530
1531 show_msg((char *)inbuf);
1532
1533 if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1534 construct_reply_chain(xconn,
1535 (char *)inbuf,
1536 nread,
1537 seqnum,
1538 encrypted);
1539 } else {
1540 construct_reply(xconn,
1541 (char *)inbuf,
1542 nread,
1543 unread_bytes,
1544 seqnum,
1545 encrypted);
1546 }
1547
1548 sconn->trans_num++;
1549 }
1550
1551 /****************************************************************************
1552 Return a string containing the function name of a SMB command.
1553 ****************************************************************************/
1554
1555 const char *smb_fn_name(int type)
1556 {
1557 const char *unknown_name = "SMBunknown";
1558
1559 if (smb_messages[type].name == NULL)
1560 return(unknown_name);
1561
1562 return(smb_messages[type].name);
1563 }
1564
1565 /****************************************************************************
1566 Helper functions for contruct_reply.
1567 ****************************************************************************/
1568
1569 void add_to_common_flags2(uint32_t v)
1570 {
1571 common_flags2 |= v;
1572 }
1573
1574 void remove_from_common_flags2(uint32_t v)
1575 {
1576 common_flags2 &= ~v;
1577 }
1578
1579 /**
1580 * @brief Find the smb_cmd offset of the last command pushed
1581 * @param[in] buf The buffer we're building up
1582 * @retval Where can we put our next andx cmd?
1583 *
1584 * While chaining requests, the "next" request we're looking at needs to put
1585 * its SMB_Command before the data the previous request already built up added
1586 * to the chain. Find the offset to the place where we have to put our cmd.
1587 */
1588
1589 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1590 {
1591 uint8_t cmd;
1592 size_t ofs;
1593
1594 cmd = CVAL(buf, smb_com);
1595
1596 if (!smb1cli_is_andx_req(cmd)) {
1597 return false;
1598 }
1599
1600 ofs = smb_vwv0;
1601
1602 while (CVAL(buf, ofs) != 0xff) {
1603
1604 if (!smb1cli_is_andx_req(CVAL(buf, ofs))) {
1605 return false;
1606 }
1607
1608 /*
1609 * ofs is from start of smb header, so add the 4 length
1610 * bytes. The next cmd is right after the wct field.
1611 */
1612 ofs = SVAL(buf, ofs+2) + 4 + 1;
1613
1614 if (ofs+4 >= talloc_get_size(buf)) {
1615 return false;
1616 }
1617 }
1618
1619 *pofs = ofs;
1620 return true;
1621 }
1622
1623 /**
1624 * @brief Do the smb chaining at a buffer level
1625 * @param[in] poutbuf Pointer to the talloc'ed buffer to be modified
1626 * @param[in] andx_buf Buffer to be appended
1627 */
1628
1629 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1630 {
1631 uint8_t smb_command = CVAL(andx_buf, smb_com);
1632 uint8_t wct = CVAL(andx_buf, smb_wct);
1633 const uint16_t *vwv = (const uint16_t *)(andx_buf + smb_vwv);
1634 uint32_t num_bytes = smb_buflen(andx_buf);
1635 const uint8_t *bytes = (const uint8_t *)smb_buf_const(andx_buf);
1636
1637 uint8_t *outbuf;
1638 size_t old_size, new_size;
1639 size_t ofs;
1640 size_t chain_padding = 0;
1641 size_t andx_cmd_ofs;
1642
1643
1644 old_size = talloc_get_size(*poutbuf);
1645
1646 if ((old_size % 4) != 0) {
1647 /*
1648 * Align the wct field of subsequent requests to a 4-byte
1649 * boundary
1650 */
1651 chain_padding = 4 - (old_size % 4);
1652 }
1653
1654 /*
1655 * After the old request comes the new wct field (1 byte), the vwv's
1656 * and the num_bytes field.
1657 */
1658
1659 new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1660 new_size += num_bytes;
1661
1662 if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1663 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
1664 (unsigned)new_size));
1665 return false;
1666 }
1667
1668 outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1669 if (outbuf == NULL) {
1670 DEBUG(0, ("talloc failed\n"));
1671 return false;
1672 }
1673 *poutbuf = outbuf;
1674
1675 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1676 DEBUG(1, ("invalid command chain\n"));
1677 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
1678 return false;
1679 }
1680
1681 if (chain_padding != 0) {
1682 memset(outbuf + old_size, 0, chain_padding);
1683 old_size += chain_padding;
1684 }
1685
1686 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1687 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1688
1689 ofs = old_size;
1690
1691 /*
1692 * Push the chained request:
1693 *
1694 * wct field
1695 */
1696
1697 SCVAL(outbuf, ofs, wct);
1698 ofs += 1;
1699
1700 /*
1701 * vwv array
1702 */
1703
1704 memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1705
1706 /*
1707 * HACK ALERT
1708 *
1709 * Read&X has an offset into its data buffer at
1710 * vwv[6]. reply_read_andx has no idea anymore that it's
1711 * running from within a chain, so we have to fix up the
1712 * offset here.
1713 *
1714 * Although it looks disgusting at this place, I want to keep
1715 * it here. The alternative would be to push knowledge about
1716 * the andx chain down into read&x again.
1717 */
1718
1719 if (smb_command == SMBreadX) {
1720 uint8_t *bytes_addr;
1721
1722 if (wct < 7) {
1723 /*
1724 * Invalid read&x response
1725 */
1726 return false;
1727 }
1728
1729 bytes_addr = outbuf + ofs /* vwv start */
1730 + sizeof(uint16_t) * wct /* vwv array */
1731 + sizeof(uint16_t) /* bcc */
1732 + 1; /* padding byte */
1733
1734 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
1735 bytes_addr - outbuf - 4);
1736 }
1737
1738 ofs += sizeof(uint16_t) * wct;
1739
1740 /*
1741 * bcc (byte count)
1742 */
1743
1744 SSVAL(outbuf, ofs, num_bytes);
1745 ofs += sizeof(uint16_t);
1746
1747 /*
1748 * The bytes field
1749 */
1750
1751 memcpy(outbuf + ofs, bytes, num_bytes);
1752
1753 return true;
1754 }
1755
1756 bool smb1_is_chain(const uint8_t *buf)
1757 {
1758 uint8_t cmd, wct, andx_cmd;
1759
1760 cmd = CVAL(buf, smb_com);
1761 if (!smb1cli_is_andx_req(cmd)) {
1762 return false;
1763 }
1764 wct = CVAL(buf, smb_wct);
1765 if (wct < 2) {
1766 return false;
1767 }
1768 andx_cmd = CVAL(buf, smb_vwv);
1769 return (andx_cmd != 0xFF);
1770 }
1771
1772 bool smb1_walk_chain(const uint8_t *buf,
1773 bool (*fn)(uint8_t cmd,
1774 uint8_t wct, const uint16_t *vwv,
1775 uint16_t num_bytes, const uint8_t *bytes,
1776 void *private_data),
1777 void *private_data)
1778 {
1779 size_t smblen = smb_len(buf);
1780 const char *smb_buf = smb_base(buf);
1781 uint8_t cmd, chain_cmd;
1782 uint8_t wct;
1783 const uint16_t *vwv;
1784 uint16_t num_bytes;
1785 const uint8_t *bytes;
1786
1787 cmd = CVAL(buf, smb_com);
1788 wct = CVAL(buf, smb_wct);
1789 vwv = (const uint16_t *)(buf + smb_vwv);
1790 num_bytes = smb_buflen(buf);
1791 bytes = (const uint8_t *)smb_buf_const(buf);
1792
1793 if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
1794 return false;
1795 }
1796
1797 if (!smb1cli_is_andx_req(cmd)) {
1798 return true;
1799 }
1800 if (wct < 2) {
1801 return false;
1802 }
1803
1804 chain_cmd = CVAL(vwv, 0);
1805
1806 while (chain_cmd != 0xff) {
1807 uint32_t chain_offset; /* uint32_t to avoid overflow */
1808 size_t length_needed;
1809 ptrdiff_t vwv_offset;
1810
1811 chain_offset = SVAL(vwv+1, 0);
1812
1813 /*
1814 * Check if the client tries to fool us. The chain
1815 * offset needs to point beyond the current request in
1816 * the chain, it needs to strictly grow. Otherwise we
1817 * might be tricked into an endless loop always
1818 * processing the same request over and over again. We
1819 * used to assume that vwv and the byte buffer array
1820 * in a chain are always attached, but OS/2 the
1821 * Write&X/Read&X chain puts the Read&X vwv array
1822 * right behind the Write&X vwv chain. The Write&X bcc
1823 * array is put behind the Read&X vwv array. So now we
1824 * check whether the chain offset points strictly
1825 * behind the previous vwv array. req->buf points
1826 * right after the vwv array of the previous
1827 * request. See
1828 * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
1829 * more information.
1830 */
1831
1832 vwv_offset = ((const char *)vwv - smb_buf);
1833 if (chain_offset <= vwv_offset) {
1834 return false;
1835 }
1836
1837 /*
1838 * Next check: Make sure the chain offset does not
1839 * point beyond the overall smb request length.
1840 */
1841
1842 length_needed = chain_offset+1; /* wct */
1843 if (length_needed > smblen) {
1844 return false;
1845 }
1846
1847 /*
1848 * Now comes the pointer magic. Goal here is to set up
1849 * vwv and buf correctly again. The chain offset (the
1850 * former vwv[1]) points at the new wct field.
1851 */
1852
1853 wct = CVAL(smb_buf, chain_offset);
1854
1855 if (smb1cli_is_andx_req(chain_cmd) && (wct < 2)) {
1856 return false;
1857 }
1858
1859 /*
1860 * Next consistency check: Make the new vwv array fits
1861 * in the overall smb request.
1862 */
1863
1864 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1865 if (length_needed > smblen) {
1866 return false;
1867 }
1868 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
1869
1870 /*
1871 * Now grab the new byte buffer....
1872 */
1873
1874 num_bytes = SVAL(vwv+wct, 0);
1875
1876 /*
1877 * .. and check that it fits.
1878 */
1879
1880 length_needed += num_bytes;
1881 if (length_needed > smblen) {
1882 return false;
1883 }
1884 bytes = (const uint8_t *)(vwv+wct+1);
1885
1886 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
1887 return false;
1888 }
1889
1890 if (!smb1cli_is_andx_req(chain_cmd)) {
1891 return true;
1892 }
1893 chain_cmd = CVAL(vwv, 0);
1894 }
1895 return true;
1896 }
1897
1898 static bool smb1_chain_length_cb(uint8_t cmd,
1899 uint8_t wct, const uint16_t *vwv,
1900 uint16_t num_bytes, const uint8_t *bytes,
1901 void *private_data)
1902 {
1903 unsigned *count = (unsigned *)private_data;
1904 *count += 1;
1905 return true;
1906 }
1907
1908 unsigned smb1_chain_length(const uint8_t *buf)
1909 {
1910 unsigned count = 0;
1911
1912 if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
1913 return 0;
1914 }
1915 return count;
1916 }
1917
1918 struct smb1_parse_chain_state {
1919 TALLOC_CTX *mem_ctx;
1920 const uint8_t *buf;
1921 struct smbd_server_connection *sconn;
1922 struct smbXsrv_connection *xconn;
1923 bool encrypted;
1924 uint32_t seqnum;
1925
1926 struct smb_request **reqs;
1927 unsigned num_reqs;
1928 };
1929
1930 static bool smb1_parse_chain_cb(uint8_t cmd,
1931 uint8_t wct, const uint16_t *vwv,
1932 uint16_t num_bytes, const uint8_t *bytes,
1933 void *private_data)
1934 {
1935 struct smb1_parse_chain_state *state =
1936 (struct smb1_parse_chain_state *)private_data;
1937 struct smb_request **reqs;
1938 struct smb_request *req;
1939 bool ok;
1940
1941 reqs = talloc_realloc(state->mem_ctx, state->reqs,
1942 struct smb_request *, state->num_reqs+1);
1943 if (reqs == NULL) {
1944 return false;
1945 }
1946 state->reqs = reqs;
1947
1948 req = talloc(reqs, struct smb_request);
1949 if (req == NULL) {
1950 return false;
1951 }
1952
1953 ok = init_smb1_request(req, state->sconn, state->xconn, state->buf, 0,
1954 state->encrypted, state->seqnum);
1955 if (!ok) {
1956 return false;
1957 }
1958 req->cmd = cmd;
1959 req->wct = wct;
1960 req->vwv = vwv;
1961 req->buflen = num_bytes;
1962 req->buf = bytes;
1963
1964 reqs[state->num_reqs] = req;
1965 state->num_reqs += 1;
1966 return true;
1967 }
1968
1969 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
1970 struct smbXsrv_connection *xconn,
1971 bool encrypted, uint32_t seqnum,
1972 struct smb_request ***reqs, unsigned *num_reqs)
1973 {
1974 struct smbd_server_connection *sconn = NULL;
1975 struct smb1_parse_chain_state state;
1976 unsigned i;
1977
1978 if (xconn != NULL) {
1979 sconn = xconn->client->sconn;
1980 }
1981
1982 state.mem_ctx = mem_ctx;
1983 state.buf = buf;
1984 state.sconn = sconn;
1985 state.xconn = xconn;
1986 state.encrypted = encrypted;
1987 state.seqnum = seqnum;
1988 state.reqs = NULL;
1989 state.num_reqs = 0;
1990
1991 if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
1992 TALLOC_FREE(state.reqs);
1993 return false;
1994 }
1995 for (i=0; i<state.num_reqs; i++) {
1996 state.reqs[i]->chain = state.reqs;
1997 }
1998 *reqs = state.reqs;
1999 *num_reqs = state.num_reqs;
2000 return true;
2001 }
2002
2003 static bool fd_is_readable(int fd)
2004 {
2005 int ret, revents;
2006
2007 ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2008
2009 return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2010
2011 }
2012
2013 static void smbd_server_connection_write_handler(
2014 struct smbXsrv_connection *xconn)
2015 {
2016 /* TODO: make write nonblocking */
2017 }
2018
2019 void smbd_smb1_server_connection_read_handler(struct smbXsrv_connection *xconn,
2020 int fd)
2021 {
2022 uint8_t *inbuf = NULL;
2023 size_t inbuf_len = 0;
2024 size_t unread_bytes = 0;
2025 bool encrypted = false;
2026 TALLOC_CTX *mem_ctx = talloc_tos();
2027 NTSTATUS status;
2028 uint32_t seqnum;
2029
2030 bool async_echo = lp_async_smb_echo_handler();
2031 bool from_client = false;
2032
2033 if (async_echo) {
2034 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2035 /*
2036 * This is the super-ugly hack to prefer the packets
2037 * forwarded by the echo handler over the ones by the
2038 * client directly
2039 */
2040 fd = xconn->smb1.echo_handler.trusted_fd;
2041 }
2042 }
2043
2044 from_client = (xconn->transport.sock == fd);
2045
2046 if (async_echo && from_client) {
2047 smbd_lock_socket(xconn);
2048
2049 if (!fd_is_readable(fd)) {
2050 DEBUG(10,("the echo listener was faster\n"));
2051 smbd_unlock_socket(xconn);
2052 return;
2053 }
2054 }
2055
2056 /* TODO: make this completely nonblocking */
2057 status = receive_smb_talloc(mem_ctx, xconn, fd,
2058 (char **)(void *)&inbuf,
2059 0, /* timeout */
2060 &unread_bytes,
2061 &encrypted,
2062 &inbuf_len, &seqnum,
2063 !from_client /* trusted channel */);
2064
2065 if (async_echo && from_client) {
2066 smbd_unlock_socket(xconn);
2067 }
2068
2069 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2070 goto process;
2071 }
2072 if (NT_STATUS_IS_ERR(status)) {
2073 exit_server_cleanly("failed to receive smb request");
2074 }
2075 if (!NT_STATUS_IS_OK(status)) {
2076 return;
2077 }
2078
2079 process:
2080 process_smb(xconn, inbuf, inbuf_len, unread_bytes, seqnum, encrypted);
2081 }
2082
2083 static void smbd_server_echo_handler(struct tevent_context *ev,
2084 struct tevent_fd *fde,
2085 uint16_t flags,
2086 void *private_data)
2087 {
2088 struct smbXsrv_connection *xconn =
2089 talloc_get_type_abort(private_data,
2090 struct smbXsrv_connection);
2091
2092 if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2093 /*
2094 * we're not supposed to do any io
2095 */
2096 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2097 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2098 return;
2099 }
2100
2101 if (flags & TEVENT_FD_WRITE) {
2102 smbd_server_connection_write_handler(xconn);
2103 return;
2104 }
2105 if (flags & TEVENT_FD_READ) {
2106 smbd_smb1_server_connection_read_handler(
2107 xconn, xconn->smb1.echo_handler.trusted_fd);
2108 return;
2109 }
2110 }
2111
2112 /*
2113 * Send keepalive packets to our client
2114 */
2115 bool keepalive_fn(const struct timeval *now, void *private_data)
2116 {
2117 struct smbd_server_connection *sconn = talloc_get_type_abort(
2118 private_data, struct smbd_server_connection);
2119 struct smbXsrv_connection *xconn = NULL;
2120 bool ret;
2121
2122 if (conn_using_smb2(sconn)) {
2123 /* Don't do keepalives on an SMB2 connection. */
2124 return false;
2125 }
2126
2127 /*
2128 * With SMB1 we only have 1 connection
2129 */
2130 xconn = sconn->client->connections;
2131 smbd_lock_socket(xconn);
2132 ret = send_keepalive(xconn->transport.sock);
2133 smbd_unlock_socket(xconn);
2134
2135 if (!ret) {
2136 int saved_errno = errno;
2137 /*
2138 * Try and give an error message saying what
2139 * client failed.
2140 */
2141 DEBUG(0, ("send_keepalive failed for client %s. "
2142 "Error %s - exiting\n",
2143 smbXsrv_connection_dbg(xconn),
2144 strerror(saved_errno)));
2145 errno = saved_errno;
2146 return False;
2147 }
2148 return True;
2149 }
2150
2151 /*
2152 * Read an smb packet in the echo handler child, giving the parent
2153 * smbd one second to react once the socket becomes readable.
2154 */
2155
2156 struct smbd_echo_read_state {
2157 struct tevent_context *ev;
2158 struct smbXsrv_connection *xconn;
2159
2160 char *buf;
2161 size_t buflen;
2162 uint32_t seqnum;
2163 };
2164
2165 static void smbd_echo_read_readable(struct tevent_req *subreq);
2166 static void smbd_echo_read_waited(struct tevent_req *subreq);
2167
2168 static struct tevent_req *smbd_echo_read_send(
2169 TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2170 struct smbXsrv_connection *xconn)
2171 {
2172 struct tevent_req *req, *subreq;
2173 struct smbd_echo_read_state *state;
2174
2175 req = tevent_req_create(mem_ctx, &state,
2176 struct smbd_echo_read_state);
2177 if (req == NULL) {
2178 return NULL;
2179 }
2180 state->ev = ev;
2181 state->xconn = xconn;
2182
2183 subreq = wait_for_read_send(state, ev, xconn->transport.sock, false);
2184 if (tevent_req_nomem(subreq, req)) {
2185 return tevent_req_post(req, ev);
2186 }
2187 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2188 return req;
2189 }
2190
2191 static void smbd_echo_read_readable(struct tevent_req *subreq)
2192 {
2193 struct tevent_req *req = tevent_req_callback_data(
2194 subreq, struct tevent_req);
2195 struct smbd_echo_read_state *state = tevent_req_data(
2196 req, struct smbd_echo_read_state);
2197 bool ok;
2198 int err;
2199
2200 ok = wait_for_read_recv(subreq, &err);
2201 TALLOC_FREE(subreq);
2202 if (!ok) {
2203 tevent_req_nterror(req, map_nt_error_from_unix(err));
2204 return;
2205 }
2206
2207 /*
2208 * Give the parent smbd one second to step in
2209 */
2210
2211 subreq = tevent_wakeup_send(
2212 state, state->ev, timeval_current_ofs(1, 0));
2213 if (tevent_req_nomem(subreq, req)) {
2214 return;
2215 }
2216 tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2217 }
2218
2219 static void smbd_echo_read_waited(struct tevent_req *subreq)
2220 {
2221 struct tevent_req *req = tevent_req_callback_data(
2222 subreq, struct tevent_req);
2223 struct smbd_echo_read_state *state = tevent_req_data(
2224 req, struct smbd_echo_read_state);
2225 struct smbXsrv_connection *xconn = state->xconn;
2226 bool ok;
2227 NTSTATUS status;
2228 size_t unread = 0;
2229 bool encrypted;
2230
2231 ok = tevent_wakeup_recv(subreq);
2232 TALLOC_FREE(subreq);
2233 if (!ok) {
2234 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2235 return;
2236 }
2237
2238 ok = smbd_lock_socket_internal(xconn);
2239 if (!ok) {
2240 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2241 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2242 return;
2243 }
2244
2245 if (!fd_is_readable(xconn->transport.sock)) {
2246 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2247 (int)getpid()));
2248
2249 ok = smbd_unlock_socket_internal(xconn);
2250 if (!ok) {
2251 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2252 DEBUG(1, ("%s: failed to unlock socket\n",
2253 __location__));
2254 return;
2255 }
2256
2257 subreq = wait_for_read_send(state, state->ev,
2258 xconn->transport.sock, false);
2259 if (tevent_req_nomem(subreq, req)) {
2260 return;
2261 }
2262 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2263 return;
2264 }
2265
2266 status = receive_smb_talloc(state, xconn,
2267 xconn->transport.sock,
2268 &state->buf,
2269 0 /* timeout */,
2270 &unread,
2271 &encrypted,
2272 &state->buflen,
2273 &state->seqnum,
2274 false /* trusted_channel*/);
2275
2276 if (tevent_req_nterror(req, status)) {
2277 tevent_req_nterror(req, status);
2278 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2279 (int)getpid(), nt_errstr(status)));
2280 return;
2281 }
2282
2283 ok = smbd_unlock_socket_internal(xconn);
2284 if (!ok) {
2285 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2286 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2287 return;
2288 }
2289 tevent_req_done(req);
2290 }
2291
2292 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2293 char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2294 {
2295 struct smbd_echo_read_state *state = tevent_req_data(
2296 req, struct smbd_echo_read_state);
2297 NTSTATUS status;
2298
2299 if (tevent_req_is_nterror(req, &status)) {
2300 return status;
2301 }
2302 *pbuf = talloc_move(mem_ctx, &state->buf);
2303 *pbuflen = state->buflen;
2304 *pseqnum = state->seqnum;
2305 return NT_STATUS_OK;
2306 }
2307
2308 struct smbd_echo_state {
2309 struct tevent_context *ev;
2310 struct iovec *pending;
2311 struct smbd_server_connection *sconn;
2312 struct smbXsrv_connection *xconn;
2313 int parent_pipe;
2314
2315 struct tevent_fd *parent_fde;
2316
2317 struct tevent_req *write_req;
2318 };
2319
2320 static void smbd_echo_writer_done(struct tevent_req *req);
2321
2322 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2323 {
2324 int num_pending;
2325
2326 if (state->write_req != NULL) {
2327 return;
2328 }
2329
2330 num_pending = talloc_array_length(state->pending);
2331 if (num_pending == 0) {
2332 return;
2333 }
2334
2335 state->write_req = writev_send(state, state->ev, NULL,
2336 state->parent_pipe, false,
2337 state->pending, num_pending);
2338 if (state->write_req == NULL) {
2339 DEBUG(1, ("writev_send failed\n"));
2340 exit(1);
2341 }
2342
2343 talloc_steal(state->write_req, state->pending);
2344 state->pending = NULL;
2345
2346 tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2347 state);
2348 }
2349
2350 static void smbd_echo_writer_done(struct tevent_req *req)
2351 {
2352 struct smbd_echo_state *state = tevent_req_callback_data(
2353 req, struct smbd_echo_state);
2354 ssize_t written;
2355 int err;
2356
2357 written = writev_recv(req, &err);
2358 TALLOC_FREE(req);
2359 state->write_req = NULL;
2360 if (written == -1) {
2361 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2362 exit(1);
2363 }
2364 DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2365 smbd_echo_activate_writer(state);
2366 }
2367
2368 static bool smbd_echo_reply(struct smbd_echo_state *state,
2369 uint8_t *inbuf, size_t inbuf_len,
2370 uint32_t seqnum)
2371 {
2372 struct smb_request req;
2373 uint16_t num_replies;
2374 char *outbuf;
2375 bool ok;
2376
2377 if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2378 DEBUG(10, ("Got netbios keepalive\n"));
2379 /*
2380 * Just swallow it
2381 */
2382 return true;
2383 }
2384
2385 if (inbuf_len < smb_size) {
2386 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2387 return false;
2388 }
2389 if (!valid_smb1_header(inbuf)) {
2390 DEBUG(10, ("Got invalid SMB header\n"));
2391 return false;
2392 }
2393
2394 if (!init_smb1_request(&req, state->sconn, state->xconn, inbuf, 0, false,
2395 seqnum)) {
2396 return false;
2397 }
2398 req.inbuf = inbuf;
2399
2400 DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2401 smb_fn_name(req.cmd)));
2402
2403 if (req.cmd != SMBecho) {
2404 return false;
2405 }
2406 if (req.wct < 1) {
2407 return false;
2408 }
2409
2410 num_replies = SVAL(req.vwv+0, 0);
2411 if (num_replies != 1) {
2412 /* Not a Windows "Hey, you're still there?" request */
2413 return false;
2414 }
2415
2416 if (!create_smb1_outbuf(talloc_tos(), &req, req.inbuf, &outbuf,
2417 1, req.buflen)) {
2418 DEBUG(10, ("create_smb1_outbuf failed\n"));
2419 return false;
2420 }
2421 req.outbuf = (uint8_t *)outbuf;
2422
2423 SSVAL(req.outbuf, smb_vwv0, num_replies);
2424
2425 if (req.buflen > 0) {
2426 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2427 }
2428
2429 ok = smb1_srv_send(req.xconn, (char *)outbuf, true, seqnum + 1, false);
2430 TALLOC_FREE(outbuf);
2431 if (!ok) {
2432 exit(1);
2433 }
2434
2435 return true;
2436 }
2437
2438 static void smbd_echo_exit(struct tevent_context *ev,
2439 struct tevent_fd *fde, uint16_t flags,
2440 void *private_data)
2441 {
2442 DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2443 exit(0);
2444 }
2445
2446 static void smbd_echo_got_packet(struct tevent_req *req);
2447
2448 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
2449 int parent_pipe)
2450 {
2451 struct smbd_echo_state *state;
2452 struct tevent_req *read_req;
2453
2454 state = talloc_zero(xconn, struct smbd_echo_state);
2455 if (state == NULL) {
2456 DEBUG(1, ("talloc failed\n"));
2457 return;
2458 }
2459 state->xconn = xconn;
2460 state->parent_pipe = parent_pipe;
2461 state->ev = samba_tevent_context_init(state);
2462 if (state->ev == NULL) {
2463 DEBUG(1, ("samba_tevent_context_init failed\n"));
2464 TALLOC_FREE(state);
2465 return;
2466 }
2467 state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2468 TEVENT_FD_READ, smbd_echo_exit,
2469 state);
2470 if (state->parent_fde == NULL) {
2471 DEBUG(1, ("tevent_add_fd failed\n"));
2472 TALLOC_FREE(state);
2473 return;
2474 }
2475
2476 read_req = smbd_echo_read_send(state, state->ev, xconn);
2477 if (read_req == NULL) {
2478 DEBUG(1, ("smbd_echo_read_send failed\n"));
2479 TALLOC_FREE(state);
2480 return;
2481 }
2482 tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2483
2484 while (true) {
2485 if (tevent_loop_once(state->ev) == -1) {
2486 DEBUG(1, ("tevent_loop_once failed: %s\n",
2487 strerror(errno)));
2488 break;
2489 }
2490 }
2491 TALLOC_FREE(state);
2492 }
2493
2494 static void smbd_echo_got_packet(struct tevent_req *req)
2495 {
2496 struct smbd_echo_state *state = tevent_req_callback_data(
2497 req, struct smbd_echo_state);
2498 NTSTATUS status;
2499 char *buf = NULL;
2500 size_t buflen = 0;
2501 uint32_t seqnum = 0;
2502 bool reply;
2503
2504 status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2505 TALLOC_FREE(req);
2506 if (!NT_STATUS_IS_OK(status)) {
2507 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2508 nt_errstr(status)));
2509 exit(1);
2510 }
2511
2512 reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2513 if (!reply) {
2514 size_t num_pending;
2515 struct iovec *tmp;
2516 struct iovec *iov;
2517
2518 num_pending = talloc_array_length(state->pending);
2519 tmp = talloc_realloc(state, state->pending, struct iovec,
2520 num_pending+1);
2521 if (tmp == NULL) {
2522 DEBUG(1, ("talloc_realloc failed\n"));
2523 exit(1);
2524 }
2525 state->pending = tmp;
2526
2527 if (buflen >= smb_size) {
2528 /*
2529 * place the seqnum in the packet so that the main process
2530 * can reply with signing
2531 */
2532 SIVAL(buf, smb_ss_field, seqnum);
2533 SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2534 }
2535
2536 iov = &state->pending[num_pending];
2537 iov->iov_base = talloc_move(state->pending, &buf);
2538 iov->iov_len = buflen;
2539
2540 DEBUG(10,("echo_handler[%d]: forward to main\n",
2541 (int)getpid()));
2542 smbd_echo_activate_writer(state);
2543 }
2544
2545 req = smbd_echo_read_send(state, state->ev, state->xconn);
2546 if (req == NULL) {
2547 DEBUG(1, ("smbd_echo_read_send failed\n"));
2548 exit(1);
2549 }
2550 tevent_req_set_callback(req, smbd_echo_got_packet, state);
2551 }
2552
2553
2554 /*
2555 * Handle SMBecho requests in a forked child process
2556 */
2557 bool fork_echo_handler(struct smbXsrv_connection *xconn)
2558 {
2559 int listener_pipe[2];
2560 int res;
2561 pid_t child;
2562 bool use_mutex = false;
2563
2564 res = pipe(listener_pipe);
2565 if (res == -1) {
2566 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2567 return false;
2568 }
2569
2570 #ifdef HAVE_ROBUST_MUTEXES
2571 use_mutex = tdb_runtime_check_for_robust_mutexes();
2572
2573 if (use_mutex) {
2574 pthread_mutexattr_t a;
2575
2576 xconn->smb1.echo_handler.socket_mutex =
2577 anonymous_shared_allocate(sizeof(pthread_mutex_t));
2578 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
2579 DEBUG(1, ("Could not create mutex shared memory: %s\n",
2580 strerror(errno)));
2581 goto fail;
2582 }
2583
2584 res = pthread_mutexattr_init(&a);
2585 if (res != 0) {
2586 DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
2587 strerror(res)));
2588 goto fail;
2589 }
2590 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
2591 if (res != 0) {
2592 DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
2593 strerror(res)));
2594 pthread_mutexattr_destroy(&a);
2595 goto fail;
2596 }
2597 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
2598 if (res != 0) {
2599 DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
2600 strerror(res)));
2601 pthread_mutexattr_destroy(&a);
2602 goto fail;
2603 }
2604 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
2605 if (res != 0) {
2606 DEBUG(1, ("pthread_mutexattr_setrobust failed: "
2607 "%s\n", strerror(res)));
2608 pthread_mutexattr_destroy(&a);
2609 goto fail;
2610 }
2611 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
2612 &a);
2613 pthread_mutexattr_destroy(&a);
2614 if (res != 0) {
2615 DEBUG(1, ("pthread_mutex_init failed: %s\n",
2616 strerror(res)));
2617 goto fail;
2618 }
2619 }
2620 #endif
2621
2622 if (!use_mutex) {
2623 xconn->smb1.echo_handler.socket_lock_fd =
2624 create_unlink_tmp(lp_lock_directory());
2625 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
2626 DEBUG(1, ("Could not create lock fd: %s\n",
2627 strerror(errno)));
2628 goto fail;
2629 }
2630 }
2631
2632 child = fork();
2633 if (child == 0) {
2634 NTSTATUS status;
2635
2636 close(listener_pipe[0]);
2637 set_blocking(listener_pipe[1], false);
2638
2639 status = smbd_reinit_after_fork(xconn->client->msg_ctx,
2640 xconn->client->raw_ev_ctx,
2641 true);
2642 if (!NT_STATUS_IS_OK(status)) {
2643 DEBUG(1, ("reinit_after_fork failed: %s\n",
2644 nt_errstr(status)));
2645 exit(1);
2646 }
2647 process_set_title("smbd-echo", "echo handler");
2648 initialize_password_db(true, xconn->client->raw_ev_ctx);
2649 smbd_echo_loop(xconn, listener_pipe[1]);
2650 exit(0);
2651 }
2652 close(listener_pipe[1]);
2653 listener_pipe[1] = -1;
2654 xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2655
2656 DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
2657
2658 /*
2659 * Without smb signing this is the same as the normal smbd
2660 * listener. This needs to change once signing comes in.
2661 */
2662 xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(
2663 xconn->client->raw_ev_ctx,
2664 xconn,
2665 xconn->smb1.echo_handler.trusted_fd,
2666 TEVENT_FD_READ,
2667 smbd_server_echo_handler,
2668 xconn);
2669 if (xconn->smb1.echo_handler.trusted_fde == NULL) {
2670 DEBUG(1, ("event_add_fd failed\n"));
2671 goto fail;
2672 }
2673
2674 return true;
2675
2676 fail:
2677 if (listener_pipe[0] != -1) {
2678 close(listener_pipe[0]);
2679 }
2680 if (listener_pipe[1] != -1) {
2681 close(listener_pipe[1]);
2682 }
2683 if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
2684 close(xconn->smb1.echo_handler.socket_lock_fd);
2685 }
2686 #ifdef HAVE_ROBUST_MUTEXES
2687 if (xconn->smb1.echo_handler.socket_mutex != NULL) {
2688 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
2689 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
2690 }
2691 #endif
2692 smbd_echo_init(xconn);
2693
2694 return false;
2695 }
2696
2697 bool req_is_in_chain(const struct smb_request *req)
2698 {
2699 if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
2700 /*
2701 * We're right now handling a subsequent request, so we must
2702 * be in a chain
2703 */
2704 return true;
2705 }
2706
2707 if (!smb1cli_is_andx_req(req->cmd)) {
2708 return false;
2709 }
2710
2711 if (req->wct < 2) {
2712 /*
2713 * Okay, an illegal request, but definitely not chained :-)
2714 */
2715 return false;
2716 }
2717
2718 return (CVAL(req->vwv+0, 0) != 0xFF);
2719 }
Samba git mirror