2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 extern int smb_echo_count;
26 * Size of data we can send to client. Set
27 * by the client for all protocols above CORE.
28 * Set by us for CORE protocol.
30 int max_send = BUFFER_SIZE;
32 * Size of the data we can receive. Set by us.
33 * Can be modified by the max xmit parameter.
35 int max_recv = BUFFER_SIZE;
37 SIG_ATOMIC_T reload_after_sighup = 0;
38 SIG_ATOMIC_T got_sig_term = 0;
39 extern bool global_machine_password_needs_changing;
42 /* Accessor function for smb_read_error for smbd functions. */
44 /****************************************************************************
46 ****************************************************************************/
48 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
53 char *buf_out = buffer;
55 /* Sign the outgoing packet if required. */
56 srv_calculate_sign_mac(buf_out);
59 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
60 if (!NT_STATUS_IS_OK(status)) {
61 DEBUG(0, ("send_smb: SMB encryption failed "
62 "on outgoing packet! Error %s\n",
68 len = smb_len(buf_out) + 4;
70 while (nwritten < len) {
71 ret = write_data(fd,buf_out+nwritten,len - nwritten);
73 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
74 (int)len,(int)ret, strerror(errno) ));
75 srv_free_enc_buffer(buf_out);
81 srv_free_enc_buffer(buf_out);
85 /*******************************************************************
86 Setup the word count and byte count for a smb message.
87 ********************************************************************/
89 int srv_set_message(char *buf,
94 if (zero && (num_words || num_bytes)) {
95 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
97 SCVAL(buf,smb_wct,num_words);
98 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
99 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
100 return (smb_size + num_words*2 + num_bytes);
103 static bool valid_smb_header(const uint8_t *inbuf)
105 if (is_encrypted_packet(inbuf)) {
108 return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
111 /* Socket functions for smbd packet processing. */
113 static bool valid_packet_size(size_t len)
116 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
117 * of header. Don't print the error if this fits.... JRA.
120 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
121 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
122 (unsigned long)len));
123 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
130 static NTSTATUS read_packet_remainder(int fd, char *buffer,
131 unsigned int timeout, ssize_t len)
137 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
140 /****************************************************************************
141 Attempt a zerocopy writeX read. We know here that len > smb_size-4
142 ****************************************************************************/
145 * Unfortunately, earlier versions of smbclient/libsmbclient
146 * don't send this "standard" writeX header. I've fixed this
147 * for 3.2 but we'll use the old method with earlier versions.
148 * Windows and CIFSFS at least use this standard size. Not
152 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
153 (2*14) + /* word count (including bcc) */ \
156 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
157 const char lenbuf[4],
158 int fd, char **buffer,
159 unsigned int timeout,
163 /* Size of a WRITEX call (+4 byte len). */
164 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
165 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
169 memcpy(writeX_header, lenbuf, sizeof(lenbuf));
171 status = read_socket_with_timeout(
172 fd, writeX_header + 4,
173 STANDARD_WRITE_AND_X_HEADER_SIZE,
174 STANDARD_WRITE_AND_X_HEADER_SIZE,
177 if (!NT_STATUS_IS_OK(status)) {
182 * Ok - now try and see if this is a possible
186 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
188 * If the data offset is beyond what
189 * we've read, drain the extra bytes.
191 uint16_t doff = SVAL(writeX_header,smb_vwv11);
194 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
195 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
196 if (drain_socket(smbd_server_fd(), drain) != drain) {
197 smb_panic("receive_smb_raw_talloc_partial_read:"
198 " failed to drain pending bytes");
201 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
204 /* Spoof down the length and null out the bcc. */
205 set_message_bcc(writeX_header, 0);
206 newlen = smb_len(writeX_header);
208 /* Copy the header we've written. */
210 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
212 sizeof(writeX_header));
214 if (*buffer == NULL) {
215 DEBUG(0, ("Could not allocate inbuf of length %d\n",
216 (int)sizeof(writeX_header)));
217 return NT_STATUS_NO_MEMORY;
220 /* Work out the remaining bytes. */
221 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
222 *len_ret = newlen + 4;
226 if (!valid_packet_size(len)) {
227 return NT_STATUS_INVALID_PARAMETER;
231 * Not a valid writeX call. Just do the standard
235 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
237 if (*buffer == NULL) {
238 DEBUG(0, ("Could not allocate inbuf of length %d\n",
240 return NT_STATUS_NO_MEMORY;
243 /* Copy in what we already read. */
246 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
247 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
250 status = read_packet_remainder(
251 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
254 if (!NT_STATUS_IS_OK(status)) {
263 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
264 char **buffer, unsigned int timeout,
265 size_t *p_unread, size_t *plen)
269 int min_recv_size = lp_min_receive_file_size();
274 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
275 if (!NT_STATUS_IS_OK(status)) {
276 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
280 if (CVAL(lenbuf,0) == 0 &&
282 smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
283 !srv_is_signing_active()) {
285 status = receive_smb_raw_talloc_partial_read(
286 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, &len);
288 if (!NT_STATUS_IS_OK(status)) {
289 DEBUG(10, ("receive_smb_raw: %s\n",
295 if (!valid_packet_size(len)) {
296 return NT_STATUS_INVALID_PARAMETER;
300 * The +4 here can't wrap, we've checked the length above already.
303 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
305 if (*buffer == NULL) {
306 DEBUG(0, ("Could not allocate inbuf of length %d\n",
308 return NT_STATUS_NO_MEMORY;
311 memcpy(*buffer, lenbuf, sizeof(lenbuf));
313 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
314 if (!NT_STATUS_IS_OK(status)) {
322 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
323 char **buffer, unsigned int timeout,
324 size_t *p_unread, bool *p_encrypted,
330 *p_encrypted = false;
332 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
334 if (!NT_STATUS_IS_OK(status)) {
338 if (is_encrypted_packet((uint8_t *)*buffer)) {
339 status = srv_decrypt_buffer(*buffer);
340 if (!NT_STATUS_IS_OK(status)) {
341 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
342 "incoming packet! Error %s\n",
343 nt_errstr(status) ));
349 /* Check the incoming SMB signature. */
350 if (!srv_check_sign_mac(*buffer, true)) {
351 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
352 "incoming packet!\n"));
353 return NT_STATUS_INVALID_NETWORK_RESPONSE;
361 * Initialize a struct smb_request from an inbuf
364 void init_smb_request(struct smb_request *req,
369 size_t req_size = smb_len(inbuf) + 4;
370 /* Ensure we have at least smb_size bytes. */
371 if (req_size < smb_size) {
372 DEBUG(0,("init_smb_request: invalid request size %u\n",
373 (unsigned int)req_size ));
374 exit_server_cleanly("Invalid SMB request");
376 req->flags2 = SVAL(inbuf, smb_flg2);
377 req->smbpid = SVAL(inbuf, smb_pid);
378 req->mid = SVAL(inbuf, smb_mid);
379 req->vuid = SVAL(inbuf, smb_uid);
380 req->tid = SVAL(inbuf, smb_tid);
381 req->wct = CVAL(inbuf, smb_wct);
382 req->unread_bytes = unread_bytes;
383 req->encrypted = encrypted;
384 req->conn = conn_find(req->tid);
386 /* Ensure we have at least wct words and 2 bytes of bcc. */
387 if (smb_size + req->wct*2 > req_size) {
388 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
389 (unsigned int)req->wct,
390 (unsigned int)req_size));
391 exit_server_cleanly("Invalid SMB request");
393 /* Ensure bcc is correct. */
394 if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
395 DEBUG(0,("init_smb_request: invalid bcc number %u "
396 "(wct = %u, size %u)\n",
397 (unsigned int)smb_buflen(inbuf),
398 (unsigned int)req->wct,
399 (unsigned int)req_size));
400 exit_server_cleanly("Invalid SMB request");
406 /****************************************************************************
407 structure to hold a linked list of queued messages.
409 ****************************************************************************/
411 static struct pending_message_list *deferred_open_queue;
413 /****************************************************************************
414 Function to push a message onto the tail of a linked list of smb messages ready
416 ****************************************************************************/
418 static bool push_queued_message(struct smb_request *req,
419 struct timeval request_time,
420 struct timeval end_time,
421 char *private_data, size_t private_len)
423 int msg_len = smb_len(req->inbuf) + 4;
424 struct pending_message_list *msg;
426 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
429 DEBUG(0,("push_message: malloc fail (1)\n"));
433 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
434 if(msg->buf.data == NULL) {
435 DEBUG(0,("push_message: malloc fail (2)\n"));
440 msg->request_time = request_time;
441 msg->end_time = end_time;
442 msg->encrypted = req->encrypted;
445 msg->private_data = data_blob_talloc(msg, private_data,
447 if (msg->private_data.data == NULL) {
448 DEBUG(0,("push_message: malloc fail (3)\n"));
454 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
456 DEBUG(10,("push_message: pushed message length %u on "
457 "deferred_open_queue\n", (unsigned int)msg_len));
462 /****************************************************************************
463 Function to delete a sharing violation open message by mid.
464 ****************************************************************************/
466 void remove_deferred_open_smb_message(uint16 mid)
468 struct pending_message_list *pml;
470 for (pml = deferred_open_queue; pml; pml = pml->next) {
471 if (mid == SVAL(pml->buf.data,smb_mid)) {
472 DEBUG(10,("remove_sharing_violation_open_smb_message: "
473 "deleting mid %u len %u\n",
475 (unsigned int)pml->buf.length ));
476 DLIST_REMOVE(deferred_open_queue, pml);
483 /****************************************************************************
484 Move a sharing violation open retry message to the front of the list and
485 schedule it for immediate processing.
486 ****************************************************************************/
488 void schedule_deferred_open_smb_message(uint16 mid)
490 struct pending_message_list *pml;
493 for (pml = deferred_open_queue; pml; pml = pml->next) {
494 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
495 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
496 (unsigned int)msg_mid ));
497 if (mid == msg_mid) {
498 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
500 pml->end_time.tv_sec = 0;
501 pml->end_time.tv_usec = 0;
502 DLIST_PROMOTE(deferred_open_queue, pml);
507 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
511 /****************************************************************************
512 Return true if this mid is on the deferred queue.
513 ****************************************************************************/
515 bool open_was_deferred(uint16 mid)
517 struct pending_message_list *pml;
519 for (pml = deferred_open_queue; pml; pml = pml->next) {
520 if (SVAL(pml->buf.data,smb_mid) == mid) {
527 /****************************************************************************
528 Return the message queued by this mid.
529 ****************************************************************************/
531 struct pending_message_list *get_open_deferred_message(uint16 mid)
533 struct pending_message_list *pml;
535 for (pml = deferred_open_queue; pml; pml = pml->next) {
536 if (SVAL(pml->buf.data,smb_mid) == mid) {
543 /****************************************************************************
544 Function to push a deferred open smb message onto a linked list of local smb
545 messages ready for processing.
546 ****************************************************************************/
548 bool push_deferred_smb_message(struct smb_request *req,
549 struct timeval request_time,
550 struct timeval timeout,
551 char *private_data, size_t priv_len)
553 struct timeval end_time;
555 if (req->unread_bytes) {
556 DEBUG(0,("push_deferred_smb_message: logic error ! "
557 "unread_bytes = %u\n",
558 (unsigned int)req->unread_bytes ));
559 smb_panic("push_deferred_smb_message: "
560 "logic error unread_bytes != 0" );
563 end_time = timeval_sum(&request_time, &timeout);
565 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
566 "timeout time [%u.%06u]\n",
567 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
568 (unsigned int)end_time.tv_sec,
569 (unsigned int)end_time.tv_usec));
571 return push_queued_message(req, request_time, end_time,
572 private_data, priv_len);
576 struct timed_event *te;
577 struct timeval interval;
579 bool (*handler)(const struct timeval *now, void *private_data);
583 static void idle_event_handler(struct event_context *ctx,
584 struct timed_event *te,
585 const struct timeval *now,
588 struct idle_event *event =
589 talloc_get_type_abort(private_data, struct idle_event);
591 TALLOC_FREE(event->te);
593 if (!event->handler(now, event->private_data)) {
594 /* Don't repeat, delete ourselves */
599 event->te = event_add_timed(ctx, event,
600 timeval_sum(now, &event->interval),
602 idle_event_handler, event);
604 /* We can't do much but fail here. */
605 SMB_ASSERT(event->te != NULL);
608 struct idle_event *event_add_idle(struct event_context *event_ctx,
610 struct timeval interval,
612 bool (*handler)(const struct timeval *now,
616 struct idle_event *result;
617 struct timeval now = timeval_current();
619 result = TALLOC_P(mem_ctx, struct idle_event);
620 if (result == NULL) {
621 DEBUG(0, ("talloc failed\n"));
625 result->interval = interval;
626 result->handler = handler;
627 result->private_data = private_data;
629 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
630 DEBUG(0, ("talloc failed\n"));
635 result->te = event_add_timed(event_ctx, result,
636 timeval_sum(&now, &interval),
638 idle_event_handler, result);
639 if (result->te == NULL) {
640 DEBUG(0, ("event_add_timed failed\n"));
648 /****************************************************************************
649 Do all async processing in here. This includes kernel oplock messages, change
651 ****************************************************************************/
653 static void async_processing(fd_set *pfds)
655 DEBUG(10,("async_processing: Doing async processing.\n"));
659 process_kernel_oplocks(smbd_messaging_context(), pfds);
661 /* Do the aio check again after receive_local_message as it does a
662 select and may have eaten our signal. */
663 /* Is this till true? -- vl */
667 exit_server_cleanly("termination signal");
670 /* check for sighup processing */
671 if (reload_after_sighup) {
672 change_to_root_user();
673 DEBUG(1,("Reloading services after SIGHUP\n"));
674 reload_services(False);
675 reload_after_sighup = 0;
679 /****************************************************************************
680 Add a fd to the set we will be select(2)ing on.
681 ****************************************************************************/
683 static int select_on_fd(int fd, int maxfd, fd_set *fds)
687 maxfd = MAX(maxfd, fd);
693 /****************************************************************************
694 Do a select on an two fd's - with timeout.
696 If a local udp message has been pushed onto the
697 queue (this can only happen during oplock break
698 processing) call async_processing()
700 If a pending smb message has been pushed onto the
701 queue (this can only happen during oplock break
702 processing) return this next.
704 If the first smbfd is ready then read an smb from it.
705 if the second (loopback UDP) fd is ready then read a message
706 from it and setup the buffer header to identify the length
708 Returns False on timeout or error.
711 The timeout is in milliseconds
712 ****************************************************************************/
714 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
715 size_t *buffer_len, int timeout,
716 size_t *p_unread, bool *p_encrypted)
730 to.tv_sec = timeout / 1000;
731 to.tv_usec = (timeout % 1000) * 1000;
733 to.tv_sec = SMBD_SELECT_TIMEOUT;
738 * Note that this call must be before processing any SMB
739 * messages as we need to synchronously process any messages
740 * we may have sent to ourselves from the previous SMB.
742 message_dispatch(smbd_messaging_context());
745 * Check to see if we already have a message on the deferred open queue
746 * and it's time to schedule.
748 if(deferred_open_queue != NULL) {
749 bool pop_message = False;
750 struct pending_message_list *msg = deferred_open_queue;
752 if (timeval_is_zero(&msg->end_time)) {
759 tdif = usec_time_diff(&msg->end_time, &tv);
761 /* Timed out. Schedule...*/
763 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
765 /* Make a more accurate select timeout. */
766 to.tv_sec = tdif / 1000000;
767 to.tv_usec = tdif % 1000000;
768 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
769 (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
775 *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
777 if (*buffer == NULL) {
778 DEBUG(0, ("talloc failed\n"));
779 return NT_STATUS_NO_MEMORY;
781 *buffer_len = msg->buf.length;
782 *p_encrypted = msg->encrypted;
784 /* We leave this message on the queue so the open code can
785 know this is a retry. */
786 DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
792 * Setup the select fd sets.
799 * Ensure we process oplock break messages by preference.
800 * We have to do this before the select, after the select
801 * and if the select returns EINTR. This is due to the fact
802 * that the selects called from async_processing can eat an EINTR
803 * caused by a signal (we can't take the break message there).
804 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
807 if (oplock_message_waiting(&r_fds)) {
808 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
809 async_processing(&r_fds);
811 * After async processing we must go and do the select again, as
812 * the state of the flag in fds for the server file descriptor is
813 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
819 * Are there any timed events waiting ? If so, ensure we don't
820 * select for longer than it would take to wait for them.
827 event_add_to_select_args(smbd_event_context(), &now,
828 &r_fds, &w_fds, &to, &maxfd);
831 if (timeval_is_zero(&to)) {
832 /* Process a timed event now... */
833 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
840 START_PROFILE(smbd_idle);
842 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
843 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
845 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
848 END_PROFILE(smbd_idle);
852 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
856 /* if we get EINTR then maybe we have received an oplock
857 signal - treat this as select returning 1. This is ugly, but
858 is the best we can do until the oplock code knows more about
860 if (selrtn == -1 && errno == EINTR) {
861 async_processing(&r_fds);
863 * After async processing we must go and do the select again, as
864 * the state of the flag in fds for the server file descriptor is
865 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
872 /* something is wrong. Maybe the socket is dead? */
873 return map_nt_error_from_unix(errno);
876 /* Did we timeout ? */
878 return NT_STATUS_IO_TIMEOUT;
882 * Ensure we process oplock break messages by preference.
883 * This is IMPORTANT ! Otherwise we can starve other processes
884 * sending us an oplock break message. JRA.
887 if (oplock_message_waiting(&r_fds)) {
888 async_processing(&r_fds);
890 * After async processing we must go and do the select again, as
891 * the state of the flag in fds for the server file descriptor is
892 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
898 * We've just woken up from a protentially long select sleep.
899 * Ensure we process local messages as we need to synchronously
900 * process any messages from other smbd's to avoid file rename race
901 * conditions. This call is cheap if there are no messages waiting.
904 message_dispatch(smbd_messaging_context());
906 status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
907 p_unread, p_encrypted, &len);
909 if (!NT_STATUS_IS_OK(status)) {
919 * Only allow 5 outstanding trans requests. We're allocating memory, so
923 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
926 for (; list != NULL; list = list->next) {
928 if (list->mid == mid) {
929 return NT_STATUS_INVALID_PARAMETER;
935 return NT_STATUS_INSUFFICIENT_RESOURCES;
941 /****************************************************************************
942 We're terminating and have closed all our files/connections etc.
943 If there are any pending local messages we need to respond to them
944 before termination so that other smbds don't think we just died whilst
946 ****************************************************************************/
948 void respond_to_all_remaining_local_messages(void)
951 * Assert we have no exclusive open oplocks.
954 if(get_number_of_exclusive_open_oplocks()) {
955 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
956 get_number_of_exclusive_open_oplocks() ));
960 process_kernel_oplocks(smbd_messaging_context(), NULL);
967 These flags determine some of the permissions required to do an operation
969 Note that I don't set NEED_WRITE on some write operations because they
970 are used by some brain-dead clients when printing, and I don't want to
971 force write permissions on print services.
973 #define AS_USER (1<<0)
974 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
975 #define TIME_INIT (1<<2)
976 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
977 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
978 #define DO_CHDIR (1<<6)
981 define a list of possible SMB messages and their corresponding
982 functions. Any message that has a NULL function is unimplemented -
983 please feel free to contribute implementations!
985 static const struct smb_message_struct {
987 void (*fn_new)(struct smb_request *req);
989 } smb_messages[256] = {
991 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
992 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
993 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
994 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
995 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
996 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
997 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
998 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
999 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1000 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1001 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1002 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1003 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1004 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1005 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1006 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1007 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1008 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1009 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1010 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1011 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1012 /* 0x15 */ { NULL, NULL, 0 },
1013 /* 0x16 */ { NULL, NULL, 0 },
1014 /* 0x17 */ { NULL, NULL, 0 },
1015 /* 0x18 */ { NULL, NULL, 0 },
1016 /* 0x19 */ { NULL, NULL, 0 },
1017 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1018 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1019 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1020 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1021 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1022 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1023 /* 0x20 */ { "SMBwritec", NULL,0},
1024 /* 0x21 */ { NULL, NULL, 0 },
1025 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1026 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1027 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1028 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1029 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1030 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1031 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1032 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1033 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1034 /* 0x2b */ { "SMBecho",reply_echo,0},
1035 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1036 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1037 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1038 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1039 /* 0x30 */ { NULL, NULL, 0 },
1040 /* 0x31 */ { NULL, NULL, 0 },
1041 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1042 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1043 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1044 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1045 /* 0x36 */ { NULL, NULL, 0 },
1046 /* 0x37 */ { NULL, NULL, 0 },
1047 /* 0x38 */ { NULL, NULL, 0 },
1048 /* 0x39 */ { NULL, NULL, 0 },
1049 /* 0x3a */ { NULL, NULL, 0 },
1050 /* 0x3b */ { NULL, NULL, 0 },
1051 /* 0x3c */ { NULL, NULL, 0 },
1052 /* 0x3d */ { NULL, NULL, 0 },
1053 /* 0x3e */ { NULL, NULL, 0 },
1054 /* 0x3f */ { NULL, NULL, 0 },
1055 /* 0x40 */ { NULL, NULL, 0 },
1056 /* 0x41 */ { NULL, NULL, 0 },
1057 /* 0x42 */ { NULL, NULL, 0 },
1058 /* 0x43 */ { NULL, NULL, 0 },
1059 /* 0x44 */ { NULL, NULL, 0 },
1060 /* 0x45 */ { NULL, NULL, 0 },
1061 /* 0x46 */ { NULL, NULL, 0 },
1062 /* 0x47 */ { NULL, NULL, 0 },
1063 /* 0x48 */ { NULL, NULL, 0 },
1064 /* 0x49 */ { NULL, NULL, 0 },
1065 /* 0x4a */ { NULL, NULL, 0 },
1066 /* 0x4b */ { NULL, NULL, 0 },
1067 /* 0x4c */ { NULL, NULL, 0 },
1068 /* 0x4d */ { NULL, NULL, 0 },
1069 /* 0x4e */ { NULL, NULL, 0 },
1070 /* 0x4f */ { NULL, NULL, 0 },
1071 /* 0x50 */ { NULL, NULL, 0 },
1072 /* 0x51 */ { NULL, NULL, 0 },
1073 /* 0x52 */ { NULL, NULL, 0 },
1074 /* 0x53 */ { NULL, NULL, 0 },
1075 /* 0x54 */ { NULL, NULL, 0 },
1076 /* 0x55 */ { NULL, NULL, 0 },
1077 /* 0x56 */ { NULL, NULL, 0 },
1078 /* 0x57 */ { NULL, NULL, 0 },
1079 /* 0x58 */ { NULL, NULL, 0 },
1080 /* 0x59 */ { NULL, NULL, 0 },
1081 /* 0x5a */ { NULL, NULL, 0 },
1082 /* 0x5b */ { NULL, NULL, 0 },
1083 /* 0x5c */ { NULL, NULL, 0 },
1084 /* 0x5d */ { NULL, NULL, 0 },
1085 /* 0x5e */ { NULL, NULL, 0 },
1086 /* 0x5f */ { NULL, NULL, 0 },
1087 /* 0x60 */ { NULL, NULL, 0 },
1088 /* 0x61 */ { NULL, NULL, 0 },
1089 /* 0x62 */ { NULL, NULL, 0 },
1090 /* 0x63 */ { NULL, NULL, 0 },
1091 /* 0x64 */ { NULL, NULL, 0 },
1092 /* 0x65 */ { NULL, NULL, 0 },
1093 /* 0x66 */ { NULL, NULL, 0 },
1094 /* 0x67 */ { NULL, NULL, 0 },
1095 /* 0x68 */ { NULL, NULL, 0 },
1096 /* 0x69 */ { NULL, NULL, 0 },
1097 /* 0x6a */ { NULL, NULL, 0 },
1098 /* 0x6b */ { NULL, NULL, 0 },
1099 /* 0x6c */ { NULL, NULL, 0 },
1100 /* 0x6d */ { NULL, NULL, 0 },
1101 /* 0x6e */ { NULL, NULL, 0 },
1102 /* 0x6f */ { NULL, NULL, 0 },
1103 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1104 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1105 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1106 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1107 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1108 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1109 /* 0x76 */ { NULL, NULL, 0 },
1110 /* 0x77 */ { NULL, NULL, 0 },
1111 /* 0x78 */ { NULL, NULL, 0 },
1112 /* 0x79 */ { NULL, NULL, 0 },
1113 /* 0x7a */ { NULL, NULL, 0 },
1114 /* 0x7b */ { NULL, NULL, 0 },
1115 /* 0x7c */ { NULL, NULL, 0 },
1116 /* 0x7d */ { NULL, NULL, 0 },
1117 /* 0x7e */ { NULL, NULL, 0 },
1118 /* 0x7f */ { NULL, NULL, 0 },
1119 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1120 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1121 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1122 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1123 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1124 /* 0x85 */ { NULL, NULL, 0 },
1125 /* 0x86 */ { NULL, NULL, 0 },
1126 /* 0x87 */ { NULL, NULL, 0 },
1127 /* 0x88 */ { NULL, NULL, 0 },
1128 /* 0x89 */ { NULL, NULL, 0 },
1129 /* 0x8a */ { NULL, NULL, 0 },
1130 /* 0x8b */ { NULL, NULL, 0 },
1131 /* 0x8c */ { NULL, NULL, 0 },
1132 /* 0x8d */ { NULL, NULL, 0 },
1133 /* 0x8e */ { NULL, NULL, 0 },
1134 /* 0x8f */ { NULL, NULL, 0 },
1135 /* 0x90 */ { NULL, NULL, 0 },
1136 /* 0x91 */ { NULL, NULL, 0 },
1137 /* 0x92 */ { NULL, NULL, 0 },
1138 /* 0x93 */ { NULL, NULL, 0 },
1139 /* 0x94 */ { NULL, NULL, 0 },
1140 /* 0x95 */ { NULL, NULL, 0 },
1141 /* 0x96 */ { NULL, NULL, 0 },
1142 /* 0x97 */ { NULL, NULL, 0 },
1143 /* 0x98 */ { NULL, NULL, 0 },
1144 /* 0x99 */ { NULL, NULL, 0 },
1145 /* 0x9a */ { NULL, NULL, 0 },
1146 /* 0x9b */ { NULL, NULL, 0 },
1147 /* 0x9c */ { NULL, NULL, 0 },
1148 /* 0x9d */ { NULL, NULL, 0 },
1149 /* 0x9e */ { NULL, NULL, 0 },
1150 /* 0x9f */ { NULL, NULL, 0 },
1151 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1152 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1153 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1154 /* 0xa3 */ { NULL, NULL, 0 },
1155 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1156 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1157 /* 0xa6 */ { NULL, NULL, 0 },
1158 /* 0xa7 */ { NULL, NULL, 0 },
1159 /* 0xa8 */ { NULL, NULL, 0 },
1160 /* 0xa9 */ { NULL, NULL, 0 },
1161 /* 0xaa */ { NULL, NULL, 0 },
1162 /* 0xab */ { NULL, NULL, 0 },
1163 /* 0xac */ { NULL, NULL, 0 },
1164 /* 0xad */ { NULL, NULL, 0 },
1165 /* 0xae */ { NULL, NULL, 0 },
1166 /* 0xaf */ { NULL, NULL, 0 },
1167 /* 0xb0 */ { NULL, NULL, 0 },
1168 /* 0xb1 */ { NULL, NULL, 0 },
1169 /* 0xb2 */ { NULL, NULL, 0 },
1170 /* 0xb3 */ { NULL, NULL, 0 },
1171 /* 0xb4 */ { NULL, NULL, 0 },
1172 /* 0xb5 */ { NULL, NULL, 0 },
1173 /* 0xb6 */ { NULL, NULL, 0 },
1174 /* 0xb7 */ { NULL, NULL, 0 },
1175 /* 0xb8 */ { NULL, NULL, 0 },
1176 /* 0xb9 */ { NULL, NULL, 0 },
1177 /* 0xba */ { NULL, NULL, 0 },
1178 /* 0xbb */ { NULL, NULL, 0 },
1179 /* 0xbc */ { NULL, NULL, 0 },
1180 /* 0xbd */ { NULL, NULL, 0 },
1181 /* 0xbe */ { NULL, NULL, 0 },
1182 /* 0xbf */ { NULL, NULL, 0 },
1183 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1184 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1185 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1186 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1187 /* 0xc4 */ { NULL, NULL, 0 },
1188 /* 0xc5 */ { NULL, NULL, 0 },
1189 /* 0xc6 */ { NULL, NULL, 0 },
1190 /* 0xc7 */ { NULL, NULL, 0 },
1191 /* 0xc8 */ { NULL, NULL, 0 },
1192 /* 0xc9 */ { NULL, NULL, 0 },
1193 /* 0xca */ { NULL, NULL, 0 },
1194 /* 0xcb */ { NULL, NULL, 0 },
1195 /* 0xcc */ { NULL, NULL, 0 },
1196 /* 0xcd */ { NULL, NULL, 0 },
1197 /* 0xce */ { NULL, NULL, 0 },
1198 /* 0xcf */ { NULL, NULL, 0 },
1199 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1200 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1201 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1202 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1203 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1204 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1205 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1206 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1207 /* 0xd8 */ { NULL, NULL, 0 },
1208 /* 0xd9 */ { NULL, NULL, 0 },
1209 /* 0xda */ { NULL, NULL, 0 },
1210 /* 0xdb */ { NULL, NULL, 0 },
1211 /* 0xdc */ { NULL, NULL, 0 },
1212 /* 0xdd */ { NULL, NULL, 0 },
1213 /* 0xde */ { NULL, NULL, 0 },
1214 /* 0xdf */ { NULL, NULL, 0 },
1215 /* 0xe0 */ { NULL, NULL, 0 },
1216 /* 0xe1 */ { NULL, NULL, 0 },
1217 /* 0xe2 */ { NULL, NULL, 0 },
1218 /* 0xe3 */ { NULL, NULL, 0 },
1219 /* 0xe4 */ { NULL, NULL, 0 },
1220 /* 0xe5 */ { NULL, NULL, 0 },
1221 /* 0xe6 */ { NULL, NULL, 0 },
1222 /* 0xe7 */ { NULL, NULL, 0 },
1223 /* 0xe8 */ { NULL, NULL, 0 },
1224 /* 0xe9 */ { NULL, NULL, 0 },
1225 /* 0xea */ { NULL, NULL, 0 },
1226 /* 0xeb */ { NULL, NULL, 0 },
1227 /* 0xec */ { NULL, NULL, 0 },
1228 /* 0xed */ { NULL, NULL, 0 },
1229 /* 0xee */ { NULL, NULL, 0 },
1230 /* 0xef */ { NULL, NULL, 0 },
1231 /* 0xf0 */ { NULL, NULL, 0 },
1232 /* 0xf1 */ { NULL, NULL, 0 },
1233 /* 0xf2 */ { NULL, NULL, 0 },
1234 /* 0xf3 */ { NULL, NULL, 0 },
1235 /* 0xf4 */ { NULL, NULL, 0 },
1236 /* 0xf5 */ { NULL, NULL, 0 },
1237 /* 0xf6 */ { NULL, NULL, 0 },
1238 /* 0xf7 */ { NULL, NULL, 0 },
1239 /* 0xf8 */ { NULL, NULL, 0 },
1240 /* 0xf9 */ { NULL, NULL, 0 },
1241 /* 0xfa */ { NULL, NULL, 0 },
1242 /* 0xfb */ { NULL, NULL, 0 },
1243 /* 0xfc */ { NULL, NULL, 0 },
1244 /* 0xfd */ { NULL, NULL, 0 },
1245 /* 0xfe */ { NULL, NULL, 0 },
1246 /* 0xff */ { NULL, NULL, 0 }
1250 /*******************************************************************
1251 allocate and initialize a reply packet
1252 ********************************************************************/
1254 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1257 * Protect against integer wrap
1259 if ((num_bytes > 0xffffff)
1260 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1262 if (asprintf(&msg, "num_bytes too large: %u",
1263 (unsigned)num_bytes) == -1) {
1264 msg = CONST_DISCARD(char *, "num_bytes too large");
1269 if (!(req->outbuf = TALLOC_ARRAY(
1271 smb_size + num_words*2 + num_bytes))) {
1272 smb_panic("could not allocate output buffer\n");
1275 construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1276 srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1278 * Zero out the word area, the caller has to take care of the bcc area
1281 if (num_words != 0) {
1282 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1289 /*******************************************************************
1290 Dump a packet to a file.
1291 ********************************************************************/
1293 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1297 if (DEBUGLEVEL < 50) {
1301 if (len < 4) len = smb_len(data)+4;
1302 for (i=1;i<100;i++) {
1303 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1304 type ? "req" : "resp") == -1) {
1307 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1308 if (fd != -1 || errno != EEXIST) break;
1311 ssize_t ret = write(fd, data, len);
1313 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1315 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1320 /****************************************************************************
1321 Prepare everything for calling the actual request function, and potentially
1322 call the request function via the "new" interface.
1324 Return False if the "legacy" function needs to be called, everything is
1327 Return True if we're done.
1329 I know this API sucks, but it is the one with the least code change I could
1331 ****************************************************************************/
1333 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1337 connection_struct *conn = NULL;
1339 static uint16 last_session_tag = UID_FIELD_INVALID;
1343 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1344 * so subtract 4 from it. */
1345 if (!valid_smb_header(req->inbuf)
1346 || (size < (smb_size - 4))) {
1347 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1348 smb_len(req->inbuf)));
1349 exit_server_cleanly("Non-SMB packet");
1352 if (smb_messages[type].fn_new == NULL) {
1353 DEBUG(0,("Unknown message type %d!\n",type));
1354 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1355 reply_unknown_new(req, type);
1359 flags = smb_messages[type].flags;
1361 /* In share mode security we must ignore the vuid. */
1362 session_tag = (lp_security() == SEC_SHARE)
1363 ? UID_FIELD_INVALID : req->vuid;
1366 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1367 (int)sys_getpid(), (unsigned long)conn));
1369 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1371 /* Ensure this value is replaced in the incoming packet. */
1372 SSVAL(req->inbuf,smb_uid,session_tag);
1375 * Ensure the correct username is in current_user_info. This is a
1376 * really ugly bugfix for problems with multiple session_setup_and_X's
1377 * being done and allowing %U and %G substitutions to work correctly.
1378 * There is a reason this code is done here, don't move it unless you
1379 * know what you're doing... :-).
1383 if (session_tag != last_session_tag) {
1384 user_struct *vuser = NULL;
1386 last_session_tag = session_tag;
1387 if(session_tag != UID_FIELD_INVALID) {
1388 vuser = get_valid_user_struct(session_tag);
1390 set_current_user_info(
1391 vuser->server_info->sanitized_username,
1392 vuser->server_info->unix_name,
1393 pdb_get_fullname(vuser->server_info
1395 pdb_get_domain(vuser->server_info
1401 /* Does this call need to be run as the connected user? */
1402 if (flags & AS_USER) {
1404 /* Does this call need a valid tree connection? */
1407 * Amazingly, the error code depends on the command
1410 if (type == SMBntcreateX) {
1411 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1413 reply_doserror(req, ERRSRV, ERRinvnid);
1418 if (!change_to_user(conn,session_tag)) {
1419 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1423 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1425 /* Does it need write permission? */
1426 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1427 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1431 /* IPC services are limited */
1432 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1433 reply_doserror(req, ERRSRV,ERRaccess);
1437 /* This call needs to be run as root */
1438 change_to_root_user();
1441 /* load service specific parameters */
1443 if (req->encrypted) {
1444 conn->encrypted_tid = true;
1445 /* encrypted required from now on. */
1446 conn->encrypt_level = Required;
1447 } else if (ENCRYPTION_REQUIRED(conn)) {
1448 uint8 com = CVAL(req->inbuf,smb_com);
1449 if (com != SMBtrans2 && com != SMBtranss2) {
1450 exit_server_cleanly("encryption required "
1456 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1457 (flags & (AS_USER|DO_CHDIR)
1459 reply_doserror(req, ERRSRV, ERRaccess);
1462 conn->num_smb_operations++;
1465 /* does this protocol need to be run as guest? */
1466 if ((flags & AS_GUEST)
1467 && (!change_to_guest() ||
1468 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1469 lp_hostsdeny(-1)))) {
1470 reply_doserror(req, ERRSRV, ERRaccess);
1474 smb_messages[type].fn_new(req);
1478 /****************************************************************************
1479 Construct a reply to the incoming packet.
1480 ****************************************************************************/
1482 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1484 uint8 type = CVAL(inbuf,smb_com);
1485 connection_struct *conn;
1486 struct smb_request *req;
1492 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1493 smb_panic("could not allocate smb_request");
1495 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1497 conn = switch_message(type, req, size);
1499 if (req->unread_bytes) {
1500 /* writeX failed. drain socket. */
1501 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1502 req->unread_bytes) {
1503 smb_panic("failed to drain pending bytes");
1505 req->unread_bytes = 0;
1508 if (req->outbuf == NULL) {
1512 if (CVAL(req->outbuf,0) == 0) {
1513 show_msg((char *)req->outbuf);
1516 if (!srv_send_smb(smbd_server_fd(),
1517 (char *)req->outbuf,
1518 IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1519 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1527 /****************************************************************************
1528 Process an smb from the client
1529 ****************************************************************************/
1531 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1533 static int trans_num;
1534 int msg_type = CVAL(inbuf,0);
1536 DO_PROFILE_INC(smb_count);
1538 if (trans_num == 0) {
1539 char addr[INET6_ADDRSTRLEN];
1541 /* on the first packet, check the global hosts allow/ hosts
1542 deny parameters before doing any parsing of the packet
1543 passed to us by the client. This prevents attacks on our
1544 parsing code from hosts not in the hosts allow list */
1546 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1547 lp_hostsdeny(-1))) {
1548 /* send a negative session response "not listening on calling name" */
1549 static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1550 DEBUG( 1, ( "Connection denied from %s\n",
1551 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1552 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1553 exit_server_cleanly("connection denied");
1557 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1559 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1561 (unsigned int)unread_bytes ));
1563 if (msg_type != 0) {
1565 * NetBIOS session request, keepalive, etc.
1567 reply_special(inbuf);
1573 construct_reply(inbuf,nread,unread_bytes,encrypted);
1578 /****************************************************************************
1579 Return a string containing the function name of a SMB command.
1580 ****************************************************************************/
1582 const char *smb_fn_name(int type)
1584 const char *unknown_name = "SMBunknown";
1586 if (smb_messages[type].name == NULL)
1587 return(unknown_name);
1589 return(smb_messages[type].name);
1592 /****************************************************************************
1593 Helper functions for contruct_reply.
1594 ****************************************************************************/
1596 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1598 void add_to_common_flags2(uint32 v)
1603 void remove_from_common_flags2(uint32 v)
1605 common_flags2 &= ~v;
1608 void construct_reply_common(const char *inbuf, char *outbuf)
1610 srv_set_message(outbuf,0,0,false);
1612 SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1613 SIVAL(outbuf,smb_rcls,0);
1614 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1615 SSVAL(outbuf,smb_flg2,
1616 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1618 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1620 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1621 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1622 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1623 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1626 /****************************************************************************
1627 Construct a chained reply and add it to the already made reply
1628 ****************************************************************************/
1630 void chain_reply(struct smb_request *req)
1632 static char *orig_inbuf;
1635 * Dirty little const_discard: We mess with req->inbuf, which is
1636 * declared as const. If maybe at some point this routine gets
1637 * rewritten, this const_discard could go away.
1639 char *inbuf = CONST_DISCARD(char *, req->inbuf);
1640 int size = smb_len(req->inbuf)+4;
1642 int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1643 unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1647 char inbuf_saved[smb_wct];
1648 char *outbuf = (char *)req->outbuf;
1649 size_t outsize = smb_len(outbuf) + 4;
1650 size_t outsize_padded;
1651 size_t ofs, to_move;
1653 struct smb_request *req2;
1654 size_t caller_outputlen;
1655 char *caller_output;
1657 /* Maybe its not chained, or it's an error packet. */
1658 if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1659 SCVAL(outbuf,smb_vwv0,0xFF);
1663 if (chain_size == 0) {
1664 /* this is the first part of the chain */
1669 * We need to save the output the caller added to the chain so that we
1670 * can splice it into the final output buffer later.
1673 caller_outputlen = outsize - smb_wct;
1675 caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1677 if (caller_output == NULL) {
1678 /* TODO: NT_STATUS_NO_MEMORY */
1679 smb_panic("could not dup outbuf");
1683 * The original Win95 redirector dies on a reply to
1684 * a lockingX and read chain unless the chain reply is
1685 * 4 byte aligned. JRA.
1688 outsize_padded = (outsize + 3) & ~3;
1691 * remember how much the caller added to the chain, only counting
1692 * stuff after the parameter words
1694 chain_size += outsize_padded - smb_wct;
1697 * work out pointers into the original packets. The
1698 * headers on these need to be filled in
1700 inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1702 /* remember the original command type */
1703 smb_com1 = CVAL(orig_inbuf,smb_com);
1705 /* save the data which will be overwritten by the new headers */
1706 memcpy(inbuf_saved,inbuf2,smb_wct);
1708 /* give the new packet the same header as the last part of the SMB */
1709 memmove(inbuf2,inbuf,smb_wct);
1711 /* create the in buffer */
1712 SCVAL(inbuf2,smb_com,smb_com2);
1714 /* work out the new size for the in buffer. */
1715 new_size = size - (inbuf2 - inbuf);
1717 DEBUG(0,("chain_reply: chain packet size incorrect "
1718 "(orig size = %d, offset = %d)\n",
1719 size, (int)(inbuf2 - inbuf) ));
1720 exit_server_cleanly("Bad chained packet");
1724 /* And set it in the header. */
1725 smb_setlen(inbuf2, new_size - 4);
1727 DEBUG(3,("Chained message\n"));
1730 if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1731 smb_panic("could not allocate smb_request");
1733 init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1735 /* process the request */
1736 switch_message(smb_com2, req2, new_size);
1739 * We don't accept deferred operations in chained requests.
1741 SMB_ASSERT(req2->outbuf != NULL);
1742 outsize2 = smb_len(req2->outbuf)+4;
1745 * Move away the new command output so that caller_output fits in,
1746 * copy in the caller_output saved above.
1749 SMB_ASSERT(outsize_padded >= smb_wct);
1752 * "ofs" is the space we need for caller_output. Equal to
1753 * caller_outputlen plus the padding.
1756 ofs = outsize_padded - smb_wct;
1759 * "to_move" is the amount of bytes the secondary routine gave us
1762 to_move = outsize2 - smb_wct;
1764 if (to_move + ofs + smb_wct + chain_size > max_send) {
1765 smb_panic("replies too large -- would have to cut");
1769 * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1770 * the first request in the chain. So we have to re-allocate it. In
1771 * the "old" API the only outbuf ever used is the global OutBuffer
1772 * which is always large enough.
1775 outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1776 to_move + ofs + smb_wct);
1777 if (outbuf == NULL) {
1778 smb_panic("could not realloc outbuf");
1781 req->outbuf = (uint8 *)outbuf;
1783 memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1784 memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1787 * copy the new reply header over the old one but preserve the smb_com
1790 memmove(outbuf, req2->outbuf, smb_wct);
1791 SCVAL(outbuf, smb_com, smb_com1);
1794 * We've just copied in the whole "wct" area from the secondary
1795 * function. Fix up the chaining: com2 and the offset need to be
1799 SCVAL(outbuf, smb_vwv0, smb_com2);
1800 SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1802 if (outsize_padded > outsize) {
1805 * Due to padding we have some uninitialized bytes after the
1809 memset(outbuf + outsize, 0, outsize_padded - outsize);
1812 smb_setlen(outbuf, outsize2 + chain_size - 4);
1815 * restore the saved data, being careful not to overwrite any data
1816 * from the reply header
1818 memcpy(inbuf2,inbuf_saved,smb_wct);
1820 SAFE_FREE(caller_output);
1826 /****************************************************************************
1827 Setup the needed select timeout in milliseconds.
1828 ****************************************************************************/
1830 static int setup_select_timeout(void)
1834 select_timeout = SMBD_SELECT_TIMEOUT*1000;
1836 if (print_notify_messages_pending()) {
1837 select_timeout = MIN(select_timeout, 1000);
1840 return select_timeout;
1843 /****************************************************************************
1844 Check if services need reloading.
1845 ****************************************************************************/
1847 void check_reload(time_t t)
1849 static pid_t mypid = 0;
1850 static time_t last_smb_conf_reload_time = 0;
1851 static time_t last_printer_reload_time = 0;
1852 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1854 if(last_smb_conf_reload_time == 0) {
1855 last_smb_conf_reload_time = t;
1856 /* Our printing subsystem might not be ready at smbd start up.
1857 Then no printer is available till the first printers check
1858 is performed. A lower initial interval circumvents this. */
1859 if ( printcap_cache_time > 60 )
1860 last_printer_reload_time = t - printcap_cache_time + 60;
1862 last_printer_reload_time = t;
1865 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1866 /* randomize over 60 second the printcap reload to avoid all
1867 * process hitting cupsd at the same time */
1868 int time_range = 60;
1870 last_printer_reload_time += random() % time_range;
1874 if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1875 reload_services(True);
1876 reload_after_sighup = False;
1877 last_smb_conf_reload_time = t;
1880 /* 'printcap cache time = 0' disable the feature */
1882 if ( printcap_cache_time != 0 )
1884 /* see if it's time to reload or if the clock has been set back */
1886 if ( (t >= last_printer_reload_time+printcap_cache_time)
1887 || (t-last_printer_reload_time < 0) )
1889 DEBUG( 3,( "Printcap cache time expired.\n"));
1891 last_printer_reload_time = t;
1896 /****************************************************************************
1897 Process any timeout housekeeping. Return False if the caller should exit.
1898 ****************************************************************************/
1900 static void timeout_processing(int *select_timeout,
1901 time_t *last_timeout_processing_time)
1905 *last_timeout_processing_time = t = time(NULL);
1907 /* become root again if waiting */
1908 change_to_root_user();
1910 /* check if we need to reload services */
1913 if(global_machine_password_needs_changing &&
1914 /* for ADS we need to do a regular ADS password change, not a domain
1916 lp_security() == SEC_DOMAIN) {
1918 unsigned char trust_passwd_hash[16];
1923 * We're in domain level security, and the code that
1924 * read the machine password flagged that the machine
1925 * password needs changing.
1929 * First, open the machine password file with an exclusive lock.
1932 lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
1935 DEBUG(0,("process: unable to lock the machine account password for \
1936 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1940 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1941 DEBUG(0,("process: unable to read the machine account password for \
1942 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1948 * Make sure someone else hasn't already done this.
1951 if(t < lct + lp_machine_password_timeout()) {
1952 global_machine_password_needs_changing = False;
1957 /* always just contact the PDC here */
1959 change_trust_account_password( lp_workgroup(), NULL);
1960 global_machine_password_needs_changing = False;
1964 /* update printer queue caches if necessary */
1966 update_monitored_printq_cache();
1969 * Now we are root, check if the log files need pruning.
1970 * Force a log file check.
1972 force_check_log_size();
1975 /* Send any queued printer notify message to interested smbd's. */
1977 print_notify_send_messages(smbd_messaging_context(), 0);
1980 * Modify the select timeout depending upon
1981 * what we have remaining in our queues.
1984 *select_timeout = setup_select_timeout();
1989 /****************************************************************************
1990 Process commands from the client
1991 ****************************************************************************/
1993 void smbd_process(void)
1995 time_t last_timeout_processing_time = time(NULL);
1996 unsigned int num_smbs = 0;
1997 size_t unread_bytes = 0;
1999 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2002 int select_timeout = setup_select_timeout();
2005 size_t inbuf_len = 0;
2006 bool encrypted = false;
2007 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2011 /* Did someone ask for immediate checks on things like blocking locks ? */
2012 if (select_timeout == 0) {
2013 timeout_processing(&select_timeout,
2014 &last_timeout_processing_time);
2015 num_smbs = 0; /* Reset smb counter. */
2018 run_events(smbd_event_context(), 0, NULL, NULL);
2023 status = receive_message_or_smb(
2024 talloc_tos(), &inbuf, &inbuf_len,
2025 select_timeout, &unread_bytes, &encrypted);
2027 if (NT_STATUS_IS_OK(status)) {
2031 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
2034 &last_timeout_processing_time);
2038 DEBUG(3, ("receive_message_or_smb failed: %s, "
2039 "exiting\n", nt_errstr(status)));
2042 num_smbs = 0; /* Reset smb counter. */
2047 * Ensure we do timeout processing if the SMB we just got was
2048 * only an echo request. This allows us to set the select
2049 * timeout in 'receive_message_or_smb()' to any value we like
2050 * without worrying that the client will send echo requests
2051 * faster than the select timeout, thus starving out the
2052 * essential processing (change notify, blocking locks) that
2053 * the timeout code does. JRA.
2055 num_echos = smb_echo_count;
2057 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2061 if (smb_echo_count != num_echos) {
2062 timeout_processing(&select_timeout,
2063 &last_timeout_processing_time);
2064 num_smbs = 0; /* Reset smb counter. */
2070 * If we are getting smb requests in a constant stream
2071 * with no echos, make sure we attempt timeout processing
2072 * every select_timeout milliseconds - but only check for this
2073 * every 200 smb requests.
2076 if ((num_smbs % 200) == 0) {
2077 time_t new_check_time = time(NULL);
2078 if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2081 &last_timeout_processing_time);
2082 num_smbs = 0; /* Reset smb counter. */
2083 last_timeout_processing_time = new_check_time; /* Reset time. */
2087 /* The timeout_processing function isn't run nearly
2088 often enough to implement 'max log size' without
2089 overrunning the size of the file by many megabytes.
2090 This is especially true if we are running at debug
2091 level 10. Checking every 50 SMBs is a nice
2092 tradeoff of performance vs log file size overrun. */
2094 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2095 change_to_root_user();