Fix bug #7067 - Linux asynchronous IO (aio) can cause smbd to fail to respond to...
[amitay/samba.git] / source3 / smbd / notify.c
index 55009ce0b1c06d7d4f7b5fdb3aae4869b62205ad..0c75769594f6e350ebe7930df0b9edb3d35d684d 100644 (file)
 */
 
 #include "includes.h"
+#include "smbd/globals.h"
 
 struct notify_change_request {
        struct notify_change_request *prev, *next;
        struct files_struct *fsp;       /* backpointer for cancel by mid */
-       uint8 request_buf[smb_size];
+       struct smb_request *req;
        uint32 filter;
        uint32 max_param;
+       void (*reply_fn)(struct smb_request *req,
+                        NTSTATUS error_code,
+                        uint8_t *buf, size_t len);
        struct notify_mid_map *mid_map;
        void *backend_data;
 };
 
 static void notify_fsp(files_struct *fsp, uint32 action, const char *name);
 
-static struct notify_mid_map *notify_changes_by_mid;
-
 /*
  * For NTCancel, we need to find the notify_change_request indexed by
  * mid. Separate list here.
@@ -65,6 +67,10 @@ static bool notify_marshall_changes(int num_changes,
        int i;
        UNISTR uni_name;
 
+       if (num_changes == -1) {
+               return false;
+       }
+
        uni_name.buffer = NULL;
 
        for (i=0; i<num_changes; i++) {
@@ -82,10 +88,9 @@ static bool notify_marshall_changes(int num_changes,
 
                c = &changes[i];
 
-               namelen = convert_string_allocate(
-                       NULL, CH_UNIX, CH_UTF16LE, c->name, strlen(c->name)+1,
-                       &uni_name.buffer, True);
-               if ((namelen == -1) || (uni_name.buffer == NULL)) {
+               if (!convert_string_talloc(talloc_tos(), CH_UNIX, CH_UTF16LE,
+                       c->name, strlen(c->name)+1, &uni_name.buffer,
+                       &namelen, True) || (uni_name.buffer == NULL)) {
                        goto fail;
                }
 
@@ -111,10 +116,13 @@ static bool notify_marshall_changes(int num_changes,
                 */
                prs_set_offset(ps, prs_offset(ps)-2);
 
-               SAFE_FREE(uni_name.buffer);
+               TALLOC_FREE(uni_name.buffer);
 
                if (prs_offset(ps) > max_offset) {
                        /* Too much data for client. */
+                       DEBUG(10, ("Client only wanted %d bytes, trying to "
+                                  "marshall %d bytes\n", (int)max_offset,
+                                  (int)prs_offset(ps)));
                        return False;
                }
        }
@@ -122,7 +130,7 @@ static bool notify_marshall_changes(int num_changes,
        return True;
 
  fail:
-       SAFE_FREE(uni_name.buffer);
+       TALLOC_FREE(uni_name.buffer);
        return False;
 }
 
@@ -130,46 +138,28 @@ static bool notify_marshall_changes(int num_changes,
  Setup the common parts of the return packet and send it.
 *****************************************************************************/
 
-static void change_notify_reply_packet(connection_struct *conn,
-                               const uint8 *request_buf,
-                                      NTSTATUS error_code)
-{
-       char outbuf[smb_size+38];
-
-       memset(outbuf, '\0', sizeof(outbuf));
-       construct_reply_common((char *)request_buf, outbuf);
-
-       ERROR_NT(error_code);
-
-       /*
-        * Seems NT needs a transact command with an error code
-        * in it. This is a longer packet than a simple error.
-        */
-       srv_set_message(outbuf,18,0,False);
-
-       show_msg(outbuf);
-       if (!srv_send_smb(smbd_server_fd(),
-                       outbuf,
-                       IS_CONN_ENCRYPTED(conn)))
-               exit_server_cleanly("change_notify_reply_packet: srv_send_smb "
-                                   "failed.");
-}
-
 void change_notify_reply(connection_struct *conn,
-                       const uint8 *request_buf, uint32 max_param,
-                        struct notify_change_buf *notify_buf)
+                        struct smb_request *req,
+                        NTSTATUS error_code,
+                        uint32_t max_param,
+                        struct notify_change_buf *notify_buf,
+                        void (*reply_fn)(struct smb_request *req,
+                               NTSTATUS error_code,
+                               uint8_t *buf, size_t len))
 {
        prs_struct ps;
-       struct smb_request *req = NULL;
-       uint8 tmp_request[smb_size];
 
-       if (notify_buf->num_changes == -1) {
-               change_notify_reply_packet(conn, request_buf, NT_STATUS_OK);
-               notify_buf->num_changes = 0;
+       if (!NT_STATUS_IS_OK(error_code)) {
+               reply_fn(req, error_code, NULL, 0);
                return;
        }
 
-       prs_init(&ps, 0, NULL, MARSHALL);
+       if (max_param == 0 || notify_buf == NULL) {
+               reply_fn(req, NT_STATUS_OK, NULL, 0);
+               return;
+       }
+
+       prs_init_empty(&ps, NULL, MARSHALL);
 
        if (!notify_marshall_changes(notify_buf->num_changes, max_param,
                                        notify_buf->changes, &ps)) {
@@ -177,31 +167,12 @@ void change_notify_reply(connection_struct *conn,
                 * We exceed what the client is willing to accept. Send
                 * nothing.
                 */
-               change_notify_reply_packet(conn, request_buf, NT_STATUS_OK);
-               goto done;
-       }
-
-       if (!(req = talloc(talloc_tos(), struct smb_request))) {
-               change_notify_reply_packet(conn, request_buf, NT_STATUS_NO_MEMORY);
-               goto done;
+               prs_mem_free(&ps);
+               prs_init_empty(&ps, NULL, MARSHALL);
        }
 
-       memcpy(tmp_request, request_buf, smb_size);
-
-       /*
-        * We're only interested in the header fields here
-        */
-
-       smb_setlen((char *)tmp_request, smb_size);
-       SCVAL(tmp_request, smb_wct, 0);
-
-       init_smb_request(req, tmp_request,0, conn->encrypted_tid);
-
-       send_nt_replies(conn, req, NT_STATUS_OK, prs_data_p(&ps),
-                       prs_offset(&ps), NULL, 0);
+       reply_fn(req, NT_STATUS_OK, (uint8_t *)prs_data_p(&ps), prs_offset(&ps));
 
- done:
-       TALLOC_FREE(req);
        prs_mem_free(&ps);
 
        TALLOC_FREE(notify_buf->changes);
@@ -211,7 +182,7 @@ void change_notify_reply(connection_struct *conn,
 static void notify_callback(void *private_data, const struct notify_event *e)
 {
        files_struct *fsp = (files_struct *)private_data;
-       DEBUG(10, ("notify_callback called for %s\n", fsp->fsp_name));
+       DEBUG(10, ("notify_callback called for %s\n", fsp_str_dbg(fsp)));
        notify_fsp(fsp, e->action, e->path);
 }
 
@@ -229,14 +200,18 @@ NTSTATUS change_notify_create(struct files_struct *fsp, uint32 filter,
                return NT_STATUS_NO_MEMORY;
        }
 
+       /* Do notify operations on the base_name. */
        if (asprintf(&fullpath, "%s/%s", fsp->conn->connectpath,
-                    fsp->fsp_name) == -1) {
+                    fsp->fsp_name->base_name) == -1) {
                DEBUG(0, ("asprintf failed\n"));
+               TALLOC_FREE(fsp->notify);
                return NT_STATUS_NO_MEMORY;
        }
 
        ZERO_STRUCT(e);
        e.path = fullpath;
+       e.dir_fd = fsp->fh->fd;
+       e.dir_id = fsp->file_id;
        e.filter = filter;
        e.subdir_filter = 0;
        if (recursive) {
@@ -249,37 +224,42 @@ NTSTATUS change_notify_create(struct files_struct *fsp, uint32 filter,
        return status;
 }
 
-NTSTATUS change_notify_add_request(const struct smb_request *req,
+NTSTATUS change_notify_add_request(struct smb_request *req,
                                uint32 max_param,
                                uint32 filter, bool recursive,
-                               struct files_struct *fsp)
+                               struct files_struct *fsp,
+                               void (*reply_fn)(struct smb_request *req,
+                                       NTSTATUS error_code,
+                                       uint8_t *buf, size_t len))
 {
        struct notify_change_request *request = NULL;
        struct notify_mid_map *map = NULL;
+       struct smbd_server_connection *sconn = smbd_server_conn;
+
+       DEBUG(10, ("change_notify_add_request: Adding request for %s: "
+                  "max_param = %d\n", fsp_str_dbg(fsp), (int)max_param));
 
-       if (!(request = SMB_MALLOC_P(struct notify_change_request))
-           || !(map = SMB_MALLOC_P(struct notify_mid_map))) {
-               SAFE_FREE(request);
+       if (!(request = talloc(NULL, struct notify_change_request))
+           || !(map = talloc(request, struct notify_mid_map))) {
+               TALLOC_FREE(request);
                return NT_STATUS_NO_MEMORY;
        }
 
        request->mid_map = map;
        map->req = request;
 
-       memcpy(request->request_buf, req->inbuf, sizeof(request->request_buf));
+       request->req = talloc_move(request, &req);
        request->max_param = max_param;
        request->filter = filter;
        request->fsp = fsp;
+       request->reply_fn = reply_fn;
        request->backend_data = NULL;
 
        DLIST_ADD_END(fsp->notify->requests, request,
                      struct notify_change_request *);
 
-       map->mid = SVAL(req->inbuf, smb_mid);
-       DLIST_ADD(notify_changes_by_mid, map);
-
-       /* Push the MID of this packet on the signing queue. */
-       srv_defer_sign_response(SVAL(req->inbuf,smb_mid));
+       map->mid = request->req->mid;
+       DLIST_ADD(sconn->smb1.notify_mid_maps, map);
 
        return NT_STATUS_OK;
 }
@@ -288,6 +268,7 @@ static void change_notify_remove_request(struct notify_change_request *remove_re
 {
        files_struct *fsp;
        struct notify_change_request *req;
+       struct smbd_server_connection *sconn = smbd_server_conn;
 
        /*
         * Paranoia checks, the fsp referenced must must have the request in
@@ -308,10 +289,8 @@ static void change_notify_remove_request(struct notify_change_request *remove_re
        }
 
        DLIST_REMOVE(fsp->notify->requests, req);
-       DLIST_REMOVE(notify_changes_by_mid, req->mid_map);
-       SAFE_FREE(req->mid_map);
-       TALLOC_FREE(req->backend_data);
-       SAFE_FREE(req);
+       DLIST_REMOVE(sconn->smb1.notify_mid_maps, req->mid_map);
+       TALLOC_FREE(req);
 }
 
 /****************************************************************************
@@ -321,8 +300,9 @@ static void change_notify_remove_request(struct notify_change_request *remove_re
 void remove_pending_change_notify_requests_by_mid(uint16 mid)
 {
        struct notify_mid_map *map;
+       struct smbd_server_connection *sconn = smbd_server_conn;
 
-       for (map = notify_changes_by_mid; map; map = map->next) {
+       for (map = sconn->smb1.notify_mid_maps; map; map = map->next) {
                if (map->mid == mid) {
                        break;
                }
@@ -332,8 +312,28 @@ void remove_pending_change_notify_requests_by_mid(uint16 mid)
                return;
        }
 
-       change_notify_reply_packet(map->req->fsp->conn,
-                       map->req->request_buf, NT_STATUS_CANCELLED);
+       change_notify_reply(map->req->fsp->conn, map->req->req,
+                           NT_STATUS_CANCELLED, 0, NULL, map->req->reply_fn);
+       change_notify_remove_request(map->req);
+}
+
+void smbd_notify_cancel_by_smbreq(struct smbd_server_connection *sconn,
+                                 const struct smb_request *smbreq)
+{
+       struct notify_mid_map *map;
+
+       for (map = sconn->smb1.notify_mid_maps; map; map = map->next) {
+               if (map->req->req == smbreq) {
+                       break;
+               }
+       }
+
+       if (map == NULL) {
+               return;
+       }
+
+       change_notify_reply(map->req->fsp->conn, map->req->req,
+                           NT_STATUS_CANCELLED, 0, NULL, map->req->reply_fn);
        change_notify_remove_request(map->req);
 }
 
@@ -349,8 +349,9 @@ void remove_pending_change_notify_requests_by_fid(files_struct *fsp,
        }
 
        while (fsp->notify->requests != NULL) {
-               change_notify_reply_packet(fsp->conn,
-                       fsp->notify->requests->request_buf, status);
+               change_notify_reply(fsp->conn, fsp->notify->requests->req,
+                                   status, 0, NULL,
+                                   fsp->notify->requests->reply_fn);
                change_notify_remove_request(fsp->notify->requests);
        }
 }
@@ -359,14 +360,33 @@ void notify_fname(connection_struct *conn, uint32 action, uint32 filter,
                  const char *path)
 {
        char *fullpath;
+       char *parent;
+       const char *name;
+
+       if (path[0] == '.' && path[1] == '/') {
+               path += 2;
+       }
+       if (parent_dirname(talloc_tos(), path, &parent, &name)) {
+               struct smb_filename smb_fname_parent;
+
+               ZERO_STRUCT(smb_fname_parent);
+               smb_fname_parent.base_name = parent;
 
-       if (asprintf(&fullpath, "%s/%s", conn->connectpath, path) == -1) {
+               if (SMB_VFS_STAT(conn, &smb_fname_parent) != -1) {
+                       notify_onelevel(conn->notify_ctx, action, filter,
+                           SMB_VFS_FILE_ID_CREATE(conn, &smb_fname_parent.st),
+                           name);
+               }
+       }
+
+       fullpath = talloc_asprintf(talloc_tos(), "%s/%s", conn->connectpath,
+                                  path);
+       if (fullpath == NULL) {
                DEBUG(0, ("asprintf failed\n"));
                return;
        }
-
        notify_trigger(conn->notify_ctx, action, filter, fullpath);
-       SAFE_FREE(fullpath);
+       TALLOC_FREE(fullpath);
 }
 
 static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
@@ -389,13 +409,28 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
        if ((fsp->notify->num_changes > 1000) || (name == NULL)) {
                /*
                 * The real number depends on the client buf, just provide a
-                * guard against a DoS here.
+                * guard against a DoS here.  If name == NULL the CN backend is
+                * alerting us to a problem.  Possibly dropped events.  Clear
+                * queued changes and send the catch-all response to the client
+                * if a request is pending.
                 */
                TALLOC_FREE(fsp->notify->changes);
                fsp->notify->num_changes = -1;
+               if (fsp->notify->requests != NULL) {
+                       change_notify_reply(fsp->conn,
+                                           fsp->notify->requests->req,
+                                           NT_STATUS_OK,
+                                           fsp->notify->requests->max_param,
+                                           fsp->notify,
+                                           fsp->notify->requests->reply_fn);
+                       change_notify_remove_request(fsp->notify->requests);
+               }
                return;
        }
 
+       /* If we've exceeded the server side queue or received a NULL name
+        * from the underlying CN implementation, don't queue up any more
+        * requests until we can send a catch-all response to the client */
        if (fsp->notify->num_changes == -1) {
                return;
        }
@@ -444,9 +479,11 @@ static void notify_fsp(files_struct *fsp, uint32 action, const char *name)
         */
 
        change_notify_reply(fsp->conn,
-                       fsp->notify->requests->request_buf,
+                           fsp->notify->requests->req,
+                           NT_STATUS_OK,
                            fsp->notify->requests->max_param,
-                           fsp->notify);
+                           fsp->notify,
+                           fsp->notify->requests->reply_fn);
 
        change_notify_remove_request(fsp->notify->requests);
 }