2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 extern int smb_echo_count;
26 * Size of data we can send to client. Set
27 * by the client for all protocols above CORE.
28 * Set by us for CORE protocol.
30 int max_send = BUFFER_SIZE;
32 * Size of the data we can receive. Set by us.
33 * Can be modified by the max xmit parameter.
35 int max_recv = BUFFER_SIZE;
37 SIG_ATOMIC_T reload_after_sighup = 0;
38 SIG_ATOMIC_T got_sig_term = 0;
39 extern bool global_machine_password_needs_changing;
42 /* Accessor function for smb_read_error for smbd functions. */
44 /****************************************************************************
46 ****************************************************************************/
48 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
53 char *buf_out = buffer;
55 /* Sign the outgoing packet if required. */
56 srv_calculate_sign_mac(buf_out);
59 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
60 if (!NT_STATUS_IS_OK(status)) {
61 DEBUG(0, ("send_smb: SMB encryption failed "
62 "on outgoing packet! Error %s\n",
68 len = smb_len(buf_out) + 4;
70 while (nwritten < len) {
71 ret = write_data(fd,buf_out+nwritten,len - nwritten);
73 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
74 (int)len,(int)ret, strerror(errno) ));
75 srv_free_enc_buffer(buf_out);
81 srv_free_enc_buffer(buf_out);
85 /*******************************************************************
86 Setup the word count and byte count for a smb message.
87 ********************************************************************/
89 int srv_set_message(char *buf,
94 if (zero && (num_words || num_bytes)) {
95 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
97 SCVAL(buf,smb_wct,num_words);
98 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
99 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
100 return (smb_size + num_words*2 + num_bytes);
103 static bool valid_smb_header(const uint8_t *inbuf)
105 if (is_encrypted_packet(inbuf)) {
108 return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
111 /* Socket functions for smbd packet processing. */
113 static bool valid_packet_size(size_t len)
116 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
117 * of header. Don't print the error if this fits.... JRA.
120 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
121 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
122 (unsigned long)len));
123 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
130 static NTSTATUS read_packet_remainder(int fd, char *buffer,
131 unsigned int timeout, ssize_t len)
137 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
140 /****************************************************************************
141 Attempt a zerocopy writeX read. We know here that len > smb_size-4
142 ****************************************************************************/
145 * Unfortunately, earlier versions of smbclient/libsmbclient
146 * don't send this "standard" writeX header. I've fixed this
147 * for 3.2 but we'll use the old method with earlier versions.
148 * Windows and CIFSFS at least use this standard size. Not
152 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
153 (2*14) + /* word count (including bcc) */ \
156 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
157 const char lenbuf[4],
158 int fd, char **buffer,
159 unsigned int timeout,
163 /* Size of a WRITEX call (+4 byte len). */
164 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
165 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
169 memcpy(writeX_header, lenbuf, sizeof(lenbuf));
171 status = read_socket_with_timeout(
172 fd, writeX_header + 4,
173 STANDARD_WRITE_AND_X_HEADER_SIZE,
174 STANDARD_WRITE_AND_X_HEADER_SIZE,
177 if (!NT_STATUS_IS_OK(status)) {
182 * Ok - now try and see if this is a possible
186 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
188 * If the data offset is beyond what
189 * we've read, drain the extra bytes.
191 uint16_t doff = SVAL(writeX_header,smb_vwv11);
194 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
195 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
196 if (drain_socket(smbd_server_fd(), drain) != drain) {
197 smb_panic("receive_smb_raw_talloc_partial_read:"
198 " failed to drain pending bytes");
201 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
204 /* Spoof down the length and null out the bcc. */
205 set_message_bcc(writeX_header, 0);
206 newlen = smb_len(writeX_header);
208 /* Copy the header we've written. */
210 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
212 sizeof(writeX_header));
214 if (*buffer == NULL) {
215 DEBUG(0, ("Could not allocate inbuf of length %d\n",
216 (int)sizeof(writeX_header)));
217 return NT_STATUS_NO_MEMORY;
220 /* Work out the remaining bytes. */
221 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
222 *len_ret = newlen + 4;
226 if (!valid_packet_size(len)) {
227 return NT_STATUS_INVALID_PARAMETER;
231 * Not a valid writeX call. Just do the standard
235 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
237 if (*buffer == NULL) {
238 DEBUG(0, ("Could not allocate inbuf of length %d\n",
240 return NT_STATUS_NO_MEMORY;
243 /* Copy in what we already read. */
246 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
247 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
250 status = read_packet_remainder(
251 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
254 if (!NT_STATUS_IS_OK(status)) {
263 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
264 char **buffer, unsigned int timeout,
265 size_t *p_unread, size_t *plen)
269 int min_recv_size = lp_min_receive_file_size();
274 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
275 if (!NT_STATUS_IS_OK(status)) {
276 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
280 if (CVAL(lenbuf,0) == 0 &&
282 smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
283 !srv_is_signing_active()) {
285 status = receive_smb_raw_talloc_partial_read(
286 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, &len);
288 if (!NT_STATUS_IS_OK(status)) {
289 DEBUG(10, ("receive_smb_raw: %s\n",
295 if (!valid_packet_size(len)) {
296 return NT_STATUS_INVALID_PARAMETER;
300 * The +4 here can't wrap, we've checked the length above already.
303 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
305 if (*buffer == NULL) {
306 DEBUG(0, ("Could not allocate inbuf of length %d\n",
308 return NT_STATUS_NO_MEMORY;
311 memcpy(*buffer, lenbuf, sizeof(lenbuf));
313 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
314 if (!NT_STATUS_IS_OK(status)) {
322 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
323 char **buffer, unsigned int timeout,
324 size_t *p_unread, bool *p_encrypted,
330 *p_encrypted = false;
332 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
334 if (!NT_STATUS_IS_OK(status)) {
338 if (is_encrypted_packet((uint8_t *)*buffer)) {
339 status = srv_decrypt_buffer(*buffer);
340 if (!NT_STATUS_IS_OK(status)) {
341 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
342 "incoming packet! Error %s\n",
343 nt_errstr(status) ));
349 /* Check the incoming SMB signature. */
350 if (!srv_check_sign_mac(*buffer, true)) {
351 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
352 "incoming packet!\n"));
353 return NT_STATUS_INVALID_NETWORK_RESPONSE;
361 * Initialize a struct smb_request from an inbuf
364 void init_smb_request(struct smb_request *req,
369 size_t req_size = smb_len(inbuf) + 4;
370 /* Ensure we have at least smb_size bytes. */
371 if (req_size < smb_size) {
372 DEBUG(0,("init_smb_request: invalid request size %u\n",
373 (unsigned int)req_size ));
374 exit_server_cleanly("Invalid SMB request");
376 req->flags2 = SVAL(inbuf, smb_flg2);
377 req->smbpid = SVAL(inbuf, smb_pid);
378 req->mid = SVAL(inbuf, smb_mid);
379 req->vuid = SVAL(inbuf, smb_uid);
380 req->tid = SVAL(inbuf, smb_tid);
381 req->wct = CVAL(inbuf, smb_wct);
382 req->unread_bytes = unread_bytes;
383 req->encrypted = encrypted;
384 req->conn = conn_find(req->tid);
386 /* Ensure we have at least wct words and 2 bytes of bcc. */
387 if (smb_size + req->wct*2 > req_size) {
388 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
389 (unsigned int)req->wct,
390 (unsigned int)req_size));
391 exit_server_cleanly("Invalid SMB request");
393 /* Ensure bcc is correct. */
394 if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
395 DEBUG(0,("init_smb_request: invalid bcc number %u "
396 "(wct = %u, size %u)\n",
397 (unsigned int)smb_buflen(inbuf),
398 (unsigned int)req->wct,
399 (unsigned int)req_size));
400 exit_server_cleanly("Invalid SMB request");
406 /****************************************************************************
407 structure to hold a linked list of queued messages.
409 ****************************************************************************/
411 static struct pending_message_list *deferred_open_queue;
413 /****************************************************************************
414 Function to push a message onto the tail of a linked list of smb messages ready
416 ****************************************************************************/
418 static bool push_queued_message(struct smb_request *req,
419 struct timeval request_time,
420 struct timeval end_time,
421 char *private_data, size_t private_len)
423 int msg_len = smb_len(req->inbuf) + 4;
424 struct pending_message_list *msg;
426 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
429 DEBUG(0,("push_message: malloc fail (1)\n"));
433 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
434 if(msg->buf.data == NULL) {
435 DEBUG(0,("push_message: malloc fail (2)\n"));
440 msg->request_time = request_time;
441 msg->end_time = end_time;
442 msg->encrypted = req->encrypted;
445 msg->private_data = data_blob_talloc(msg, private_data,
447 if (msg->private_data.data == NULL) {
448 DEBUG(0,("push_message: malloc fail (3)\n"));
454 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
456 DEBUG(10,("push_message: pushed message length %u on "
457 "deferred_open_queue\n", (unsigned int)msg_len));
462 /****************************************************************************
463 Function to delete a sharing violation open message by mid.
464 ****************************************************************************/
466 void remove_deferred_open_smb_message(uint16 mid)
468 struct pending_message_list *pml;
470 for (pml = deferred_open_queue; pml; pml = pml->next) {
471 if (mid == SVAL(pml->buf.data,smb_mid)) {
472 DEBUG(10,("remove_sharing_violation_open_smb_message: "
473 "deleting mid %u len %u\n",
475 (unsigned int)pml->buf.length ));
476 DLIST_REMOVE(deferred_open_queue, pml);
483 /****************************************************************************
484 Move a sharing violation open retry message to the front of the list and
485 schedule it for immediate processing.
486 ****************************************************************************/
488 void schedule_deferred_open_smb_message(uint16 mid)
490 struct pending_message_list *pml;
493 for (pml = deferred_open_queue; pml; pml = pml->next) {
494 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
495 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
496 (unsigned int)msg_mid ));
497 if (mid == msg_mid) {
498 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
500 pml->end_time.tv_sec = 0;
501 pml->end_time.tv_usec = 0;
502 DLIST_PROMOTE(deferred_open_queue, pml);
507 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
511 /****************************************************************************
512 Return true if this mid is on the deferred queue.
513 ****************************************************************************/
515 bool open_was_deferred(uint16 mid)
517 struct pending_message_list *pml;
519 for (pml = deferred_open_queue; pml; pml = pml->next) {
520 if (SVAL(pml->buf.data,smb_mid) == mid) {
527 /****************************************************************************
528 Return the message queued by this mid.
529 ****************************************************************************/
531 struct pending_message_list *get_open_deferred_message(uint16 mid)
533 struct pending_message_list *pml;
535 for (pml = deferred_open_queue; pml; pml = pml->next) {
536 if (SVAL(pml->buf.data,smb_mid) == mid) {
543 /****************************************************************************
544 Function to push a deferred open smb message onto a linked list of local smb
545 messages ready for processing.
546 ****************************************************************************/
548 bool push_deferred_smb_message(struct smb_request *req,
549 struct timeval request_time,
550 struct timeval timeout,
551 char *private_data, size_t priv_len)
553 struct timeval end_time;
555 if (req->unread_bytes) {
556 DEBUG(0,("push_deferred_smb_message: logic error ! "
557 "unread_bytes = %u\n",
558 (unsigned int)req->unread_bytes ));
559 smb_panic("push_deferred_smb_message: "
560 "logic error unread_bytes != 0" );
563 end_time = timeval_sum(&request_time, &timeout);
565 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
566 "timeout time [%u.%06u]\n",
567 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
568 (unsigned int)end_time.tv_sec,
569 (unsigned int)end_time.tv_usec));
571 return push_queued_message(req, request_time, end_time,
572 private_data, priv_len);
576 struct timed_event *te;
577 struct timeval interval;
579 bool (*handler)(const struct timeval *now, void *private_data);
583 static void idle_event_handler(struct event_context *ctx,
584 struct timed_event *te,
585 const struct timeval *now,
588 struct idle_event *event =
589 talloc_get_type_abort(private_data, struct idle_event);
591 TALLOC_FREE(event->te);
593 if (!event->handler(now, event->private_data)) {
594 /* Don't repeat, delete ourselves */
599 event->te = event_add_timed(ctx, event,
600 timeval_sum(now, &event->interval),
602 idle_event_handler, event);
604 /* We can't do much but fail here. */
605 SMB_ASSERT(event->te != NULL);
608 struct idle_event *event_add_idle(struct event_context *event_ctx,
610 struct timeval interval,
612 bool (*handler)(const struct timeval *now,
616 struct idle_event *result;
617 struct timeval now = timeval_current();
619 result = TALLOC_P(mem_ctx, struct idle_event);
620 if (result == NULL) {
621 DEBUG(0, ("talloc failed\n"));
625 result->interval = interval;
626 result->handler = handler;
627 result->private_data = private_data;
629 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
630 DEBUG(0, ("talloc failed\n"));
635 result->te = event_add_timed(event_ctx, result,
636 timeval_sum(&now, &interval),
638 idle_event_handler, result);
639 if (result->te == NULL) {
640 DEBUG(0, ("event_add_timed failed\n"));
648 /****************************************************************************
649 Do all async processing in here. This includes kernel oplock messages, change
651 ****************************************************************************/
653 static void async_processing(fd_set *pfds)
655 DEBUG(10,("async_processing: Doing async processing.\n"));
659 process_kernel_oplocks(smbd_messaging_context(), pfds);
661 /* Do the aio check again after receive_local_message as it does a
662 select and may have eaten our signal. */
663 /* Is this till true? -- vl */
667 exit_server_cleanly("termination signal");
670 /* check for sighup processing */
671 if (reload_after_sighup) {
672 change_to_root_user();
673 DEBUG(1,("Reloading services after SIGHUP\n"));
674 reload_services(False);
675 reload_after_sighup = 0;
679 /****************************************************************************
680 Add a fd to the set we will be select(2)ing on.
681 ****************************************************************************/
683 static int select_on_fd(int fd, int maxfd, fd_set *fds)
687 maxfd = MAX(maxfd, fd);
693 /****************************************************************************
694 Do a select on an two fd's - with timeout.
696 If a local udp message has been pushed onto the
697 queue (this can only happen during oplock break
698 processing) call async_processing()
700 If a pending smb message has been pushed onto the
701 queue (this can only happen during oplock break
702 processing) return this next.
704 If the first smbfd is ready then read an smb from it.
705 if the second (loopback UDP) fd is ready then read a message
706 from it and setup the buffer header to identify the length
708 Returns False on timeout or error.
711 The timeout is in milliseconds
712 ****************************************************************************/
714 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
715 size_t *buffer_len, int timeout,
716 size_t *p_unread, bool *p_encrypted)
730 to.tv_sec = timeout / 1000;
731 to.tv_usec = (timeout % 1000) * 1000;
733 to.tv_sec = SMBD_SELECT_TIMEOUT;
738 * Note that this call must be before processing any SMB
739 * messages as we need to synchronously process any messages
740 * we may have sent to ourselves from the previous SMB.
742 message_dispatch(smbd_messaging_context());
745 * Check to see if we already have a message on the deferred open queue
746 * and it's time to schedule.
748 if(deferred_open_queue != NULL) {
749 bool pop_message = False;
750 struct pending_message_list *msg = deferred_open_queue;
752 if (timeval_is_zero(&msg->end_time)) {
759 tdif = usec_time_diff(&msg->end_time, &tv);
761 /* Timed out. Schedule...*/
763 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
765 /* Make a more accurate select timeout. */
766 to.tv_sec = tdif / 1000000;
767 to.tv_usec = tdif % 1000000;
768 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
769 (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
775 *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
777 if (*buffer == NULL) {
778 DEBUG(0, ("talloc failed\n"));
779 return NT_STATUS_NO_MEMORY;
781 *buffer_len = msg->buf.length;
782 *p_encrypted = msg->encrypted;
784 /* We leave this message on the queue so the open code can
785 know this is a retry. */
786 DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
792 * Setup the select fd sets.
799 * Ensure we process oplock break messages by preference.
800 * We have to do this before the select, after the select
801 * and if the select returns EINTR. This is due to the fact
802 * that the selects called from async_processing can eat an EINTR
803 * caused by a signal (we can't take the break message there).
804 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
807 if (oplock_message_waiting(&r_fds)) {
808 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
809 async_processing(&r_fds);
811 * After async processing we must go and do the select again, as
812 * the state of the flag in fds for the server file descriptor is
813 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
819 * Are there any timed events waiting ? If so, ensure we don't
820 * select for longer than it would take to wait for them.
827 event_add_to_select_args(smbd_event_context(), &now,
828 &r_fds, &w_fds, &to, &maxfd);
831 if (timeval_is_zero(&to)) {
832 /* Process a timed event now... */
833 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
840 START_PROFILE(smbd_idle);
842 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
843 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
845 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
848 END_PROFILE(smbd_idle);
852 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
856 /* if we get EINTR then maybe we have received an oplock
857 signal - treat this as select returning 1. This is ugly, but
858 is the best we can do until the oplock code knows more about
860 if (selrtn == -1 && errno == EINTR) {
861 async_processing(&r_fds);
863 * After async processing we must go and do the select again, as
864 * the state of the flag in fds for the server file descriptor is
865 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
872 /* something is wrong. Maybe the socket is dead? */
873 return map_nt_error_from_unix(errno);
876 /* Did we timeout ? */
878 return NT_STATUS_IO_TIMEOUT;
882 * Ensure we process oplock break messages by preference.
883 * This is IMPORTANT ! Otherwise we can starve other processes
884 * sending us an oplock break message. JRA.
887 if (oplock_message_waiting(&r_fds)) {
888 async_processing(&r_fds);
890 * After async processing we must go and do the select again, as
891 * the state of the flag in fds for the server file descriptor is
892 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
897 status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
898 p_unread, p_encrypted, &len);
900 if (!NT_STATUS_IS_OK(status)) {
910 * Only allow 5 outstanding trans requests. We're allocating memory, so
914 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
917 for (; list != NULL; list = list->next) {
919 if (list->mid == mid) {
920 return NT_STATUS_INVALID_PARAMETER;
926 return NT_STATUS_INSUFFICIENT_RESOURCES;
932 /****************************************************************************
933 We're terminating and have closed all our files/connections etc.
934 If there are any pending local messages we need to respond to them
935 before termination so that other smbds don't think we just died whilst
937 ****************************************************************************/
939 void respond_to_all_remaining_local_messages(void)
942 * Assert we have no exclusive open oplocks.
945 if(get_number_of_exclusive_open_oplocks()) {
946 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
947 get_number_of_exclusive_open_oplocks() ));
951 process_kernel_oplocks(smbd_messaging_context(), NULL);
958 These flags determine some of the permissions required to do an operation
960 Note that I don't set NEED_WRITE on some write operations because they
961 are used by some brain-dead clients when printing, and I don't want to
962 force write permissions on print services.
964 #define AS_USER (1<<0)
965 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
966 #define TIME_INIT (1<<2)
967 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
968 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
969 #define DO_CHDIR (1<<6)
972 define a list of possible SMB messages and their corresponding
973 functions. Any message that has a NULL function is unimplemented -
974 please feel free to contribute implementations!
976 static const struct smb_message_struct {
978 void (*fn_new)(struct smb_request *req);
980 } smb_messages[256] = {
982 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
983 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
984 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
985 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
986 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
987 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
988 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
989 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
990 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
991 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
992 /* 0x0a */ { "SMBread",reply_read,AS_USER},
993 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
994 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
995 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
996 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
997 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
998 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
999 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1000 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1001 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1002 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1003 /* 0x15 */ { NULL, NULL, 0 },
1004 /* 0x16 */ { NULL, NULL, 0 },
1005 /* 0x17 */ { NULL, NULL, 0 },
1006 /* 0x18 */ { NULL, NULL, 0 },
1007 /* 0x19 */ { NULL, NULL, 0 },
1008 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1009 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1010 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1011 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1012 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1013 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1014 /* 0x20 */ { "SMBwritec", NULL,0},
1015 /* 0x21 */ { NULL, NULL, 0 },
1016 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1017 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1018 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1019 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1020 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1021 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1022 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1023 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1024 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1025 /* 0x2b */ { "SMBecho",reply_echo,0},
1026 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1027 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1028 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1029 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1030 /* 0x30 */ { NULL, NULL, 0 },
1031 /* 0x31 */ { NULL, NULL, 0 },
1032 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1033 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1034 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1035 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1036 /* 0x36 */ { NULL, NULL, 0 },
1037 /* 0x37 */ { NULL, NULL, 0 },
1038 /* 0x38 */ { NULL, NULL, 0 },
1039 /* 0x39 */ { NULL, NULL, 0 },
1040 /* 0x3a */ { NULL, NULL, 0 },
1041 /* 0x3b */ { NULL, NULL, 0 },
1042 /* 0x3c */ { NULL, NULL, 0 },
1043 /* 0x3d */ { NULL, NULL, 0 },
1044 /* 0x3e */ { NULL, NULL, 0 },
1045 /* 0x3f */ { NULL, NULL, 0 },
1046 /* 0x40 */ { NULL, NULL, 0 },
1047 /* 0x41 */ { NULL, NULL, 0 },
1048 /* 0x42 */ { NULL, NULL, 0 },
1049 /* 0x43 */ { NULL, NULL, 0 },
1050 /* 0x44 */ { NULL, NULL, 0 },
1051 /* 0x45 */ { NULL, NULL, 0 },
1052 /* 0x46 */ { NULL, NULL, 0 },
1053 /* 0x47 */ { NULL, NULL, 0 },
1054 /* 0x48 */ { NULL, NULL, 0 },
1055 /* 0x49 */ { NULL, NULL, 0 },
1056 /* 0x4a */ { NULL, NULL, 0 },
1057 /* 0x4b */ { NULL, NULL, 0 },
1058 /* 0x4c */ { NULL, NULL, 0 },
1059 /* 0x4d */ { NULL, NULL, 0 },
1060 /* 0x4e */ { NULL, NULL, 0 },
1061 /* 0x4f */ { NULL, NULL, 0 },
1062 /* 0x50 */ { NULL, NULL, 0 },
1063 /* 0x51 */ { NULL, NULL, 0 },
1064 /* 0x52 */ { NULL, NULL, 0 },
1065 /* 0x53 */ { NULL, NULL, 0 },
1066 /* 0x54 */ { NULL, NULL, 0 },
1067 /* 0x55 */ { NULL, NULL, 0 },
1068 /* 0x56 */ { NULL, NULL, 0 },
1069 /* 0x57 */ { NULL, NULL, 0 },
1070 /* 0x58 */ { NULL, NULL, 0 },
1071 /* 0x59 */ { NULL, NULL, 0 },
1072 /* 0x5a */ { NULL, NULL, 0 },
1073 /* 0x5b */ { NULL, NULL, 0 },
1074 /* 0x5c */ { NULL, NULL, 0 },
1075 /* 0x5d */ { NULL, NULL, 0 },
1076 /* 0x5e */ { NULL, NULL, 0 },
1077 /* 0x5f */ { NULL, NULL, 0 },
1078 /* 0x60 */ { NULL, NULL, 0 },
1079 /* 0x61 */ { NULL, NULL, 0 },
1080 /* 0x62 */ { NULL, NULL, 0 },
1081 /* 0x63 */ { NULL, NULL, 0 },
1082 /* 0x64 */ { NULL, NULL, 0 },
1083 /* 0x65 */ { NULL, NULL, 0 },
1084 /* 0x66 */ { NULL, NULL, 0 },
1085 /* 0x67 */ { NULL, NULL, 0 },
1086 /* 0x68 */ { NULL, NULL, 0 },
1087 /* 0x69 */ { NULL, NULL, 0 },
1088 /* 0x6a */ { NULL, NULL, 0 },
1089 /* 0x6b */ { NULL, NULL, 0 },
1090 /* 0x6c */ { NULL, NULL, 0 },
1091 /* 0x6d */ { NULL, NULL, 0 },
1092 /* 0x6e */ { NULL, NULL, 0 },
1093 /* 0x6f */ { NULL, NULL, 0 },
1094 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1095 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1096 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1097 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1098 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1099 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1100 /* 0x76 */ { NULL, NULL, 0 },
1101 /* 0x77 */ { NULL, NULL, 0 },
1102 /* 0x78 */ { NULL, NULL, 0 },
1103 /* 0x79 */ { NULL, NULL, 0 },
1104 /* 0x7a */ { NULL, NULL, 0 },
1105 /* 0x7b */ { NULL, NULL, 0 },
1106 /* 0x7c */ { NULL, NULL, 0 },
1107 /* 0x7d */ { NULL, NULL, 0 },
1108 /* 0x7e */ { NULL, NULL, 0 },
1109 /* 0x7f */ { NULL, NULL, 0 },
1110 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1111 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1112 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1113 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1114 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1115 /* 0x85 */ { NULL, NULL, 0 },
1116 /* 0x86 */ { NULL, NULL, 0 },
1117 /* 0x87 */ { NULL, NULL, 0 },
1118 /* 0x88 */ { NULL, NULL, 0 },
1119 /* 0x89 */ { NULL, NULL, 0 },
1120 /* 0x8a */ { NULL, NULL, 0 },
1121 /* 0x8b */ { NULL, NULL, 0 },
1122 /* 0x8c */ { NULL, NULL, 0 },
1123 /* 0x8d */ { NULL, NULL, 0 },
1124 /* 0x8e */ { NULL, NULL, 0 },
1125 /* 0x8f */ { NULL, NULL, 0 },
1126 /* 0x90 */ { NULL, NULL, 0 },
1127 /* 0x91 */ { NULL, NULL, 0 },
1128 /* 0x92 */ { NULL, NULL, 0 },
1129 /* 0x93 */ { NULL, NULL, 0 },
1130 /* 0x94 */ { NULL, NULL, 0 },
1131 /* 0x95 */ { NULL, NULL, 0 },
1132 /* 0x96 */ { NULL, NULL, 0 },
1133 /* 0x97 */ { NULL, NULL, 0 },
1134 /* 0x98 */ { NULL, NULL, 0 },
1135 /* 0x99 */ { NULL, NULL, 0 },
1136 /* 0x9a */ { NULL, NULL, 0 },
1137 /* 0x9b */ { NULL, NULL, 0 },
1138 /* 0x9c */ { NULL, NULL, 0 },
1139 /* 0x9d */ { NULL, NULL, 0 },
1140 /* 0x9e */ { NULL, NULL, 0 },
1141 /* 0x9f */ { NULL, NULL, 0 },
1142 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1143 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1144 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1145 /* 0xa3 */ { NULL, NULL, 0 },
1146 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1147 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1148 /* 0xa6 */ { NULL, NULL, 0 },
1149 /* 0xa7 */ { NULL, NULL, 0 },
1150 /* 0xa8 */ { NULL, NULL, 0 },
1151 /* 0xa9 */ { NULL, NULL, 0 },
1152 /* 0xaa */ { NULL, NULL, 0 },
1153 /* 0xab */ { NULL, NULL, 0 },
1154 /* 0xac */ { NULL, NULL, 0 },
1155 /* 0xad */ { NULL, NULL, 0 },
1156 /* 0xae */ { NULL, NULL, 0 },
1157 /* 0xaf */ { NULL, NULL, 0 },
1158 /* 0xb0 */ { NULL, NULL, 0 },
1159 /* 0xb1 */ { NULL, NULL, 0 },
1160 /* 0xb2 */ { NULL, NULL, 0 },
1161 /* 0xb3 */ { NULL, NULL, 0 },
1162 /* 0xb4 */ { NULL, NULL, 0 },
1163 /* 0xb5 */ { NULL, NULL, 0 },
1164 /* 0xb6 */ { NULL, NULL, 0 },
1165 /* 0xb7 */ { NULL, NULL, 0 },
1166 /* 0xb8 */ { NULL, NULL, 0 },
1167 /* 0xb9 */ { NULL, NULL, 0 },
1168 /* 0xba */ { NULL, NULL, 0 },
1169 /* 0xbb */ { NULL, NULL, 0 },
1170 /* 0xbc */ { NULL, NULL, 0 },
1171 /* 0xbd */ { NULL, NULL, 0 },
1172 /* 0xbe */ { NULL, NULL, 0 },
1173 /* 0xbf */ { NULL, NULL, 0 },
1174 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1175 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1176 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1177 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1178 /* 0xc4 */ { NULL, NULL, 0 },
1179 /* 0xc5 */ { NULL, NULL, 0 },
1180 /* 0xc6 */ { NULL, NULL, 0 },
1181 /* 0xc7 */ { NULL, NULL, 0 },
1182 /* 0xc8 */ { NULL, NULL, 0 },
1183 /* 0xc9 */ { NULL, NULL, 0 },
1184 /* 0xca */ { NULL, NULL, 0 },
1185 /* 0xcb */ { NULL, NULL, 0 },
1186 /* 0xcc */ { NULL, NULL, 0 },
1187 /* 0xcd */ { NULL, NULL, 0 },
1188 /* 0xce */ { NULL, NULL, 0 },
1189 /* 0xcf */ { NULL, NULL, 0 },
1190 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1191 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1192 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1193 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1194 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1195 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1196 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1197 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1198 /* 0xd8 */ { NULL, NULL, 0 },
1199 /* 0xd9 */ { NULL, NULL, 0 },
1200 /* 0xda */ { NULL, NULL, 0 },
1201 /* 0xdb */ { NULL, NULL, 0 },
1202 /* 0xdc */ { NULL, NULL, 0 },
1203 /* 0xdd */ { NULL, NULL, 0 },
1204 /* 0xde */ { NULL, NULL, 0 },
1205 /* 0xdf */ { NULL, NULL, 0 },
1206 /* 0xe0 */ { NULL, NULL, 0 },
1207 /* 0xe1 */ { NULL, NULL, 0 },
1208 /* 0xe2 */ { NULL, NULL, 0 },
1209 /* 0xe3 */ { NULL, NULL, 0 },
1210 /* 0xe4 */ { NULL, NULL, 0 },
1211 /* 0xe5 */ { NULL, NULL, 0 },
1212 /* 0xe6 */ { NULL, NULL, 0 },
1213 /* 0xe7 */ { NULL, NULL, 0 },
1214 /* 0xe8 */ { NULL, NULL, 0 },
1215 /* 0xe9 */ { NULL, NULL, 0 },
1216 /* 0xea */ { NULL, NULL, 0 },
1217 /* 0xeb */ { NULL, NULL, 0 },
1218 /* 0xec */ { NULL, NULL, 0 },
1219 /* 0xed */ { NULL, NULL, 0 },
1220 /* 0xee */ { NULL, NULL, 0 },
1221 /* 0xef */ { NULL, NULL, 0 },
1222 /* 0xf0 */ { NULL, NULL, 0 },
1223 /* 0xf1 */ { NULL, NULL, 0 },
1224 /* 0xf2 */ { NULL, NULL, 0 },
1225 /* 0xf3 */ { NULL, NULL, 0 },
1226 /* 0xf4 */ { NULL, NULL, 0 },
1227 /* 0xf5 */ { NULL, NULL, 0 },
1228 /* 0xf6 */ { NULL, NULL, 0 },
1229 /* 0xf7 */ { NULL, NULL, 0 },
1230 /* 0xf8 */ { NULL, NULL, 0 },
1231 /* 0xf9 */ { NULL, NULL, 0 },
1232 /* 0xfa */ { NULL, NULL, 0 },
1233 /* 0xfb */ { NULL, NULL, 0 },
1234 /* 0xfc */ { NULL, NULL, 0 },
1235 /* 0xfd */ { NULL, NULL, 0 },
1236 /* 0xfe */ { NULL, NULL, 0 },
1237 /* 0xff */ { NULL, NULL, 0 }
1241 /*******************************************************************
1242 allocate and initialize a reply packet
1243 ********************************************************************/
1245 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1248 * Protect against integer wrap
1250 if ((num_bytes > 0xffffff)
1251 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1253 asprintf(&msg, "num_bytes too large: %u",
1254 (unsigned)num_bytes);
1258 if (!(req->outbuf = TALLOC_ARRAY(
1260 smb_size + num_words*2 + num_bytes))) {
1261 smb_panic("could not allocate output buffer\n");
1264 construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1265 srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1267 * Zero out the word area, the caller has to take care of the bcc area
1270 if (num_words != 0) {
1271 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1278 /*******************************************************************
1279 Dump a packet to a file.
1280 ********************************************************************/
1282 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1286 if (DEBUGLEVEL < 50) {
1290 if (len < 4) len = smb_len(data)+4;
1291 for (i=1;i<100;i++) {
1292 asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1293 type ? "req" : "resp");
1297 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1298 if (fd != -1 || errno != EEXIST) break;
1301 ssize_t ret = write(fd, data, len);
1303 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1305 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1310 /****************************************************************************
1311 Prepare everything for calling the actual request function, and potentially
1312 call the request function via the "new" interface.
1314 Return False if the "legacy" function needs to be called, everything is
1317 Return True if we're done.
1319 I know this API sucks, but it is the one with the least code change I could
1321 ****************************************************************************/
1323 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1327 connection_struct *conn = NULL;
1329 static uint16 last_session_tag = UID_FIELD_INVALID;
1333 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1334 * so subtract 4 from it. */
1335 if (!valid_smb_header(req->inbuf)
1336 || (size < (smb_size - 4))) {
1337 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1338 smb_len(req->inbuf)));
1339 exit_server_cleanly("Non-SMB packet");
1342 if (smb_messages[type].fn_new == NULL) {
1343 DEBUG(0,("Unknown message type %d!\n",type));
1344 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1345 reply_unknown_new(req, type);
1349 flags = smb_messages[type].flags;
1351 /* In share mode security we must ignore the vuid. */
1352 session_tag = (lp_security() == SEC_SHARE)
1353 ? UID_FIELD_INVALID : req->vuid;
1356 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1357 (int)sys_getpid(), (unsigned long)conn));
1359 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1361 /* Ensure this value is replaced in the incoming packet. */
1362 SSVAL(req->inbuf,smb_uid,session_tag);
1365 * Ensure the correct username is in current_user_info. This is a
1366 * really ugly bugfix for problems with multiple session_setup_and_X's
1367 * being done and allowing %U and %G substitutions to work correctly.
1368 * There is a reason this code is done here, don't move it unless you
1369 * know what you're doing... :-).
1373 if (session_tag != last_session_tag) {
1374 user_struct *vuser = NULL;
1376 last_session_tag = session_tag;
1377 if(session_tag != UID_FIELD_INVALID) {
1378 vuser = get_valid_user_struct(session_tag);
1380 set_current_user_info(&vuser->user);
1385 /* Does this call need to be run as the connected user? */
1386 if (flags & AS_USER) {
1388 /* Does this call need a valid tree connection? */
1391 * Amazingly, the error code depends on the command
1394 if (type == SMBntcreateX) {
1395 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1397 reply_doserror(req, ERRSRV, ERRinvnid);
1402 if (!change_to_user(conn,session_tag)) {
1403 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1407 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1409 /* Does it need write permission? */
1410 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1411 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1415 /* IPC services are limited */
1416 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1417 reply_doserror(req, ERRSRV,ERRaccess);
1421 /* This call needs to be run as root */
1422 change_to_root_user();
1425 /* load service specific parameters */
1427 if (req->encrypted) {
1428 conn->encrypted_tid = true;
1429 /* encrypted required from now on. */
1430 conn->encrypt_level = Required;
1431 } else if (ENCRYPTION_REQUIRED(conn)) {
1432 uint8 com = CVAL(req->inbuf,smb_com);
1433 if (com != SMBtrans2 && com != SMBtranss2) {
1434 exit_server_cleanly("encryption required "
1440 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1441 (flags & (AS_USER|DO_CHDIR)
1443 reply_doserror(req, ERRSRV, ERRaccess);
1446 conn->num_smb_operations++;
1449 /* does this protocol need to be run as guest? */
1450 if ((flags & AS_GUEST)
1451 && (!change_to_guest() ||
1452 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1453 lp_hostsdeny(-1)))) {
1454 reply_doserror(req, ERRSRV, ERRaccess);
1458 smb_messages[type].fn_new(req);
1462 /****************************************************************************
1463 Construct a reply to the incoming packet.
1464 ****************************************************************************/
1466 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1468 uint8 type = CVAL(inbuf,smb_com);
1469 connection_struct *conn;
1470 struct smb_request *req;
1476 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1477 smb_panic("could not allocate smb_request");
1479 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1481 conn = switch_message(type, req, size);
1483 if (req->unread_bytes) {
1484 /* writeX failed. drain socket. */
1485 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1486 req->unread_bytes) {
1487 smb_panic("failed to drain pending bytes");
1489 req->unread_bytes = 0;
1492 if (req->outbuf == NULL) {
1496 if (CVAL(req->outbuf,0) == 0) {
1497 show_msg((char *)req->outbuf);
1500 if (!srv_send_smb(smbd_server_fd(),
1501 (char *)req->outbuf,
1502 IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1503 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1511 /****************************************************************************
1512 Process an smb from the client
1513 ****************************************************************************/
1515 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1517 static int trans_num;
1518 int msg_type = CVAL(inbuf,0);
1520 DO_PROFILE_INC(smb_count);
1522 if (trans_num == 0) {
1523 char addr[INET6_ADDRSTRLEN];
1525 /* on the first packet, check the global hosts allow/ hosts
1526 deny parameters before doing any parsing of the packet
1527 passed to us by the client. This prevents attacks on our
1528 parsing code from hosts not in the hosts allow list */
1530 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1531 lp_hostsdeny(-1))) {
1532 /* send a negative session response "not listening on calling name" */
1533 static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1534 DEBUG( 1, ( "Connection denied from %s\n",
1535 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1536 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1537 exit_server_cleanly("connection denied");
1541 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1543 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1545 (unsigned int)unread_bytes ));
1547 if (msg_type != 0) {
1549 * NetBIOS session request, keepalive, etc.
1551 reply_special(inbuf);
1557 construct_reply(inbuf,nread,unread_bytes,encrypted);
1562 /****************************************************************************
1563 Return a string containing the function name of a SMB command.
1564 ****************************************************************************/
1566 const char *smb_fn_name(int type)
1568 const char *unknown_name = "SMBunknown";
1570 if (smb_messages[type].name == NULL)
1571 return(unknown_name);
1573 return(smb_messages[type].name);
1576 /****************************************************************************
1577 Helper functions for contruct_reply.
1578 ****************************************************************************/
1580 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1582 void add_to_common_flags2(uint32 v)
1587 void remove_from_common_flags2(uint32 v)
1589 common_flags2 &= ~v;
1592 void construct_reply_common(const char *inbuf, char *outbuf)
1594 srv_set_message(outbuf,0,0,false);
1596 SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1597 SIVAL(outbuf,smb_rcls,0);
1598 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1599 SSVAL(outbuf,smb_flg2,
1600 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1602 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1604 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1605 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1606 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1607 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1610 /****************************************************************************
1611 Construct a chained reply and add it to the already made reply
1612 ****************************************************************************/
1614 void chain_reply(struct smb_request *req)
1616 static char *orig_inbuf;
1619 * Dirty little const_discard: We mess with req->inbuf, which is
1620 * declared as const. If maybe at some point this routine gets
1621 * rewritten, this const_discard could go away.
1623 char *inbuf = CONST_DISCARD(char *, req->inbuf);
1624 int size = smb_len(req->inbuf)+4;
1626 int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1627 unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1631 char inbuf_saved[smb_wct];
1632 char *outbuf = (char *)req->outbuf;
1633 size_t outsize = smb_len(outbuf) + 4;
1634 size_t outsize_padded;
1635 size_t ofs, to_move;
1637 struct smb_request *req2;
1638 size_t caller_outputlen;
1639 char *caller_output;
1641 /* Maybe its not chained, or it's an error packet. */
1642 if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1643 SCVAL(outbuf,smb_vwv0,0xFF);
1647 if (chain_size == 0) {
1648 /* this is the first part of the chain */
1653 * We need to save the output the caller added to the chain so that we
1654 * can splice it into the final output buffer later.
1657 caller_outputlen = outsize - smb_wct;
1659 caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1661 if (caller_output == NULL) {
1662 /* TODO: NT_STATUS_NO_MEMORY */
1663 smb_panic("could not dup outbuf");
1667 * The original Win95 redirector dies on a reply to
1668 * a lockingX and read chain unless the chain reply is
1669 * 4 byte aligned. JRA.
1672 outsize_padded = (outsize + 3) & ~3;
1675 * remember how much the caller added to the chain, only counting
1676 * stuff after the parameter words
1678 chain_size += outsize_padded - smb_wct;
1681 * work out pointers into the original packets. The
1682 * headers on these need to be filled in
1684 inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1686 /* remember the original command type */
1687 smb_com1 = CVAL(orig_inbuf,smb_com);
1689 /* save the data which will be overwritten by the new headers */
1690 memcpy(inbuf_saved,inbuf2,smb_wct);
1692 /* give the new packet the same header as the last part of the SMB */
1693 memmove(inbuf2,inbuf,smb_wct);
1695 /* create the in buffer */
1696 SCVAL(inbuf2,smb_com,smb_com2);
1698 /* work out the new size for the in buffer. */
1699 new_size = size - (inbuf2 - inbuf);
1701 DEBUG(0,("chain_reply: chain packet size incorrect "
1702 "(orig size = %d, offset = %d)\n",
1703 size, (int)(inbuf2 - inbuf) ));
1704 exit_server_cleanly("Bad chained packet");
1708 /* And set it in the header. */
1709 smb_setlen(inbuf2, new_size - 4);
1711 DEBUG(3,("Chained message\n"));
1714 if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1715 smb_panic("could not allocate smb_request");
1717 init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1719 /* process the request */
1720 switch_message(smb_com2, req2, new_size);
1723 * We don't accept deferred operations in chained requests.
1725 SMB_ASSERT(req2->outbuf != NULL);
1726 outsize2 = smb_len(req2->outbuf)+4;
1729 * Move away the new command output so that caller_output fits in,
1730 * copy in the caller_output saved above.
1733 SMB_ASSERT(outsize_padded >= smb_wct);
1736 * "ofs" is the space we need for caller_output. Equal to
1737 * caller_outputlen plus the padding.
1740 ofs = outsize_padded - smb_wct;
1743 * "to_move" is the amount of bytes the secondary routine gave us
1746 to_move = outsize2 - smb_wct;
1748 if (to_move + ofs + smb_wct + chain_size > max_send) {
1749 smb_panic("replies too large -- would have to cut");
1753 * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1754 * the first request in the chain. So we have to re-allocate it. In
1755 * the "old" API the only outbuf ever used is the global OutBuffer
1756 * which is always large enough.
1759 outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1760 to_move + ofs + smb_wct);
1761 if (outbuf == NULL) {
1762 smb_panic("could not realloc outbuf");
1765 req->outbuf = (uint8 *)outbuf;
1767 memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1768 memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1771 * copy the new reply header over the old one but preserve the smb_com
1774 memmove(outbuf, req2->outbuf, smb_wct);
1775 SCVAL(outbuf, smb_com, smb_com1);
1778 * We've just copied in the whole "wct" area from the secondary
1779 * function. Fix up the chaining: com2 and the offset need to be
1783 SCVAL(outbuf, smb_vwv0, smb_com2);
1784 SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1786 if (outsize_padded > outsize) {
1789 * Due to padding we have some uninitialized bytes after the
1793 memset(outbuf + outsize, 0, outsize_padded - outsize);
1796 smb_setlen(outbuf, outsize2 + chain_size - 4);
1799 * restore the saved data, being careful not to overwrite any data
1800 * from the reply header
1802 memcpy(inbuf2,inbuf_saved,smb_wct);
1804 SAFE_FREE(caller_output);
1810 /****************************************************************************
1811 Setup the needed select timeout in milliseconds.
1812 ****************************************************************************/
1814 static int setup_select_timeout(void)
1818 select_timeout = SMBD_SELECT_TIMEOUT*1000;
1820 if (print_notify_messages_pending()) {
1821 select_timeout = MIN(select_timeout, 1000);
1824 return select_timeout;
1827 /****************************************************************************
1828 Check if services need reloading.
1829 ****************************************************************************/
1831 void check_reload(time_t t)
1833 static pid_t mypid = 0;
1834 static time_t last_smb_conf_reload_time = 0;
1835 static time_t last_printer_reload_time = 0;
1836 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1838 if(last_smb_conf_reload_time == 0) {
1839 last_smb_conf_reload_time = t;
1840 /* Our printing subsystem might not be ready at smbd start up.
1841 Then no printer is available till the first printers check
1842 is performed. A lower initial interval circumvents this. */
1843 if ( printcap_cache_time > 60 )
1844 last_printer_reload_time = t - printcap_cache_time + 60;
1846 last_printer_reload_time = t;
1849 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1850 /* randomize over 60 second the printcap reload to avoid all
1851 * process hitting cupsd at the same time */
1852 int time_range = 60;
1854 last_printer_reload_time += random() % time_range;
1858 if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1859 reload_services(True);
1860 reload_after_sighup = False;
1861 last_smb_conf_reload_time = t;
1864 /* 'printcap cache time = 0' disable the feature */
1866 if ( printcap_cache_time != 0 )
1868 /* see if it's time to reload or if the clock has been set back */
1870 if ( (t >= last_printer_reload_time+printcap_cache_time)
1871 || (t-last_printer_reload_time < 0) )
1873 DEBUG( 3,( "Printcap cache time expired.\n"));
1875 last_printer_reload_time = t;
1880 /****************************************************************************
1881 Process any timeout housekeeping. Return False if the caller should exit.
1882 ****************************************************************************/
1884 static void timeout_processing(int *select_timeout,
1885 time_t *last_timeout_processing_time)
1889 *last_timeout_processing_time = t = time(NULL);
1891 /* become root again if waiting */
1892 change_to_root_user();
1894 /* check if we need to reload services */
1897 if(global_machine_password_needs_changing &&
1898 /* for ADS we need to do a regular ADS password change, not a domain
1900 lp_security() == SEC_DOMAIN) {
1902 unsigned char trust_passwd_hash[16];
1906 * We're in domain level security, and the code that
1907 * read the machine password flagged that the machine
1908 * password needs changing.
1912 * First, open the machine password file with an exclusive lock.
1915 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1916 DEBUG(0,("process: unable to lock the machine account password for \
1917 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1921 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1922 DEBUG(0,("process: unable to read the machine account password for \
1923 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1924 secrets_lock_trust_account_password(lp_workgroup(), False);
1929 * Make sure someone else hasn't already done this.
1932 if(t < lct + lp_machine_password_timeout()) {
1933 global_machine_password_needs_changing = False;
1934 secrets_lock_trust_account_password(lp_workgroup(), False);
1938 /* always just contact the PDC here */
1940 change_trust_account_password( lp_workgroup(), NULL);
1941 global_machine_password_needs_changing = False;
1942 secrets_lock_trust_account_password(lp_workgroup(), False);
1945 /* update printer queue caches if necessary */
1947 update_monitored_printq_cache();
1950 * Now we are root, check if the log files need pruning.
1951 * Force a log file check.
1953 force_check_log_size();
1956 /* Send any queued printer notify message to interested smbd's. */
1958 print_notify_send_messages(smbd_messaging_context(), 0);
1961 * Modify the select timeout depending upon
1962 * what we have remaining in our queues.
1965 *select_timeout = setup_select_timeout();
1970 /****************************************************************************
1971 Process commands from the client
1972 ****************************************************************************/
1974 void smbd_process(void)
1976 time_t last_timeout_processing_time = time(NULL);
1977 unsigned int num_smbs = 0;
1978 size_t unread_bytes = 0;
1980 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1983 int select_timeout = setup_select_timeout();
1986 size_t inbuf_len = 0;
1987 bool encrypted = false;
1988 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1992 /* Did someone ask for immediate checks on things like blocking locks ? */
1993 if (select_timeout == 0) {
1994 timeout_processing(&select_timeout,
1995 &last_timeout_processing_time);
1996 num_smbs = 0; /* Reset smb counter. */
1999 run_events(smbd_event_context(), 0, NULL, NULL);
2004 status = receive_message_or_smb(
2005 talloc_tos(), &inbuf, &inbuf_len,
2006 select_timeout, &unread_bytes, &encrypted);
2008 if (NT_STATUS_IS_OK(status)) {
2012 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
2015 &last_timeout_processing_time);
2019 DEBUG(3, ("receive_message_or_smb failed: %s, "
2020 "exiting\n", nt_errstr(status)));
2023 num_smbs = 0; /* Reset smb counter. */
2028 * Ensure we do timeout processing if the SMB we just got was
2029 * only an echo request. This allows us to set the select
2030 * timeout in 'receive_message_or_smb()' to any value we like
2031 * without worrying that the client will send echo requests
2032 * faster than the select timeout, thus starving out the
2033 * essential processing (change notify, blocking locks) that
2034 * the timeout code does. JRA.
2036 num_echos = smb_echo_count;
2038 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2042 if (smb_echo_count != num_echos) {
2043 timeout_processing(&select_timeout,
2044 &last_timeout_processing_time);
2045 num_smbs = 0; /* Reset smb counter. */
2051 * If we are getting smb requests in a constant stream
2052 * with no echos, make sure we attempt timeout processing
2053 * every select_timeout milliseconds - but only check for this
2054 * every 200 smb requests.
2057 if ((num_smbs % 200) == 0) {
2058 time_t new_check_time = time(NULL);
2059 if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2062 &last_timeout_processing_time);
2063 num_smbs = 0; /* Reset smb counter. */
2064 last_timeout_processing_time = new_check_time; /* Reset time. */
2068 /* The timeout_processing function isn't run nearly
2069 often enough to implement 'max log size' without
2070 overrunning the size of the file by many megabytes.
2071 This is especially true if we are running at debug
2072 level 10. Checking every 50 SMBs is a nice
2073 tradeoff of performance vs log file size overrun. */
2075 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2076 change_to_root_user();