ebe194814109096d963cfbc74acf16592f83e986
[kai/samba.git] / source3 / nmbd / nmbd_incomingrequests.c
1 /* 
2    Unix SMB/CIFS implementation.
3    NBT netbios routines and daemon - version 2
4    Copyright (C) Andrew Tridgell 1994-1998
5    Copyright (C) Luke Kenneth Casson Leighton 1994-1998
6    Copyright (C) Jeremy Allison 1994-2003
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20    
21    This file contains all the code to process NetBIOS requests coming
22    in on port 137. It does not deal with the code needed to service
23    WINS server requests, but only broadcast and unicast requests.
24
25 */
26
27 #include "includes.h"
28
29 /****************************************************************************
30 Send a name release response.
31 **************************************************************************/
32
33 static void send_name_release_response(int rcode, struct packet_struct *p)
34 {
35         struct nmb_packet *nmb = &p->packet.nmb;
36         char rdata[6];
37
38         memcpy(&rdata[0], &nmb->additional->rdata[0], 6);
39   
40         reply_netbios_packet(p,                       /* Packet to reply to. */
41                         rcode,                        /* Result code. */
42                         NMB_REL,                      /* nmbd type code. */
43                         NMB_NAME_RELEASE_OPCODE,      /* opcode. */
44                         0,                            /* ttl. */
45                         rdata,                        /* data to send. */
46                         6);                           /* data length. */
47 }
48
49 /****************************************************************************
50 Process a name release packet on a broadcast subnet.
51 Ignore it if it's not one of our names.
52 ****************************************************************************/
53
54 void process_name_release_request(struct subnet_record *subrec, 
55                                   struct packet_struct *p)
56 {
57         struct nmb_packet *nmb = &p->packet.nmb;
58         struct in_addr owner_ip;
59         struct nmb_name *question = &nmb->question.question_name;
60         unstring qname;
61         bool bcast = nmb->header.nm_flags.bcast;
62         uint16 nb_flags = get_nb_flags(nmb->additional->rdata);
63         bool group = (nb_flags & NB_GROUP) ? True : False;
64         struct name_record *namerec;
65         int rcode = 0;
66   
67         putip((char *)&owner_ip,&nmb->additional->rdata[2]);  
68   
69         if(!bcast) {
70                 /* We should only get broadcast name release packets here.
71                    Anyone trying to release unicast should be going to a WINS
72                    server. If the code gets here, then either we are not a wins
73                    server and they sent it anyway, or we are a WINS server and
74                    the request was malformed. Either way, log an error here.
75                    and send an error reply back.
76                 */
77                 DEBUG(0,("process_name_release_request: unicast name release request \
78 received for name %s from IP %s on subnet %s. Error - should be sent to WINS server\n",
79                         nmb_namestr(question), inet_ntoa(owner_ip), subrec->subnet_name));      
80
81                 send_name_release_response(FMT_ERR, p);
82                 return;
83         }
84
85         DEBUG(3,("process_name_release_request: Name release on name %s, \
86 subnet %s from owner IP %s\n",
87                 nmb_namestr(&nmb->question.question_name),
88                 subrec->subnet_name, inet_ntoa(owner_ip)));
89   
90         /* If someone is releasing a broadcast group name, just ignore it. */
91         if( group && !ismyip_v4(owner_ip) )
92                 return;
93
94         /*
95          * Code to work around a bug in FTP OnNet software NBT implementation.
96          * They do a broadcast name release for WORKGROUP<0> and WORKGROUP<1e>
97          * names and *don't set the group bit* !!!!!
98          */
99
100         pull_ascii_nstring(qname, sizeof(qname), question->name);
101         if( !group && !ismyip_v4(owner_ip) && strequal(qname, lp_workgroup()) && 
102                         ((question->name_type == 0x0) || (question->name_type == 0x1e))) {
103                 DEBUG(6,("process_name_release_request: FTP OnNet bug workaround. Ignoring \
104 group release name %s from IP %s on subnet %s with no group bit set.\n",
105                         nmb_namestr(question), inet_ntoa(owner_ip), subrec->subnet_name ));
106                 return;
107         }
108
109         namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME);
110
111         /* We only care about someone trying to release one of our names. */
112         if( namerec && ( (namerec->data.source == SELF_NAME)
113                         || (namerec->data.source == PERMANENT_NAME) ) ) {
114                 rcode = ACT_ERR;
115                 DEBUG(0, ("process_name_release_request: Attempt to release name %s from IP %s \
116 on subnet %s being rejected as it is one of our names.\n", 
117                 nmb_namestr(&nmb->question.question_name), inet_ntoa(owner_ip), subrec->subnet_name));
118         }
119
120         if(rcode == 0)
121                 return;
122
123         /* Send a NAME RELEASE RESPONSE (pos/neg) see rfc1002.txt 4.2.10-11 */
124         send_name_release_response(rcode, p);
125 }
126
127 /****************************************************************************
128 Send a name registration response.
129 **************************************************************************/
130
131 static void send_name_registration_response(int rcode, int ttl, struct packet_struct *p)
132 {
133         struct nmb_packet *nmb = &p->packet.nmb;
134         char rdata[6];
135
136         memcpy(&rdata[0], &nmb->additional->rdata[0], 6);
137   
138         reply_netbios_packet(p,                                /* Packet to reply to. */
139                                 rcode,                         /* Result code. */
140                                 NMB_REG,                       /* nmbd type code. */
141                                 NMB_NAME_REG_OPCODE,           /* opcode. */
142                                 ttl,                           /* ttl. */
143                                 rdata,                         /* data to send. */
144                                 6);                            /* data length. */
145 }
146
147 /****************************************************************************
148 Process a name refresh request on a broadcast subnet.
149 **************************************************************************/
150      
151 void process_name_refresh_request(struct subnet_record *subrec,
152                                   struct packet_struct *p)
153 {    
154         struct nmb_packet *nmb = &p->packet.nmb;
155         struct nmb_name *question = &nmb->question.question_name;
156         bool bcast = nmb->header.nm_flags.bcast;
157         struct in_addr from_ip;
158   
159         putip((char *)&from_ip,&nmb->additional->rdata[2]);
160
161         if(!bcast) { 
162                 /* We should only get broadcast name refresh packets here.
163                    Anyone trying to refresh unicast should be going to a WINS
164                    server. If the code gets here, then either we are not a wins
165                    server and they sent it anyway, or we are a WINS server and
166                    the request was malformed. Either way, log an error here.
167                    and send an error reply back.
168                 */
169                 DEBUG(0,("process_name_refresh_request: unicast name registration request \
170 received for name %s from IP %s on subnet %s.\n",
171                         nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name));
172                 DEBUG(0,("Error - should be sent to WINS server\n"));
173     
174                 send_name_registration_response(FMT_ERR, 0, p);
175                 return;
176         } 
177
178         /* Just log a message. We really don't care about broadcast name refreshes. */
179      
180         DEBUG(3,("process_name_refresh_request: Name refresh for name %s \
181 IP %s on subnet %s\n", nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name));
182 }
183     
184 /****************************************************************************
185 Process a name registration request on a broadcast subnet.
186 **************************************************************************/
187
188 void process_name_registration_request(struct subnet_record *subrec, 
189                                        struct packet_struct *p)
190 {
191         struct nmb_packet *nmb = &p->packet.nmb;
192         struct nmb_name *question = &nmb->question.question_name;
193         bool bcast = nmb->header.nm_flags.bcast;
194         uint16 nb_flags = get_nb_flags(nmb->additional->rdata);
195         bool group = (nb_flags & NB_GROUP) ? True : False;
196         struct name_record *namerec = NULL;
197         int ttl = nmb->additional->ttl;
198         struct in_addr from_ip;
199   
200         putip((char *)&from_ip,&nmb->additional->rdata[2]);
201   
202         if(!bcast) {
203                 /* We should only get broadcast name registration packets here.
204                    Anyone trying to register unicast should be going to a WINS
205                    server. If the code gets here, then either we are not a wins
206                    server and they sent it anyway, or we are a WINS server and
207                    the request was malformed. Either way, log an error here.
208                    and send an error reply back.
209                 */
210                 DEBUG(0,("process_name_registration_request: unicast name registration request \
211 received for name %s from IP %s on subnet %s. Error - should be sent to WINS server\n",
212                         nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name));      
213
214                 send_name_registration_response(FMT_ERR, 0, p);
215                 return;
216         }
217
218         DEBUG(3,("process_name_registration_request: Name registration for name %s \
219 IP %s on subnet %s\n", nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name));
220   
221         /* See if the name already exists. */
222         namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME);
223  
224         /* 
225          * If the name being registered exists and is a WINS_PROXY_NAME 
226          * then delete the WINS proxy name entry so we don't reply erroneously
227          * later to queries.
228          */
229
230         if((namerec != NULL) && (namerec->data.source == WINS_PROXY_NAME)) {
231                 remove_name_from_namelist( subrec, namerec );
232                 namerec = NULL;
233         }
234
235         if (!group) {
236                 /* Unique name. */
237
238                 if( (namerec != NULL)
239                                 && ( (namerec->data.source == SELF_NAME)
240                                 || (namerec->data.source == PERMANENT_NAME)
241                                 || NAME_GROUP(namerec) ) ) {
242                         /* No-one can register one of Samba's names, nor can they
243                                 register a name that's a group name as a unique name */
244
245                         send_name_registration_response(ACT_ERR, 0, p);
246                         return;
247                 } else if(namerec != NULL) {
248                         /* Update the namelist record with the new information. */
249                         namerec->data.ip[0] = from_ip;
250                         update_name_ttl(namerec, ttl);
251
252                         DEBUG(3,("process_name_registration_request: Updated name record %s \
253 with IP %s on subnet %s\n",nmb_namestr(&namerec->name),inet_ntoa(from_ip), subrec->subnet_name));
254                         return;
255                 }
256         } else {
257                 /* Group name. */
258
259                 if( (namerec != NULL)
260                                 && !NAME_GROUP(namerec)
261                                 && ( (namerec->data.source == SELF_NAME)
262                                 || (namerec->data.source == PERMANENT_NAME) ) ) {
263                         /* Disallow group names when we have a unique name. */
264                         send_name_registration_response(ACT_ERR, 0, p);  
265                         return;  
266                 }  
267         }
268 }
269
270 /****************************************************************************
271 This is used to sort names for a name status into a sensible order.
272 We put our own names first, then in alphabetical order.
273 **************************************************************************/
274
275 static int status_compare(char *n1,char *n2)
276 {
277         unstring name1, name2;
278         int l1,l2,l3;
279
280         memset(name1, '\0', sizeof(name1));
281         memset(name2, '\0', sizeof(name2));
282         pull_ascii_nstring(name1, sizeof(name1), n1);
283         pull_ascii_nstring(name2, sizeof(name2), n2);
284         n1 = name1;
285         n2 = name2;
286
287         /* It's a bit tricky because the names are space padded */
288         for (l1=0;l1<15 && n1[l1] && n1[l1] != ' ';l1++)
289                 ;
290         for (l2=0;l2<15 && n2[l2] && n2[l2] != ' ';l2++)
291                 ;
292         l3 = strlen(global_myname());
293
294         if ((l1==l3) && strncmp(n1,global_myname(),l3) == 0 && 
295                         (l2!=l3 || strncmp(n2,global_myname(),l3) != 0))
296                 return -1;
297
298         if ((l2==l3) && strncmp(n2,global_myname(),l3) == 0 && 
299                         (l1!=l3 || strncmp(n1,global_myname(),l3) != 0))
300                 return 1;
301
302         return memcmp(n1,n2,sizeof(name1));
303 }
304
305 /****************************************************************************
306   Process a node status query
307   ****************************************************************************/
308
309 void process_node_status_request(struct subnet_record *subrec, struct packet_struct *p)
310 {
311         struct nmb_packet *nmb = &p->packet.nmb;
312         unstring qname;
313         int ques_type = nmb->question.question_name.name_type;
314         char rdata[MAX_DGRAM_SIZE];
315         char *countptr, *buf, *bufend, *buf0;
316         int names_added,i;
317         struct name_record *namerec;
318
319         pull_ascii_nstring(qname, sizeof(qname), nmb->question.question_name.name);
320
321         DEBUG(3,("process_node_status_request: status request for name %s from IP %s on \
322 subnet %s.\n", nmb_namestr(&nmb->question.question_name), inet_ntoa(p->ip), subrec->subnet_name));
323
324         if((namerec = find_name_on_subnet(subrec, &nmb->question.question_name, FIND_SELF_NAME)) == 0) {
325                 DEBUG(1,("process_node_status_request: status request for name %s from IP %s on \
326 subnet %s - name not found.\n", nmb_namestr(&nmb->question.question_name),
327                         inet_ntoa(p->ip), subrec->subnet_name));
328
329                 return;
330         }
331  
332         /* this is not an exact calculation. the 46 is for the stats buffer
333                 and the 60 is to leave room for the header etc */
334         bufend = &rdata[MAX_DGRAM_SIZE-1] - (18 + 46 + 60);
335         countptr = buf = rdata;
336         buf += 1;
337         buf0 = buf;
338
339         names_added = 0;
340
341         namerec = subrec->namelist;
342
343         while (buf < bufend) {
344                 if( (namerec->data.source == SELF_NAME) || (namerec->data.source == PERMANENT_NAME) ) {
345                         int name_type = namerec->name.name_type;
346                         unstring name;
347
348                         pull_ascii_nstring(name, sizeof(name), namerec->name.name);
349                         strupper_m(name);
350                         if (!strequal(name,"*") &&
351                                         !strequal(name,"__SAMBA__") &&
352                                         (name_type < 0x1b || name_type >= 0x20 || 
353                                         ques_type < 0x1b || ques_type >= 0x20 ||
354                                         strequal(qname, name))) {
355                                 /* Start with the name. */
356                                 size_t len;
357                                 push_ascii_nstring(buf, name);
358                                 len = strlen(buf);
359                                 memset(buf + len, ' ', MAX_NETBIOSNAME_LEN - len - 1);
360                                 buf[MAX_NETBIOSNAME_LEN - 1] = '\0';
361
362                                 /* Put the name type and netbios flags in the buffer. */
363
364                                 buf[15] = name_type;
365                                 set_nb_flags( &buf[16],namerec->data.nb_flags );
366                                 buf[16] |= NB_ACTIVE; /* all our names are active */
367
368                                 buf += 18;
369
370                                 names_added++;
371                         }
372                 }
373
374                 /* Remove duplicate names. */
375                 if (names_added > 1) {
376                         qsort( buf0, names_added, 18, QSORT_CAST status_compare );
377                 }
378
379                 for( i=1; i < names_added ; i++ ) {
380                         if (memcmp(buf0 + 18*i,buf0 + 18*(i-1),16) == 0) {
381                                 names_added--;
382                                 if (names_added == i)
383                                         break;
384                                 memmove(buf0 + 18*i,buf0 + 18*(i+1),18*(names_added-i));
385                                 i--;
386                         }
387                 }
388
389                 buf = buf0 + 18*names_added;
390
391                 namerec = namerec->next;
392
393                 if (!namerec) {
394                         /* End of the subnet specific name list. Now 
395                                 add the names on the unicast subnet . */
396                         struct subnet_record *uni_subrec = unicast_subnet;
397
398                         if (uni_subrec != subrec) {
399                                 subrec = uni_subrec;
400                                 namerec = subrec->namelist;
401                         }
402                 }
403                 if (!namerec)
404                         break;
405
406         }
407   
408         SCVAL(countptr,0,names_added);
409   
410         /* We don't send any stats as they could be used to attack
411                 the protocol. */
412         memset(buf,'\0',46);
413   
414         buf += 46;
415   
416         /* Send a NODE STATUS RESPONSE */
417         reply_netbios_packet(p,                               /* Packet to reply to. */
418                                 0,                            /* Result code. */
419                                 NMB_STATUS,                   /* nmbd type code. */
420                                 NMB_NAME_QUERY_OPCODE,        /* opcode. */
421                                 0,                            /* ttl. */
422                                 rdata,                        /* data to send. */
423                                 PTR_DIFF(buf,rdata));         /* data length. */
424 }
425
426
427 /***************************************************************************
428 Process a name query.
429
430 For broadcast name queries:
431
432   - Only reply if the query is for one of YOUR names.
433   - NEVER send a negative response to a broadcast query.
434
435 ****************************************************************************/
436
437 void process_name_query_request(struct subnet_record *subrec, struct packet_struct *p)
438 {
439         struct nmb_packet *nmb = &p->packet.nmb;
440         struct nmb_name *question = &nmb->question.question_name;
441         int name_type = question->name_type;
442         bool bcast = nmb->header.nm_flags.bcast;
443         int ttl=0;
444         int rcode = 0;
445         char *prdata = NULL;
446         char rdata[6];
447         bool success = False;
448         struct name_record *namerec = NULL;
449         int reply_data_len = 0;
450         int i;
451         
452         DEBUG(3,("process_name_query_request: Name query from %s on subnet %s for name %s\n", 
453                  inet_ntoa(p->ip), subrec->subnet_name, nmb_namestr(question)));
454   
455         /* Look up the name in the cache - if the request is a broadcast request that
456            came from a subnet we don't know about then search all the broadcast subnets
457            for a match (as we don't know what interface the request came in on). */
458
459         if(subrec == remote_broadcast_subnet)
460                 namerec = find_name_for_remote_broadcast_subnet( question, FIND_ANY_NAME);
461         else
462                 namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME);
463
464         /* Check if it is a name that expired */
465         if (namerec && 
466             ((namerec->data.death_time != PERMANENT_TTL) && 
467              (namerec->data.death_time < p->timestamp))) {
468                 DEBUG(5,("process_name_query_request: expired name %s\n", nmb_namestr(&namerec->name)));
469                 namerec = NULL;
470         }
471
472         if (namerec) {
473                 /* 
474                  * Always respond to unicast queries.
475                  * Don't respond to broadcast queries unless the query is for
476                  * a name we own, a Primary Domain Controller name, or a WINS_PROXY 
477                  * name with type 0 or 0x20. WINS_PROXY names are only ever added
478                  * into the namelist if we were configured as a WINS proxy.
479                  */
480                 
481                 if (!bcast || 
482                     (bcast && ((name_type == 0x1b) ||
483                                (namerec->data.source == SELF_NAME) ||
484                                (namerec->data.source == PERMANENT_NAME) ||
485                                ((namerec->data.source == WINS_PROXY_NAME) &&
486                                 ((name_type == 0) || (name_type == 0x20)))))) {
487                         /* The requested name is a directed query, or it's SELF or PERMANENT or WINS_PROXY, 
488                            or it's a Domain Master type. */
489
490                         /*
491                          * If this is a WINS_PROXY_NAME, then ceck that none of the IP 
492                          * addresses we are returning is on the same broadcast subnet 
493                          * as the requesting packet. If it is then don't reply as the 
494                          * actual machine will be replying also and we don't want two 
495                          * replies to a broadcast query.
496                          */
497                         
498                         if (namerec->data.source == WINS_PROXY_NAME) {
499                                 for( i = 0; i < namerec->data.num_ips; i++) {
500                                         if (same_net_v4(namerec->data.ip[i], subrec->myip, subrec->mask_ip)) {
501                                                 DEBUG(5,("process_name_query_request: name %s is a WINS proxy name and is also on the same subnet (%s) as the requestor. Not replying.\n", 
502                                                          nmb_namestr(&namerec->name), subrec->subnet_name ));
503                                                 return;
504                                         }
505                                 }
506                         }
507
508                         ttl = (namerec->data.death_time != PERMANENT_TTL) ?
509                                 namerec->data.death_time - p->timestamp : lp_max_ttl();
510
511                         /* Copy all known ip addresses into the return data. */
512                         /* Optimise for the common case of one IP address so 
513                            we don't need a malloc. */
514
515                         if (namerec->data.num_ips == 1) {
516                                 prdata = rdata;
517                         } else {
518                                 if ((prdata = (char *)SMB_MALLOC( namerec->data.num_ips * 6 )) == NULL) {
519                                         DEBUG(0,("process_name_query_request: malloc fail !\n"));
520                                         return;
521                                 }
522                         }
523
524                         for (i = 0; i < namerec->data.num_ips; i++) {
525                                 set_nb_flags(&prdata[i*6],namerec->data.nb_flags);
526                                 putip((char *)&prdata[2+(i*6)], &namerec->data.ip[i]);
527                         }
528
529                         sort_query_replies(prdata, i, p->ip);
530                         
531                         reply_data_len = namerec->data.num_ips * 6;
532                         success = True;
533                 }
534         }
535
536         /*
537          * If a machine is broadcasting a name lookup request and we have lp_wins_proxy()
538          * set we should initiate a WINS query here. On success we add the resolved name 
539          * into our namelist with a type of WINS_PROXY_NAME and then reply to the query.
540          */
541         
542         if(!success && (namerec == NULL) && we_are_a_wins_client() && lp_wins_proxy() && 
543            bcast && (subrec != remote_broadcast_subnet)) {
544                 make_wins_proxy_name_query_request( subrec, p, question );
545                 return;
546         }
547
548         if (!success && bcast) {
549                 if(prdata != rdata)
550                         SAFE_FREE(prdata);
551                 return; /* Never reply with a negative response to broadcasts. */
552         }
553
554         /* 
555          * Final check. From observation, if a unicast packet is sent
556          * to a non-WINS server with the recursion desired bit set
557          * then never send a negative response.
558          */
559         
560         if(!success && !bcast && nmb->header.nm_flags.recursion_desired) {
561                 if(prdata != rdata)
562                         SAFE_FREE(prdata);
563                 return;
564         }
565
566         if (success) {
567                 rcode = 0;
568                 DEBUG(3,("OK\n"));
569         } else {
570                 rcode = NAM_ERR;
571                 DEBUG(3,("UNKNOWN\n"));      
572         }
573
574         /* See rfc1002.txt 4.2.13. */
575
576         reply_netbios_packet(p,                              /* Packet to reply to. */
577                              rcode,                          /* Result code. */
578                              NMB_QUERY,                      /* nmbd type code. */
579                              NMB_NAME_QUERY_OPCODE,          /* opcode. */
580                              ttl,                            /* ttl. */
581                              prdata,                         /* data to send. */
582                              reply_data_len);                /* data length. */
583         
584         if(prdata != rdata)
585                 SAFE_FREE(prdata);
586 }