r19386: Limit the size of the connection bitmap to <64K entries.

[tprouty/samba.git] / source / smbd / conn.c

diff --git a/source/smbd/conn.c b/source/smbd/conn.c
index 9bac0acdb9fd3b6e622e26a6f2211bffade5e896..73d2ed7003b1a6f2aad14a4fe8079ffe3f9663a7 100644 (file)
--- a/source/smbd/conn.c
+++ b/source/smbd/conn.c
@@ -57,7 +57,7 @@ BOOL conn_snum_used(int snum)
 {
        connection_struct *conn;
        for (conn=Connections;conn;conn=conn->next) {
-               if (conn->service == snum) {
+               if (conn->params->service == snum) {
                        return(True);
                }
        }
@@ -107,7 +107,7 @@ find_again:
                 int             newsz = bmap->n + BITMAP_BLOCK_SZ;
                 struct bitmap * nbmap;
 
-                if (newsz <= 0) {
+                if (newsz <= oldsz) {
                         /* Integer wrap. */
                        DEBUG(0,("ERROR! Out of connection structures\n"));
                         return NULL;
@@ -117,6 +117,10 @@ find_again:
                         oldsz, newsz));
 
                 nbmap = bitmap_allocate(newsz);
+               if (!nbmap) {
+                       DEBUG(0,("ERROR! malloc fail.\n"));
+                       return NULL;
+               }
 
                 bitmap_copy(nbmap, bmap);
                 bitmap_free(bmap);
@@ -127,13 +131,25 @@ find_again:
                 goto find_again;
        }
 
+       /* The bitmap position is used below as the connection number
+        * conn->cnum). This ends up as the TID field in the SMB header,
+        * which is limited to 16 bits (we skip 0xffff which is the
+        * NULL TID).
+        */
+       if (i > 65534) {
+               DEBUG(0, ("Maximum connection limit reached\n"));
+               return NULL;
+       }
+
        if ((mem_ctx=talloc_init("connection_struct"))==NULL) {
                DEBUG(0,("talloc_init(connection_struct) failed!\n"));
                return NULL;
        }
 
-       if ((conn=(connection_struct *)talloc_zero(mem_ctx, sizeof(*conn)))==NULL) {
+       if (!(conn=TALLOC_ZERO_P(mem_ctx, connection_struct)) ||
+           !(conn->params = TALLOC_P(mem_ctx, struct share_params))) {
                DEBUG(0,("talloc_zero() failed!\n"));
+               TALLOC_FREE(mem_ctx);
                return NULL;
        }
        conn->mem_ctx = mem_ctx;
@@ -154,13 +170,15 @@ find_again:
 }
 
 /****************************************************************************
-close all conn structures
+ Close all conn structures.
 ****************************************************************************/
+
 void conn_close_all(void)
 {
        connection_struct *conn, *next;
        for (conn=Connections;conn;conn=next) {
                next=conn->next;
+               set_current_service(conn, 0, True);
                close_cnum(conn, conn->vuid);
        }
 }
@@ -177,13 +195,20 @@ BOOL conn_idle_all(time_t t, int deadtime)
 
        for (conn=Connections;conn;conn=next) {
                next=conn->next;
+
+               /* Update if connection wasn't idle. */
+               if (conn->lastused != conn->lastused_count) {
+                       conn->lastused = t;
+               }
+
                /* close dirptrs on connections that are idle */
-               if ((t-conn->lastused) > DPTR_IDLE_TIMEOUT)
+               if ((t-conn->lastused) > DPTR_IDLE_TIMEOUT) {
                        dptr_idlecnum(conn);
+               }
 
-               if (conn->num_files_open > 0 || 
-                   (t-conn->lastused)<deadtime)
+               if (conn->num_files_open > 0 || (t-conn->lastused)<deadtime) {
                        allidle = False;
+               }
        }
 
        /*
@@ -224,10 +249,10 @@ void conn_clear_vuid_cache(uint16 vuid)
 }
 
 /****************************************************************************
- Free a conn structure.
+ Free a conn structure - internal part.
 ****************************************************************************/
 
-void conn_free(connection_struct *conn)
+void conn_free_internal(connection_struct *conn)
 {
        vfs_handle_struct *handle = NULL, *thandle = NULL;
        TALLOC_CTX *mem_ctx = NULL;
@@ -242,43 +267,56 @@ void conn_free(connection_struct *conn)
                handle = thandle;
        }
 
-       DLIST_REMOVE(Connections, conn);
-
        if (conn->ngroups && conn->groups) {
                SAFE_FREE(conn->groups);
                conn->ngroups = 0;
        }
 
+       if (conn->nt_user_token) {
+               TALLOC_FREE(conn->nt_user_token);
+       }
+
        free_namearray(conn->veto_list);
        free_namearray(conn->hide_list);
        free_namearray(conn->veto_oplock_list);
+       free_namearray(conn->aio_write_behind_list);
        
        string_free(&conn->user);
        string_free(&conn->dirpath);
        string_free(&conn->connectpath);
        string_free(&conn->origpath);
 
-       bitmap_clear(bmap, conn->cnum);
-       num_open--;
-
        mem_ctx = conn->mem_ctx;
        ZERO_STRUCTP(conn);
        talloc_destroy(mem_ctx);
 }
 
+/****************************************************************************
+ Free a conn structure.
+****************************************************************************/
 
+void conn_free(connection_struct *conn)
+{
+       DLIST_REMOVE(Connections, conn);
+
+       bitmap_clear(bmap, conn->cnum);
+       num_open--;
+
+       conn_free_internal(conn);
+}
+ 
 /****************************************************************************
 receive a smbcontrol message to forcibly unmount a share
 the message contains just a share name and all instances of that
 share are unmounted
 the special sharename '*' forces unmount of all shares
 ****************************************************************************/
-void msg_force_tdis(int msg_type, pid_t pid, void *buf, size_t len)
+void msg_force_tdis(int msg_type, struct process_id pid, void *buf, size_t len)
 {
        connection_struct *conn, *next;
        fstring sharename;
 
-       fstrcpy(sharename, buf);
+       fstrcpy(sharename, (const char *)buf);
 
        if (strcmp(sharename, "*") == 0) {
                DEBUG(1,("Forcing close of all shares\n"));
@@ -288,7 +326,7 @@ void msg_force_tdis(int msg_type, pid_t pid, void *buf, size_t len)
 
        for (conn=Connections;conn;conn=next) {
                next=conn->next;
-               if (strequal(lp_servicename(conn->service), sharename)) {
+               if (strequal(lp_servicename(SNUM(conn)), sharename)) {
                        DEBUG(1,("Forcing close of share %s cnum=%d\n",
                                 sharename, conn->cnum));
                        close_cnum(conn, (uint16)-1);