source: branches/samba-3.0/source/smbd/process.c@ 104

Last change on this file since 104 was 30, checked in by Paul Smedley, 18 years ago

Code updated to Samba 3.0.25rc2 level
File size: 49.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20*/
21
22#include "includes.h"
23
24uint16 global_smbpid;
25extern int keepalive;
26extern struct auth_context *negprot_global_auth_context;
27extern int smb_echo_count;
28
29static char *InBuffer = NULL;
30static char *OutBuffer = NULL;
31static char *current_inbuf = NULL;
32
33/*
34 * Size of data we can send to client. Set
35 * by the client for all protocols above CORE.
36 * Set by us for CORE protocol.
37 */
38int max_send = BUFFER_SIZE;
39/*
40 * Size of the data we can receive. Set by us.
41 * Can be modified by the max xmit parameter.
42 */
43int max_recv = BUFFER_SIZE;
44
45extern int last_message;
46extern int smb_read_error;
47SIG_ATOMIC_T reload_after_sighup = 0;
48SIG_ATOMIC_T got_sig_term = 0;
49extern BOOL global_machine_password_needs_changing;
50extern int max_send;
51
52/****************************************************************************
53 Function to return the current request mid from Inbuffer.
54****************************************************************************/
55
56uint16 get_current_mid(void)
57{
58 return SVAL(InBuffer,smb_mid);
59}
60
61/****************************************************************************
62 structure to hold a linked list of queued messages.
63 for processing.
64****************************************************************************/
65
66static struct pending_message_list *deferred_open_queue;
67
68/****************************************************************************
69 Function to push a message onto the tail of a linked list of smb messages ready
70 for processing.
71****************************************************************************/
72
73static BOOL push_queued_message(char *buf, int msg_len,
74 struct timeval request_time,
75 struct timeval end_time,
76 char *private_data, size_t private_len)
77{
78 struct pending_message_list *msg;
79
80 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
81
82 if(msg == NULL) {
83 DEBUG(0,("push_message: malloc fail (1)\n"));
84 return False;
85 }
86
87 msg->buf = data_blob_talloc(msg, buf, msg_len);
88 if(msg->buf.data == NULL) {
89 DEBUG(0,("push_message: malloc fail (2)\n"));
90 TALLOC_FREE(msg);
91 return False;
92 }
93
94 msg->request_time = request_time;
95 msg->end_time = end_time;
96
97 if (private_data) {
98 msg->private_data = data_blob_talloc(msg, private_data,
99 private_len);
100 if (msg->private_data.data == NULL) {
101 DEBUG(0,("push_message: malloc fail (3)\n"));
102 TALLOC_FREE(msg);
103 return False;
104 }
105 }
106
107 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
108
109 DEBUG(10,("push_message: pushed message length %u on "
110 "deferred_open_queue\n", (unsigned int)msg_len));
111
112 return True;
113}
114
115/****************************************************************************
116 Function to delete a sharing violation open message by mid.
117****************************************************************************/
118
119void remove_deferred_open_smb_message(uint16 mid)
120{
121 struct pending_message_list *pml;
122
123 for (pml = deferred_open_queue; pml; pml = pml->next) {
124 if (mid == SVAL(pml->buf.data,smb_mid)) {
125 DEBUG(10,("remove_sharing_violation_open_smb_message: "
126 "deleting mid %u len %u\n",
127 (unsigned int)mid,
128 (unsigned int)pml->buf.length ));
129 DLIST_REMOVE(deferred_open_queue, pml);
130 TALLOC_FREE(pml);
131 return;
132 }
133 }
134}
135
136/****************************************************************************
137 Move a sharing violation open retry message to the front of the list and
138 schedule it for immediate processing.
139****************************************************************************/
140
141void schedule_deferred_open_smb_message(uint16 mid)
142{
143 struct pending_message_list *pml;
144 int i = 0;
145
146 for (pml = deferred_open_queue; pml; pml = pml->next) {
147 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
148 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
149 (unsigned int)msg_mid ));
150 if (mid == msg_mid) {
151 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
152 mid ));
153 pml->end_time.tv_sec = 0;
154 pml->end_time.tv_usec = 0;
155 DLIST_PROMOTE(deferred_open_queue, pml);
156 return;
157 }
158 }
159
160 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
161 mid ));
162}
163
164/****************************************************************************
165 Return true if this mid is on the deferred queue.
166****************************************************************************/
167
168BOOL open_was_deferred(uint16 mid)
169{
170 struct pending_message_list *pml;
171
172 for (pml = deferred_open_queue; pml; pml = pml->next) {
173 if (SVAL(pml->buf.data,smb_mid) == mid) {
174 return True;
175 }
176 }
177 return False;
178}
179
180/****************************************************************************
181 Return the message queued by this mid.
182****************************************************************************/
183
184struct pending_message_list *get_open_deferred_message(uint16 mid)
185{
186 struct pending_message_list *pml;
187
188 for (pml = deferred_open_queue; pml; pml = pml->next) {
189 if (SVAL(pml->buf.data,smb_mid) == mid) {
190 return pml;
191 }
192 }
193 return NULL;
194}
195
196/****************************************************************************
197 Function to push a deferred open smb message onto a linked list of local smb
198 messages ready for processing.
199****************************************************************************/
200
201BOOL push_deferred_smb_message(uint16 mid,
202 struct timeval request_time,
203 struct timeval timeout,
204 char *private_data, size_t priv_len)
205{
206 struct timeval end_time;
207
208 end_time = timeval_sum(&request_time, &timeout);
209
210 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
211 "timeout time [%u.%06u]\n",
212 (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
213 (unsigned int)end_time.tv_sec,
214 (unsigned int)end_time.tv_usec));
215
216 return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
217 request_time, end_time,
218 private_data, priv_len);
219}
220
221struct idle_event {
222 struct timed_event *te;
223 struct timeval interval;
224 BOOL (*handler)(const struct timeval *now, void *private_data);
225 void *private_data;
226};
227
228static void idle_event_handler(struct event_context *ctx,
229 struct timed_event *te,
230 const struct timeval *now,
231 void *private_data)
232{
233 struct idle_event *event =
234 talloc_get_type_abort(private_data, struct idle_event);
235
236 TALLOC_FREE(event->te);
237
238 if (!event->handler(now, event->private_data)) {
239 /* Don't repeat, delete ourselves */
240 TALLOC_FREE(event);
241 return;
242 }
243
244 event->te = event_add_timed(smbd_event_context(), event,
245 timeval_sum(now, &event->interval),
246 "idle_event_handler",
247 idle_event_handler, event);
248
249 /* We can't do much but fail here. */
250 SMB_ASSERT(event->te != NULL);
251}
252
253struct idle_event *add_idle_event(TALLOC_CTX *mem_ctx,
254 struct timeval interval,
255 BOOL (*handler)(const struct timeval *now,
256 void *private_data),
257 void *private_data)
258{
259 struct idle_event *result;
260 struct timeval now = timeval_current();
261
262 result = TALLOC_P(mem_ctx, struct idle_event);
263 if (result == NULL) {
264 DEBUG(0, ("talloc failed\n"));
265 return NULL;
266 }
267
268 result->interval = interval;
269 result->handler = handler;
270 result->private_data = private_data;
271
272 result->te = event_add_timed(smbd_event_context(), result,
273 timeval_sum(&now, &interval),
274 "idle_event_handler",
275 idle_event_handler, result);
276 if (result->te == NULL) {
277 DEBUG(0, ("event_add_timed failed\n"));
278 TALLOC_FREE(result);
279 return NULL;
280 }
281
282 return result;
283}
284
285/****************************************************************************
286 Do all async processing in here. This includes kernel oplock messages, change
287 notify events etc.
288****************************************************************************/
289
290static void async_processing(fd_set *pfds)
291{
292 DEBUG(10,("async_processing: Doing async processing.\n"));
293
294 process_aio_queue();
295
296 process_kernel_oplocks(pfds);
297
298 /* Do the aio check again after receive_local_message as it does a
299 select and may have eaten our signal. */
300 /* Is this till true? -- vl */
301 process_aio_queue();
302
303 if (got_sig_term) {
304 exit_server_cleanly("termination signal");
305 }
306
307 /* check for sighup processing */
308 if (reload_after_sighup) {
309 change_to_root_user();
310 DEBUG(1,("Reloading services after SIGHUP\n"));
311 reload_services(False);
312 reload_after_sighup = 0;
313 }
314}
315
316/****************************************************************************
317 Add a fd to the set we will be select(2)ing on.
318****************************************************************************/
319
320static int select_on_fd(int fd, int maxfd, fd_set *fds)
321{
322 if (fd != -1) {
323 FD_SET(fd, fds);
324 maxfd = MAX(maxfd, fd);
325 }
326
327 return maxfd;
328}
329
330/****************************************************************************
331 Do a select on an two fd's - with timeout.
332
333 If a local udp message has been pushed onto the
334 queue (this can only happen during oplock break
335 processing) call async_processing()
336
337 If a pending smb message has been pushed onto the
338 queue (this can only happen during oplock break
339 processing) return this next.
340
341 If the first smbfd is ready then read an smb from it.
342 if the second (loopback UDP) fd is ready then read a message
343 from it and setup the buffer header to identify the length
344 and from address.
345 Returns False on timeout or error.
346 Else returns True.
347
348The timeout is in milliseconds
349****************************************************************************/
350
351static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
352{
353 fd_set r_fds, w_fds;
354 int selrtn;
355 struct timeval to;
356 int maxfd = 0;
357
358 smb_read_error = 0;
359
360 again:
361
362 if (timeout >= 0) {
363 to.tv_sec = timeout / 1000;
364 to.tv_usec = (timeout % 1000) * 1000;
365 } else {
366 to.tv_sec = SMBD_SELECT_TIMEOUT;
367 to.tv_usec = 0;
368 }
369
370 /*
371 * Note that this call must be before processing any SMB
372 * messages as we need to synchronously process any messages
373 * we may have sent to ourselves from the previous SMB.
374 */
375 message_dispatch();
376
377 /*
378 * Check to see if we already have a message on the deferred open queue
379 * and it's time to schedule.
380 */
381 if(deferred_open_queue != NULL) {
382 BOOL pop_message = False;
383 struct pending_message_list *msg = deferred_open_queue;
384
385 if (timeval_is_zero(&msg->end_time)) {
386 pop_message = True;
387 } else {
388 struct timeval tv;
389 SMB_BIG_INT tdif;
390
391 GetTimeOfDay(&tv);
392 tdif = usec_time_diff(&msg->end_time, &tv);
393 if (tdif <= 0) {
394 /* Timed out. Schedule...*/
395 pop_message = True;
396 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
397 } else {
398 /* Make a more accurate select timeout. */
399 to.tv_sec = tdif / 1000000;
400 to.tv_usec = tdif % 1000000;
401 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
402 (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
403 }
404 }
405
406 if (pop_message) {
407 memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
408
409 /* We leave this message on the queue so the open code can
410 know this is a retry. */
411 DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
412 return True;
413 }
414 }
415
416 /*
417 * Setup the select fd sets.
418 */
419
420 FD_ZERO(&r_fds);
421 FD_ZERO(&w_fds);
422
423 /*
424 * Ensure we process oplock break messages by preference.
425 * We have to do this before the select, after the select
426 * and if the select returns EINTR. This is due to the fact
427 * that the selects called from async_processing can eat an EINTR
428 * caused by a signal (we can't take the break message there).
429 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
430 */
431
432 if (oplock_message_waiting(&r_fds)) {
433 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
434 async_processing(&r_fds);
435 /*
436 * After async processing we must go and do the select again, as
437 * the state of the flag in fds for the server file descriptor is
438 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
439 */
440 goto again;
441 }
442
443 /*
444 * Are there any timed events waiting ? If so, ensure we don't
445 * select for longer than it would take to wait for them.
446 */
447
448 {
449 struct timeval now;
450 GetTimeOfDay(&now);
451
452 event_add_to_select_args(smbd_event_context(), &now,
453 &r_fds, &w_fds, &to, &maxfd);
454 }
455
456 if (timeval_is_zero(&to)) {
457 /* Process a timed event now... */
458 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
459 goto again;
460 }
461 }
462
463 {
464 int sav;
465 START_PROFILE(smbd_idle);
466
467 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
468 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
469
470 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
471 sav = errno;
472
473 END_PROFILE(smbd_idle);
474 errno = sav;
475 }
476
477 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
478 goto again;
479 }
480
481 /* if we get EINTR then maybe we have received an oplock
482 signal - treat this as select returning 1. This is ugly, but
483 is the best we can do until the oplock code knows more about
484 signals */
485 if (selrtn == -1 && errno == EINTR) {
486 async_processing(&r_fds);
487 /*
488 * After async processing we must go and do the select again, as
489 * the state of the flag in fds for the server file descriptor is
490 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
491 */
492 goto again;
493 }
494
495 /* Check if error */
496 if (selrtn == -1) {
497 /* something is wrong. Maybe the socket is dead? */
498 smb_read_error = READ_ERROR;
499 return False;
500 }
501
502 /* Did we timeout ? */
503 if (selrtn == 0) {
504 smb_read_error = READ_TIMEOUT;
505 return False;
506 }
507
508 /*
509 * Ensure we process oplock break messages by preference.
510 * This is IMPORTANT ! Otherwise we can starve other processes
511 * sending us an oplock break message. JRA.
512 */
513
514 if (oplock_message_waiting(&r_fds)) {
515 async_processing(&r_fds);
516 /*
517 * After async processing we must go and do the select again, as
518 * the state of the flag in fds for the server file descriptor is
519 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
520 */
521 goto again;
522 }
523
524 return receive_smb(smbd_server_fd(), buffer, 0);
525}
526
527/*
528 * Only allow 5 outstanding trans requests. We're allocating memory, so
529 * prevent a DoS.
530 */
531
532NTSTATUS allow_new_trans(struct trans_state *list, int mid)
533{
534 int count = 0;
535 for (; list != NULL; list = list->next) {
536
537 if (list->mid == mid) {
538 return NT_STATUS_INVALID_PARAMETER;
539 }
540
541 count += 1;
542 }
543 if (count > 5) {
544 return NT_STATUS_INSUFFICIENT_RESOURCES;
545 }
546
547 return NT_STATUS_OK;
548}
549
550/****************************************************************************
551 We're terminating and have closed all our files/connections etc.
552 If there are any pending local messages we need to respond to them
553 before termination so that other smbds don't think we just died whilst
554 holding oplocks.
555****************************************************************************/
556
557void respond_to_all_remaining_local_messages(void)
558{
559 /*
560 * Assert we have no exclusive open oplocks.
561 */
562
563 if(get_number_of_exclusive_open_oplocks()) {
564 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
565 get_number_of_exclusive_open_oplocks() ));
566 return;
567 }
568
569 process_kernel_oplocks(NULL);
570
571 return;
572}
573
574
575/*
576These flags determine some of the permissions required to do an operation
577
578Note that I don't set NEED_WRITE on some write operations because they
579are used by some brain-dead clients when printing, and I don't want to
580force write permissions on print services.
581*/
582#define AS_USER (1<<0)
583#define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
584#define TIME_INIT (1<<2)
585#define CAN_IPC (1<<3) /* Must be paired with AS_USER */
586#define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
587#define DO_CHDIR (1<<6)
588
589/*
590 define a list of possible SMB messages and their corresponding
591 functions. Any message that has a NULL function is unimplemented -
592 please feel free to contribute implementations!
593*/
594static const struct smb_message_struct {
595 const char *name;
596 int (*fn)(connection_struct *conn, char *, char *, int, int);
597 int flags;
598} smb_messages[256] = {
599
600/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
601/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
602/* 0x02 */ { "SMBopen",reply_open,AS_USER },
603/* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
604/* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
605/* 0x05 */ { "SMBflush",reply_flush,AS_USER},
606/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
607/* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
608/* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
609/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
610/* 0x0a */ { "SMBread",reply_read,AS_USER},
611/* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
612/* 0x0c */ { "SMBlock",reply_lock,AS_USER},
613/* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
614/* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
615/* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
616/* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
617/* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
618/* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
619/* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
620/* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
621/* 0x15 */ { NULL, NULL, 0 },
622/* 0x16 */ { NULL, NULL, 0 },
623/* 0x17 */ { NULL, NULL, 0 },
624/* 0x18 */ { NULL, NULL, 0 },
625/* 0x19 */ { NULL, NULL, 0 },
626/* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
627/* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
628/* 0x1c */ { "SMBreadBs",NULL,0 },
629/* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
630/* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
631/* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
632/* 0x20 */ { "SMBwritec",NULL,0},
633/* 0x21 */ { NULL, NULL, 0 },
634/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
635/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
636/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
637/* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
638/* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
639/* 0x27 */ { "SMBioctl",reply_ioctl,0},
640/* 0x28 */ { "SMBioctls",NULL,AS_USER},
641/* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
642/* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
643/* 0x2b */ { "SMBecho",reply_echo,0},
644/* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
645/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
646/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
647/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
648/* 0x30 */ { NULL, NULL, 0 },
649/* 0x31 */ { NULL, NULL, 0 },
650/* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
651/* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
652/* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
653/* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
654/* 0x36 */ { NULL, NULL, 0 },
655/* 0x37 */ { NULL, NULL, 0 },
656/* 0x38 */ { NULL, NULL, 0 },
657/* 0x39 */ { NULL, NULL, 0 },
658/* 0x3a */ { NULL, NULL, 0 },
659/* 0x3b */ { NULL, NULL, 0 },
660/* 0x3c */ { NULL, NULL, 0 },
661/* 0x3d */ { NULL, NULL, 0 },
662/* 0x3e */ { NULL, NULL, 0 },
663/* 0x3f */ { NULL, NULL, 0 },
664/* 0x40 */ { NULL, NULL, 0 },
665/* 0x41 */ { NULL, NULL, 0 },
666/* 0x42 */ { NULL, NULL, 0 },
667/* 0x43 */ { NULL, NULL, 0 },
668/* 0x44 */ { NULL, NULL, 0 },
669/* 0x45 */ { NULL, NULL, 0 },
670/* 0x46 */ { NULL, NULL, 0 },
671/* 0x47 */ { NULL, NULL, 0 },
672/* 0x48 */ { NULL, NULL, 0 },
673/* 0x49 */ { NULL, NULL, 0 },
674/* 0x4a */ { NULL, NULL, 0 },
675/* 0x4b */ { NULL, NULL, 0 },
676/* 0x4c */ { NULL, NULL, 0 },
677/* 0x4d */ { NULL, NULL, 0 },
678/* 0x4e */ { NULL, NULL, 0 },
679/* 0x4f */ { NULL, NULL, 0 },
680/* 0x50 */ { NULL, NULL, 0 },
681/* 0x51 */ { NULL, NULL, 0 },
682/* 0x52 */ { NULL, NULL, 0 },
683/* 0x53 */ { NULL, NULL, 0 },
684/* 0x54 */ { NULL, NULL, 0 },
685/* 0x55 */ { NULL, NULL, 0 },
686/* 0x56 */ { NULL, NULL, 0 },
687/* 0x57 */ { NULL, NULL, 0 },
688/* 0x58 */ { NULL, NULL, 0 },
689/* 0x59 */ { NULL, NULL, 0 },
690/* 0x5a */ { NULL, NULL, 0 },
691/* 0x5b */ { NULL, NULL, 0 },
692/* 0x5c */ { NULL, NULL, 0 },
693/* 0x5d */ { NULL, NULL, 0 },
694/* 0x5e */ { NULL, NULL, 0 },
695/* 0x5f */ { NULL, NULL, 0 },
696/* 0x60 */ { NULL, NULL, 0 },
697/* 0x61 */ { NULL, NULL, 0 },
698/* 0x62 */ { NULL, NULL, 0 },
699/* 0x63 */ { NULL, NULL, 0 },
700/* 0x64 */ { NULL, NULL, 0 },
701/* 0x65 */ { NULL, NULL, 0 },
702/* 0x66 */ { NULL, NULL, 0 },
703/* 0x67 */ { NULL, NULL, 0 },
704/* 0x68 */ { NULL, NULL, 0 },
705/* 0x69 */ { NULL, NULL, 0 },
706/* 0x6a */ { NULL, NULL, 0 },
707/* 0x6b */ { NULL, NULL, 0 },
708/* 0x6c */ { NULL, NULL, 0 },
709/* 0x6d */ { NULL, NULL, 0 },
710/* 0x6e */ { NULL, NULL, 0 },
711/* 0x6f */ { NULL, NULL, 0 },
712/* 0x70 */ { "SMBtcon",reply_tcon,0},
713/* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
714/* 0x72 */ { "SMBnegprot",reply_negprot,0},
715/* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
716/* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
717/* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
718/* 0x76 */ { NULL, NULL, 0 },
719/* 0x77 */ { NULL, NULL, 0 },
720/* 0x78 */ { NULL, NULL, 0 },
721/* 0x79 */ { NULL, NULL, 0 },
722/* 0x7a */ { NULL, NULL, 0 },
723/* 0x7b */ { NULL, NULL, 0 },
724/* 0x7c */ { NULL, NULL, 0 },
725/* 0x7d */ { NULL, NULL, 0 },
726/* 0x7e */ { NULL, NULL, 0 },
727/* 0x7f */ { NULL, NULL, 0 },
728/* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
729/* 0x81 */ { "SMBsearch",reply_search,AS_USER},
730/* 0x82 */ { "SMBffirst",reply_search,AS_USER},
731/* 0x83 */ { "SMBfunique",reply_search,AS_USER},
732/* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
733/* 0x85 */ { NULL, NULL, 0 },
734/* 0x86 */ { NULL, NULL, 0 },
735/* 0x87 */ { NULL, NULL, 0 },
736/* 0x88 */ { NULL, NULL, 0 },
737/* 0x89 */ { NULL, NULL, 0 },
738/* 0x8a */ { NULL, NULL, 0 },
739/* 0x8b */ { NULL, NULL, 0 },
740/* 0x8c */ { NULL, NULL, 0 },
741/* 0x8d */ { NULL, NULL, 0 },
742/* 0x8e */ { NULL, NULL, 0 },
743/* 0x8f */ { NULL, NULL, 0 },
744/* 0x90 */ { NULL, NULL, 0 },
745/* 0x91 */ { NULL, NULL, 0 },
746/* 0x92 */ { NULL, NULL, 0 },
747/* 0x93 */ { NULL, NULL, 0 },
748/* 0x94 */ { NULL, NULL, 0 },
749/* 0x95 */ { NULL, NULL, 0 },
750/* 0x96 */ { NULL, NULL, 0 },
751/* 0x97 */ { NULL, NULL, 0 },
752/* 0x98 */ { NULL, NULL, 0 },
753/* 0x99 */ { NULL, NULL, 0 },
754/* 0x9a */ { NULL, NULL, 0 },
755/* 0x9b */ { NULL, NULL, 0 },
756/* 0x9c */ { NULL, NULL, 0 },
757/* 0x9d */ { NULL, NULL, 0 },
758/* 0x9e */ { NULL, NULL, 0 },
759/* 0x9f */ { NULL, NULL, 0 },
760/* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
761/* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
762/* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
763/* 0xa3 */ { NULL, NULL, 0 },
764/* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
765/* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
766/* 0xa6 */ { NULL, NULL, 0 },
767/* 0xa7 */ { NULL, NULL, 0 },
768/* 0xa8 */ { NULL, NULL, 0 },
769/* 0xa9 */ { NULL, NULL, 0 },
770/* 0xaa */ { NULL, NULL, 0 },
771/* 0xab */ { NULL, NULL, 0 },
772/* 0xac */ { NULL, NULL, 0 },
773/* 0xad */ { NULL, NULL, 0 },
774/* 0xae */ { NULL, NULL, 0 },
775/* 0xaf */ { NULL, NULL, 0 },
776/* 0xb0 */ { NULL, NULL, 0 },
777/* 0xb1 */ { NULL, NULL, 0 },
778/* 0xb2 */ { NULL, NULL, 0 },
779/* 0xb3 */ { NULL, NULL, 0 },
780/* 0xb4 */ { NULL, NULL, 0 },
781/* 0xb5 */ { NULL, NULL, 0 },
782/* 0xb6 */ { NULL, NULL, 0 },
783/* 0xb7 */ { NULL, NULL, 0 },
784/* 0xb8 */ { NULL, NULL, 0 },
785/* 0xb9 */ { NULL, NULL, 0 },
786/* 0xba */ { NULL, NULL, 0 },
787/* 0xbb */ { NULL, NULL, 0 },
788/* 0xbc */ { NULL, NULL, 0 },
789/* 0xbd */ { NULL, NULL, 0 },
790/* 0xbe */ { NULL, NULL, 0 },
791/* 0xbf */ { NULL, NULL, 0 },
792/* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
793/* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
794/* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
795/* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
796/* 0xc4 */ { NULL, NULL, 0 },
797/* 0xc5 */ { NULL, NULL, 0 },
798/* 0xc6 */ { NULL, NULL, 0 },
799/* 0xc7 */ { NULL, NULL, 0 },
800/* 0xc8 */ { NULL, NULL, 0 },
801/* 0xc9 */ { NULL, NULL, 0 },
802/* 0xca */ { NULL, NULL, 0 },
803/* 0xcb */ { NULL, NULL, 0 },
804/* 0xcc */ { NULL, NULL, 0 },
805/* 0xcd */ { NULL, NULL, 0 },
806/* 0xce */ { NULL, NULL, 0 },
807/* 0xcf */ { NULL, NULL, 0 },
808/* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
809/* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
810/* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
811/* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
812/* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
813/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
814/* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
815/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
816/* 0xd8 */ { NULL, NULL, 0 },
817/* 0xd9 */ { NULL, NULL, 0 },
818/* 0xda */ { NULL, NULL, 0 },
819/* 0xdb */ { NULL, NULL, 0 },
820/* 0xdc */ { NULL, NULL, 0 },
821/* 0xdd */ { NULL, NULL, 0 },
822/* 0xde */ { NULL, NULL, 0 },
823/* 0xdf */ { NULL, NULL, 0 },
824/* 0xe0 */ { NULL, NULL, 0 },
825/* 0xe1 */ { NULL, NULL, 0 },
826/* 0xe2 */ { NULL, NULL, 0 },
827/* 0xe3 */ { NULL, NULL, 0 },
828/* 0xe4 */ { NULL, NULL, 0 },
829/* 0xe5 */ { NULL, NULL, 0 },
830/* 0xe6 */ { NULL, NULL, 0 },
831/* 0xe7 */ { NULL, NULL, 0 },
832/* 0xe8 */ { NULL, NULL, 0 },
833/* 0xe9 */ { NULL, NULL, 0 },
834/* 0xea */ { NULL, NULL, 0 },
835/* 0xeb */ { NULL, NULL, 0 },
836/* 0xec */ { NULL, NULL, 0 },
837/* 0xed */ { NULL, NULL, 0 },
838/* 0xee */ { NULL, NULL, 0 },
839/* 0xef */ { NULL, NULL, 0 },
840/* 0xf0 */ { NULL, NULL, 0 },
841/* 0xf1 */ { NULL, NULL, 0 },
842/* 0xf2 */ { NULL, NULL, 0 },
843/* 0xf3 */ { NULL, NULL, 0 },
844/* 0xf4 */ { NULL, NULL, 0 },
845/* 0xf5 */ { NULL, NULL, 0 },
846/* 0xf6 */ { NULL, NULL, 0 },
847/* 0xf7 */ { NULL, NULL, 0 },
848/* 0xf8 */ { NULL, NULL, 0 },
849/* 0xf9 */ { NULL, NULL, 0 },
850/* 0xfa */ { NULL, NULL, 0 },
851/* 0xfb */ { NULL, NULL, 0 },
852/* 0xfc */ { NULL, NULL, 0 },
853/* 0xfd */ { NULL, NULL, 0 },
854/* 0xfe */ { NULL, NULL, 0 },
855/* 0xff */ { NULL, NULL, 0 }
856
857};
858
859/*******************************************************************
860 Dump a packet to a file.
861********************************************************************/
862
863static void smb_dump(const char *name, int type, char *data, ssize_t len)
864{
865 int fd, i;
866 pstring fname;
867 if (DEBUGLEVEL < 50) return;
868
869 if (len < 4) len = smb_len(data)+4;
870 for (i=1;i<100;i++) {
871 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
872 type ? "req" : "resp");
873 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
874 if (fd != -1 || errno != EEXIST) break;
875 }
876 if (fd != -1) {
877 ssize_t ret = write(fd, data, len);
878 if (ret != len)
879 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
880 close(fd);
881 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
882 }
883}
884
885
886/****************************************************************************
887 Do a switch on the message type, and return the response size
888****************************************************************************/
889
890static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
891{
892 static pid_t pid= (pid_t)-1;
893 int outsize = 0;
894
895 type &= 0xff;
896
897 if (pid == (pid_t)-1)
898 pid = sys_getpid();
899
900 errno = 0;
901
902 last_message = type;
903
904 /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
905 if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
906 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
907 exit_server_cleanly("Non-SMB packet");
908 return(-1);
909 }
910
911 /* yuck! this is an interim measure before we get rid of our
912 current inbuf/outbuf system */
913 global_smbpid = SVAL(inbuf,smb_pid);
914
915 if (smb_messages[type].fn == NULL) {
916 DEBUG(0,("Unknown message type %d!\n",type));
917 smb_dump("Unknown", 1, inbuf, size);
918 outsize = reply_unknown(inbuf,outbuf);
919 } else {
920 int flags = smb_messages[type].flags;
921 static uint16 last_session_tag = UID_FIELD_INVALID;
922 /* In share mode security we must ignore the vuid. */
923 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
924 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
925
926 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
927
928 smb_dump(smb_fn_name(type), 1, inbuf, size);
929
930 /* Ensure this value is replaced in the incoming packet. */
931 SSVAL(inbuf,smb_uid,session_tag);
932
933 /*
934 * Ensure the correct username is in current_user_info.
935 * This is a really ugly bugfix for problems with
936 * multiple session_setup_and_X's being done and
937 * allowing %U and %G substitutions to work correctly.
938 * There is a reason this code is done here, don't
939 * move it unless you know what you're doing... :-).
940 * JRA.
941 */
942
943 if (session_tag != last_session_tag) {
944 user_struct *vuser = NULL;
945
946 last_session_tag = session_tag;
947 if(session_tag != UID_FIELD_INVALID) {
948 vuser = get_valid_user_struct(session_tag);
949 if (vuser) {
950 set_current_user_info(&vuser->user);
951 }
952 }
953 }
954
955 /* Does this call need to be run as the connected user? */
956 if (flags & AS_USER) {
957
958 /* Does this call need a valid tree connection? */
959 if (!conn) {
960 /* Amazingly, the error code depends on the command (from Samba4). */
961 if (type == SMBntcreateX) {
962 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
963 } else {
964 return ERROR_DOS(ERRSRV, ERRinvnid);
965 }
966 }
967
968 if (!change_to_user(conn,session_tag)) {
969 return(ERROR_NT(NT_STATUS_DOS(ERRSRV,ERRbaduid)));
970 }
971
972 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
973
974 /* Does it need write permission? */
975 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
976 return ERROR_NT(NT_STATUS_MEDIA_WRITE_PROTECTED);
977 }
978
979 /* IPC services are limited */
980 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
981 return(ERROR_DOS(ERRSRV,ERRaccess));
982 }
983 } else {
984 /* This call needs to be run as root */
985 change_to_root_user();
986 }
987
988 /* load service specific parameters */
989 if (conn) {
990 if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
991 return(ERROR_DOS(ERRSRV,ERRaccess));
992 }
993 conn->num_smb_operations++;
994 }
995
996 /* does this protocol need to be run as guest? */
997 if ((flags & AS_GUEST) && (!change_to_guest() ||
998 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
999 return(ERROR_DOS(ERRSRV,ERRaccess));
1000 }
1001
1002 current_inbuf = inbuf; /* In case we need to defer this message in open... */
1003 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1004 }
1005
1006 smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1007
1008 return(outsize);
1009}
1010
1011/****************************************************************************
1012 Construct a reply to the incoming packet.
1013****************************************************************************/
1014
1015static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1016{
1017 int type = CVAL(inbuf,smb_com);
1018 int outsize = 0;
1019 int msg_type = CVAL(inbuf,0);
1020
1021 chain_size = 0;
1022 file_chain_reset();
1023 reset_chain_p();
1024
1025 if (msg_type != 0)
1026 return(reply_special(inbuf,outbuf));
1027
1028 construct_reply_common(inbuf, outbuf);
1029
1030 outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1031
1032 outsize += chain_size;
1033
1034 if(outsize > 4)
1035 smb_setlen(outbuf,outsize - 4);
1036 return(outsize);
1037}
1038
1039/****************************************************************************
1040 Process an smb from the client
1041****************************************************************************/
1042
1043static void process_smb(char *inbuf, char *outbuf)
1044{
1045 static int trans_num;
1046 int msg_type = CVAL(inbuf,0);
1047 int32 len = smb_len(inbuf);
1048 int nread = len + 4;
1049
1050 DO_PROFILE_INC(smb_count);
1051
1052 if (trans_num == 0) {
1053 /* on the first packet, check the global hosts allow/ hosts
1054 deny parameters before doing any parsing of the packet
1055 passed to us by the client. This prevents attacks on our
1056 parsing code from hosts not in the hosts allow list */
1057 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1058 lp_hostsdeny(-1))) {
1059 /* send a negative session response "not listening on calling name" */
1060 static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1061 DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1062 (void)send_smb(smbd_server_fd(),(char *)buf);
1063 exit_server_cleanly("connection denied");
1064 }
1065 }
1066
1067 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1068 DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1069
1070 if (msg_type == 0)
1071 show_msg(inbuf);
1072 else if(msg_type == SMBkeepalive)
1073 return; /* Keepalive packet. */
1074
1075 nread = construct_reply(inbuf,outbuf,nread,max_send);
1076
1077 if(nread > 0) {
1078 if (CVAL(outbuf,0) == 0)
1079 show_msg(outbuf);
1080
1081 if (nread != smb_len(outbuf) + 4) {
1082 DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1083 nread, smb_len(outbuf)));
1084 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1085 exit_server_cleanly("process_smb: send_smb failed.");
1086 }
1087 }
1088 trans_num++;
1089}
1090
1091/****************************************************************************
1092 Return a string containing the function name of a SMB command.
1093****************************************************************************/
1094
1095const char *smb_fn_name(int type)
1096{
1097 const char *unknown_name = "SMBunknown";
1098
1099 if (smb_messages[type].name == NULL)
1100 return(unknown_name);
1101
1102 return(smb_messages[type].name);
1103}
1104
1105/****************************************************************************
1106 Helper functions for contruct_reply.
1107****************************************************************************/
1108
1109static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1110
1111void add_to_common_flags2(uint32 v)
1112{
1113 common_flags2 |= v;
1114}
1115
1116void remove_from_common_flags2(uint32 v)
1117{
1118 common_flags2 &= ~v;
1119}
1120
1121void construct_reply_common(const char *inbuf, char *outbuf)
1122{
1123 set_message(outbuf,0,0,False);
1124
1125 SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1126 SIVAL(outbuf,smb_rcls,0);
1127 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1128 SSVAL(outbuf,smb_flg2,
1129 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1130 common_flags2);
1131 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1132
1133 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1134 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1135 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1136 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1137}
1138
1139/****************************************************************************
1140 Construct a chained reply and add it to the already made reply
1141****************************************************************************/
1142
1143int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1144{
1145 static char *orig_inbuf;
1146 static char *orig_outbuf;
1147 int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1148 unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1149 char *inbuf2, *outbuf2;
1150 int outsize2;
1151 int new_size;
1152 char inbuf_saved[smb_wct];
1153 char outbuf_saved[smb_wct];
1154 int outsize = smb_len(outbuf) + 4;
1155
1156 /* Maybe its not chained, or it's an error packet. */
1157 if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1158 SCVAL(outbuf,smb_vwv0,0xFF);
1159 return outsize;
1160 }
1161
1162 if (chain_size == 0) {
1163 /* this is the first part of the chain */
1164 orig_inbuf = inbuf;
1165 orig_outbuf = outbuf;
1166 }
1167
1168 /*
1169 * The original Win95 redirector dies on a reply to
1170 * a lockingX and read chain unless the chain reply is
1171 * 4 byte aligned. JRA.
1172 */
1173
1174 outsize = (outsize + 3) & ~3;
1175
1176 /* we need to tell the client where the next part of the reply will be */
1177 SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1178 SCVAL(outbuf,smb_vwv0,smb_com2);
1179
1180 /* remember how much the caller added to the chain, only counting stuff
1181 after the parameter words */
1182 chain_size += outsize - smb_wct;
1183
1184 /* work out pointers into the original packets. The
1185 headers on these need to be filled in */
1186 inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1187 outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1188
1189 /* remember the original command type */
1190 smb_com1 = CVAL(orig_inbuf,smb_com);
1191
1192 /* save the data which will be overwritten by the new headers */
1193 memcpy(inbuf_saved,inbuf2,smb_wct);
1194 memcpy(outbuf_saved,outbuf2,smb_wct);
1195
1196 /* give the new packet the same header as the last part of the SMB */
1197 memmove(inbuf2,inbuf,smb_wct);
1198
1199 /* create the in buffer */
1200 SCVAL(inbuf2,smb_com,smb_com2);
1201
1202 /* work out the new size for the in buffer. */
1203 new_size = size - (inbuf2 - inbuf);
1204 if (new_size < 0) {
1205 DEBUG(0,("chain_reply: chain packet size incorrect (orig size = %d, "
1206 "offset = %d)\n",
1207 size,
1208 (inbuf2 - inbuf) ));
1209 exit_server_cleanly("Bad chained packet");
1210 return(-1);
1211 }
1212
1213 /* And set it in the header. */
1214 smb_setlen(inbuf2, new_size);
1215
1216 /* create the out buffer */
1217 construct_reply_common(inbuf2, outbuf2);
1218
1219 DEBUG(3,("Chained message\n"));
1220 show_msg(inbuf2);
1221
1222 /* process the request */
1223 outsize2 = switch_message(smb_com2,inbuf2,outbuf2,new_size,
1224 bufsize-chain_size);
1225
1226 /* copy the new reply and request headers over the old ones, but
1227 preserve the smb_com field */
1228 memmove(orig_outbuf,outbuf2,smb_wct);
1229 SCVAL(orig_outbuf,smb_com,smb_com1);
1230
1231 /* restore the saved data, being careful not to overwrite any
1232 data from the reply header */
1233 memcpy(inbuf2,inbuf_saved,smb_wct);
1234
1235 {
1236 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1237 if (ofs < 0) {
1238 ofs = 0;
1239 }
1240 memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1241 }
1242
1243 return outsize2;
1244}
1245
1246/****************************************************************************
1247 Setup the needed select timeout in milliseconds.
1248****************************************************************************/
1249
1250static int setup_select_timeout(void)
1251{
1252 int select_timeout;
1253
1254 select_timeout = blocking_locks_timeout_ms(SMBD_SELECT_TIMEOUT*1000);
1255
1256 if (print_notify_messages_pending()) {
1257 select_timeout = MIN(select_timeout, 1000);
1258 }
1259
1260 return select_timeout;
1261}
1262
1263/****************************************************************************
1264 Check if services need reloading.
1265****************************************************************************/
1266
1267void check_reload(time_t t)
1268{
1269 static pid_t mypid = 0;
1270 static time_t last_smb_conf_reload_time = 0;
1271 static time_t last_printer_reload_time = 0;
1272 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1273
1274 if(last_smb_conf_reload_time == 0) {
1275 last_smb_conf_reload_time = t;
1276 /* Our printing subsystem might not be ready at smbd start up.
1277 Then no printer is available till the first printers check
1278 is performed. A lower initial interval circumvents this. */
1279 if ( printcap_cache_time > 60 )
1280 last_printer_reload_time = t - printcap_cache_time + 60;
1281 else
1282 last_printer_reload_time = t;
1283 }
1284
1285 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1286 /* randomize over 60 second the printcap reload to avoid all
1287 * process hitting cupsd at the same time */
1288 int time_range = 60;
1289
1290 last_printer_reload_time += random() % time_range;
1291 mypid = getpid();
1292 }
1293
1294 if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1295 reload_services(True);
1296 reload_after_sighup = False;
1297 last_smb_conf_reload_time = t;
1298 }
1299
1300 /* 'printcap cache time = 0' disable the feature */
1301
1302 if ( printcap_cache_time != 0 )
1303 {
1304 /* see if it's time to reload or if the clock has been set back */
1305
1306 if ( (t >= last_printer_reload_time+printcap_cache_time)
1307 || (t-last_printer_reload_time < 0) )
1308 {
1309 DEBUG( 3,( "Printcap cache time expired.\n"));
1310 reload_printers();
1311 last_printer_reload_time = t;
1312 }
1313 }
1314}
1315
1316/****************************************************************************
1317 Process any timeout housekeeping. Return False if the caller should exit.
1318****************************************************************************/
1319
1320static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1321{
1322 static time_t last_keepalive_sent_time = 0;
1323 static time_t last_idle_closed_check = 0;
1324 time_t t;
1325 BOOL allidle = True;
1326
1327 if (smb_read_error == READ_EOF) {
1328 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1329 return False;
1330 }
1331
1332 if (smb_read_error == READ_ERROR) {
1333 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1334 strerror(errno)));
1335 return False;
1336 }
1337
1338 if (smb_read_error == READ_BAD_SIG) {
1339 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1340 return False;
1341 }
1342
1343 *last_timeout_processing_time = t = time(NULL);
1344
1345 if(last_keepalive_sent_time == 0)
1346 last_keepalive_sent_time = t;
1347
1348 if(last_idle_closed_check == 0)
1349 last_idle_closed_check = t;
1350
1351 /* become root again if waiting */
1352 change_to_root_user();
1353
1354 /* run all registered idle events */
1355 smb_run_idle_events(t);
1356
1357 /* check if we need to reload services */
1358 check_reload(t);
1359
1360 /* automatic timeout if all connections are closed */
1361 if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1362 DEBUG( 2, ( "Closing idle connection\n" ) );
1363 return False;
1364 } else {
1365 last_idle_closed_check = t;
1366 }
1367
1368 if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1369 if (!send_keepalive(smbd_server_fd())) {
1370 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1371 return False;
1372 }
1373
1374 /* send a keepalive for a password server or the like.
1375 This is attached to the auth_info created in the
1376 negprot */
1377 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1378 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1379
1380 negprot_global_auth_context->challenge_set_method->send_keepalive
1381 (&negprot_global_auth_context->challenge_set_method->private_data);
1382 }
1383
1384 last_keepalive_sent_time = t;
1385 }
1386
1387 /* check for connection timeouts */
1388 allidle = conn_idle_all(t, deadtime);
1389
1390 if (allidle && conn_num_open()>0) {
1391 DEBUG(2,("Closing idle connection 2.\n"));
1392 return False;
1393 }
1394
1395 if(global_machine_password_needs_changing &&
1396 /* for ADS we need to do a regular ADS password change, not a domain
1397 password change */
1398 lp_security() == SEC_DOMAIN) {
1399
1400 unsigned char trust_passwd_hash[16];
1401 time_t lct;
1402
1403 /*
1404 * We're in domain level security, and the code that
1405 * read the machine password flagged that the machine
1406 * password needs changing.
1407 */
1408
1409 /*
1410 * First, open the machine password file with an exclusive lock.
1411 */
1412
1413 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1414 DEBUG(0,("process: unable to lock the machine account password for \
1415machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1416 return True;
1417 }
1418
1419 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1420 DEBUG(0,("process: unable to read the machine account password for \
1421machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1422 secrets_lock_trust_account_password(lp_workgroup(), False);
1423 return True;
1424 }
1425
1426 /*
1427 * Make sure someone else hasn't already done this.
1428 */
1429
1430 if(t < lct + lp_machine_password_timeout()) {
1431 global_machine_password_needs_changing = False;
1432 secrets_lock_trust_account_password(lp_workgroup(), False);
1433 return True;
1434 }
1435
1436 /* always just contact the PDC here */
1437
1438 change_trust_account_password( lp_workgroup(), NULL);
1439 global_machine_password_needs_changing = False;
1440 secrets_lock_trust_account_password(lp_workgroup(), False);
1441 }
1442
1443 /*
1444 * Check to see if we have any blocking locks
1445 * outstanding on the queue.
1446 */
1447 process_blocking_lock_queue();
1448
1449 /* update printer queue caches if necessary */
1450
1451 update_monitored_printq_cache();
1452
1453 /*
1454 * Now we are root, check if the log files need pruning.
1455 * Force a log file check.
1456 */
1457 force_check_log_size();
1458 check_log_size();
1459
1460 /* Send any queued printer notify message to interested smbd's. */
1461
1462 print_notify_send_messages(0);
1463
1464 /*
1465 * Modify the select timeout depending upon
1466 * what we have remaining in our queues.
1467 */
1468
1469 *select_timeout = setup_select_timeout();
1470
1471 return True;
1472}
1473
1474/****************************************************************************
1475 Accessor functions for InBuffer, OutBuffer.
1476****************************************************************************/
1477
1478char *get_InBuffer(void)
1479{
1480 return InBuffer;
1481}
1482
1483char *get_OutBuffer(void)
1484{
1485 return OutBuffer;
1486}
1487
1488const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1489
1490/****************************************************************************
1491 Allocate a new InBuffer. Returns the new and old ones.
1492****************************************************************************/
1493
1494static char *NewInBuffer(char **old_inbuf)
1495{
1496 char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1497 if (!new_inbuf) {
1498 return NULL;
1499 }
1500 if (old_inbuf) {
1501 *old_inbuf = InBuffer;
1502 }
1503 InBuffer = new_inbuf;
1504#if defined(DEVELOPER)
1505 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1506#endif
1507 return InBuffer;
1508}
1509
1510/****************************************************************************
1511 Allocate a new OutBuffer. Returns the new and old ones.
1512****************************************************************************/
1513
1514static char *NewOutBuffer(char **old_outbuf)
1515{
1516 char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1517 if (!new_outbuf) {
1518 return NULL;
1519 }
1520 if (old_outbuf) {
1521 *old_outbuf = OutBuffer;
1522 }
1523 OutBuffer = new_outbuf;
1524#if defined(DEVELOPER)
1525 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1526#endif
1527 return OutBuffer;
1528}
1529
1530/****************************************************************************
1531 Process commands from the client
1532****************************************************************************/
1533
1534void smbd_process(void)
1535{
1536 time_t last_timeout_processing_time = time(NULL);
1537 unsigned int num_smbs = 0;
1538
1539 /* Allocate the primary Inbut/Output buffers. */
1540
1541 if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1542 return;
1543
1544 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1545
1546 while (True) {
1547 int deadtime = lp_deadtime()*60;
1548 int select_timeout = setup_select_timeout();
1549 int num_echos;
1550
1551 if (deadtime <= 0)
1552 deadtime = DEFAULT_SMBD_TIMEOUT;
1553
1554 errno = 0;
1555
1556 /* free up temporary memory */
1557 lp_TALLOC_FREE();
1558 main_loop_TALLOC_FREE();
1559
1560 /* Did someone ask for immediate checks on things like blocking locks ? */
1561 if (select_timeout == 0) {
1562 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1563 return;
1564 num_smbs = 0; /* Reset smb counter. */
1565 }
1566
1567 run_events(smbd_event_context(), 0, NULL, NULL);
1568
1569#if defined(DEVELOPER)
1570 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1571#endif
1572
1573 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1574 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1575 return;
1576 num_smbs = 0; /* Reset smb counter. */
1577 }
1578
1579 /*
1580 * Ensure we do timeout processing if the SMB we just got was
1581 * only an echo request. This allows us to set the select
1582 * timeout in 'receive_message_or_smb()' to any value we like
1583 * without worrying that the client will send echo requests
1584 * faster than the select timeout, thus starving out the
1585 * essential processing (change notify, blocking locks) that
1586 * the timeout code does. JRA.
1587 */
1588 num_echos = smb_echo_count;
1589
1590 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1591
1592 process_smb(InBuffer, OutBuffer);
1593
1594 if (smb_echo_count != num_echos) {
1595 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1596 return;
1597 num_smbs = 0; /* Reset smb counter. */
1598 }
1599
1600 num_smbs++;
1601
1602 /*
1603 * If we are getting smb requests in a constant stream
1604 * with no echos, make sure we attempt timeout processing
1605 * every select_timeout milliseconds - but only check for this
1606 * every 200 smb requests.
1607 */
1608
1609 if ((num_smbs % 200) == 0) {
1610 time_t new_check_time = time(NULL);
1611 if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1612 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1613 return;
1614 num_smbs = 0; /* Reset smb counter. */
1615 last_timeout_processing_time = new_check_time; /* Reset time. */
1616 }
1617 }
1618
1619 /* The timeout_processing function isn't run nearly
1620 often enough to implement 'max log size' without
1621 overrunning the size of the file by many megabytes.
1622 This is especially true if we are running at debug
1623 level 10. Checking every 50 SMBs is a nice
1624 tradeoff of performance vs log file size overrun. */
1625
1626 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1627 change_to_root_user();
1628 check_log_size();
1629 }
1630 }
1631}
Note: See TracBrowser for help on using the repository browser.