source: branches/samba-3.3.x/source/smbd/process.c

Last change on this file was 694, checked in by Herwig Bauernfeind, 13 years ago

Update Samba 3.3 with CVE-2012-0870 security patch
File size: 57.4 KB
RevLine 
[223]1/*
2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22
23extern int smb_echo_count;
24
25/*
26 * Size of data we can send to client. Set
27 * by the client for all protocols above CORE.
28 * Set by us for CORE protocol.
29 */
30int max_send = BUFFER_SIZE;
31/*
32 * Size of the data we can receive. Set by us.
33 * Can be modified by the max xmit parameter.
34 */
35int max_recv = BUFFER_SIZE;
36
37SIG_ATOMIC_T reload_after_sighup = 0;
38SIG_ATOMIC_T got_sig_term = 0;
39extern bool global_machine_password_needs_changing;
40extern int max_send;
41
42/* Accessor function for smb_read_error for smbd functions. */
43
44/****************************************************************************
45 Send an smb to a fd.
46****************************************************************************/
47
48bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
49{
50 size_t len;
51 size_t nwritten=0;
52 ssize_t ret;
53 char *buf_out = buffer;
54
55 /* Sign the outgoing packet if required. */
56 srv_calculate_sign_mac(buf_out);
57
58 if (do_encrypt) {
59 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
60 if (!NT_STATUS_IS_OK(status)) {
61 DEBUG(0, ("send_smb: SMB encryption failed "
62 "on outgoing packet! Error %s\n",
63 nt_errstr(status) ));
64 return false;
65 }
66 }
67
68 len = smb_len(buf_out) + 4;
69
70 while (nwritten < len) {
71 ret = write_data(fd,buf_out+nwritten,len - nwritten);
72 if (ret <= 0) {
73 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
74 (int)len,(int)ret, strerror(errno) ));
75 srv_free_enc_buffer(buf_out);
76 return false;
77 }
78 nwritten += ret;
79 }
80
81 srv_free_enc_buffer(buf_out);
82 return true;
83}
84
85/*******************************************************************
86 Setup the word count and byte count for a smb message.
87********************************************************************/
88
89int srv_set_message(char *buf,
90 int num_words,
91 int num_bytes,
92 bool zero)
93{
94 if (zero && (num_words || num_bytes)) {
95 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
96 }
97 SCVAL(buf,smb_wct,num_words);
98 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
99 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
100 return (smb_size + num_words*2 + num_bytes);
101}
102
103static bool valid_smb_header(const uint8_t *inbuf)
104{
105 if (is_encrypted_packet(inbuf)) {
106 return true;
107 }
108 /*
109 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
110 * but it just looks weird to call strncmp for this one.
111 */
112 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
113}
114
115/* Socket functions for smbd packet processing. */
116
117static bool valid_packet_size(size_t len)
118{
119 /*
120 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
121 * of header. Don't print the error if this fits.... JRA.
122 */
123
124 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
125 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
126 (unsigned long)len));
127 return false;
128 }
129 return true;
130}
131
132static NTSTATUS read_packet_remainder(int fd, char *buffer,
133 unsigned int timeout, ssize_t len)
134{
135 if (len <= 0) {
136 return NT_STATUS_OK;
137 }
138
139 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
140}
141
142/****************************************************************************
143 Attempt a zerocopy writeX read. We know here that len > smb_size-4
144****************************************************************************/
145
146/*
147 * Unfortunately, earlier versions of smbclient/libsmbclient
148 * don't send this "standard" writeX header. I've fixed this
149 * for 3.2 but we'll use the old method with earlier versions.
150 * Windows and CIFSFS at least use this standard size. Not
151 * sure about MacOSX.
152 */
153
154#define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
155 (2*14) + /* word count (including bcc) */ \
156 1 /* pad byte */)
157
158static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
159 const char *lenbuf,
160 int fd, char **buffer,
161 unsigned int timeout,
162 size_t *p_unread,
163 size_t *len_ret)
164{
165 /* Size of a WRITEX call (+4 byte len). */
166 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
167 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
168 ssize_t toread;
169 NTSTATUS status;
170
171 memcpy(writeX_header, lenbuf, 4);
172
173 status = read_socket_with_timeout(
174 fd, writeX_header + 4,
175 STANDARD_WRITE_AND_X_HEADER_SIZE,
176 STANDARD_WRITE_AND_X_HEADER_SIZE,
177 timeout, NULL);
178
179 if (!NT_STATUS_IS_OK(status)) {
180 return status;
181 }
182
183 /*
184 * Ok - now try and see if this is a possible
185 * valid writeX call.
186 */
187
188 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
189 /*
190 * If the data offset is beyond what
191 * we've read, drain the extra bytes.
192 */
193 uint16_t doff = SVAL(writeX_header,smb_vwv11);
194 ssize_t newlen;
195
196 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
197 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
198 if (drain_socket(smbd_server_fd(), drain) != drain) {
199 smb_panic("receive_smb_raw_talloc_partial_read:"
200 " failed to drain pending bytes");
201 }
202 } else {
203 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
204 }
205
206 /* Spoof down the length and null out the bcc. */
207 set_message_bcc(writeX_header, 0);
208 newlen = smb_len(writeX_header);
209
210 /* Copy the header we've written. */
211
212 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
213 writeX_header,
214 sizeof(writeX_header));
215
216 if (*buffer == NULL) {
217 DEBUG(0, ("Could not allocate inbuf of length %d\n",
218 (int)sizeof(writeX_header)));
219 return NT_STATUS_NO_MEMORY;
220 }
221
222 /* Work out the remaining bytes. */
223 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
224 *len_ret = newlen + 4;
225 return NT_STATUS_OK;
226 }
227
228 if (!valid_packet_size(len)) {
229 return NT_STATUS_INVALID_PARAMETER;
230 }
231
232 /*
233 * Not a valid writeX call. Just do the standard
234 * talloc and return.
235 */
236
237 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
238
239 if (*buffer == NULL) {
240 DEBUG(0, ("Could not allocate inbuf of length %d\n",
241 (int)len+4));
242 return NT_STATUS_NO_MEMORY;
243 }
244
245 /* Copy in what we already read. */
246 memcpy(*buffer,
247 writeX_header,
248 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
249 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
250
251 if(toread > 0) {
252 status = read_packet_remainder(
253 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
254 timeout, toread);
255
256 if (!NT_STATUS_IS_OK(status)) {
257 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
258 nt_errstr(status)));
259 return status;
260 }
261 }
262
263 *len_ret = len + 4;
264 return NT_STATUS_OK;
265}
266
267static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
268 char **buffer, unsigned int timeout,
269 size_t *p_unread, size_t *plen)
270{
271 char lenbuf[4];
272 size_t len;
273 int min_recv_size = lp_min_receive_file_size();
274 NTSTATUS status;
275
276 *p_unread = 0;
277
278 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
279 if (!NT_STATUS_IS_OK(status)) {
280 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
281 return status;
282 }
283
284 if (CVAL(lenbuf,0) == 0 &&
285 min_recv_size &&
286 smb_len_large(lenbuf) > (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE) && /* Could be a UNIX large writeX. */
287 !srv_is_signing_active()) {
288
289 return receive_smb_raw_talloc_partial_read(
290 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
291 }
292
293 if (!valid_packet_size(len)) {
294 return NT_STATUS_INVALID_PARAMETER;
295 }
296
297 /*
298 * The +4 here can't wrap, we've checked the length above already.
299 */
300
301 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
302
303 if (*buffer == NULL) {
304 DEBUG(0, ("Could not allocate inbuf of length %d\n",
305 (int)len+4));
306 return NT_STATUS_NO_MEMORY;
307 }
308
309 memcpy(*buffer, lenbuf, sizeof(lenbuf));
310
311 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
312 if (!NT_STATUS_IS_OK(status)) {
313 return status;
314 }
315
316 *plen = len + 4;
317 return NT_STATUS_OK;
318}
319
320static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
321 char **buffer, unsigned int timeout,
322 size_t *p_unread, bool *p_encrypted,
323 size_t *p_len)
324{
325 size_t len = 0;
326 NTSTATUS status;
327
328 *p_encrypted = false;
329
330 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
331 p_unread, &len);
332 if (!NT_STATUS_IS_OK(status)) {
333 return status;
334 }
335
336 if (is_encrypted_packet((uint8_t *)*buffer)) {
337 status = srv_decrypt_buffer(*buffer);
338 if (!NT_STATUS_IS_OK(status)) {
339 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
340 "incoming packet! Error %s\n",
341 nt_errstr(status) ));
342 return status;
343 }
344 *p_encrypted = true;
345 }
346
347 /* Check the incoming SMB signature. */
348 if (!srv_check_sign_mac(*buffer, true)) {
349 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
350 "incoming packet!\n"));
351 return NT_STATUS_INVALID_NETWORK_RESPONSE;
352 }
353
354 *p_len = len;
355 return NT_STATUS_OK;
356}
357
358/*
359 * Initialize a struct smb_request from an inbuf
360 */
361
362void init_smb_request(struct smb_request *req,
363 const uint8 *inbuf,
364 size_t unread_bytes,
365 bool encrypted)
366{
367 size_t req_size = smb_len(inbuf) + 4;
368 /* Ensure we have at least smb_size bytes. */
369 if (req_size < smb_size) {
370 DEBUG(0,("init_smb_request: invalid request size %u\n",
371 (unsigned int)req_size ));
372 exit_server_cleanly("Invalid SMB request");
373 }
374 req->flags2 = SVAL(inbuf, smb_flg2);
375 req->smbpid = SVAL(inbuf, smb_pid);
376 req->mid = SVAL(inbuf, smb_mid);
377 req->vuid = SVAL(inbuf, smb_uid);
378 req->tid = SVAL(inbuf, smb_tid);
379 req->wct = CVAL(inbuf, smb_wct);
380 req->unread_bytes = unread_bytes;
381 req->encrypted = encrypted;
382 req->conn = conn_find(req->tid);
383
384 /* Ensure we have at least wct words and 2 bytes of bcc. */
385 if (smb_size + req->wct*2 > req_size) {
386 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
387 (unsigned int)req->wct,
388 (unsigned int)req_size));
389 exit_server_cleanly("Invalid SMB request");
390 }
391 /* Ensure bcc is correct. */
392 if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
393 DEBUG(0,("init_smb_request: invalid bcc number %u "
394 "(wct = %u, size %u)\n",
395 (unsigned int)smb_buflen(inbuf),
396 (unsigned int)req->wct,
397 (unsigned int)req_size));
398 exit_server_cleanly("Invalid SMB request");
399 }
400 req->inbuf = inbuf;
401 req->outbuf = NULL;
402}
403
404/****************************************************************************
405 structure to hold a linked list of queued messages.
406 for processing.
407****************************************************************************/
408
409static struct pending_message_list *deferred_open_queue;
410
411/****************************************************************************
412 Function to push a message onto the tail of a linked list of smb messages ready
413 for processing.
414****************************************************************************/
415
416static bool push_queued_message(struct smb_request *req,
417 struct timeval request_time,
418 struct timeval end_time,
419 char *private_data, size_t private_len)
420{
421 int msg_len = smb_len(req->inbuf) + 4;
422 struct pending_message_list *msg;
423
424 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
425
426 if(msg == NULL) {
427 DEBUG(0,("push_message: malloc fail (1)\n"));
428 return False;
429 }
430
431 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
432 if(msg->buf.data == NULL) {
433 DEBUG(0,("push_message: malloc fail (2)\n"));
434 TALLOC_FREE(msg);
435 return False;
436 }
437
438 msg->request_time = request_time;
439 msg->end_time = end_time;
440 msg->encrypted = req->encrypted;
[338]441 msg->processed = false;
[223]442
443 if (private_data) {
444 msg->private_data = data_blob_talloc(msg, private_data,
445 private_len);
446 if (msg->private_data.data == NULL) {
447 DEBUG(0,("push_message: malloc fail (3)\n"));
448 TALLOC_FREE(msg);
449 return False;
450 }
451 }
452
453 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
454
455 DEBUG(10,("push_message: pushed message length %u on "
456 "deferred_open_queue\n", (unsigned int)msg_len));
457
458 return True;
459}
460
461/****************************************************************************
462 Function to delete a sharing violation open message by mid.
463****************************************************************************/
464
465void remove_deferred_open_smb_message(uint16 mid)
466{
467 struct pending_message_list *pml;
468
469 for (pml = deferred_open_queue; pml; pml = pml->next) {
470 if (mid == SVAL(pml->buf.data,smb_mid)) {
471 DEBUG(10,("remove_sharing_violation_open_smb_message: "
472 "deleting mid %u len %u\n",
473 (unsigned int)mid,
474 (unsigned int)pml->buf.length ));
475 DLIST_REMOVE(deferred_open_queue, pml);
476 TALLOC_FREE(pml);
477 return;
478 }
479 }
480}
481
482/****************************************************************************
483 Move a sharing violation open retry message to the front of the list and
484 schedule it for immediate processing.
485****************************************************************************/
486
487void schedule_deferred_open_smb_message(uint16 mid)
488{
489 struct pending_message_list *pml;
490 int i = 0;
491
492 for (pml = deferred_open_queue; pml; pml = pml->next) {
493 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
494 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
495 (unsigned int)msg_mid ));
496 if (mid == msg_mid) {
[338]497
498 if (pml->processed) {
499 /* A processed message should not be
500 * rescheduled. */
501 DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR "
502 "message mid %u was already processed\n",
503 (unsigned int)msg_mid ));
504 continue;
505 }
506
[223]507 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
508 mid ));
509 pml->end_time.tv_sec = 0;
510 pml->end_time.tv_usec = 0;
511 DLIST_PROMOTE(deferred_open_queue, pml);
512 return;
513 }
514 }
515
516 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
517 mid ));
518}
519
520/****************************************************************************
[338]521 Return true if this mid is on the deferred queue and was not yet processed.
[223]522****************************************************************************/
523
524bool open_was_deferred(uint16 mid)
525{
526 struct pending_message_list *pml;
527
528 for (pml = deferred_open_queue; pml; pml = pml->next) {
[338]529 if (SVAL(pml->buf.data,smb_mid) == mid && !pml->processed) {
[223]530 return True;
531 }
532 }
533 return False;
534}
535
536/****************************************************************************
537 Return the message queued by this mid.
538****************************************************************************/
539
540struct pending_message_list *get_open_deferred_message(uint16 mid)
541{
542 struct pending_message_list *pml;
543
544 for (pml = deferred_open_queue; pml; pml = pml->next) {
545 if (SVAL(pml->buf.data,smb_mid) == mid) {
546 return pml;
547 }
548 }
549 return NULL;
550}
551
552/****************************************************************************
553 Function to push a deferred open smb message onto a linked list of local smb
554 messages ready for processing.
555****************************************************************************/
556
557bool push_deferred_smb_message(struct smb_request *req,
558 struct timeval request_time,
559 struct timeval timeout,
560 char *private_data, size_t priv_len)
561{
562 struct timeval end_time;
563
564 if (req->unread_bytes) {
565 DEBUG(0,("push_deferred_smb_message: logic error ! "
566 "unread_bytes = %u\n",
567 (unsigned int)req->unread_bytes ));
568 smb_panic("push_deferred_smb_message: "
569 "logic error unread_bytes != 0" );
570 }
571
572 end_time = timeval_sum(&request_time, &timeout);
573
574 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
575 "timeout time [%u.%06u]\n",
576 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
577 (unsigned int)end_time.tv_sec,
578 (unsigned int)end_time.tv_usec));
579
580 return push_queued_message(req, request_time, end_time,
581 private_data, priv_len);
582}
583
584struct idle_event {
585 struct timed_event *te;
586 struct timeval interval;
587 char *name;
588 bool (*handler)(const struct timeval *now, void *private_data);
589 void *private_data;
590};
591
592static void smbd_idle_event_handler(struct event_context *ctx,
593 struct timed_event *te,
594 struct timeval now,
595 void *private_data)
596{
597 struct idle_event *event =
598 talloc_get_type_abort(private_data, struct idle_event);
599
600 TALLOC_FREE(event->te);
601
602 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
603 event->name, event->te));
604
605 if (!event->handler(&now, event->private_data)) {
606 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
607 event->name, event->te));
608 /* Don't repeat, delete ourselves */
609 TALLOC_FREE(event);
610 return;
611 }
612
613 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
614 event->name, event->te));
615
616 event->te = event_add_timed(ctx, event,
617 timeval_sum(&now, &event->interval),
618 smbd_idle_event_handler, event);
619
620 /* We can't do much but fail here. */
621 SMB_ASSERT(event->te != NULL);
622}
623
624struct idle_event *event_add_idle(struct event_context *event_ctx,
625 TALLOC_CTX *mem_ctx,
626 struct timeval interval,
627 const char *name,
628 bool (*handler)(const struct timeval *now,
629 void *private_data),
630 void *private_data)
631{
632 struct idle_event *result;
633 struct timeval now = timeval_current();
634
635 result = TALLOC_P(mem_ctx, struct idle_event);
636 if (result == NULL) {
637 DEBUG(0, ("talloc failed\n"));
638 return NULL;
639 }
640
641 result->interval = interval;
642 result->handler = handler;
643 result->private_data = private_data;
644
645 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
646 DEBUG(0, ("talloc failed\n"));
647 TALLOC_FREE(result);
648 return NULL;
649 }
650
651 result->te = event_add_timed(event_ctx, result,
652 timeval_sum(&now, &interval),
653 smbd_idle_event_handler, result);
654 if (result->te == NULL) {
655 DEBUG(0, ("event_add_timed failed\n"));
656 TALLOC_FREE(result);
657 return NULL;
658 }
659
660 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
661 return result;
662}
663
664/****************************************************************************
665 Do all async processing in here. This includes kernel oplock messages, change
666 notify events etc.
667****************************************************************************/
668
669static void async_processing(fd_set *pfds)
670{
671 DEBUG(10,("async_processing: Doing async processing.\n"));
672
673 process_aio_queue();
674
675 process_kernel_oplocks(smbd_messaging_context(), pfds);
676
677 /* Do the aio check again after receive_local_message as it does a
678 select and may have eaten our signal. */
679 /* Is this till true? -- vl */
680 process_aio_queue();
681
682 if (got_sig_term) {
683 exit_server_cleanly("termination signal");
684 }
685
686 /* check for sighup processing */
687 if (reload_after_sighup) {
688 change_to_root_user();
689 DEBUG(1,("Reloading services after SIGHUP\n"));
690 reload_services(False);
691 reload_after_sighup = 0;
692 }
693}
694
695/****************************************************************************
696 Add a fd to the set we will be select(2)ing on.
697****************************************************************************/
698
699static int select_on_fd(int fd, int maxfd, fd_set *fds)
700{
[578]701 if (fd != -1 && fd < FD_SETSIZE) {
[223]702 FD_SET(fd, fds);
703 maxfd = MAX(maxfd, fd);
704 }
705
706 return maxfd;
707}
708
709/****************************************************************************
710 Do a select on an two fd's - with timeout.
711
712 If a local udp message has been pushed onto the
713 queue (this can only happen during oplock break
714 processing) call async_processing()
715
716 If a pending smb message has been pushed onto the
717 queue (this can only happen during oplock break
718 processing) return this next.
719
720 If the first smbfd is ready then read an smb from it.
721 if the second (loopback UDP) fd is ready then read a message
722 from it and setup the buffer header to identify the length
723 and from address.
724 Returns False on timeout or error.
725 Else returns True.
726
727The timeout is in milliseconds
728****************************************************************************/
729
730static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
731 size_t *buffer_len,
732 size_t *p_unread, bool *p_encrypted)
733{
734 fd_set r_fds, w_fds;
735 int selrtn;
736 struct timeval to;
737 int maxfd = 0;
738 size_t len = 0;
739 NTSTATUS status;
740
741 *p_unread = 0;
742
743 again:
744
745 to.tv_sec = SMBD_SELECT_TIMEOUT;
746 to.tv_usec = 0;
747
748 /*
749 * Note that this call must be before processing any SMB
750 * messages as we need to synchronously process any messages
751 * we may have sent to ourselves from the previous SMB.
752 */
753 message_dispatch(smbd_messaging_context());
754
755 /*
756 * Check to see if we already have a message on the deferred open queue
757 * and it's time to schedule.
758 */
759 if(deferred_open_queue != NULL) {
760 bool pop_message = False;
761 struct pending_message_list *msg = deferred_open_queue;
762
763 if (timeval_is_zero(&msg->end_time)) {
764 pop_message = True;
765 } else {
766 struct timeval tv;
767 SMB_BIG_INT tdif;
768
769 GetTimeOfDay(&tv);
770 tdif = usec_time_diff(&msg->end_time, &tv);
771 if (tdif <= 0) {
772 /* Timed out. Schedule...*/
773 pop_message = True;
774 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
775 } else {
776 /* Make a more accurate select timeout. */
777 to.tv_sec = tdif / 1000000;
778 to.tv_usec = tdif % 1000000;
779 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
780 (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
781 }
782 }
783
784 if (pop_message) {
785
786 *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
787 msg->buf.length);
788 if (*buffer == NULL) {
789 DEBUG(0, ("talloc failed\n"));
790 return NT_STATUS_NO_MEMORY;
791 }
792 *buffer_len = msg->buf.length;
793 *p_encrypted = msg->encrypted;
794
795 /* We leave this message on the queue so the open code can
796 know this is a retry. */
797 DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
[338]798
799 /* Mark the message as processed so this is not
800 * re-processed in error. */
801 msg->processed = true;
[223]802 return NT_STATUS_OK;
803 }
804 }
805
806 /*
807 * Setup the select fd sets.
808 */
809
810 FD_ZERO(&r_fds);
811 FD_ZERO(&w_fds);
812
813 /*
814 * Ensure we process oplock break messages by preference.
815 * We have to do this before the select, after the select
816 * and if the select returns EINTR. This is due to the fact
817 * that the selects called from async_processing can eat an EINTR
818 * caused by a signal (we can't take the break message there).
819 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
820 */
821
822 if (oplock_message_waiting(&r_fds)) {
823 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
824 async_processing(&r_fds);
825 /*
826 * After async processing we must go and do the select again, as
827 * the state of the flag in fds for the server file descriptor is
828 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
829 */
830 goto again;
831 }
832
833 /*
834 * Are there any timed events waiting ? If so, ensure we don't
835 * select for longer than it would take to wait for them.
836 */
837
838 {
839 struct timeval now;
840 GetTimeOfDay(&now);
841
842 event_add_to_select_args(smbd_event_context(), &now,
843 &r_fds, &w_fds, &to, &maxfd);
844 }
845
846 if (timeval_is_zero(&to)) {
847 /* Process a timed event now... */
848 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
849 goto again;
850 }
851 }
852
853 {
854 int sav;
855 START_PROFILE(smbd_idle);
856
857 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
858 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
859
860 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
861 sav = errno;
862
863 END_PROFILE(smbd_idle);
864 errno = sav;
865 }
866
867 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
868 goto again;
869 }
870
871 /* if we get EINTR then maybe we have received an oplock
872 signal - treat this as select returning 1. This is ugly, but
873 is the best we can do until the oplock code knows more about
874 signals */
875 if (selrtn == -1 && errno == EINTR) {
876 async_processing(&r_fds);
877 /*
878 * After async processing we must go and do the select again, as
879 * the state of the flag in fds for the server file descriptor is
880 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
881 */
882 goto again;
883 }
884
885 /* Check if error */
886 if (selrtn == -1) {
887 /* something is wrong. Maybe the socket is dead? */
888 return map_nt_error_from_unix(errno);
889 }
890
891 /* Did we timeout ? */
892 if (selrtn == 0) {
893 goto again;
894 }
895
896 /*
897 * Ensure we process oplock break messages by preference.
898 * This is IMPORTANT ! Otherwise we can starve other processes
899 * sending us an oplock break message. JRA.
900 */
901
902 if (oplock_message_waiting(&r_fds)) {
903 async_processing(&r_fds);
904 /*
905 * After async processing we must go and do the select again, as
906 * the state of the flag in fds for the server file descriptor is
907 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
908 */
909 goto again;
910 }
911
912 /*
913 * We've just woken up from a protentially long select sleep.
914 * Ensure we process local messages as we need to synchronously
915 * process any messages from other smbd's to avoid file rename race
916 * conditions. This call is cheap if there are no messages waiting.
917 * JRA.
918 */
919 message_dispatch(smbd_messaging_context());
920
921 status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
922 p_unread, p_encrypted, &len);
923
924 if (!NT_STATUS_IS_OK(status)) {
925 return status;
926 }
927
928 *buffer_len = len;
929
930 return NT_STATUS_OK;
931}
932
933/*
934 * Only allow 5 outstanding trans requests. We're allocating memory, so
935 * prevent a DoS.
936 */
937
938NTSTATUS allow_new_trans(struct trans_state *list, int mid)
939{
940 int count = 0;
941 for (; list != NULL; list = list->next) {
942
943 if (list->mid == mid) {
944 return NT_STATUS_INVALID_PARAMETER;
945 }
946
947 count += 1;
948 }
949 if (count > 5) {
950 return NT_STATUS_INSUFFICIENT_RESOURCES;
951 }
952
953 return NT_STATUS_OK;
954}
955
956/****************************************************************************
957 We're terminating and have closed all our files/connections etc.
958 If there are any pending local messages we need to respond to them
959 before termination so that other smbds don't think we just died whilst
960 holding oplocks.
961****************************************************************************/
962
963void respond_to_all_remaining_local_messages(void)
964{
965 /*
966 * Assert we have no exclusive open oplocks.
967 */
968
969 if(get_number_of_exclusive_open_oplocks()) {
970 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
971 get_number_of_exclusive_open_oplocks() ));
972 return;
973 }
974
975 process_kernel_oplocks(smbd_messaging_context(), NULL);
976
977 return;
978}
979
980
981/*
982These flags determine some of the permissions required to do an operation
983
984Note that I don't set NEED_WRITE on some write operations because they
985are used by some brain-dead clients when printing, and I don't want to
986force write permissions on print services.
987*/
988#define AS_USER (1<<0)
989#define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
990#define TIME_INIT (1<<2)
991#define CAN_IPC (1<<3) /* Must be paired with AS_USER */
992#define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
993#define DO_CHDIR (1<<6)
994
995/*
996 define a list of possible SMB messages and their corresponding
997 functions. Any message that has a NULL function is unimplemented -
998 please feel free to contribute implementations!
999*/
1000static const struct smb_message_struct {
1001 const char *name;
1002 void (*fn)(struct smb_request *req);
1003 int flags;
1004} smb_messages[256] = {
1005
1006/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1007/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1008/* 0x02 */ { "SMBopen",reply_open,AS_USER },
1009/* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1010/* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1011/* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1012/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1013/* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1014/* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1015/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1016/* 0x0a */ { "SMBread",reply_read,AS_USER},
1017/* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1018/* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1019/* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1020/* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1021/* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1022/* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1023/* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1024/* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1025/* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1026/* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1027/* 0x15 */ { NULL, NULL, 0 },
1028/* 0x16 */ { NULL, NULL, 0 },
1029/* 0x17 */ { NULL, NULL, 0 },
1030/* 0x18 */ { NULL, NULL, 0 },
1031/* 0x19 */ { NULL, NULL, 0 },
1032/* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1033/* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1034/* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1035/* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1036/* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1037/* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1038/* 0x20 */ { "SMBwritec", NULL,0},
1039/* 0x21 */ { NULL, NULL, 0 },
1040/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1041/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1042/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1043/* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1044/* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1045/* 0x27 */ { "SMBioctl",reply_ioctl,0},
1046/* 0x28 */ { "SMBioctls", NULL,AS_USER},
1047/* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1048/* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1049/* 0x2b */ { "SMBecho",reply_echo,0},
1050/* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1051/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1052/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1053/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1054/* 0x30 */ { NULL, NULL, 0 },
1055/* 0x31 */ { NULL, NULL, 0 },
1056/* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1057/* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC},
1058/* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1059/* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1060/* 0x36 */ { NULL, NULL, 0 },
1061/* 0x37 */ { NULL, NULL, 0 },
1062/* 0x38 */ { NULL, NULL, 0 },
1063/* 0x39 */ { NULL, NULL, 0 },
1064/* 0x3a */ { NULL, NULL, 0 },
1065/* 0x3b */ { NULL, NULL, 0 },
1066/* 0x3c */ { NULL, NULL, 0 },
1067/* 0x3d */ { NULL, NULL, 0 },
1068/* 0x3e */ { NULL, NULL, 0 },
1069/* 0x3f */ { NULL, NULL, 0 },
1070/* 0x40 */ { NULL, NULL, 0 },
1071/* 0x41 */ { NULL, NULL, 0 },
1072/* 0x42 */ { NULL, NULL, 0 },
1073/* 0x43 */ { NULL, NULL, 0 },
1074/* 0x44 */ { NULL, NULL, 0 },
1075/* 0x45 */ { NULL, NULL, 0 },
1076/* 0x46 */ { NULL, NULL, 0 },
1077/* 0x47 */ { NULL, NULL, 0 },
1078/* 0x48 */ { NULL, NULL, 0 },
1079/* 0x49 */ { NULL, NULL, 0 },
1080/* 0x4a */ { NULL, NULL, 0 },
1081/* 0x4b */ { NULL, NULL, 0 },
1082/* 0x4c */ { NULL, NULL, 0 },
1083/* 0x4d */ { NULL, NULL, 0 },
1084/* 0x4e */ { NULL, NULL, 0 },
1085/* 0x4f */ { NULL, NULL, 0 },
1086/* 0x50 */ { NULL, NULL, 0 },
1087/* 0x51 */ { NULL, NULL, 0 },
1088/* 0x52 */ { NULL, NULL, 0 },
1089/* 0x53 */ { NULL, NULL, 0 },
1090/* 0x54 */ { NULL, NULL, 0 },
1091/* 0x55 */ { NULL, NULL, 0 },
1092/* 0x56 */ { NULL, NULL, 0 },
1093/* 0x57 */ { NULL, NULL, 0 },
1094/* 0x58 */ { NULL, NULL, 0 },
1095/* 0x59 */ { NULL, NULL, 0 },
1096/* 0x5a */ { NULL, NULL, 0 },
1097/* 0x5b */ { NULL, NULL, 0 },
1098/* 0x5c */ { NULL, NULL, 0 },
1099/* 0x5d */ { NULL, NULL, 0 },
1100/* 0x5e */ { NULL, NULL, 0 },
1101/* 0x5f */ { NULL, NULL, 0 },
1102/* 0x60 */ { NULL, NULL, 0 },
1103/* 0x61 */ { NULL, NULL, 0 },
1104/* 0x62 */ { NULL, NULL, 0 },
1105/* 0x63 */ { NULL, NULL, 0 },
1106/* 0x64 */ { NULL, NULL, 0 },
1107/* 0x65 */ { NULL, NULL, 0 },
1108/* 0x66 */ { NULL, NULL, 0 },
1109/* 0x67 */ { NULL, NULL, 0 },
1110/* 0x68 */ { NULL, NULL, 0 },
1111/* 0x69 */ { NULL, NULL, 0 },
1112/* 0x6a */ { NULL, NULL, 0 },
1113/* 0x6b */ { NULL, NULL, 0 },
1114/* 0x6c */ { NULL, NULL, 0 },
1115/* 0x6d */ { NULL, NULL, 0 },
1116/* 0x6e */ { NULL, NULL, 0 },
1117/* 0x6f */ { NULL, NULL, 0 },
1118/* 0x70 */ { "SMBtcon",reply_tcon,0},
1119/* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1120/* 0x72 */ { "SMBnegprot",reply_negprot,0},
1121/* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1122/* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1123/* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1124/* 0x76 */ { NULL, NULL, 0 },
1125/* 0x77 */ { NULL, NULL, 0 },
1126/* 0x78 */ { NULL, NULL, 0 },
1127/* 0x79 */ { NULL, NULL, 0 },
1128/* 0x7a */ { NULL, NULL, 0 },
1129/* 0x7b */ { NULL, NULL, 0 },
1130/* 0x7c */ { NULL, NULL, 0 },
1131/* 0x7d */ { NULL, NULL, 0 },
1132/* 0x7e */ { NULL, NULL, 0 },
1133/* 0x7f */ { NULL, NULL, 0 },
1134/* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1135/* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1136/* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1137/* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1138/* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1139/* 0x85 */ { NULL, NULL, 0 },
1140/* 0x86 */ { NULL, NULL, 0 },
1141/* 0x87 */ { NULL, NULL, 0 },
1142/* 0x88 */ { NULL, NULL, 0 },
1143/* 0x89 */ { NULL, NULL, 0 },
1144/* 0x8a */ { NULL, NULL, 0 },
1145/* 0x8b */ { NULL, NULL, 0 },
1146/* 0x8c */ { NULL, NULL, 0 },
1147/* 0x8d */ { NULL, NULL, 0 },
1148/* 0x8e */ { NULL, NULL, 0 },
1149/* 0x8f */ { NULL, NULL, 0 },
1150/* 0x90 */ { NULL, NULL, 0 },
1151/* 0x91 */ { NULL, NULL, 0 },
1152/* 0x92 */ { NULL, NULL, 0 },
1153/* 0x93 */ { NULL, NULL, 0 },
1154/* 0x94 */ { NULL, NULL, 0 },
1155/* 0x95 */ { NULL, NULL, 0 },
1156/* 0x96 */ { NULL, NULL, 0 },
1157/* 0x97 */ { NULL, NULL, 0 },
1158/* 0x98 */ { NULL, NULL, 0 },
1159/* 0x99 */ { NULL, NULL, 0 },
1160/* 0x9a */ { NULL, NULL, 0 },
1161/* 0x9b */ { NULL, NULL, 0 },
1162/* 0x9c */ { NULL, NULL, 0 },
1163/* 0x9d */ { NULL, NULL, 0 },
1164/* 0x9e */ { NULL, NULL, 0 },
1165/* 0x9f */ { NULL, NULL, 0 },
1166/* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1167/* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1168/* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1169/* 0xa3 */ { NULL, NULL, 0 },
1170/* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1171/* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1172/* 0xa6 */ { NULL, NULL, 0 },
1173/* 0xa7 */ { NULL, NULL, 0 },
1174/* 0xa8 */ { NULL, NULL, 0 },
1175/* 0xa9 */ { NULL, NULL, 0 },
1176/* 0xaa */ { NULL, NULL, 0 },
1177/* 0xab */ { NULL, NULL, 0 },
1178/* 0xac */ { NULL, NULL, 0 },
1179/* 0xad */ { NULL, NULL, 0 },
1180/* 0xae */ { NULL, NULL, 0 },
1181/* 0xaf */ { NULL, NULL, 0 },
1182/* 0xb0 */ { NULL, NULL, 0 },
1183/* 0xb1 */ { NULL, NULL, 0 },
1184/* 0xb2 */ { NULL, NULL, 0 },
1185/* 0xb3 */ { NULL, NULL, 0 },
1186/* 0xb4 */ { NULL, NULL, 0 },
1187/* 0xb5 */ { NULL, NULL, 0 },
1188/* 0xb6 */ { NULL, NULL, 0 },
1189/* 0xb7 */ { NULL, NULL, 0 },
1190/* 0xb8 */ { NULL, NULL, 0 },
1191/* 0xb9 */ { NULL, NULL, 0 },
1192/* 0xba */ { NULL, NULL, 0 },
1193/* 0xbb */ { NULL, NULL, 0 },
1194/* 0xbc */ { NULL, NULL, 0 },
1195/* 0xbd */ { NULL, NULL, 0 },
1196/* 0xbe */ { NULL, NULL, 0 },
1197/* 0xbf */ { NULL, NULL, 0 },
1198/* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1199/* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1200/* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1201/* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1202/* 0xc4 */ { NULL, NULL, 0 },
1203/* 0xc5 */ { NULL, NULL, 0 },
1204/* 0xc6 */ { NULL, NULL, 0 },
1205/* 0xc7 */ { NULL, NULL, 0 },
1206/* 0xc8 */ { NULL, NULL, 0 },
1207/* 0xc9 */ { NULL, NULL, 0 },
1208/* 0xca */ { NULL, NULL, 0 },
1209/* 0xcb */ { NULL, NULL, 0 },
1210/* 0xcc */ { NULL, NULL, 0 },
1211/* 0xcd */ { NULL, NULL, 0 },
1212/* 0xce */ { NULL, NULL, 0 },
1213/* 0xcf */ { NULL, NULL, 0 },
1214/* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1215/* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1216/* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1217/* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1218/* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1219/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1220/* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1221/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1222/* 0xd8 */ { NULL, NULL, 0 },
1223/* 0xd9 */ { NULL, NULL, 0 },
1224/* 0xda */ { NULL, NULL, 0 },
1225/* 0xdb */ { NULL, NULL, 0 },
1226/* 0xdc */ { NULL, NULL, 0 },
1227/* 0xdd */ { NULL, NULL, 0 },
1228/* 0xde */ { NULL, NULL, 0 },
1229/* 0xdf */ { NULL, NULL, 0 },
1230/* 0xe0 */ { NULL, NULL, 0 },
1231/* 0xe1 */ { NULL, NULL, 0 },
1232/* 0xe2 */ { NULL, NULL, 0 },
1233/* 0xe3 */ { NULL, NULL, 0 },
1234/* 0xe4 */ { NULL, NULL, 0 },
1235/* 0xe5 */ { NULL, NULL, 0 },
1236/* 0xe6 */ { NULL, NULL, 0 },
1237/* 0xe7 */ { NULL, NULL, 0 },
1238/* 0xe8 */ { NULL, NULL, 0 },
1239/* 0xe9 */ { NULL, NULL, 0 },
1240/* 0xea */ { NULL, NULL, 0 },
1241/* 0xeb */ { NULL, NULL, 0 },
1242/* 0xec */ { NULL, NULL, 0 },
1243/* 0xed */ { NULL, NULL, 0 },
1244/* 0xee */ { NULL, NULL, 0 },
1245/* 0xef */ { NULL, NULL, 0 },
1246/* 0xf0 */ { NULL, NULL, 0 },
1247/* 0xf1 */ { NULL, NULL, 0 },
1248/* 0xf2 */ { NULL, NULL, 0 },
1249/* 0xf3 */ { NULL, NULL, 0 },
1250/* 0xf4 */ { NULL, NULL, 0 },
1251/* 0xf5 */ { NULL, NULL, 0 },
1252/* 0xf6 */ { NULL, NULL, 0 },
1253/* 0xf7 */ { NULL, NULL, 0 },
1254/* 0xf8 */ { NULL, NULL, 0 },
1255/* 0xf9 */ { NULL, NULL, 0 },
1256/* 0xfa */ { NULL, NULL, 0 },
1257/* 0xfb */ { NULL, NULL, 0 },
1258/* 0xfc */ { NULL, NULL, 0 },
1259/* 0xfd */ { NULL, NULL, 0 },
1260/* 0xfe */ { NULL, NULL, 0 },
1261/* 0xff */ { NULL, NULL, 0 }
1262
1263};
1264
1265/*******************************************************************
1266 allocate and initialize a reply packet
1267********************************************************************/
1268
1269bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
1270 uint8_t num_words, uint32_t num_bytes)
1271{
1272 /*
1273 * Protect against integer wrap
1274 */
1275 if ((num_bytes > 0xffffff)
1276 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1277 char *msg;
1278 if (asprintf(&msg, "num_bytes too large: %u",
1279 (unsigned)num_bytes) == -1) {
1280 msg = CONST_DISCARD(char *, "num_bytes too large");
1281 }
1282 smb_panic(msg);
1283 }
1284
1285 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1286 smb_size + num_words*2 + num_bytes);
1287 if (*outbuf == NULL) {
1288 return false;
1289 }
1290
1291 construct_reply_common(inbuf, *outbuf);
1292 srv_set_message(*outbuf, num_words, num_bytes, false);
1293 /*
1294 * Zero out the word area, the caller has to take care of the bcc area
1295 * himself
1296 */
1297 if (num_words != 0) {
1298 memset(*outbuf + smb_vwv0, 0, num_words*2);
1299 }
1300
1301 return true;
1302}
1303
1304void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1305{
1306 char *outbuf;
1307 if (!create_outbuf(req, (char *)req->inbuf, &outbuf, num_words,
1308 num_bytes)) {
1309 smb_panic("could not allocate output buffer\n");
1310 }
1311 req->outbuf = (uint8_t *)outbuf;
1312}
1313
1314
1315/*******************************************************************
1316 Dump a packet to a file.
1317********************************************************************/
1318
1319static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1320{
1321 int fd, i;
1322 char *fname = NULL;
1323 if (DEBUGLEVEL < 50) {
1324 return;
1325 }
1326
1327 if (len < 4) len = smb_len(data)+4;
1328 for (i=1;i<100;i++) {
1329 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1330 type ? "req" : "resp") == -1) {
1331 return;
1332 }
1333 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1334 if (fd != -1 || errno != EEXIST) break;
1335 }
1336 if (fd != -1) {
1337 ssize_t ret = write(fd, data, len);
1338 if (ret != len)
1339 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1340 close(fd);
1341 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1342 }
1343 SAFE_FREE(fname);
1344}
1345
1346/****************************************************************************
1347 Prepare everything for calling the actual request function, and potentially
1348 call the request function via the "new" interface.
1349
1350 Return False if the "legacy" function needs to be called, everything is
1351 prepared.
1352
1353 Return True if we're done.
1354
1355 I know this API sucks, but it is the one with the least code change I could
1356 find.
1357****************************************************************************/
1358
1359static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1360{
1361 int flags;
1362 uint16 session_tag;
1363 connection_struct *conn = NULL;
1364
1365 static uint16 last_session_tag = UID_FIELD_INVALID;
1366
1367 errno = 0;
1368
1369 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1370 * so subtract 4 from it. */
1371 if (!valid_smb_header(req->inbuf)
1372 || (size < (smb_size - 4))) {
1373 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1374 smb_len(req->inbuf)));
1375 exit_server_cleanly("Non-SMB packet");
1376 }
1377
1378 if (smb_messages[type].fn == NULL) {
1379 DEBUG(0,("Unknown message type %d!\n",type));
1380 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1381 reply_unknown_new(req, type);
1382 return NULL;
1383 }
1384
1385 flags = smb_messages[type].flags;
1386
1387 /* In share mode security we must ignore the vuid. */
1388 session_tag = (lp_security() == SEC_SHARE)
1389 ? UID_FIELD_INVALID : req->vuid;
1390 conn = req->conn;
1391
1392 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1393 (int)sys_getpid(), (unsigned long)conn));
1394
1395 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1396
1397 /* Ensure this value is replaced in the incoming packet. */
1398 SSVAL(req->inbuf,smb_uid,session_tag);
1399
1400 /*
1401 * Ensure the correct username is in current_user_info. This is a
1402 * really ugly bugfix for problems with multiple session_setup_and_X's
1403 * being done and allowing %U and %G substitutions to work correctly.
1404 * There is a reason this code is done here, don't move it unless you
1405 * know what you're doing... :-).
1406 * JRA.
1407 */
1408
1409 if (session_tag != last_session_tag) {
1410 user_struct *vuser = NULL;
1411
1412 last_session_tag = session_tag;
1413 if(session_tag != UID_FIELD_INVALID) {
1414 vuser = get_valid_user_struct(session_tag);
1415 if (vuser) {
1416 set_current_user_info(
1417 vuser->server_info->sanitized_username,
1418 vuser->server_info->unix_name,
1419 pdb_get_fullname(vuser->server_info
1420 ->sam_account),
1421 pdb_get_domain(vuser->server_info
1422 ->sam_account));
1423 }
1424 }
1425 }
1426
1427 /* Does this call need to be run as the connected user? */
1428 if (flags & AS_USER) {
1429
1430 /* Does this call need a valid tree connection? */
1431 if (!conn) {
1432 /*
1433 * Amazingly, the error code depends on the command
1434 * (from Samba4).
1435 */
1436 if (type == SMBntcreateX) {
1437 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1438 } else {
1439 reply_doserror(req, ERRSRV, ERRinvnid);
1440 }
1441 return NULL;
1442 }
1443
1444 if (!change_to_user(conn,session_tag)) {
1445 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1446 return conn;
1447 }
1448
1449 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1450
1451 /* Does it need write permission? */
1452 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1453 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1454 return conn;
1455 }
1456
1457 /* IPC services are limited */
1458 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1459 reply_doserror(req, ERRSRV,ERRaccess);
1460 return conn;
1461 }
1462 } else {
1463 /* This call needs to be run as root */
1464 change_to_root_user();
1465 }
1466
1467 /* load service specific parameters */
1468 if (conn) {
1469 if (req->encrypted) {
1470 conn->encrypted_tid = true;
1471 /* encrypted required from now on. */
1472 conn->encrypt_level = Required;
1473 } else if (ENCRYPTION_REQUIRED(conn)) {
1474 uint8 com = CVAL(req->inbuf,smb_com);
1475 if (com != SMBtrans2 && com != SMBtranss2) {
1476 exit_server_cleanly("encryption required "
1477 "on connection");
1478 return conn;
1479 }
1480 }
1481
1482 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1483 (flags & (AS_USER|DO_CHDIR)
1484 ?True:False))) {
1485 reply_doserror(req, ERRSRV, ERRaccess);
1486 return conn;
1487 }
1488 conn->num_smb_operations++;
1489 }
1490
1491 /* does this protocol need to be run as guest? */
1492 if ((flags & AS_GUEST)
1493 && (!change_to_guest() ||
1494 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1495 lp_hostsdeny(-1)))) {
1496 reply_doserror(req, ERRSRV, ERRaccess);
1497 return conn;
1498 }
1499
1500 smb_messages[type].fn(req);
1501 return req->conn;
1502}
1503
1504/****************************************************************************
1505 Construct a reply to the incoming packet.
1506****************************************************************************/
1507
1508static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1509{
[338]1510 struct pending_message_list *pml = NULL;
[223]1511 uint8 type = CVAL(inbuf,smb_com);
1512 connection_struct *conn;
1513 struct smb_request *req;
1514
1515 chain_size = 0;
1516 file_chain_reset();
1517 reset_chain_p();
1518
1519 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1520 smb_panic("could not allocate smb_request");
1521 }
1522 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1523
1524 conn = switch_message(type, req, size);
1525
[338]1526 /* If this was a deferred message and it's still there and
1527 * was processed, remove it. */
1528 pml = get_open_deferred_message(req->mid);
1529 if (pml && pml->processed) {
1530 remove_deferred_open_smb_message(req->mid);
1531 }
1532
[223]1533 if (req->unread_bytes) {
1534 /* writeX failed. drain socket. */
1535 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1536 req->unread_bytes) {
1537 smb_panic("failed to drain pending bytes");
1538 }
1539 req->unread_bytes = 0;
1540 }
1541
1542 if (req->outbuf == NULL) {
1543 return;
1544 }
1545
1546 if (CVAL(req->outbuf,0) == 0) {
1547 show_msg((char *)req->outbuf);
1548 }
1549
1550 if (!srv_send_smb(smbd_server_fd(),
1551 (char *)req->outbuf,
1552 IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1553 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1554 }
1555
1556 TALLOC_FREE(req);
1557
1558 return;
1559}
1560
1561/****************************************************************************
1562 Process an smb from the client
1563****************************************************************************/
1564
1565static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1566{
1567 static int trans_num;
1568 int msg_type = CVAL(inbuf,0);
1569
1570 DO_PROFILE_INC(smb_count);
1571
1572 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1573 smb_len(inbuf) ) );
1574 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1575 (int)nread,
1576 (unsigned int)unread_bytes ));
1577
1578 if (msg_type != 0) {
1579 /*
1580 * NetBIOS session request, keepalive, etc.
1581 */
1582 reply_special(inbuf);
1583 return;
1584 }
1585
1586 show_msg(inbuf);
1587
1588 construct_reply(inbuf,nread,unread_bytes,encrypted);
1589
1590 trans_num++;
1591}
1592
1593/****************************************************************************
1594 Return a string containing the function name of a SMB command.
1595****************************************************************************/
1596
1597const char *smb_fn_name(int type)
1598{
1599 const char *unknown_name = "SMBunknown";
1600
1601 if (smb_messages[type].name == NULL)
1602 return(unknown_name);
1603
1604 return(smb_messages[type].name);
1605}
1606
1607/****************************************************************************
1608 Helper functions for contruct_reply.
1609****************************************************************************/
1610
1611static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1612
1613void add_to_common_flags2(uint32 v)
1614{
1615 common_flags2 |= v;
1616}
1617
1618void remove_from_common_flags2(uint32 v)
1619{
1620 common_flags2 &= ~v;
1621}
1622
1623void construct_reply_common(const char *inbuf, char *outbuf)
1624{
1625 srv_set_message(outbuf,0,0,false);
1626
1627 SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1628 SIVAL(outbuf,smb_rcls,0);
1629 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1630 SSVAL(outbuf,smb_flg2,
1631 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1632 common_flags2);
1633 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1634
1635 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1636 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1637 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1638 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1639}
1640
1641/****************************************************************************
1642 Construct a chained reply and add it to the already made reply
1643****************************************************************************/
1644
1645void chain_reply(struct smb_request *req)
1646{
1647 static char *orig_inbuf;
[467]1648 static int orig_size;
[223]1649
1650 /*
1651 * Dirty little const_discard: We mess with req->inbuf, which is
1652 * declared as const. If maybe at some point this routine gets
1653 * rewritten, this const_discard could go away.
1654 */
1655 char *inbuf = CONST_DISCARD(char *, req->inbuf);
1656 int size = smb_len(req->inbuf)+4;
1657
1658 int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
[694]1659 static unsigned smb_off2;
[223]1660 char *inbuf2;
1661 int outsize2;
1662 int new_size;
1663 char inbuf_saved[smb_wct];
1664 char *outbuf = (char *)req->outbuf;
1665 size_t outsize = smb_len(outbuf) + 4;
1666 size_t outsize_padded;
1667 size_t padding;
1668 size_t ofs, to_move;
1669
1670 struct smb_request *req2;
1671 size_t caller_outputlen;
1672 char *caller_output;
1673
1674 /* Maybe its not chained, or it's an error packet. */
1675 if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1676 SCVAL(outbuf,smb_vwv0,0xFF);
1677 return;
1678 }
1679
1680 if (chain_size == 0) {
1681 /* this is the first part of the chain */
1682 orig_inbuf = inbuf;
[467]1683 orig_size = size;
[694]1684 smb_off2 = 0;
[223]1685 }
[694]1686
1687 if (SVAL(inbuf,smb_vwv1) <= smb_off2) {
1688 DEBUG(1, ("AndX offset not increasing\n"));
1689 SCVAL(outbuf, smb_vwv0, 0xFF);
1690 return;
1691 }
1692 smb_off2 = SVAL(inbuf, smb_vwv1);
1693
[467]1694 /* Validate smb_off2 */
1695 if ((smb_off2 < smb_wct - 4) || orig_size < (smb_off2 + 4 - smb_wct)) {
1696 exit_server_cleanly("Bad chained packet");
1697 return;
1698 }
[223]1699 /*
1700 * We need to save the output the caller added to the chain so that we
1701 * can splice it into the final output buffer later.
1702 */
1703
[467]1704 if (outsize <= smb_wct) {
1705 exit_server_cleanly("Bad chained packet");
1706 return;
1707 }
1708
[223]1709 caller_outputlen = outsize - smb_wct;
1710
1711 caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1712
1713 if (caller_output == NULL) {
1714 /* TODO: NT_STATUS_NO_MEMORY */
1715 smb_panic("could not dup outbuf");
1716 }
1717
1718 /*
1719 * The original Win95 redirector dies on a reply to
1720 * a lockingX and read chain unless the chain reply is
1721 * 4 byte aligned. JRA.
1722 */
1723
1724 outsize_padded = (outsize + 3) & ~3;
1725 padding = outsize_padded - outsize;
1726
1727 /*
1728 * remember how much the caller added to the chain, only counting
1729 * stuff after the parameter words
1730 */
1731 chain_size += (outsize_padded - smb_wct);
1732
1733 /*
1734 * work out pointers into the original packets. The
1735 * headers on these need to be filled in
1736 */
1737 inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1738
1739 /* remember the original command type */
1740 smb_com1 = CVAL(orig_inbuf,smb_com);
1741
1742 /* save the data which will be overwritten by the new headers */
1743 memcpy(inbuf_saved,inbuf2,smb_wct);
1744
1745 /* give the new packet the same header as the last part of the SMB */
1746 memmove(inbuf2,inbuf,smb_wct);
1747
1748 /* create the in buffer */
1749 SCVAL(inbuf2,smb_com,smb_com2);
1750
1751 /* work out the new size for the in buffer. */
1752 new_size = size - (inbuf2 - inbuf);
1753 if (new_size < 0) {
1754 DEBUG(0,("chain_reply: chain packet size incorrect "
1755 "(orig size = %d, offset = %d)\n",
1756 size, (int)(inbuf2 - inbuf) ));
1757 exit_server_cleanly("Bad chained packet");
1758 return;
1759 }
1760
1761 /* And set it in the header. */
1762 smb_setlen(inbuf2, new_size - 4);
1763
1764 DEBUG(3,("Chained message\n"));
1765 show_msg(inbuf2);
1766
1767 if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1768 smb_panic("could not allocate smb_request");
1769 }
1770 init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1771
1772 /* process the request */
1773 switch_message(smb_com2, req2, new_size);
1774
1775 /*
1776 * We don't accept deferred operations in chained requests.
1777 */
1778 SMB_ASSERT(req2->outbuf != NULL);
1779 outsize2 = smb_len(req2->outbuf)+4;
1780
1781 /*
1782 * Move away the new command output so that caller_output fits in,
1783 * copy in the caller_output saved above.
1784 */
1785
1786 SMB_ASSERT(outsize_padded >= smb_wct);
1787
1788 /*
1789 * "ofs" is the space we need for caller_output. Equal to
1790 * caller_outputlen plus the padding.
1791 */
1792
1793 ofs = outsize_padded - smb_wct;
1794
1795 /*
1796 * "to_move" is the amount of bytes the secondary routine gave us
1797 */
1798
1799 to_move = outsize2 - smb_wct;
1800
1801 if (to_move + ofs + smb_wct + chain_size > max_send) {
1802 smb_panic("replies too large -- would have to cut");
1803 }
1804
1805 /*
1806 * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1807 * the first request in the chain. So we have to re-allocate it. In
1808 * the "old" API the only outbuf ever used is the global OutBuffer
1809 * which is always large enough.
1810 */
1811
1812 outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1813 to_move + ofs + smb_wct);
1814 if (outbuf == NULL) {
1815 smb_panic("could not realloc outbuf");
1816 }
1817
1818 req->outbuf = (uint8 *)outbuf;
1819
1820 memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1821 memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1822
1823 /*
1824 * copy the new reply header over the old one but preserve the smb_com
1825 * field
1826 */
1827 memmove(outbuf, req2->outbuf, smb_wct);
1828 SCVAL(outbuf, smb_com, smb_com1);
1829
1830 /*
1831 * We've just copied in the whole "wct" area from the secondary
1832 * function. Fix up the chaining: com2 and the offset need to be
1833 * readjusted.
1834 */
1835
1836 SCVAL(outbuf, smb_vwv0, smb_com2);
1837 SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1838
1839 if (padding != 0) {
1840
1841 /*
1842 * Due to padding we have some uninitialized bytes after the
1843 * caller's output
1844 */
1845
1846 memset(outbuf + outsize, 0, padding);
1847 }
1848
1849 smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1850
1851 /*
1852 * restore the saved data, being careful not to overwrite any data
1853 * from the reply header
1854 */
1855 memcpy(inbuf2,inbuf_saved,smb_wct);
1856
1857 SAFE_FREE(caller_output);
1858 TALLOC_FREE(req2);
1859
1860 /*
1861 * Reset the chain_size for our caller's offset calculations
1862 */
1863
1864 chain_size -= (outsize_padded - smb_wct);
1865
1866 return;
1867}
1868
1869/****************************************************************************
1870 Check if services need reloading.
1871****************************************************************************/
1872
1873void check_reload(time_t t)
1874{
1875 static pid_t mypid = 0;
1876 static time_t last_smb_conf_reload_time = 0;
1877 static time_t last_printer_reload_time = 0;
1878 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1879
1880 if(last_smb_conf_reload_time == 0) {
1881 last_smb_conf_reload_time = t;
1882 /* Our printing subsystem might not be ready at smbd start up.
1883 Then no printer is available till the first printers check
1884 is performed. A lower initial interval circumvents this. */
1885 if ( printcap_cache_time > 60 )
1886 last_printer_reload_time = t - printcap_cache_time + 60;
1887 else
1888 last_printer_reload_time = t;
1889 }
1890
1891 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1892 /* randomize over 60 second the printcap reload to avoid all
1893 * process hitting cupsd at the same time */
1894 int time_range = 60;
1895
1896 last_printer_reload_time += random() % time_range;
1897 mypid = getpid();
1898 }
1899
1900 if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1901 reload_services(True);
1902 reload_after_sighup = False;
1903 last_smb_conf_reload_time = t;
1904 }
1905
1906 /* 'printcap cache time = 0' disable the feature */
1907
1908 if ( printcap_cache_time != 0 )
1909 {
1910 /* see if it's time to reload or if the clock has been set back */
1911
1912 if ( (t >= last_printer_reload_time+printcap_cache_time)
1913 || (t-last_printer_reload_time < 0) )
1914 {
1915 DEBUG( 3,( "Printcap cache time expired.\n"));
1916 reload_printers();
1917 last_printer_reload_time = t;
1918 }
1919 }
1920}
1921
1922/****************************************************************************
1923 Process commands from the client
1924****************************************************************************/
1925
1926void smbd_process(void)
1927{
1928 unsigned int num_smbs = 0;
1929 size_t unread_bytes = 0;
1930
1931 char addr[INET6_ADDRSTRLEN];
1932
1933 /*
1934 * Before the first packet, check the global hosts allow/ hosts deny
1935 * parameters before doing any parsing of packets passed to us by the
1936 * client. This prevents attacks on our parsing code from hosts not in
1937 * the hosts allow list.
1938 */
1939
1940 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1941 lp_hostsdeny(-1))) {
1942 /*
1943 * send a negative session response "not listening on calling
1944 * name"
1945 */
1946 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1947 DEBUG( 1, ("Connection denied from %s\n",
1948 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1949 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1950 exit_server_cleanly("connection denied");
1951 }
1952
1953 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1954
1955 while (True) {
1956 NTSTATUS status;
1957 char *inbuf = NULL;
1958 size_t inbuf_len = 0;
1959 bool encrypted = false;
1960 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1961
1962 errno = 0;
1963
1964 run_events(smbd_event_context(), 0, NULL, NULL);
1965
1966 status = receive_message_or_smb(
1967 talloc_tos(), &inbuf, &inbuf_len,
1968 &unread_bytes, &encrypted);
1969
1970 if (!NT_STATUS_IS_OK(status)) {
1971 DEBUG(3, ("receive_message_or_smb failed: %s, "
1972 "exiting\n", nt_errstr(status)));
1973 return;
1974 }
1975
1976 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
1977
1978 TALLOC_FREE(inbuf);
1979
1980 num_smbs++;
1981
1982 /* The timeout_processing function isn't run nearly
1983 often enough to implement 'max log size' without
1984 overrunning the size of the file by many megabytes.
1985 This is especially true if we are running at debug
1986 level 10. Checking every 50 SMBs is a nice
1987 tradeoff of performance vs log file size overrun. */
1988
1989 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1990 change_to_root_user();
1991 check_log_size();
1992 }
1993 TALLOC_FREE(frame);
1994 }
1995}
Note: See TracBrowser for help on using the repository browser.