2 Unix SMB/CIFS implementation.
3 process incoming packets - main loop
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Volker Lendecke 2005-2007
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/globals.h"
24 extern bool global_machine_password_needs_changing;
26 static void construct_reply_common(struct smb_request *req, const char *inbuf,
29 /* Accessor function for smb_read_error for smbd functions. */
31 /****************************************************************************
33 ****************************************************************************/
35 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
40 char *buf_out = buffer;
42 /* Sign the outgoing packet if required. */
43 srv_calculate_sign_mac(buf_out);
46 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
47 if (!NT_STATUS_IS_OK(status)) {
48 DEBUG(0, ("send_smb: SMB encryption failed "
49 "on outgoing packet! Error %s\n",
55 len = smb_len(buf_out) + 4;
57 while (nwritten < len) {
58 ret = write_data(fd,buf_out+nwritten,len - nwritten);
60 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
61 (int)len,(int)ret, strerror(errno) ));
62 srv_free_enc_buffer(buf_out);
68 srv_free_enc_buffer(buf_out);
72 /*******************************************************************
73 Setup the word count and byte count for a smb message.
74 ********************************************************************/
76 int srv_set_message(char *buf,
81 if (zero && (num_words || num_bytes)) {
82 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
84 SCVAL(buf,smb_wct,num_words);
85 SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
86 smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
87 return (smb_size + num_words*2 + num_bytes);
90 static bool valid_smb_header(const uint8_t *inbuf)
92 if (is_encrypted_packet(inbuf)) {
96 * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
97 * but it just looks weird to call strncmp for this one.
99 return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
102 /* Socket functions for smbd packet processing. */
104 static bool valid_packet_size(size_t len)
107 * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
108 * of header. Don't print the error if this fits.... JRA.
111 if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
112 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
113 (unsigned long)len));
119 static NTSTATUS read_packet_remainder(int fd, char *buffer,
120 unsigned int timeout, ssize_t len)
126 return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
129 /****************************************************************************
130 Attempt a zerocopy writeX read. We know here that len > smb_size-4
131 ****************************************************************************/
134 * Unfortunately, earlier versions of smbclient/libsmbclient
135 * don't send this "standard" writeX header. I've fixed this
136 * for 3.2 but we'll use the old method with earlier versions.
137 * Windows and CIFSFS at least use this standard size. Not
141 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
142 (2*14) + /* word count (including bcc) */ \
145 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
146 const char lenbuf[4],
147 int fd, char **buffer,
148 unsigned int timeout,
152 /* Size of a WRITEX call (+4 byte len). */
153 char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
154 ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
158 memcpy(writeX_header, lenbuf, 4);
160 status = read_socket_with_timeout(
161 fd, writeX_header + 4,
162 STANDARD_WRITE_AND_X_HEADER_SIZE,
163 STANDARD_WRITE_AND_X_HEADER_SIZE,
166 if (!NT_STATUS_IS_OK(status)) {
171 * Ok - now try and see if this is a possible
175 if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
177 * If the data offset is beyond what
178 * we've read, drain the extra bytes.
180 uint16_t doff = SVAL(writeX_header,smb_vwv11);
183 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
184 size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
185 if (drain_socket(smbd_server_fd(), drain) != drain) {
186 smb_panic("receive_smb_raw_talloc_partial_read:"
187 " failed to drain pending bytes");
190 doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
193 /* Spoof down the length and null out the bcc. */
194 set_message_bcc(writeX_header, 0);
195 newlen = smb_len(writeX_header);
197 /* Copy the header we've written. */
199 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
201 sizeof(writeX_header));
203 if (*buffer == NULL) {
204 DEBUG(0, ("Could not allocate inbuf of length %d\n",
205 (int)sizeof(writeX_header)));
206 return NT_STATUS_NO_MEMORY;
209 /* Work out the remaining bytes. */
210 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
211 *len_ret = newlen + 4;
215 if (!valid_packet_size(len)) {
216 return NT_STATUS_INVALID_PARAMETER;
220 * Not a valid writeX call. Just do the standard
224 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
226 if (*buffer == NULL) {
227 DEBUG(0, ("Could not allocate inbuf of length %d\n",
229 return NT_STATUS_NO_MEMORY;
232 /* Copy in what we already read. */
235 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
236 toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
239 status = read_packet_remainder(
240 fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
243 if (!NT_STATUS_IS_OK(status)) {
244 DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
254 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
255 char **buffer, unsigned int timeout,
256 size_t *p_unread, size_t *plen)
260 int min_recv_size = lp_min_receive_file_size();
265 status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
266 if (!NT_STATUS_IS_OK(status)) {
267 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
271 if (CVAL(lenbuf,0) == 0 &&
273 smb_len_large(lenbuf) > (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE) && /* Could be a UNIX large writeX. */
274 !srv_is_signing_active()) {
276 return receive_smb_raw_talloc_partial_read(
277 mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
280 if (!valid_packet_size(len)) {
281 return NT_STATUS_INVALID_PARAMETER;
285 * The +4 here can't wrap, we've checked the length above already.
288 *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
290 if (*buffer == NULL) {
291 DEBUG(0, ("Could not allocate inbuf of length %d\n",
293 return NT_STATUS_NO_MEMORY;
296 memcpy(*buffer, lenbuf, sizeof(lenbuf));
298 status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
299 if (!NT_STATUS_IS_OK(status)) {
307 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
308 char **buffer, unsigned int timeout,
309 size_t *p_unread, bool *p_encrypted,
315 *p_encrypted = false;
317 status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
319 if (!NT_STATUS_IS_OK(status)) {
323 if (is_encrypted_packet((uint8_t *)*buffer)) {
324 status = srv_decrypt_buffer(*buffer);
325 if (!NT_STATUS_IS_OK(status)) {
326 DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
327 "incoming packet! Error %s\n",
328 nt_errstr(status) ));
334 /* Check the incoming SMB signature. */
335 if (!srv_check_sign_mac(*buffer, true)) {
336 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
337 "incoming packet!\n"));
338 return NT_STATUS_INVALID_NETWORK_RESPONSE;
346 * Initialize a struct smb_request from an inbuf
349 void init_smb_request(struct smb_request *req,
354 size_t req_size = smb_len(inbuf) + 4;
355 /* Ensure we have at least smb_size bytes. */
356 if (req_size < smb_size) {
357 DEBUG(0,("init_smb_request: invalid request size %u\n",
358 (unsigned int)req_size ));
359 exit_server_cleanly("Invalid SMB request");
361 req->cmd = CVAL(inbuf, smb_com);
362 req->flags2 = SVAL(inbuf, smb_flg2);
363 req->smbpid = SVAL(inbuf, smb_pid);
364 req->mid = SVAL(inbuf, smb_mid);
365 req->vuid = SVAL(inbuf, smb_uid);
366 req->tid = SVAL(inbuf, smb_tid);
367 req->wct = CVAL(inbuf, smb_wct);
368 req->vwv = (uint16_t *)(inbuf+smb_vwv);
369 req->buflen = smb_buflen(inbuf);
370 req->buf = (const uint8_t *)smb_buf(inbuf);
371 req->unread_bytes = unread_bytes;
372 req->encrypted = encrypted;
373 req->conn = conn_find(req->tid);
374 req->chain_fsp = NULL;
375 req->chain_outbuf = NULL;
377 /* Ensure we have at least wct words and 2 bytes of bcc. */
378 if (smb_size + req->wct*2 > req_size) {
379 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
380 (unsigned int)req->wct,
381 (unsigned int)req_size));
382 exit_server_cleanly("Invalid SMB request");
384 /* Ensure bcc is correct. */
385 if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
386 DEBUG(0,("init_smb_request: invalid bcc number %u "
387 "(wct = %u, size %u)\n",
388 (unsigned int)req->buflen,
389 (unsigned int)req->wct,
390 (unsigned int)req_size));
391 exit_server_cleanly("Invalid SMB request");
396 static void process_smb(struct smbd_server_connection *conn,
397 uint8_t *inbuf, size_t nread, size_t unread_bytes,
400 static void smbd_deferred_open_timer(struct event_context *ev,
401 struct timed_event *te,
402 struct timeval _tval,
405 struct pending_message_list *msg = talloc_get_type(private_data,
406 struct pending_message_list);
407 TALLOC_CTX *mem_ctx = talloc_tos();
410 inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
413 exit_server("smbd_deferred_open_timer: talloc failed\n");
417 /* We leave this message on the queue so the open code can
418 know this is a retry. */
419 DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
420 (unsigned int)SVAL(msg->buf.data,smb_mid)));
422 process_smb(smbd_server_conn, inbuf,
427 /****************************************************************************
428 Function to push a message onto the tail of a linked list of smb messages ready
430 ****************************************************************************/
432 static bool push_queued_message(struct smb_request *req,
433 struct timeval request_time,
434 struct timeval end_time,
435 char *private_data, size_t private_len)
437 int msg_len = smb_len(req->inbuf) + 4;
438 struct pending_message_list *msg;
440 msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
443 DEBUG(0,("push_message: malloc fail (1)\n"));
447 msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
448 if(msg->buf.data == NULL) {
449 DEBUG(0,("push_message: malloc fail (2)\n"));
454 msg->request_time = request_time;
455 msg->encrypted = req->encrypted;
458 msg->private_data = data_blob_talloc(msg, private_data,
460 if (msg->private_data.data == NULL) {
461 DEBUG(0,("push_message: malloc fail (3)\n"));
467 msg->te = event_add_timed(smbd_event_context(),
470 smbd_deferred_open_timer,
473 DEBUG(0,("push_message: event_add_timed failed\n"));
478 DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
480 DEBUG(10,("push_message: pushed message length %u on "
481 "deferred_open_queue\n", (unsigned int)msg_len));
486 /****************************************************************************
487 Function to delete a sharing violation open message by mid.
488 ****************************************************************************/
490 void remove_deferred_open_smb_message(uint16 mid)
492 struct pending_message_list *pml;
494 for (pml = deferred_open_queue; pml; pml = pml->next) {
495 if (mid == SVAL(pml->buf.data,smb_mid)) {
496 DEBUG(10,("remove_sharing_violation_open_smb_message: "
497 "deleting mid %u len %u\n",
499 (unsigned int)pml->buf.length ));
500 DLIST_REMOVE(deferred_open_queue, pml);
507 /****************************************************************************
508 Move a sharing violation open retry message to the front of the list and
509 schedule it for immediate processing.
510 ****************************************************************************/
512 void schedule_deferred_open_smb_message(uint16 mid)
514 struct pending_message_list *pml;
517 for (pml = deferred_open_queue; pml; pml = pml->next) {
518 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
520 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
521 (unsigned int)msg_mid ));
523 if (mid == msg_mid) {
524 struct timed_event *te;
526 DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
529 te = event_add_timed(smbd_event_context(),
532 smbd_deferred_open_timer,
535 DEBUG(10,("schedule_deferred_open_smb_message: "
536 "event_add_timed() failed, skipping mid %u\n",
540 TALLOC_FREE(pml->te);
542 DLIST_PROMOTE(deferred_open_queue, pml);
547 DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
551 /****************************************************************************
552 Return true if this mid is on the deferred queue.
553 ****************************************************************************/
555 bool open_was_deferred(uint16 mid)
557 struct pending_message_list *pml;
559 for (pml = deferred_open_queue; pml; pml = pml->next) {
560 if (SVAL(pml->buf.data,smb_mid) == mid) {
567 /****************************************************************************
568 Return the message queued by this mid.
569 ****************************************************************************/
571 struct pending_message_list *get_open_deferred_message(uint16 mid)
573 struct pending_message_list *pml;
575 for (pml = deferred_open_queue; pml; pml = pml->next) {
576 if (SVAL(pml->buf.data,smb_mid) == mid) {
583 /****************************************************************************
584 Function to push a deferred open smb message onto a linked list of local smb
585 messages ready for processing.
586 ****************************************************************************/
588 bool push_deferred_smb_message(struct smb_request *req,
589 struct timeval request_time,
590 struct timeval timeout,
591 char *private_data, size_t priv_len)
593 struct timeval end_time;
595 if (req->unread_bytes) {
596 DEBUG(0,("push_deferred_smb_message: logic error ! "
597 "unread_bytes = %u\n",
598 (unsigned int)req->unread_bytes ));
599 smb_panic("push_deferred_smb_message: "
600 "logic error unread_bytes != 0" );
603 end_time = timeval_sum(&request_time, &timeout);
605 DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
606 "timeout time [%u.%06u]\n",
607 (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
608 (unsigned int)end_time.tv_sec,
609 (unsigned int)end_time.tv_usec));
611 return push_queued_message(req, request_time, end_time,
612 private_data, priv_len);
616 struct timed_event *te;
617 struct timeval interval;
619 bool (*handler)(const struct timeval *now, void *private_data);
623 static void smbd_idle_event_handler(struct event_context *ctx,
624 struct timed_event *te,
628 struct idle_event *event =
629 talloc_get_type_abort(private_data, struct idle_event);
631 TALLOC_FREE(event->te);
633 DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
634 event->name, event->te));
636 if (!event->handler(&now, event->private_data)) {
637 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
638 event->name, event->te));
639 /* Don't repeat, delete ourselves */
644 DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
645 event->name, event->te));
647 event->te = event_add_timed(ctx, event,
648 timeval_sum(&now, &event->interval),
649 smbd_idle_event_handler, event);
651 /* We can't do much but fail here. */
652 SMB_ASSERT(event->te != NULL);
655 struct idle_event *event_add_idle(struct event_context *event_ctx,
657 struct timeval interval,
659 bool (*handler)(const struct timeval *now,
663 struct idle_event *result;
664 struct timeval now = timeval_current();
666 result = TALLOC_P(mem_ctx, struct idle_event);
667 if (result == NULL) {
668 DEBUG(0, ("talloc failed\n"));
672 result->interval = interval;
673 result->handler = handler;
674 result->private_data = private_data;
676 if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
677 DEBUG(0, ("talloc failed\n"));
682 result->te = event_add_timed(event_ctx, result,
683 timeval_sum(&now, &interval),
684 smbd_idle_event_handler, result);
685 if (result->te == NULL) {
686 DEBUG(0, ("event_add_timed failed\n"));
691 DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
695 static void smbd_sig_term_handler(struct tevent_context *ev,
696 struct tevent_signal *se,
702 exit_server_cleanly("termination signal");
705 void smbd_setup_sig_term_handler(void)
707 struct tevent_signal *se;
709 se = tevent_add_signal(smbd_event_context(),
710 smbd_event_context(),
712 smbd_sig_term_handler,
715 exit_server("failed to setup SIGTERM handler");
719 static void smbd_sig_hup_handler(struct tevent_context *ev,
720 struct tevent_signal *se,
726 change_to_root_user();
727 DEBUG(1,("Reloading services after SIGHUP\n"));
728 reload_services(False);
731 void smbd_setup_sig_hup_handler(void)
733 struct tevent_signal *se;
735 se = tevent_add_signal(smbd_event_context(),
736 smbd_event_context(),
738 smbd_sig_hup_handler,
741 exit_server("failed to setup SIGHUP handler");
745 /****************************************************************************
746 Do all async processing in here. This includes kernel oplock messages, change
748 ****************************************************************************/
750 static void async_processing(void)
752 DEBUG(10,("async_processing: Doing async processing.\n"));
756 process_kernel_oplocks(smbd_messaging_context());
758 /* Do the aio check again after receive_local_message as it does a
759 select and may have eaten our signal. */
760 /* Is this till true? -- vl */
764 /****************************************************************************
765 Do a select on an two fd's - with timeout.
767 If a local udp message has been pushed onto the
768 queue (this can only happen during oplock break
769 processing) call async_processing()
771 If a pending smb message has been pushed onto the
772 queue (this can only happen during oplock break
773 processing) return this next.
775 If the first smbfd is ready then read an smb from it.
776 if the second (loopback UDP) fd is ready then read a message
777 from it and setup the buffer header to identify the length
779 Returns False on timeout or error.
782 The timeout is in milliseconds
783 ****************************************************************************/
785 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
792 to.tv_sec = SMBD_SELECT_TIMEOUT;
796 * Setup the select fd sets.
803 * Ensure we process oplock break messages by preference.
804 * We have to do this before the select, after the select
805 * and if the select returns EINTR. This is due to the fact
806 * that the selects called from async_processing can eat an EINTR
807 * caused by a signal (we can't take the break message there).
808 * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
811 if (oplock_message_waiting()) {
812 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
815 * After async processing we must go and do the select again, as
816 * the state of the flag in fds for the server file descriptor is
817 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
819 return NT_STATUS_RETRY;
823 * Are there any timed events waiting ? If so, ensure we don't
824 * select for longer than it would take to wait for them.
831 event_add_to_select_args(smbd_event_context(), &now,
832 &r_fds, &w_fds, &to, &maxfd);
835 /* Process a signal and timed events now... */
836 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
837 return NT_STATUS_RETRY;
842 START_PROFILE(smbd_idle);
844 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
847 END_PROFILE(smbd_idle);
851 if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
852 return NT_STATUS_RETRY;
855 /* if we get EINTR then maybe we have received an oplock
856 signal - treat this as select returning 1. This is ugly, but
857 is the best we can do until the oplock code knows more about
859 if (selrtn == -1 && errno == EINTR) {
862 * After async processing we must go and do the select again, as
863 * the state of the flag in fds for the server file descriptor is
864 * indeterminate - we may have done I/O on it in the oplock processing. JRA.
866 return NT_STATUS_RETRY;
871 /* something is wrong. Maybe the socket is dead? */
872 return map_nt_error_from_unix(errno);
875 /* Did we timeout ? */
877 return NT_STATUS_RETRY;
880 /* should not be reached */
881 return NT_STATUS_INTERNAL_ERROR;
885 * Only allow 5 outstanding trans requests. We're allocating memory, so
889 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
892 for (; list != NULL; list = list->next) {
894 if (list->mid == mid) {
895 return NT_STATUS_INVALID_PARAMETER;
901 return NT_STATUS_INSUFFICIENT_RESOURCES;
907 /****************************************************************************
908 We're terminating and have closed all our files/connections etc.
909 If there are any pending local messages we need to respond to them
910 before termination so that other smbds don't think we just died whilst
912 ****************************************************************************/
914 void respond_to_all_remaining_local_messages(void)
917 * Assert we have no exclusive open oplocks.
920 if(get_number_of_exclusive_open_oplocks()) {
921 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
922 get_number_of_exclusive_open_oplocks() ));
926 process_kernel_oplocks(smbd_messaging_context());
933 These flags determine some of the permissions required to do an operation
935 Note that I don't set NEED_WRITE on some write operations because they
936 are used by some brain-dead clients when printing, and I don't want to
937 force write permissions on print services.
939 #define AS_USER (1<<0)
940 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
941 #define TIME_INIT (1<<2)
942 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
943 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
944 #define DO_CHDIR (1<<6)
947 define a list of possible SMB messages and their corresponding
948 functions. Any message that has a NULL function is unimplemented -
949 please feel free to contribute implementations!
951 static const struct smb_message_struct {
953 void (*fn)(struct smb_request *req);
955 } smb_messages[256] = {
957 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
958 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
959 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
960 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
961 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
962 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
963 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
964 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
965 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
966 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
967 /* 0x0a */ { "SMBread",reply_read,AS_USER},
968 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
969 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
970 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
971 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
972 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
973 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
974 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
975 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
976 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
977 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
978 /* 0x15 */ { NULL, NULL, 0 },
979 /* 0x16 */ { NULL, NULL, 0 },
980 /* 0x17 */ { NULL, NULL, 0 },
981 /* 0x18 */ { NULL, NULL, 0 },
982 /* 0x19 */ { NULL, NULL, 0 },
983 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
984 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
985 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
986 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
987 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
988 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
989 /* 0x20 */ { "SMBwritec", NULL,0},
990 /* 0x21 */ { NULL, NULL, 0 },
991 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
992 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
993 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
994 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
995 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
996 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
997 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
998 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
999 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1000 /* 0x2b */ { "SMBecho",reply_echo,0},
1001 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1002 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1003 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1004 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1005 /* 0x30 */ { NULL, NULL, 0 },
1006 /* 0x31 */ { NULL, NULL, 0 },
1007 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1008 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1009 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1010 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1011 /* 0x36 */ { NULL, NULL, 0 },
1012 /* 0x37 */ { NULL, NULL, 0 },
1013 /* 0x38 */ { NULL, NULL, 0 },
1014 /* 0x39 */ { NULL, NULL, 0 },
1015 /* 0x3a */ { NULL, NULL, 0 },
1016 /* 0x3b */ { NULL, NULL, 0 },
1017 /* 0x3c */ { NULL, NULL, 0 },
1018 /* 0x3d */ { NULL, NULL, 0 },
1019 /* 0x3e */ { NULL, NULL, 0 },
1020 /* 0x3f */ { NULL, NULL, 0 },
1021 /* 0x40 */ { NULL, NULL, 0 },
1022 /* 0x41 */ { NULL, NULL, 0 },
1023 /* 0x42 */ { NULL, NULL, 0 },
1024 /* 0x43 */ { NULL, NULL, 0 },
1025 /* 0x44 */ { NULL, NULL, 0 },
1026 /* 0x45 */ { NULL, NULL, 0 },
1027 /* 0x46 */ { NULL, NULL, 0 },
1028 /* 0x47 */ { NULL, NULL, 0 },
1029 /* 0x48 */ { NULL, NULL, 0 },
1030 /* 0x49 */ { NULL, NULL, 0 },
1031 /* 0x4a */ { NULL, NULL, 0 },
1032 /* 0x4b */ { NULL, NULL, 0 },
1033 /* 0x4c */ { NULL, NULL, 0 },
1034 /* 0x4d */ { NULL, NULL, 0 },
1035 /* 0x4e */ { NULL, NULL, 0 },
1036 /* 0x4f */ { NULL, NULL, 0 },
1037 /* 0x50 */ { NULL, NULL, 0 },
1038 /* 0x51 */ { NULL, NULL, 0 },
1039 /* 0x52 */ { NULL, NULL, 0 },
1040 /* 0x53 */ { NULL, NULL, 0 },
1041 /* 0x54 */ { NULL, NULL, 0 },
1042 /* 0x55 */ { NULL, NULL, 0 },
1043 /* 0x56 */ { NULL, NULL, 0 },
1044 /* 0x57 */ { NULL, NULL, 0 },
1045 /* 0x58 */ { NULL, NULL, 0 },
1046 /* 0x59 */ { NULL, NULL, 0 },
1047 /* 0x5a */ { NULL, NULL, 0 },
1048 /* 0x5b */ { NULL, NULL, 0 },
1049 /* 0x5c */ { NULL, NULL, 0 },
1050 /* 0x5d */ { NULL, NULL, 0 },
1051 /* 0x5e */ { NULL, NULL, 0 },
1052 /* 0x5f */ { NULL, NULL, 0 },
1053 /* 0x60 */ { NULL, NULL, 0 },
1054 /* 0x61 */ { NULL, NULL, 0 },
1055 /* 0x62 */ { NULL, NULL, 0 },
1056 /* 0x63 */ { NULL, NULL, 0 },
1057 /* 0x64 */ { NULL, NULL, 0 },
1058 /* 0x65 */ { NULL, NULL, 0 },
1059 /* 0x66 */ { NULL, NULL, 0 },
1060 /* 0x67 */ { NULL, NULL, 0 },
1061 /* 0x68 */ { NULL, NULL, 0 },
1062 /* 0x69 */ { NULL, NULL, 0 },
1063 /* 0x6a */ { NULL, NULL, 0 },
1064 /* 0x6b */ { NULL, NULL, 0 },
1065 /* 0x6c */ { NULL, NULL, 0 },
1066 /* 0x6d */ { NULL, NULL, 0 },
1067 /* 0x6e */ { NULL, NULL, 0 },
1068 /* 0x6f */ { NULL, NULL, 0 },
1069 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1070 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1071 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1072 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1073 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1074 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1075 /* 0x76 */ { NULL, NULL, 0 },
1076 /* 0x77 */ { NULL, NULL, 0 },
1077 /* 0x78 */ { NULL, NULL, 0 },
1078 /* 0x79 */ { NULL, NULL, 0 },
1079 /* 0x7a */ { NULL, NULL, 0 },
1080 /* 0x7b */ { NULL, NULL, 0 },
1081 /* 0x7c */ { NULL, NULL, 0 },
1082 /* 0x7d */ { NULL, NULL, 0 },
1083 /* 0x7e */ { NULL, NULL, 0 },
1084 /* 0x7f */ { NULL, NULL, 0 },
1085 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1086 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1087 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1088 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1089 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1090 /* 0x85 */ { NULL, NULL, 0 },
1091 /* 0x86 */ { NULL, NULL, 0 },
1092 /* 0x87 */ { NULL, NULL, 0 },
1093 /* 0x88 */ { NULL, NULL, 0 },
1094 /* 0x89 */ { NULL, NULL, 0 },
1095 /* 0x8a */ { NULL, NULL, 0 },
1096 /* 0x8b */ { NULL, NULL, 0 },
1097 /* 0x8c */ { NULL, NULL, 0 },
1098 /* 0x8d */ { NULL, NULL, 0 },
1099 /* 0x8e */ { NULL, NULL, 0 },
1100 /* 0x8f */ { NULL, NULL, 0 },
1101 /* 0x90 */ { NULL, NULL, 0 },
1102 /* 0x91 */ { NULL, NULL, 0 },
1103 /* 0x92 */ { NULL, NULL, 0 },
1104 /* 0x93 */ { NULL, NULL, 0 },
1105 /* 0x94 */ { NULL, NULL, 0 },
1106 /* 0x95 */ { NULL, NULL, 0 },
1107 /* 0x96 */ { NULL, NULL, 0 },
1108 /* 0x97 */ { NULL, NULL, 0 },
1109 /* 0x98 */ { NULL, NULL, 0 },
1110 /* 0x99 */ { NULL, NULL, 0 },
1111 /* 0x9a */ { NULL, NULL, 0 },
1112 /* 0x9b */ { NULL, NULL, 0 },
1113 /* 0x9c */ { NULL, NULL, 0 },
1114 /* 0x9d */ { NULL, NULL, 0 },
1115 /* 0x9e */ { NULL, NULL, 0 },
1116 /* 0x9f */ { NULL, NULL, 0 },
1117 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1118 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1119 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1120 /* 0xa3 */ { NULL, NULL, 0 },
1121 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1122 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1123 /* 0xa6 */ { NULL, NULL, 0 },
1124 /* 0xa7 */ { NULL, NULL, 0 },
1125 /* 0xa8 */ { NULL, NULL, 0 },
1126 /* 0xa9 */ { NULL, NULL, 0 },
1127 /* 0xaa */ { NULL, NULL, 0 },
1128 /* 0xab */ { NULL, NULL, 0 },
1129 /* 0xac */ { NULL, NULL, 0 },
1130 /* 0xad */ { NULL, NULL, 0 },
1131 /* 0xae */ { NULL, NULL, 0 },
1132 /* 0xaf */ { NULL, NULL, 0 },
1133 /* 0xb0 */ { NULL, NULL, 0 },
1134 /* 0xb1 */ { NULL, NULL, 0 },
1135 /* 0xb2 */ { NULL, NULL, 0 },
1136 /* 0xb3 */ { NULL, NULL, 0 },
1137 /* 0xb4 */ { NULL, NULL, 0 },
1138 /* 0xb5 */ { NULL, NULL, 0 },
1139 /* 0xb6 */ { NULL, NULL, 0 },
1140 /* 0xb7 */ { NULL, NULL, 0 },
1141 /* 0xb8 */ { NULL, NULL, 0 },
1142 /* 0xb9 */ { NULL, NULL, 0 },
1143 /* 0xba */ { NULL, NULL, 0 },
1144 /* 0xbb */ { NULL, NULL, 0 },
1145 /* 0xbc */ { NULL, NULL, 0 },
1146 /* 0xbd */ { NULL, NULL, 0 },
1147 /* 0xbe */ { NULL, NULL, 0 },
1148 /* 0xbf */ { NULL, NULL, 0 },
1149 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1150 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1151 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1152 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1153 /* 0xc4 */ { NULL, NULL, 0 },
1154 /* 0xc5 */ { NULL, NULL, 0 },
1155 /* 0xc6 */ { NULL, NULL, 0 },
1156 /* 0xc7 */ { NULL, NULL, 0 },
1157 /* 0xc8 */ { NULL, NULL, 0 },
1158 /* 0xc9 */ { NULL, NULL, 0 },
1159 /* 0xca */ { NULL, NULL, 0 },
1160 /* 0xcb */ { NULL, NULL, 0 },
1161 /* 0xcc */ { NULL, NULL, 0 },
1162 /* 0xcd */ { NULL, NULL, 0 },
1163 /* 0xce */ { NULL, NULL, 0 },
1164 /* 0xcf */ { NULL, NULL, 0 },
1165 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1166 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1167 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1168 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1169 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1170 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1171 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1172 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1173 /* 0xd8 */ { NULL, NULL, 0 },
1174 /* 0xd9 */ { NULL, NULL, 0 },
1175 /* 0xda */ { NULL, NULL, 0 },
1176 /* 0xdb */ { NULL, NULL, 0 },
1177 /* 0xdc */ { NULL, NULL, 0 },
1178 /* 0xdd */ { NULL, NULL, 0 },
1179 /* 0xde */ { NULL, NULL, 0 },
1180 /* 0xdf */ { NULL, NULL, 0 },
1181 /* 0xe0 */ { NULL, NULL, 0 },
1182 /* 0xe1 */ { NULL, NULL, 0 },
1183 /* 0xe2 */ { NULL, NULL, 0 },
1184 /* 0xe3 */ { NULL, NULL, 0 },
1185 /* 0xe4 */ { NULL, NULL, 0 },
1186 /* 0xe5 */ { NULL, NULL, 0 },
1187 /* 0xe6 */ { NULL, NULL, 0 },
1188 /* 0xe7 */ { NULL, NULL, 0 },
1189 /* 0xe8 */ { NULL, NULL, 0 },
1190 /* 0xe9 */ { NULL, NULL, 0 },
1191 /* 0xea */ { NULL, NULL, 0 },
1192 /* 0xeb */ { NULL, NULL, 0 },
1193 /* 0xec */ { NULL, NULL, 0 },
1194 /* 0xed */ { NULL, NULL, 0 },
1195 /* 0xee */ { NULL, NULL, 0 },
1196 /* 0xef */ { NULL, NULL, 0 },
1197 /* 0xf0 */ { NULL, NULL, 0 },
1198 /* 0xf1 */ { NULL, NULL, 0 },
1199 /* 0xf2 */ { NULL, NULL, 0 },
1200 /* 0xf3 */ { NULL, NULL, 0 },
1201 /* 0xf4 */ { NULL, NULL, 0 },
1202 /* 0xf5 */ { NULL, NULL, 0 },
1203 /* 0xf6 */ { NULL, NULL, 0 },
1204 /* 0xf7 */ { NULL, NULL, 0 },
1205 /* 0xf8 */ { NULL, NULL, 0 },
1206 /* 0xf9 */ { NULL, NULL, 0 },
1207 /* 0xfa */ { NULL, NULL, 0 },
1208 /* 0xfb */ { NULL, NULL, 0 },
1209 /* 0xfc */ { NULL, NULL, 0 },
1210 /* 0xfd */ { NULL, NULL, 0 },
1211 /* 0xfe */ { NULL, NULL, 0 },
1212 /* 0xff */ { NULL, NULL, 0 }
1216 /*******************************************************************
1217 allocate and initialize a reply packet
1218 ********************************************************************/
1220 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1221 const char *inbuf, char **outbuf, uint8_t num_words,
1225 * Protect against integer wrap
1227 if ((num_bytes > 0xffffff)
1228 || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1230 if (asprintf(&msg, "num_bytes too large: %u",
1231 (unsigned)num_bytes) == -1) {
1232 msg = CONST_DISCARD(char *, "num_bytes too large");
1237 *outbuf = TALLOC_ARRAY(mem_ctx, char,
1238 smb_size + num_words*2 + num_bytes);
1239 if (*outbuf == NULL) {
1243 construct_reply_common(req, inbuf, *outbuf);
1244 srv_set_message(*outbuf, num_words, num_bytes, false);
1246 * Zero out the word area, the caller has to take care of the bcc area
1249 if (num_words != 0) {
1250 memset(*outbuf + smb_vwv0, 0, num_words*2);
1256 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1259 if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1261 smb_panic("could not allocate output buffer\n");
1263 req->outbuf = (uint8_t *)outbuf;
1267 /*******************************************************************
1268 Dump a packet to a file.
1269 ********************************************************************/
1271 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1275 if (DEBUGLEVEL < 50) {
1279 if (len < 4) len = smb_len(data)+4;
1280 for (i=1;i<100;i++) {
1281 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1282 type ? "req" : "resp") == -1) {
1285 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1286 if (fd != -1 || errno != EEXIST) break;
1289 ssize_t ret = write(fd, data, len);
1291 DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1293 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1298 /****************************************************************************
1299 Prepare everything for calling the actual request function, and potentially
1300 call the request function via the "new" interface.
1302 Return False if the "legacy" function needs to be called, everything is
1305 Return True if we're done.
1307 I know this API sucks, but it is the one with the least code change I could
1309 ****************************************************************************/
1311 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1315 connection_struct *conn = NULL;
1319 /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1320 * so subtract 4 from it. */
1321 if (!valid_smb_header(req->inbuf)
1322 || (size < (smb_size - 4))) {
1323 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1324 smb_len(req->inbuf)));
1325 exit_server_cleanly("Non-SMB packet");
1328 if (smb_messages[type].fn == NULL) {
1329 DEBUG(0,("Unknown message type %d!\n",type));
1330 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1331 reply_unknown_new(req, type);
1335 flags = smb_messages[type].flags;
1337 /* In share mode security we must ignore the vuid. */
1338 session_tag = (lp_security() == SEC_SHARE)
1339 ? UID_FIELD_INVALID : req->vuid;
1342 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1343 (int)sys_getpid(), (unsigned long)conn));
1345 smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1347 /* Ensure this value is replaced in the incoming packet. */
1348 SSVAL(req->inbuf,smb_uid,session_tag);
1351 * Ensure the correct username is in current_user_info. This is a
1352 * really ugly bugfix for problems with multiple session_setup_and_X's
1353 * being done and allowing %U and %G substitutions to work correctly.
1354 * There is a reason this code is done here, don't move it unless you
1355 * know what you're doing... :-).
1359 if (session_tag != last_session_tag) {
1360 user_struct *vuser = NULL;
1362 last_session_tag = session_tag;
1363 if(session_tag != UID_FIELD_INVALID) {
1364 vuser = get_valid_user_struct(session_tag);
1366 set_current_user_info(
1367 vuser->server_info->sanitized_username,
1368 vuser->server_info->unix_name,
1369 pdb_get_domain(vuser->server_info
1375 /* Does this call need to be run as the connected user? */
1376 if (flags & AS_USER) {
1378 /* Does this call need a valid tree connection? */
1381 * Amazingly, the error code depends on the command
1384 if (type == SMBntcreateX) {
1385 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1387 reply_doserror(req, ERRSRV, ERRinvnid);
1392 if (!change_to_user(conn,session_tag)) {
1393 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1394 remove_deferred_open_smb_message(req->mid);
1398 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1400 /* Does it need write permission? */
1401 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1402 reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1406 /* IPC services are limited */
1407 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1408 reply_doserror(req, ERRSRV,ERRaccess);
1412 /* This call needs to be run as root */
1413 change_to_root_user();
1416 /* load service specific parameters */
1418 if (req->encrypted) {
1419 conn->encrypted_tid = true;
1420 /* encrypted required from now on. */
1421 conn->encrypt_level = Required;
1422 } else if (ENCRYPTION_REQUIRED(conn)) {
1423 if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1424 exit_server_cleanly("encryption required "
1430 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1431 (flags & (AS_USER|DO_CHDIR)
1433 reply_doserror(req, ERRSRV, ERRaccess);
1436 conn->num_smb_operations++;
1439 /* does this protocol need to be run as guest? */
1440 if ((flags & AS_GUEST)
1441 && (!change_to_guest() ||
1442 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1443 lp_hostsdeny(-1)))) {
1444 reply_doserror(req, ERRSRV, ERRaccess);
1448 smb_messages[type].fn(req);
1452 /****************************************************************************
1453 Construct a reply to the incoming packet.
1454 ****************************************************************************/
1456 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1458 connection_struct *conn;
1459 struct smb_request *req;
1463 if (!(req = talloc(talloc_tos(), struct smb_request))) {
1464 smb_panic("could not allocate smb_request");
1466 init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1467 req->inbuf = (uint8_t *)talloc_move(req, &inbuf);
1469 conn = switch_message(req->cmd, req, size);
1471 if (req->unread_bytes) {
1472 /* writeX failed. drain socket. */
1473 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1474 req->unread_bytes) {
1475 smb_panic("failed to drain pending bytes");
1477 req->unread_bytes = 0;
1480 if (req->outbuf == NULL) {
1484 if (CVAL(req->outbuf,0) == 0) {
1485 show_msg((char *)req->outbuf);
1488 if (!srv_send_smb(smbd_server_fd(),
1489 (char *)req->outbuf,
1490 IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1491 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1499 /****************************************************************************
1500 Process an smb from the client
1501 ****************************************************************************/
1503 static void process_smb(struct smbd_server_connection *conn,
1504 uint8_t *inbuf, size_t nread, size_t unread_bytes,
1507 int msg_type = CVAL(inbuf,0);
1509 DO_PROFILE_INC(smb_count);
1511 DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1513 DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1515 (unsigned int)unread_bytes ));
1517 if (msg_type != 0) {
1519 * NetBIOS session request, keepalive, etc.
1521 reply_special((char *)inbuf);
1525 show_msg((char *)inbuf);
1527 construct_reply((char *)inbuf,nread,unread_bytes,encrypted);
1532 conn->num_requests++;
1534 /* The timeout_processing function isn't run nearly
1535 often enough to implement 'max log size' without
1536 overrunning the size of the file by many megabytes.
1537 This is especially true if we are running at debug
1538 level 10. Checking every 50 SMBs is a nice
1539 tradeoff of performance vs log file size overrun. */
1541 if ((conn->num_requests % 50) == 0 &&
1542 need_to_check_log_size()) {
1543 change_to_root_user();
1548 /****************************************************************************
1549 Return a string containing the function name of a SMB command.
1550 ****************************************************************************/
1552 const char *smb_fn_name(int type)
1554 const char *unknown_name = "SMBunknown";
1556 if (smb_messages[type].name == NULL)
1557 return(unknown_name);
1559 return(smb_messages[type].name);
1562 /****************************************************************************
1563 Helper functions for contruct_reply.
1564 ****************************************************************************/
1566 void add_to_common_flags2(uint32 v)
1571 void remove_from_common_flags2(uint32 v)
1573 common_flags2 &= ~v;
1576 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1579 srv_set_message(outbuf,0,0,false);
1581 SCVAL(outbuf, smb_com, req->cmd);
1582 SIVAL(outbuf,smb_rcls,0);
1583 SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1584 SSVAL(outbuf,smb_flg2,
1585 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1587 memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1589 SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1590 SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1591 SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1592 SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1595 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1597 construct_reply_common(req, (char *)req->inbuf, outbuf);
1601 * How many bytes have we already accumulated up to the current wct field
1605 size_t req_wct_ofs(struct smb_request *req)
1609 if (req->chain_outbuf == NULL) {
1612 buf_size = talloc_get_size(req->chain_outbuf);
1613 if ((buf_size % 4) != 0) {
1614 buf_size += (4 - (buf_size % 4));
1616 return buf_size - 4;
1620 * Hack around reply_nterror & friends not being aware of chained requests,
1621 * generating illegal (i.e. wct==0) chain replies.
1624 static void fixup_chain_error_packet(struct smb_request *req)
1626 uint8_t *outbuf = req->outbuf;
1628 reply_outbuf(req, 2, 0);
1629 memcpy(req->outbuf, outbuf, smb_wct);
1630 TALLOC_FREE(outbuf);
1631 SCVAL(req->outbuf, smb_vwv0, 0xff);
1634 /****************************************************************************
1635 Construct a chained reply and add it to the already made reply
1636 ****************************************************************************/
1638 void chain_reply(struct smb_request *req)
1640 size_t smblen = smb_len(req->inbuf);
1641 size_t already_used, length_needed;
1643 uint32_t chain_offset; /* uint32_t to avoid overflow */
1650 if (IVAL(req->outbuf, smb_rcls) != 0) {
1651 fixup_chain_error_packet(req);
1655 * Any of the AndX requests and replies have at least a wct of
1656 * 2. vwv[0] is the next command, vwv[1] is the offset from the
1657 * beginning of the SMB header to the next wct field.
1659 * None of the AndX requests put anything valuable in vwv[0] and [1],
1660 * so we can overwrite it here to form the chain.
1663 if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1668 * Here we assume that this is the end of the chain. For that we need
1669 * to set "next command" to 0xff and the offset to 0. If we later find
1670 * more commands in the chain, this will be overwritten again.
1673 SCVAL(req->outbuf, smb_vwv0, 0xff);
1674 SCVAL(req->outbuf, smb_vwv0+1, 0);
1675 SSVAL(req->outbuf, smb_vwv1, 0);
1677 if (req->chain_outbuf == NULL) {
1679 * In req->chain_outbuf we collect all the replies. Start the
1680 * chain by copying in the first reply.
1682 * We do the realloc because later on we depend on
1683 * talloc_get_size to determine the length of
1684 * chain_outbuf. The reply_xxx routines might have
1685 * over-allocated (reply_pipe_read_and_X used to be such an
1688 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1689 req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1690 if (req->chain_outbuf == NULL) {
1695 if (!smb_splice_chain(&req->chain_outbuf,
1696 CVAL(req->outbuf, smb_com),
1697 CVAL(req->outbuf, smb_wct),
1698 (uint16_t *)(req->outbuf + smb_vwv),
1699 0, smb_buflen(req->outbuf),
1700 (uint8_t *)smb_buf(req->outbuf))) {
1703 TALLOC_FREE(req->outbuf);
1707 * We use the old request's vwv field to grab the next chained command
1708 * and offset into the chained fields.
1711 chain_cmd = CVAL(req->vwv+0, 0);
1712 chain_offset = SVAL(req->vwv+1, 0);
1714 if (chain_cmd == 0xff) {
1716 * End of chain, no more requests from the client. So ship the
1719 smb_setlen((char *)(req->chain_outbuf),
1720 talloc_get_size(req->chain_outbuf) - 4);
1721 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1722 IS_CONN_ENCRYPTED(req->conn)
1723 ||req->encrypted)) {
1724 exit_server_cleanly("chain_reply: srv_send_smb "
1731 * Check if the client tries to fool us. The request so far uses the
1732 * space to the end of the byte buffer in the request just
1733 * processed. The chain_offset can't point into that area. If that was
1734 * the case, we could end up with an endless processing of the chain,
1735 * we would always handle the same request.
1738 already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1739 if (chain_offset < already_used) {
1744 * Next check: Make sure the chain offset does not point beyond the
1745 * overall smb request length.
1748 length_needed = chain_offset+1; /* wct */
1749 if (length_needed > smblen) {
1754 * Now comes the pointer magic. Goal here is to set up req->vwv and
1755 * req->buf correctly again to be able to call the subsequent
1756 * switch_message(). The chain offset (the former vwv[1]) points at
1757 * the new wct field.
1760 wct = CVAL(smb_base(req->inbuf), chain_offset);
1763 * Next consistency check: Make the new vwv array fits in the overall
1767 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1768 if (length_needed > smblen) {
1771 vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1774 * Now grab the new byte buffer....
1777 buflen = SVAL(vwv+wct, 0);
1780 * .. and check that it fits.
1783 length_needed += buflen;
1784 if (length_needed > smblen) {
1787 buf = (uint8_t *)(vwv+wct+1);
1789 req->cmd = chain_cmd;
1792 req->buflen = buflen;
1795 switch_message(chain_cmd, req, smblen);
1797 if (req->outbuf == NULL) {
1799 * This happens if the chained command has suspended itself or
1800 * if it has called srv_send_smb() itself.
1806 * We end up here if the chained command was not itself chained or
1807 * suspended, but for example a close() command. We now need to splice
1808 * the chained commands' outbuf into the already built up chain_outbuf
1809 * and ship the result.
1815 * We end up here if there's any error in the chain syntax. Report a
1816 * DOS error, just like Windows does.
1818 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
1819 fixup_chain_error_packet(req);
1822 if (!smb_splice_chain(&req->chain_outbuf,
1823 CVAL(req->outbuf, smb_com),
1824 CVAL(req->outbuf, smb_wct),
1825 (uint16_t *)(req->outbuf + smb_vwv),
1826 0, smb_buflen(req->outbuf),
1827 (uint8_t *)smb_buf(req->outbuf))) {
1828 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
1830 TALLOC_FREE(req->outbuf);
1832 smb_setlen((char *)(req->chain_outbuf),
1833 talloc_get_size(req->chain_outbuf) - 4);
1835 show_msg((char *)(req->chain_outbuf));
1837 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1838 IS_CONN_ENCRYPTED(req->conn)||req->encrypted)) {
1839 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1843 /****************************************************************************
1844 Check if services need reloading.
1845 ****************************************************************************/
1847 void check_reload(time_t t)
1849 time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1851 if(last_smb_conf_reload_time == 0) {
1852 last_smb_conf_reload_time = t;
1853 /* Our printing subsystem might not be ready at smbd start up.
1854 Then no printer is available till the first printers check
1855 is performed. A lower initial interval circumvents this. */
1856 if ( printcap_cache_time > 60 )
1857 last_printer_reload_time = t - printcap_cache_time + 60;
1859 last_printer_reload_time = t;
1862 if (mypid != getpid()) { /* First time or fork happened meanwhile */
1863 /* randomize over 60 second the printcap reload to avoid all
1864 * process hitting cupsd at the same time */
1865 int time_range = 60;
1867 last_printer_reload_time += random() % time_range;
1871 if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
1872 reload_services(True);
1873 last_smb_conf_reload_time = t;
1876 /* 'printcap cache time = 0' disable the feature */
1878 if ( printcap_cache_time != 0 )
1880 /* see if it's time to reload or if the clock has been set back */
1882 if ( (t >= last_printer_reload_time+printcap_cache_time)
1883 || (t-last_printer_reload_time < 0) )
1885 DEBUG( 3,( "Printcap cache time expired.\n"));
1887 last_printer_reload_time = t;
1892 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
1894 /* TODO: make write nonblocking */
1897 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
1899 uint8_t *inbuf = NULL;
1900 size_t inbuf_len = 0;
1901 size_t unread_bytes = 0;
1902 bool encrypted = false;
1903 TALLOC_CTX *mem_ctx = talloc_tos();
1906 /* TODO: make this completely nonblocking */
1908 status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
1909 (char **)(void *)&inbuf,
1914 if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1917 if (NT_STATUS_IS_ERR(status)) {
1918 exit_server_cleanly("failed to receive smb request");
1920 if (!NT_STATUS_IS_OK(status)) {
1925 process_smb(conn, inbuf, inbuf_len, unread_bytes, encrypted);
1928 static void smbd_server_connection_handler(struct event_context *ev,
1929 struct fd_event *fde,
1933 struct smbd_server_connection *conn = talloc_get_type(private_data,
1934 struct smbd_server_connection);
1936 if (flags & EVENT_FD_WRITE) {
1937 smbd_server_connection_write_handler(conn);
1938 } else if (flags & EVENT_FD_READ) {
1939 smbd_server_connection_read_handler(conn);
1944 /****************************************************************************
1945 received when we should release a specific IP
1946 ****************************************************************************/
1947 static void release_ip(const char *ip, void *priv)
1949 char addr[INET6_ADDRSTRLEN];
1951 if (strcmp(client_socket_addr(get_client_fd(),addr,sizeof(addr)), ip) == 0) {
1952 /* we can't afford to do a clean exit - that involves
1953 database writes, which would potentially mean we
1954 are still running after the failover has finished -
1955 we have to get rid of this process ID straight
1957 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
1959 /* note we must exit with non-zero status so the unclean handler gets
1960 called in the parent, so that the brl database is tickled */
1965 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
1966 uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
1968 release_ip((char *)data->data, NULL);
1971 #ifdef CLUSTER_SUPPORT
1972 static int client_get_tcp_info(struct sockaddr_storage *server,
1973 struct sockaddr_storage *client)
1976 if (server_fd == -1) {
1979 length = sizeof(*server);
1980 if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
1983 length = sizeof(*client);
1984 if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
1992 * Send keepalive packets to our client
1994 static bool keepalive_fn(const struct timeval *now, void *private_data)
1996 if (!send_keepalive(smbd_server_fd())) {
1997 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2004 * Do the recurring check if we're idle
2006 static bool deadtime_fn(const struct timeval *now, void *private_data)
2008 if ((conn_num_open() == 0)
2009 || (conn_idle_all(now->tv_sec))) {
2010 DEBUG( 2, ( "Closing idle connection\n" ) );
2011 messaging_send(smbd_messaging_context(), procid_self(),
2012 MSG_SHUTDOWN, &data_blob_null);
2020 * Do the recurring log file and smb.conf reload checks.
2023 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2025 change_to_root_user();
2027 /* update printer queue caches if necessary */
2028 update_monitored_printq_cache();
2030 /* check if we need to reload services */
2031 check_reload(time(NULL));
2033 /* Change machine password if neccessary. */
2034 attempt_machine_password_change();
2037 * Force a log file check.
2039 force_check_log_size();
2044 /****************************************************************************
2045 Process commands from the client
2046 ****************************************************************************/
2048 void smbd_process(void)
2050 TALLOC_CTX *frame = talloc_stackframe();
2051 char remaddr[INET6_ADDRSTRLEN];
2053 smbd_server_conn = talloc_zero(smbd_event_context(), struct smbd_server_connection);
2054 if (!smbd_server_conn) {
2055 exit_server("failed to create smbd_server_connection");
2058 /* Ensure child is set to blocking mode */
2059 set_blocking(smbd_server_fd(),True);
2061 set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2062 set_socket_options(smbd_server_fd(), lp_socket_options());
2064 /* this is needed so that we get decent entries
2065 in smbstatus for port 445 connects */
2066 set_remote_machine_name(get_peer_addr(smbd_server_fd(),
2070 reload_services(true);
2073 * Before the first packet, check the global hosts allow/ hosts deny
2074 * parameters before doing any parsing of packets passed to us by the
2075 * client. This prevents attacks on our parsing code from hosts not in
2076 * the hosts allow list.
2079 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2080 lp_hostsdeny(-1))) {
2081 char addr[INET6_ADDRSTRLEN];
2084 * send a negative session response "not listening on calling
2087 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2088 DEBUG( 1, ("Connection denied from %s\n",
2089 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
2090 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
2091 exit_server_cleanly("connection denied");
2098 if (!init_account_policy()) {
2099 exit_server("Could not open account policy tdb.\n");
2102 if (*lp_rootdir()) {
2103 if (chroot(lp_rootdir()) != 0) {
2104 DEBUG(0,("Failed changed root to %s\n", lp_rootdir()));
2105 exit_server("Failed to chroot()");
2107 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2111 if (!init_oplocks(smbd_messaging_context()))
2112 exit_server("Failed to init oplocks");
2114 /* Setup aio signal handler. */
2115 initialize_async_io_handler();
2117 /* register our message handlers */
2118 messaging_register(smbd_messaging_context(), NULL,
2119 MSG_SMB_FORCE_TDIS, msg_force_tdis);
2120 messaging_register(smbd_messaging_context(), NULL,
2121 MSG_SMB_RELEASE_IP, msg_release_ip);
2122 messaging_register(smbd_messaging_context(), NULL,
2123 MSG_SMB_CLOSE_FILE, msg_close_file);
2125 if ((lp_keepalive() != 0)
2126 && !(event_add_idle(smbd_event_context(), NULL,
2127 timeval_set(lp_keepalive(), 0),
2128 "keepalive", keepalive_fn,
2130 DEBUG(0, ("Could not add keepalive event\n"));
2134 if (!(event_add_idle(smbd_event_context(), NULL,
2135 timeval_set(IDLE_CLOSED_TIMEOUT, 0),
2136 "deadtime", deadtime_fn, NULL))) {
2137 DEBUG(0, ("Could not add deadtime event\n"));
2141 if (!(event_add_idle(smbd_event_context(), NULL,
2142 timeval_set(SMBD_SELECT_TIMEOUT, 0),
2143 "housekeeping", housekeeping_fn, NULL))) {
2144 DEBUG(0, ("Could not add housekeeping event\n"));
2148 #ifdef CLUSTER_SUPPORT
2150 if (lp_clustering()) {
2152 * We need to tell ctdb about our client's TCP
2153 * connection, so that for failover ctdbd can send
2154 * tickle acks, triggering a reconnection by the
2158 struct sockaddr_storage srv, clnt;
2160 if (client_get_tcp_info(&srv, &clnt) == 0) {
2164 status = ctdbd_register_ips(
2165 messaging_ctdbd_connection(),
2166 &srv, &clnt, release_ip, NULL);
2168 if (!NT_STATUS_IS_OK(status)) {
2169 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
2170 nt_errstr(status)));
2174 DEBUG(0,("Unable to get tcp info for "
2175 "CTDB_CONTROL_TCP_CLIENT: %s\n",
2182 max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2184 smbd_server_conn->fde = event_add_fd(smbd_event_context(),
2188 smbd_server_connection_handler,
2190 if (!smbd_server_conn->fde) {
2191 exit_server("failed to create smbd_server_connection fde");
2199 frame = talloc_stackframe_pool(8192);
2203 status = smbd_server_connection_loop_once(smbd_server_conn);
2204 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
2205 !NT_STATUS_IS_OK(status)) {
2206 DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2207 " exiting\n", nt_errstr(status)));
2214 exit_server_cleanly(NULL);