source3/modules/vfs_scannedonly.c

   1 /*
   2  * scannedonly VFS module for Samba 3.5
   3  *
   4  * Copyright 2007,2008,2009,2010 (C) Olivier Sessink
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  *
  20  * ABOUT SCANNEDONLY
  21  *
  22  * scannedonly implements a 'filter' like vfs module that talks over a
  23  * unix domain socket or over UDP to a anti-virus engine.
  24  *
  25  * files that are clean have a corresponding .scanned:{filename} file
  26  * in the same directory. So why the .scanned: files? They take up
  27  * only an inode, because they are 0 bytes. To test if the file is
  28  * scanned only a stat() call on the filesystem is needed which is
  29  * very quick compared to a database lookup. All modern filesystems
  30  * use database technology such as balanced trees for lookups anyway.
  31  * The number of inodes in modern filesystems is also not limiting
  32  * anymore. The .scanned: files are also easy scriptable. You can
  33  * remove them with a simple find command or create them with a
  34  * simple touch command. Extended filesystem attributes have similar
  35  * properties, but are not supported on all filesystems, so that
  36  * would limit the usage of the module (and attributes are not as
  37  * easily scriptable)
  38  *
  39  * files that are not clean are sent to the AV-engine. Only the
  40  * filename is sent over the socket. The protocol is very simple:
  41  * a newline separated list of filenames inside each datagram.
  42  *
  43  * a file AV-scan may be requested multiple times, the AV-engine
  44  * should also check if the file has been scanned already. Requests
  45  * can also be dropped by the AV-engine (and we thus don't need the
  46  * reliability of TCP).
  47  *
  48  */
  49
  50 #include "includes.h"
  51 #include "system/filesys.h"
  52
  53 #include "config.h"
  54
  55 #define SENDBUFFERSIZE 1450
  56
  57 #ifndef       SUN_LEN
  58 #define       SUN_LEN(sunp)   ((size_t)((struct sockaddr_un *)0)->sun_path \
  59                                 + strlen((sunp)->sun_path))
  60 #endif
  61
  62
  63 struct Tscannedonly {
  64         int socket;
  65         int domain_socket;
  66         int portnum;
  67         int scanning_message_len;
  68         int recheck_time_open;
  69         int recheck_tries_open;
  70         int recheck_size_open;
  71         int recheck_time_readdir;
  72         int recheck_tries_readdir;
  73         bool show_special_files;
  74         bool rm_hidden_files_on_rmdir;
  75         bool hide_nonscanned_files;
  76         bool allow_nonscanned_files;
  77         char *socketname;
  78         char *scanhost;
  79         char *scanning_message;
  80         char *p_scanned; /* prefix for scanned files */
  81         char *p_virus; /* prefix for virus containing files */
  82         char *p_failed; /* prefix for failed to scan files */
  83         char gsendbuffer[SENDBUFFERSIZE + 1];
  84 };
  85
  86 #define STRUCTSCANO(var) ((struct Tscannedonly *)var)
  87
  88 struct scannedonly_DIR {
  89         char *base;
  90         int notify_loop_done;
  91         SMB_STRUCT_DIR *DIR;
  92 };
  93 #define SCANNEDONLY_DEBUG 9
  94 /*********************/
  95 /* utility functions */
  96 /*********************/
  97
  98 static char *real_path_from_notify_path(TALLOC_CTX *ctx,
  99                                         struct Tscannedonly *so,
 100                                         const char *path)
 101 {
 102         char *name;
 103         int len, pathlen;
 104
 105         name = strrchr(path, '/');
 106         if (!name) {
 107                 return NULL;
 108         }
 109         pathlen = name - path;
 110         name++;
 111         len = strlen(name);
 112         if (len <= so->scanning_message_len) {
 113                 return NULL;
 114         }
 115
 116         if (strcmp(name + (len - so->scanning_message_len),
 117                    so->scanning_message) != 0) {
 118                 return NULL;
 119         }
 120
 121         return talloc_strndup(ctx,path,
 122                               pathlen + len - so->scanning_message_len);
 123 }
 124
 125 static char *cachefile_name(TALLOC_CTX *ctx,
 126                             const char *shortname,
 127                             const char *base,
 128                             const char *p_scanned)
 129 {
 130         return talloc_asprintf(ctx, "%s%s%s", base, p_scanned, shortname);
 131 }
 132
 133 static char *name_w_ending_slash(TALLOC_CTX *ctx, const char *name)
 134 {
 135         int len = strlen(name);
 136         if (name[len - 1] == '/') {
 137                 return talloc_strdup(ctx,name);
 138         } else {
 139                 return talloc_asprintf(ctx, "%s/", name);
 140         }
 141 }
 142
 143 static char *cachefile_name_f_fullpath(TALLOC_CTX *ctx,
 144                                        const char *fullpath,
 145                                        const char *p_scanned)
 146 {
 147         const char *base;
 148         char *tmp, *cachefile, *shortname;
 149         tmp = strrchr(fullpath, '/');
 150         if (tmp) {
 151                 base = talloc_strndup(ctx, fullpath, (tmp - fullpath) + 1);
 152                 shortname = tmp + 1;
 153         } else {
 154                 base = "";
 155                 shortname = (char *)fullpath;
 156         }
 157         cachefile = cachefile_name(ctx, shortname, base, p_scanned);
 158         DEBUG(SCANNEDONLY_DEBUG,
 159               ("cachefile_name_f_fullpath cachefile=%s\n", cachefile));
 160         return cachefile;
 161 }
 162
 163 static char *construct_full_path(TALLOC_CTX *ctx, vfs_handle_struct * handle,
 164                                  const char *somepath, bool ending_slash)
 165 {
 166         char *tmp;
 167
 168         if (!somepath) {
 169                 return NULL;
 170         }
 171         if (somepath[0] == '/') {
 172                 if (ending_slash) {
 173                         return name_w_ending_slash(ctx,somepath);
 174                 }
 175                 return talloc_strdup(ctx,somepath);
 176         }
 177         tmp=(char *)somepath;
 178         if (tmp[0]=='.'&&tmp[1]=='/') {
 179                 tmp+=2;
 180         }
 181         /* vfs_GetWd() seems to return a path with a slash */
 182         if (ending_slash) {
 183                 return talloc_asprintf(ctx, "%s/%s/",
 184                                        vfs_GetWd(ctx, handle->conn),tmp);
 185         }
 186         return talloc_asprintf(ctx, "%s/%s",
 187                                vfs_GetWd(ctx, handle->conn),tmp);
 188 }
 189
 190 static int connect_to_scanner(vfs_handle_struct * handle)
 191 {
 192         struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
 193
 194         if (so->domain_socket) {
 195                 struct sockaddr_un saun;
 196                 DEBUG(SCANNEDONLY_DEBUG, ("socket=%s\n", so->socketname));
 197                 if ((so->socket = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) {
 198                         DEBUG(2, ("failed to create socket %s\n",
 199                                   so->socketname));
 200                         return -1;
 201                 }
 202                 saun.sun_family = AF_UNIX;
 203                 strncpy(saun.sun_path, so->socketname,
 204                         sizeof(saun.sun_path) - 1);
 205                 if (connect(so->socket, (struct sockaddr *)(void *)&saun,
 206                             SUN_LEN(&saun)) < 0) {
 207                         DEBUG(2, ("failed to connect to socket %s\n",
 208                                   so->socketname));
 209                         return -1;
 210                 }
 211                 DEBUG(SCANNEDONLY_DEBUG,("bound %s to socket %d\n",
 212                                          saun.sun_path, so->socket));
 213
 214         } else {
 215                 so->socket = open_udp_socket(so->scanhost, so->portnum);
 216                 if (so->socket < 0) {
 217                         DEBUG(2,("failed to open UDP socket to %s:%d\n",
 218                                  so->scanhost,so->portnum));
 219                         return -1;
 220                 }
 221         }
 222
 223         {/* increasing the socket buffer is done because we have large bursts
 224             of UDP packets or DGRAM's on a domain socket whenever we hit a
 225             large directory with lots of unscanned files. */
 226                 int sndsize;
 227                 socklen_t size = sizeof(int);
 228                 getsockopt(so->socket, SOL_SOCKET, SO_RCVBUF,
 229                            (char *)&sndsize, &size);
 230                 DEBUG(SCANNEDONLY_DEBUG, ("current socket buffer size=%d\n",
 231                                           sndsize));
 232                 sndsize = 262144;
 233                 if (setsockopt(so->socket, SOL_SOCKET, SO_RCVBUF,
 234                                (char *)&sndsize,
 235                                (int)sizeof(sndsize)) != 0) {
 236                         DEBUG(SCANNEDONLY_DEBUG,
 237                               ("error setting socket buffer %s (%d)\n",
 238                                strerror(errno), errno));
 239                 }
 240         }
 241         set_blocking(so->socket, false);
 242         return 0;
 243 }
 244
 245 static void flush_sendbuffer(vfs_handle_struct * handle)
 246 {
 247         struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
 248         int ret, len, loop = 10;
 249         if (so->gsendbuffer[0] == '\0') {
 250                 return;
 251         }
 252
 253         do {
 254                 loop--;
 255                 len = strlen(so->gsendbuffer);
 256                 ret = send(so->socket, so->gsendbuffer, len, 0);
 257                 if (ret == len) {
 258                         so->gsendbuffer[0] = '\0';
 259                         break;
 260                 }
 261                 if (ret == -1) {
 262                         DEBUG(3,("scannedonly flush_sendbuffer: "
 263                                  "error sending on socket %d to scanner:"
 264                                  " %s (%d)\n",
 265                                  so->socket, strerror(errno), errno));
 266                         if (errno == ECONNREFUSED || errno == ENOTCONN
 267                             || errno == ECONNRESET) {
 268                                 if (connect_to_scanner(handle) == -1)
 269                                         break;  /* connecting fails, abort */
 270                                 /* try again */
 271                         } else if (errno != EINTR) {
 272                                 /* on EINTR we just try again, all remaining
 273                                    other errors we log the error
 274                                    and try again ONCE */
 275                                 loop = 1;
 276                                 DEBUG(3,("scannedonly flush_sendbuffer: "
 277                                          "error sending data to scanner: %s "
 278                                          "(%d)\n", strerror(errno), errno));
 279                         }
 280                 } else {
 281                         /* --> partial write: Resend all filenames that were
 282                            not or not completely written. a partial filename
 283                            written means the filename will not arrive correctly,
 284                            so resend it completely */
 285                         int pos = 0;
 286                         while (pos < len) {
 287                                 char *tmp = strchr(so->gsendbuffer+pos, '\n');
 288                                 if (tmp && tmp - so->gsendbuffer < ret)
 289                                         pos = tmp - so->gsendbuffer + 1;
 290                                 else
 291                                         break;
 292                         }
 293                         memmove(so->gsendbuffer, so->gsendbuffer + pos,
 294                                 SENDBUFFERSIZE - ret);
 295                         /* now try again */
 296                 }
 297         } while (loop > 0);
 298
 299         if (so->gsendbuffer[0] != '\0') {
 300                 DEBUG(2,
 301                       ("scannedonly flush_sendbuffer: "
 302                        "failed to send files to AV scanner, "
 303                        "discarding files."));
 304                 so->gsendbuffer[0] = '\0';
 305         }
 306 }
 307
 308 static void notify_scanner(vfs_handle_struct * handle, const char *scanfile)
 309 {
 310         char *tmp;
 311         int tmplen, gsendlen;
 312         struct Tscannedonly *so = (struct Tscannedonly *)handle->data;
 313         TALLOC_CTX *ctx=talloc_tos();
 314         if (scanfile[0] != '/') {
 315                 tmp = construct_full_path(ctx,handle, scanfile, false);
 316         } else {
 317                 tmp = (char *)scanfile;
 318         }
 319         tmplen = strlen(tmp);
 320         gsendlen = strlen(so->gsendbuffer);
 321         DEBUG(SCANNEDONLY_DEBUG,
 322               ("scannedonly notify_scanner: tmp=%s, tmplen=%d, gsendlen=%d\n",
 323                tmp, tmplen, gsendlen));
 324         if (gsendlen + tmplen >= SENDBUFFERSIZE) {
 325                 flush_sendbuffer(handle);
 326         }
 327         strlcat(so->gsendbuffer, tmp, SENDBUFFERSIZE + 1);
 328         strlcat(so->gsendbuffer, "\n", SENDBUFFERSIZE + 1);
 329 }
 330
 331 static bool is_scannedonly_file(struct Tscannedonly *so, const char *shortname)
 332 {
 333         if (shortname[0]!='.') {
 334                 return false;
 335         }
 336         if (strncmp(shortname, so->p_scanned, strlen(so->p_scanned)) == 0) {
 337                 return true;
 338         }
 339         if (strncmp(shortname, so->p_virus, strlen(so->p_virus)) == 0) {
 340                 return true;
 341         }
 342         if (strncmp(shortname, so->p_failed, strlen(so->p_failed)) == 0) {
 343                 return true;
 344         }
 345         return false;
 346 }
 347
 348 static bool timespec_is_newer(struct timespec *base, struct timespec *test)
 349 {
 350         return timespec_compare(base,test) < 0;
 351 }
 352
 353 /*
 354 vfs_handle_struct *handle the scannedonly handle
 355 scannedonly_DIR * sDIR the scannedonly struct if called from _readdir()
 356 or NULL
 357 fullpath is a full path starting from / or a relative path to the
 358 current working directory
 359 shortname is the filename without directory components
 360 basename, is the directory without file name component
 361 allow_nonexistant return TRUE if stat() on the requested file fails
 362 recheck_time, the time in milliseconds to wait for the daemon to
 363 create a .scanned file
 364 recheck_tries, the number of tries to wait
 365 recheck_size, size in Kb of files that should not be waited for
 366 loop : boolean if we should try to loop over all files in the directory
 367 and send a notify to the scanner for all files that need scanning
 368 */
 369 static bool scannedonly_allow_access(vfs_handle_struct * handle,
 370                                      struct scannedonly_DIR *sDIR,
 371                                      struct smb_filename *smb_fname,
 372                                      const char *shortname,
 373                                      const char *base_name,
 374                                      int allow_nonexistant,
 375                                      int recheck_time, int recheck_tries,
 376                                      int recheck_size, int loop)
 377 {
 378         struct smb_filename *cache_smb_fname;
 379         TALLOC_CTX *ctx=talloc_tos();
 380         char *cachefile;
 381         int retval = -1;
 382         int didloop;
 383         DEBUG(SCANNEDONLY_DEBUG,
 384               ("smb_fname->base_name=%s, shortname=%s, base_name=%s\n"
 385                ,smb_fname->base_name,shortname,base_name));
 386
 387         if (ISDOT(shortname) || ISDOTDOT(shortname)) {
 388                 return true;
 389         }
 390         if (is_scannedonly_file(STRUCTSCANO(handle->data), shortname)) {
 391                 DEBUG(SCANNEDONLY_DEBUG,
 392                       ("scannedonly_allow_access, %s is a scannedonly file, "
 393                        "return 0\n", shortname));
 394                 return false;
 395         }
 396
 397         if (!VALID_STAT(smb_fname->st)) {
 398                 DEBUG(SCANNEDONLY_DEBUG,("stat %s\n",smb_fname->base_name));
 399                 retval = SMB_VFS_NEXT_STAT(handle, smb_fname);
 400                 if (retval != 0) {
 401                         /* failed to stat this file?!? --> hide it */
 402                         DEBUG(SCANNEDONLY_DEBUG,("no valid stat, return"
 403                                                  " allow_nonexistant=%d\n",
 404                                                  allow_nonexistant));
 405                         return allow_nonexistant;
 406                 }
 407         }
 408         if (!S_ISREG(smb_fname->st.st_ex_mode)) {
 409                 DEBUG(SCANNEDONLY_DEBUG,
 410                       ("%s is not a regular file, ISDIR=%d\n",
 411                        smb_fname->base_name,
 412                        S_ISDIR(smb_fname->st.st_ex_mode)));
 413                 return (STRUCTSCANO(handle->data)->
 414                         show_special_files ||
 415                         S_ISDIR(smb_fname->st.st_ex_mode));
 416         }
 417         if (smb_fname->st.st_ex_size == 0) {
 418                 DEBUG(SCANNEDONLY_DEBUG,("empty file, return 1\n"));
 419                 return true;    /* empty files cannot contain viruses ! */
 420         }
 421         cachefile = cachefile_name(ctx,
 422                                    shortname,
 423                                    base_name,
 424                                    STRUCTSCANO(handle->data)->p_scanned);
 425         create_synthetic_smb_fname(ctx, cachefile,NULL,NULL,&cache_smb_fname);
 426         if (!VALID_STAT(cache_smb_fname->st)) {
 427                 retval = SMB_VFS_NEXT_STAT(handle, cache_smb_fname);
 428         }
 429         if (retval == 0 && VALID_STAT(cache_smb_fname->st)) {
 430                 if (timespec_is_newer(&smb_fname->st.st_ex_ctime,
 431                                       &cache_smb_fname->st.st_ex_ctime)) {
 432                         talloc_free(cache_smb_fname);
 433                         return true;
 434                 }
 435                 /* no cachefile or too old */
 436                 SMB_VFS_NEXT_UNLINK(handle, cache_smb_fname);
 437                 retval = -1;
 438         }
 439
 440         notify_scanner(handle, smb_fname->base_name);
 441
 442         didloop = 0;
 443         if (loop && sDIR && !sDIR->notify_loop_done) {
 444                 /* check the rest of the directory and notify the
 445                    scanner if some file needs scanning */
 446                 long offset;
 447                 SMB_STRUCT_DIRENT *dire;
 448
 449                 offset = SMB_VFS_NEXT_TELLDIR(handle, sDIR->DIR);
 450                 dire = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR, NULL);
 451                 while (dire) {
 452                         char *fpath2;
 453                         struct smb_filename *smb_fname2;
 454                         fpath2 = talloc_asprintf(ctx, "%s%s", base_name,dire->d_name);
 455                         DEBUG(SCANNEDONLY_DEBUG,
 456                               ("scannedonly_allow_access in loop, "
 457                                "found %s\n", fpath2));
 458                         create_synthetic_smb_fname(ctx, fpath2,NULL,NULL,
 459                                                    &smb_fname2);
 460                         scannedonly_allow_access(handle, NULL,
 461                                                  smb_fname2,
 462                                                  dire->d_name,
 463                                                  base_name, 0, 0, 0, 0, 0);
 464                         talloc_free(fpath2);
 465                         talloc_free(smb_fname2);
 466                         dire = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR,NULL);
 467                 }
 468                 sDIR->notify_loop_done = 1;
 469                 didloop = 1;
 470                 SMB_VFS_NEXT_SEEKDIR(handle, sDIR->DIR, offset);
 471         }
 472         if (recheck_time > 0
 473             && ((recheck_size > 0
 474                  && smb_fname->st.st_ex_size < (1024 * recheck_size))
 475                 || didloop)) {
 476                 int i = 0;
 477                 flush_sendbuffer(handle);
 478                 while (retval != 0      /*&& errno == ENOENT */
 479                        && i < recheck_tries) {
 480                         DEBUG(SCANNEDONLY_DEBUG,
 481                               ("scannedonly_allow_access, wait (try=%d "
 482                                "(max %d), %d ms) for %s\n",
 483                                i, recheck_tries,
 484                                recheck_time, cache_smb_fname->base_name));
 485                         smb_msleep(recheck_time);
 486                         retval = SMB_VFS_NEXT_STAT(handle, cache_smb_fname);
 487                         i++;
 488                 }
 489         }
 490         /* still no cachefile, or still too old, return 0 */
 491         if (retval != 0
 492             || !timespec_is_newer(&smb_fname->st.st_ex_ctime,
 493                                   &cache_smb_fname->st.st_ex_ctime)) {
 494                 DEBUG(SCANNEDONLY_DEBUG,
 495                       ("retval=%d, return 0\n",retval));
 496                 return false;
 497         }
 498         return true;
 499 }
 500
 501 /*********************/
 502 /* VFS functions     */
 503 /*********************/
 504
 505 static SMB_STRUCT_DIR *scannedonly_opendir(vfs_handle_struct * handle,
 506                                            const char *fname,
 507                                            const char *mask, uint32 attr)
 508 {
 509         SMB_STRUCT_DIR *DIRp;
 510         struct scannedonly_DIR *sDIR;
 511
 512         DIRp = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
 513         if (!DIRp) {
 514                 return NULL;
 515         }
 516
 517         sDIR = TALLOC_P(NULL, struct scannedonly_DIR);
 518         if (fname[0] != '/') {
 519                 sDIR->base = construct_full_path(sDIR,handle, fname, true);
 520         } else {
 521                 sDIR->base = name_w_ending_slash(sDIR, fname);
 522         }
 523         DEBUG(SCANNEDONLY_DEBUG,
 524                         ("scannedonly_opendir, fname=%s, base=%s\n",fname,sDIR->base));
 525         sDIR->DIR = DIRp;
 526         sDIR->notify_loop_done = 0;
 527         return (SMB_STRUCT_DIR *) sDIR;
 528 }
 529
 530 static SMB_STRUCT_DIR *scannedonly_fdopendir(vfs_handle_struct * handle,
 531                                            files_struct *fsp,
 532                                            const char *mask, uint32 attr)
 533 {
 534         SMB_STRUCT_DIR *DIRp;
 535         struct scannedonly_DIR *sDIR;
 536         const char *fname;
 537
 538         DIRp = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 539         if (!DIRp) {
 540                 return NULL;
 541         }
 542
 543         fname = (const char *)fsp->fsp_name->base_name;
 544
 545         sDIR = TALLOC_P(NULL, struct scannedonly_DIR);
 546         if (fname[0] != '/') {
 547                 sDIR->base = construct_full_path(sDIR,handle, fname, true);
 548         } else {
 549                 sDIR->base = name_w_ending_slash(sDIR, fname);
 550         }
 551         DEBUG(SCANNEDONLY_DEBUG,
 552                         ("scannedonly_fdopendir, fname=%s, base=%s\n",fname,sDIR->base));
 553         sDIR->DIR = DIRp;
 554         sDIR->notify_loop_done = 0;
 555         return (SMB_STRUCT_DIR *) sDIR;
 556 }
 557
 558
 559 static SMB_STRUCT_DIRENT *scannedonly_readdir(vfs_handle_struct *handle,
 560                                               SMB_STRUCT_DIR * dirp,
 561                                               SMB_STRUCT_STAT *sbuf)
 562 {
 563         SMB_STRUCT_DIRENT *result;
 564         int allowed = 0;
 565         char *tmp;
 566         struct smb_filename *smb_fname;
 567         char *notify_name;
 568         int namelen;
 569         SMB_STRUCT_DIRENT *newdirent;
 570         TALLOC_CTX *ctx=talloc_tos();
 571
 572         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 573         if (!dirp) {
 574                 return NULL;
 575         }
 576
 577         result = SMB_VFS_NEXT_READDIR(handle, sDIR->DIR, sbuf);
 578
 579         if (!result)
 580                 return NULL;
 581
 582         if (is_scannedonly_file(STRUCTSCANO(handle->data), result->d_name)) {
 583                 DEBUG(SCANNEDONLY_DEBUG,
 584                       ("scannedonly_readdir, %s is a scannedonly file, "
 585                        "skip to next entry\n", result->d_name));
 586                 return scannedonly_readdir(handle, dirp, NULL);
 587         }
 588         tmp = talloc_asprintf(ctx, "%s%s", sDIR->base, result->d_name);
 589         DEBUG(SCANNEDONLY_DEBUG,
 590               ("scannedonly_readdir, check access to %s (sbuf=%p)\n",
 591                tmp,sbuf));
 592
 593         /* even if we don't hide nonscanned files or we allow non scanned
 594            files we call allow_access because it will notify the daemon to
 595            scan these files */
 596         create_synthetic_smb_fname(ctx, tmp,NULL,
 597                                    sbuf?VALID_STAT(*sbuf)?sbuf:NULL:NULL,
 598                                    &smb_fname);
 599         allowed = scannedonly_allow_access(
 600                 handle, sDIR, smb_fname,
 601                 result->d_name,
 602                 sDIR->base, 0,
 603                 STRUCTSCANO(handle->data)->hide_nonscanned_files
 604                 ? STRUCTSCANO(handle->data)->recheck_time_readdir
 605                 : 0,
 606                 STRUCTSCANO(handle->data)->recheck_tries_readdir,
 607                 -1,
 608                 1);
 609         DEBUG(SCANNEDONLY_DEBUG,
 610               ("scannedonly_readdir access to %s (%s) = %d\n", tmp,
 611                result->d_name, allowed));
 612         if (allowed) {
 613                 return result;
 614         }
 615         DEBUG(SCANNEDONLY_DEBUG,
 616               ("hide_nonscanned_files=%d, allow_nonscanned_files=%d\n",
 617                STRUCTSCANO(handle->data)->hide_nonscanned_files,
 618                STRUCTSCANO(handle->data)->allow_nonscanned_files
 619                       ));
 620
 621         if (!STRUCTSCANO(handle->data)->hide_nonscanned_files
 622             || STRUCTSCANO(handle->data)->allow_nonscanned_files) {
 623                 return result;
 624         }
 625
 626         DEBUG(SCANNEDONLY_DEBUG,
 627               ("scannedonly_readdir, readdir listing for %s not "
 628                "allowed, notify user\n", result->d_name));
 629         notify_name = talloc_asprintf(
 630                 ctx,"%s %s",result->d_name,
 631                 STRUCTSCANO(handle->data)->scanning_message);
 632         namelen = strlen(notify_name);
 633         newdirent = (SMB_STRUCT_DIRENT *)TALLOC_ARRAY(
 634                 ctx, char, sizeof(SMB_STRUCT_DIRENT) + namelen + 1);
 635         if (!newdirent) {
 636                 return NULL;
 637         }
 638         memcpy(newdirent, result, sizeof(SMB_STRUCT_DIRENT));
 639         memcpy(&newdirent->d_name, notify_name, namelen + 1);
 640         DEBUG(SCANNEDONLY_DEBUG,
 641               ("scannedonly_readdir, return newdirent at %p with "
 642                "notification %s\n", newdirent, newdirent->d_name));
 643         return newdirent;
 644 }
 645
 646 static void scannedonly_seekdir(struct vfs_handle_struct *handle,
 647                                 SMB_STRUCT_DIR * dirp, long offset)
 648 {
 649         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 650         SMB_VFS_NEXT_SEEKDIR(handle, sDIR->DIR, offset);
 651 }
 652
 653 static long scannedonly_telldir(struct vfs_handle_struct *handle,
 654                                 SMB_STRUCT_DIR * dirp)
 655 {
 656         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 657         return SMB_VFS_NEXT_TELLDIR(handle, sDIR->DIR);
 658 }
 659
 660 static void scannedonly_rewinddir(struct vfs_handle_struct *handle,
 661                                   SMB_STRUCT_DIR * dirp)
 662 {
 663         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 664         SMB_VFS_NEXT_REWINDDIR(handle, sDIR->DIR);
 665 }
 666
 667 static int scannedonly_closedir(vfs_handle_struct * handle,
 668                                 SMB_STRUCT_DIR * dirp)
 669 {
 670         int retval;
 671         struct scannedonly_DIR *sDIR = (struct scannedonly_DIR *)dirp;
 672         flush_sendbuffer(handle);
 673         retval = SMB_VFS_NEXT_CLOSEDIR(handle, sDIR->DIR);
 674         TALLOC_FREE(sDIR);
 675         return retval;
 676 }
 677
 678 static int scannedonly_stat(vfs_handle_struct * handle,
 679                             struct smb_filename *smb_fname)
 680 {
 681         int ret;
 682         ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
 683         DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_stat: %s returned %d\n",
 684                                   smb_fname->base_name, ret));
 685         if (ret != 0 && errno == ENOENT) {
 686                 TALLOC_CTX *ctx=talloc_tos();
 687                 char *test_base_name, *tmp_base_name = smb_fname->base_name;
 688                 /* possibly this was a fake name (file is being scanned for
 689                    viruses.txt): check for that and create the real name and
 690                    stat the real name */
 691                 test_base_name = real_path_from_notify_path(
 692                         ctx,
 693                         STRUCTSCANO(handle->data),
 694                         smb_fname->base_name);
 695                 if (test_base_name) {
 696                         smb_fname->base_name = test_base_name;
 697                         ret = SMB_VFS_NEXT_STAT(handle, smb_fname);
 698                         DEBUG(5, ("_stat: %s returned %d\n",
 699                                   test_base_name, ret));
 700                         smb_fname->base_name = tmp_base_name;
 701                 }
 702         }
 703         return ret;
 704 }
 705
 706 static int scannedonly_lstat(vfs_handle_struct * handle,
 707                              struct smb_filename *smb_fname)
 708 {
 709         int ret;
 710         ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
 711         DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_lstat: %s returned %d\n",
 712                                   smb_fname->base_name, ret));
 713         if (ret != 0 && errno == ENOENT) {
 714                 TALLOC_CTX *ctx=talloc_tos();
 715                 char *test_base_name, *tmp_base_name = smb_fname->base_name;
 716                 /* possibly this was a fake name (file is being scanned for
 717                    viruses.txt): check for that and create the real name and
 718                    stat the real name */
 719                 test_base_name = real_path_from_notify_path(
 720                         ctx, STRUCTSCANO(handle->data), smb_fname->base_name);
 721                 if (test_base_name) {
 722                         smb_fname->base_name = test_base_name;
 723                         ret = SMB_VFS_NEXT_LSTAT(handle, smb_fname);
 724                         DEBUG(5, ("_lstat: %s returned %d\n",
 725                                   test_base_name, ret));
 726                         smb_fname->base_name = tmp_base_name;
 727                 }
 728         }
 729         return ret;
 730 }
 731
 732 static int scannedonly_open(vfs_handle_struct * handle,
 733                             struct smb_filename *smb_fname,
 734                             files_struct * fsp, int flags, mode_t mode)
 735 {
 736         const char *base;
 737         char *tmp, *shortname;
 738         int allowed, write_access = 0;
 739         TALLOC_CTX *ctx=talloc_tos();
 740         /* if open for writing ignore it */
 741         if ((flags & O_ACCMODE) == O_WRONLY) {
 742                 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 743         }
 744         if ((flags & O_ACCMODE) == O_RDWR) {
 745                 write_access = 1;
 746         }
 747         /* check if this file is scanned already */
 748         tmp = strrchr(smb_fname->base_name, '/');
 749         if (tmp) {
 750                 base = talloc_strndup(ctx,smb_fname->base_name,
 751                                       (tmp - smb_fname->base_name) + 1);
 752                 shortname = tmp + 1;
 753         } else {
 754                 base = "";
 755                 shortname = (char *)smb_fname->base_name;
 756         }
 757         allowed = scannedonly_allow_access(
 758                 handle, NULL, smb_fname, shortname,
 759                 base,
 760                 write_access,
 761                 STRUCTSCANO(handle->data)->recheck_time_open,
 762                 STRUCTSCANO(handle->data)->recheck_tries_open,
 763                 STRUCTSCANO(handle->data)->recheck_size_open,
 764                 0);
 765         flush_sendbuffer(handle);
 766         DEBUG(SCANNEDONLY_DEBUG, ("scannedonly_open: allow=%d for %s\n",
 767                                   allowed, smb_fname->base_name));
 768         if (allowed
 769             || STRUCTSCANO(handle->data)->allow_nonscanned_files) {
 770                 return SMB_VFS_NEXT_OPEN(handle, smb_fname, fsp, flags, mode);
 771         }
 772         errno = EACCES;
 773         return -1;
 774 }
 775
 776 static int scannedonly_close(vfs_handle_struct * handle, files_struct * fsp)
 777 {
 778         /* we only have to notify the scanner
 779            for files that were open readwrite or writable. */
 780         if (fsp->can_write) {
 781                 TALLOC_CTX *ctx = talloc_tos();
 782                 notify_scanner(handle, construct_full_path(
 783                                        ctx,handle,
 784                                        fsp->fsp_name->base_name,false));
 785                 flush_sendbuffer(handle);
 786         }
 787         return SMB_VFS_NEXT_CLOSE(handle, fsp);
 788 }
 789
 790 static int scannedonly_rename(vfs_handle_struct * handle,
 791                               const struct smb_filename *smb_fname_src,
 792                               const struct smb_filename *smb_fname_dst)
 793 {
 794         /* rename the cache file before we pass the actual rename on */
 795         struct smb_filename *smb_fname_src_tmp = NULL;
 796         struct smb_filename *smb_fname_dst_tmp = NULL;
 797         char *cachefile_src, *cachefile_dst;
 798         bool needscandst=false;
 799         int ret;
 800         TALLOC_CTX *ctx = talloc_tos();
 801
 802         /* Setup temporary smb_filename structs. */
 803         cachefile_src = cachefile_name_f_fullpath(
 804                 ctx,
 805                 smb_fname_src->base_name,
 806                 STRUCTSCANO(handle->data)->p_scanned);
 807         cachefile_dst = cachefile_name_f_fullpath(
 808                 ctx,
 809                 smb_fname_dst->base_name,
 810                 STRUCTSCANO(handle->data)->p_scanned);
 811         create_synthetic_smb_fname(ctx, cachefile_src,NULL,NULL,
 812                                    &smb_fname_src_tmp);
 813         create_synthetic_smb_fname(ctx, cachefile_dst,NULL,NULL,
 814                                    &smb_fname_dst_tmp);
 815
 816         ret = SMB_VFS_NEXT_RENAME(handle, smb_fname_src_tmp, smb_fname_dst_tmp);
 817         if (ret == ENOENT) {
 818                 needscandst=true;
 819         } else if (ret != 0) {
 820                 DEBUG(SCANNEDONLY_DEBUG,
 821                       ("failed to rename %s into %s error %d: %s\n", cachefile_src,
 822                        cachefile_dst, ret, strerror(ret)));
 823                 needscandst=true;
 824         }
 825         ret = SMB_VFS_NEXT_RENAME(handle, smb_fname_src, smb_fname_dst);
 826         if (ret == 0 && needscandst) {
 827                 notify_scanner(handle, smb_fname_dst->base_name);
 828                 flush_sendbuffer(handle);
 829         }
 830         return ret;
 831 }
 832
 833 static int scannedonly_unlink(vfs_handle_struct * handle,
 834                               const struct smb_filename *smb_fname)
 835 {
 836         /* unlink the 'scanned' file too */
 837         struct smb_filename *smb_fname_cache = NULL;
 838         char * cachefile;
 839         TALLOC_CTX *ctx = talloc_tos();
 840
 841         cachefile = cachefile_name_f_fullpath(
 842                 ctx,
 843                 smb_fname->base_name,
 844                 STRUCTSCANO(handle->data)->p_scanned);
 845         create_synthetic_smb_fname(ctx, cachefile,NULL,NULL,
 846                                    &smb_fname_cache);
 847         if (SMB_VFS_NEXT_UNLINK(handle, smb_fname_cache) != 0) {
 848                 DEBUG(SCANNEDONLY_DEBUG, ("_unlink: failed to unlink %s\n",
 849                                           smb_fname_cache->base_name));
 850         }
 851         return SMB_VFS_NEXT_UNLINK(handle, smb_fname);
 852 }
 853
 854 static int scannedonly_rmdir(vfs_handle_struct * handle, const char *path)
 855 {
 856         /* if there are only .scanned: .virus: or .failed: files, we delete
 857            those, because the client cannot see them */
 858         DIR *dirp;
 859         SMB_STRUCT_DIRENT *dire;
 860         TALLOC_CTX *ctx = talloc_tos();
 861         bool only_deletable_files = true, have_files = false;
 862         char *path_w_slash;
 863
 864         if (!STRUCTSCANO(handle->data)->rm_hidden_files_on_rmdir)
 865                 return SMB_VFS_NEXT_RMDIR(handle, path);
 866
 867         path_w_slash = name_w_ending_slash(ctx,path);
 868         dirp = SMB_VFS_NEXT_OPENDIR(handle, path, NULL, 0);
 869         if (!dirp) {
 870                 return -1;
 871         }
 872         while ((dire = SMB_VFS_NEXT_READDIR(handle, dirp, NULL)) != NULL) {
 873                 if (ISDOT(dire->d_name) || ISDOTDOT(dire->d_name)) {
 874                         continue;
 875                 }
 876                 have_files = true;
 877                 if (!is_scannedonly_file(STRUCTSCANO(handle->data),
 878                                          dire->d_name)) {
 879                         struct smb_filename *smb_fname = NULL;
 880                         char *fullpath;
 881                         int retval;
 882
 883                         if (STRUCTSCANO(handle->data)->show_special_files) {
 884                                 only_deletable_files = false;
 885                                 break;
 886                         }
 887                         /* stat the file and see if it is a
 888                            special file */
 889                         fullpath = talloc_asprintf(ctx, "%s%s", path_w_slash,
 890                                                   dire->d_name);
 891                         create_synthetic_smb_fname(ctx, fullpath,NULL,NULL,
 892                                                    &smb_fname);
 893                         retval = SMB_VFS_NEXT_STAT(handle, smb_fname);
 894                         if (retval == 0
 895                             && S_ISREG(smb_fname->st.st_ex_mode)) {
 896                                 only_deletable_files = false;
 897                         }
 898                         TALLOC_FREE(fullpath);
 899                         TALLOC_FREE(smb_fname);
 900                         break;
 901                 }
 902         }
 903         DEBUG(SCANNEDONLY_DEBUG,
 904               ("path=%s, have_files=%d, only_deletable_files=%d\n",
 905                path, have_files, only_deletable_files));
 906         if (have_files && only_deletable_files) {
 907                 DEBUG(SCANNEDONLY_DEBUG,
 908                       ("scannedonly_rmdir, remove leftover scannedonly "
 909                        "files from %s\n", path_w_slash));
 910                 SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 911                 while ((dire = SMB_VFS_NEXT_READDIR(handle, dirp, NULL))
 912                        != NULL) {
 913                         char *fullpath;
 914                         struct smb_filename *smb_fname = NULL;
 915                         if (ISDOT(dire->d_name) || ISDOTDOT(dire->d_name)) {
 916                                 continue;
 917                         }
 918                         fullpath = talloc_asprintf(ctx, "%s%s", path_w_slash,
 919                                                   dire->d_name);
 920                         create_synthetic_smb_fname(ctx, fullpath,NULL,NULL,
 921                                                    &smb_fname);
 922                         DEBUG(SCANNEDONLY_DEBUG, ("unlink %s\n", fullpath));
 923                         SMB_VFS_NEXT_UNLINK(handle, smb_fname);
 924                         TALLOC_FREE(fullpath);
 925                         TALLOC_FREE(smb_fname);
 926                 }
 927         }
 928         SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 929         return SMB_VFS_NEXT_RMDIR(handle, path);
 930 }
 931
 932 static void free_scannedonly_data(void **data)
 933 {
 934         SAFE_FREE(*data);
 935 }
 936
 937 static int scannedonly_connect(struct vfs_handle_struct *handle,
 938                                const char *service, const char *user)
 939 {
 940
 941         struct Tscannedonly *so;
 942
 943         so = SMB_MALLOC_P(struct Tscannedonly);
 944         handle->data = (void *)so;
 945         handle->free_data = free_scannedonly_data;
 946         so->gsendbuffer[0]='\0';
 947         so->domain_socket =
 948                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 949                              "domain_socket", True);
 950         so->socketname =
 951                 (char *)lp_parm_const_string(SNUM(handle->conn),
 952                                              "scannedonly", "socketname",
 953                                              "/var/lib/scannedonly/scan");
 954         so->portnum =
 955                 lp_parm_int(SNUM(handle->conn), "scannedonly", "portnum",
 956                             2020);
 957         so->scanhost =
 958                 (char *)lp_parm_const_string(SNUM(handle->conn),
 959                                              "scannedonly", "scanhost",
 960                                              "localhost");
 961
 962         so->show_special_files =
 963                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 964                              "show_special_files", True);
 965         so->rm_hidden_files_on_rmdir =
 966                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 967                              "rm_hidden_files_on_rmdir", True);
 968         so->hide_nonscanned_files =
 969                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 970                              "hide_nonscanned_files", False);
 971         so->allow_nonscanned_files =
 972                 lp_parm_bool(SNUM(handle->conn), "scannedonly",
 973                              "allow_nonscanned_files", False);
 974         so->scanning_message =
 975                 (char *)lp_parm_const_string(SNUM(handle->conn),
 976                                              "scannedonly",
 977                                              "scanning_message",
 978                                              "is being scanned for viruses");
 979         so->scanning_message_len = strlen(so->scanning_message);
 980         so->recheck_time_open =
 981                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 982                             "recheck_time_open", 50);
 983         so->recheck_tries_open =
 984                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 985                             "recheck_tries_open", 100);
 986         so->recheck_size_open =
 987                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 988                             "recheck_size_open", 100);
 989         so->recheck_time_readdir =
 990                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 991                             "recheck_time_readdir", 50);
 992         so->recheck_tries_readdir =
 993                 lp_parm_int(SNUM(handle->conn), "scannedonly",
 994                             "recheck_tries_readdir", 20);
 995
 996         so->p_scanned =
 997                 (char *)lp_parm_const_string(SNUM(handle->conn),
 998                                              "scannedonly",
 999                                              "pref_scanned",
1000                                              ".scanned:");
1001         so->p_virus =
1002                 (char *)lp_parm_const_string(SNUM(handle->conn),
1003                                              "scannedonly",
1004                                              "pref_virus",
1005                                              ".virus:");
1006         so->p_failed =
1007                 (char *)lp_parm_const_string(SNUM(handle->conn),
1008                                              "scannedonly",
1009                                              "pref_failed",
1010                                              ".failed:");
1011         connect_to_scanner(handle);
1012
1013         return SMB_VFS_NEXT_CONNECT(handle, service, user);
1014 }
1015
1016 /* VFS operations structure */
1017 static struct vfs_fn_pointers vfs_scannedonly_fns = {
1018         .opendir = scannedonly_opendir,
1019         .fdopendir = scannedonly_fdopendir,
1020         .readdir = scannedonly_readdir,
1021         .seekdir = scannedonly_seekdir,
1022         .telldir = scannedonly_telldir,
1023         .rewind_dir = scannedonly_rewinddir,
1024         .closedir = scannedonly_closedir,
1025         .rmdir = scannedonly_rmdir,
1026         .stat = scannedonly_stat,
1027         .lstat = scannedonly_lstat,
1028         .open = scannedonly_open,
1029         .close_fn = scannedonly_close,
1030         .rename = scannedonly_rename,
1031         .unlink = scannedonly_unlink,
1032         .connect_fn = scannedonly_connect
1033 };
1034
1035 NTSTATUS vfs_scannedonly_init(void)
1036 {
1037         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "scannedonly",
1038                                 &vfs_scannedonly_fns);
1039 }