source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23
  24 extern bool global_machine_password_needs_changing;
  25
  26 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  27                                    char *outbuf);
  28
  29 bool smbd_lock_socket(struct smbd_server_connection *sconn)
  30 {
  31         return true;
  32 }
  33
  34 bool smbd_unlock_socket(struct smbd_server_connection *sconn)
  35 {
  36         return true;
  37 }
  38
  39 /* Accessor function for smb_read_error for smbd functions. */
  40
  41 /****************************************************************************
  42  Send an smb to a fd.
  43 ****************************************************************************/
  44
  45 bool srv_send_smb(int fd, char *buffer,
  46                   bool do_signing, uint32_t seqnum,
  47                   bool do_encrypt,
  48                   struct smb_perfcount_data *pcd)
  49 {
  50         size_t len = 0;
  51         size_t nwritten=0;
  52         ssize_t ret;
  53         char *buf_out = buffer;
  54
  55         if (do_signing) {
  56                 /* Sign the outgoing packet if required. */
  57                 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
  58         }
  59
  60         if (do_encrypt) {
  61                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  62                 if (!NT_STATUS_IS_OK(status)) {
  63                         DEBUG(0, ("send_smb: SMB encryption failed "
  64                                 "on outgoing packet! Error %s\n",
  65                                 nt_errstr(status) ));
  66                         goto out;
  67                 }
  68         }
  69
  70         len = smb_len(buf_out) + 4;
  71
  72         while (nwritten < len) {
  73                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  74                 if (ret <= 0) {
  75                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  76                                 (int)len,(int)ret, strerror(errno) ));
  77                         srv_free_enc_buffer(buf_out);
  78                         goto out;
  79                 }
  80                 nwritten += ret;
  81         }
  82
  83         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
  84         srv_free_enc_buffer(buf_out);
  85 out:
  86         SMB_PERFCOUNT_END(pcd);
  87         return true;
  88 }
  89
  90 /*******************************************************************
  91  Setup the word count and byte count for a smb message.
  92 ********************************************************************/
  93
  94 int srv_set_message(char *buf,
  95                         int num_words,
  96                         int num_bytes,
  97                         bool zero)
  98 {
  99         if (zero && (num_words || num_bytes)) {
 100                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 101         }
 102         SCVAL(buf,smb_wct,num_words);
 103         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 104         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 105         return (smb_size + num_words*2 + num_bytes);
 106 }
 107
 108 static bool valid_smb_header(const uint8_t *inbuf)
 109 {
 110         if (is_encrypted_packet(inbuf)) {
 111                 return true;
 112         }
 113         /*
 114          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 115          * but it just looks weird to call strncmp for this one.
 116          */
 117         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 118 }
 119
 120 /* Socket functions for smbd packet processing. */
 121
 122 static bool valid_packet_size(size_t len)
 123 {
 124         /*
 125          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 126          * of header. Don't print the error if this fits.... JRA.
 127          */
 128
 129         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 130                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 131                                         (unsigned long)len));
 132                 return false;
 133         }
 134         return true;
 135 }
 136
 137 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 138                                       unsigned int timeout, ssize_t len)
 139 {
 140         if (len <= 0) {
 141                 return NT_STATUS_OK;
 142         }
 143
 144         return read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 145 }
 146
 147 /****************************************************************************
 148  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 149 ****************************************************************************/
 150
 151 /*
 152  * Unfortunately, earlier versions of smbclient/libsmbclient
 153  * don't send this "standard" writeX header. I've fixed this
 154  * for 3.2 but we'll use the old method with earlier versions.
 155  * Windows and CIFSFS at least use this standard size. Not
 156  * sure about MacOSX.
 157  */
 158
 159 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 160                                 (2*14) + /* word count (including bcc) */ \
 161                                 1 /* pad byte */)
 162
 163 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 164                                                     const char lenbuf[4],
 165                                                     int fd, char **buffer,
 166                                                     unsigned int timeout,
 167                                                     size_t *p_unread,
 168                                                     size_t *len_ret)
 169 {
 170         /* Size of a WRITEX call (+4 byte len). */
 171         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 172         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 173         ssize_t toread;
 174         NTSTATUS status;
 175
 176         memcpy(writeX_header, lenbuf, 4);
 177
 178         status = read_fd_with_timeout(
 179                 fd, writeX_header + 4,
 180                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 181                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 182                 timeout, NULL);
 183
 184         if (!NT_STATUS_IS_OK(status)) {
 185                 return status;
 186         }
 187
 188         /*
 189          * Ok - now try and see if this is a possible
 190          * valid writeX call.
 191          */
 192
 193         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 194                 /*
 195                  * If the data offset is beyond what
 196                  * we've read, drain the extra bytes.
 197                  */
 198                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 199                 ssize_t newlen;
 200
 201                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 202                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 203                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 204                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 205                                         " failed to drain pending bytes");
 206                         }
 207                 } else {
 208                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 209                 }
 210
 211                 /* Spoof down the length and null out the bcc. */
 212                 set_message_bcc(writeX_header, 0);
 213                 newlen = smb_len(writeX_header);
 214
 215                 /* Copy the header we've written. */
 216
 217                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 218                                 writeX_header,
 219                                 sizeof(writeX_header));
 220
 221                 if (*buffer == NULL) {
 222                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 223                                   (int)sizeof(writeX_header)));
 224                         return NT_STATUS_NO_MEMORY;
 225                 }
 226
 227                 /* Work out the remaining bytes. */
 228                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 229                 *len_ret = newlen + 4;
 230                 return NT_STATUS_OK;
 231         }
 232
 233         if (!valid_packet_size(len)) {
 234                 return NT_STATUS_INVALID_PARAMETER;
 235         }
 236
 237         /*
 238          * Not a valid writeX call. Just do the standard
 239          * talloc and return.
 240          */
 241
 242         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 243
 244         if (*buffer == NULL) {
 245                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 246                           (int)len+4));
 247                 return NT_STATUS_NO_MEMORY;
 248         }
 249
 250         /* Copy in what we already read. */
 251         memcpy(*buffer,
 252                 writeX_header,
 253                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 254         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 255
 256         if(toread > 0) {
 257                 status = read_packet_remainder(
 258                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 259                         timeout, toread);
 260
 261                 if (!NT_STATUS_IS_OK(status)) {
 262                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 263                                    nt_errstr(status)));
 264                         return status;
 265                 }
 266         }
 267
 268         *len_ret = len + 4;
 269         return NT_STATUS_OK;
 270 }
 271
 272 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 273                                        char **buffer, unsigned int timeout,
 274                                        size_t *p_unread, size_t *plen)
 275 {
 276         char lenbuf[4];
 277         size_t len;
 278         int min_recv_size = lp_min_receive_file_size();
 279         NTSTATUS status;
 280
 281         *p_unread = 0;
 282
 283         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 284         if (!NT_STATUS_IS_OK(status)) {
 285                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 286                 return status;
 287         }
 288
 289         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 290             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 291                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 292             !srv_is_signing_active(smbd_server_conn)) {
 293
 294                 return receive_smb_raw_talloc_partial_read(
 295                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 296         }
 297
 298         if (!valid_packet_size(len)) {
 299                 return NT_STATUS_INVALID_PARAMETER;
 300         }
 301
 302         /*
 303          * The +4 here can't wrap, we've checked the length above already.
 304          */
 305
 306         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 307
 308         if (*buffer == NULL) {
 309                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 310                           (int)len+4));
 311                 return NT_STATUS_NO_MEMORY;
 312         }
 313
 314         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 315
 316         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 return status;
 319         }
 320
 321         *plen = len + 4;
 322         return NT_STATUS_OK;
 323 }
 324
 325 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 326                                    char **buffer, unsigned int timeout,
 327                                    size_t *p_unread, bool *p_encrypted,
 328                                    size_t *p_len,
 329                                    uint32_t *seqnum)
 330 {
 331         size_t len = 0;
 332         NTSTATUS status;
 333
 334         *p_encrypted = false;
 335
 336         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 337                                         p_unread, &len);
 338         if (!NT_STATUS_IS_OK(status)) {
 339                 return status;
 340         }
 341
 342         if (is_encrypted_packet((uint8_t *)*buffer)) {
 343                 status = srv_decrypt_buffer(*buffer);
 344                 if (!NT_STATUS_IS_OK(status)) {
 345                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 346                                 "incoming packet! Error %s\n",
 347                                 nt_errstr(status) ));
 348                         return status;
 349                 }
 350                 *p_encrypted = true;
 351         }
 352
 353         /* Check the incoming SMB signature. */
 354         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, false)) {
 355                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 356                           "incoming packet!\n"));
 357                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 358         }
 359
 360         *p_len = len;
 361         return NT_STATUS_OK;
 362 }
 363
 364 /*
 365  * Initialize a struct smb_request from an inbuf
 366  */
 367
 368 void init_smb_request(struct smb_request *req,
 369                         const uint8 *inbuf,
 370                         size_t unread_bytes,
 371                         bool encrypted)
 372 {
 373         size_t req_size = smb_len(inbuf) + 4;
 374         /* Ensure we have at least smb_size bytes. */
 375         if (req_size < smb_size) {
 376                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 377                         (unsigned int)req_size ));
 378                 exit_server_cleanly("Invalid SMB request");
 379         }
 380         req->cmd    = CVAL(inbuf, smb_com);
 381         req->flags2 = SVAL(inbuf, smb_flg2);
 382         req->smbpid = SVAL(inbuf, smb_pid);
 383         req->mid    = SVAL(inbuf, smb_mid);
 384         req->seqnum = 0;
 385         req->vuid   = SVAL(inbuf, smb_uid);
 386         req->tid    = SVAL(inbuf, smb_tid);
 387         req->wct    = CVAL(inbuf, smb_wct);
 388         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 389         req->buflen = smb_buflen(inbuf);
 390         req->buf    = (const uint8_t *)smb_buf(inbuf);
 391         req->unread_bytes = unread_bytes;
 392         req->encrypted = encrypted;
 393         req->conn = conn_find(req->tid);
 394         req->chain_fsp = NULL;
 395         req->chain_outbuf = NULL;
 396         req->done = false;
 397         smb_init_perfcount_data(&req->pcd);
 398
 399         /* Ensure we have at least wct words and 2 bytes of bcc. */
 400         if (smb_size + req->wct*2 > req_size) {
 401                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 402                         (unsigned int)req->wct,
 403                         (unsigned int)req_size));
 404                 exit_server_cleanly("Invalid SMB request");
 405         }
 406         /* Ensure bcc is correct. */
 407         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 408                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 409                         "(wct = %u, size %u)\n",
 410                         (unsigned int)req->buflen,
 411                         (unsigned int)req->wct,
 412                         (unsigned int)req_size));
 413                 exit_server_cleanly("Invalid SMB request");
 414         }
 415
 416         req->outbuf = NULL;
 417 }
 418
 419 static void process_smb(struct smbd_server_connection *conn,
 420                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 421                         uint32_t seqnum, bool encrypted,
 422                         struct smb_perfcount_data *deferred_pcd);
 423
 424 static void smbd_deferred_open_timer(struct event_context *ev,
 425                                      struct timed_event *te,
 426                                      struct timeval _tval,
 427                                      void *private_data)
 428 {
 429         struct pending_message_list *msg = talloc_get_type(private_data,
 430                                            struct pending_message_list);
 431         TALLOC_CTX *mem_ctx = talloc_tos();
 432         uint16_t mid = SVAL(msg->buf.data,smb_mid);
 433         uint8_t *inbuf;
 434
 435         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 436                                          msg->buf.length);
 437         if (inbuf == NULL) {
 438                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 439                 return;
 440         }
 441
 442         /* We leave this message on the queue so the open code can
 443            know this is a retry. */
 444         DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
 445                 (unsigned int)mid));
 446
 447         /* Mark the message as processed so this is not
 448          * re-processed in error. */
 449         msg->processed = true;
 450
 451         process_smb(smbd_server_conn, inbuf,
 452                     msg->buf.length, 0,
 453                     msg->seqnum, msg->encrypted, &msg->pcd);
 454
 455         /* If it's still there and was processed, remove it. */
 456         msg = get_open_deferred_message(mid);
 457         if (msg && msg->processed) {
 458                 remove_deferred_open_smb_message(mid);
 459         }
 460 }
 461
 462 /****************************************************************************
 463  Function to push a message onto the tail of a linked list of smb messages ready
 464  for processing.
 465 ****************************************************************************/
 466
 467 static bool push_queued_message(struct smb_request *req,
 468                                 struct timeval request_time,
 469                                 struct timeval end_time,
 470                                 char *private_data, size_t private_len)
 471 {
 472         int msg_len = smb_len(req->inbuf) + 4;
 473         struct pending_message_list *msg;
 474
 475         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 476
 477         if(msg == NULL) {
 478                 DEBUG(0,("push_message: malloc fail (1)\n"));
 479                 return False;
 480         }
 481
 482         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 483         if(msg->buf.data == NULL) {
 484                 DEBUG(0,("push_message: malloc fail (2)\n"));
 485                 TALLOC_FREE(msg);
 486                 return False;
 487         }
 488
 489         msg->request_time = request_time;
 490         msg->seqnum = req->seqnum;
 491         msg->encrypted = req->encrypted;
 492         msg->processed = false;
 493         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 494
 495         if (private_data) {
 496                 msg->private_data = data_blob_talloc(msg, private_data,
 497                                                      private_len);
 498                 if (msg->private_data.data == NULL) {
 499                         DEBUG(0,("push_message: malloc fail (3)\n"));
 500                         TALLOC_FREE(msg);
 501                         return False;
 502                 }
 503         }
 504
 505         msg->te = event_add_timed(smbd_event_context(),
 506                                   msg,
 507                                   end_time,
 508                                   smbd_deferred_open_timer,
 509                                   msg);
 510         if (!msg->te) {
 511                 DEBUG(0,("push_message: event_add_timed failed\n"));
 512                 TALLOC_FREE(msg);
 513                 return false;
 514         }
 515
 516         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 517
 518         DEBUG(10,("push_message: pushed message length %u on "
 519                   "deferred_open_queue\n", (unsigned int)msg_len));
 520
 521         return True;
 522 }
 523
 524 /****************************************************************************
 525  Function to delete a sharing violation open message by mid.
 526 ****************************************************************************/
 527
 528 void remove_deferred_open_smb_message(uint16 mid)
 529 {
 530         struct pending_message_list *pml;
 531
 532         for (pml = deferred_open_queue; pml; pml = pml->next) {
 533                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 534                         DEBUG(10,("remove_deferred_open_smb_message: "
 535                                   "deleting mid %u len %u\n",
 536                                   (unsigned int)mid,
 537                                   (unsigned int)pml->buf.length ));
 538                         DLIST_REMOVE(deferred_open_queue, pml);
 539                         TALLOC_FREE(pml);
 540                         return;
 541                 }
 542         }
 543 }
 544
 545 /****************************************************************************
 546  Move a sharing violation open retry message to the front of the list and
 547  schedule it for immediate processing.
 548 ****************************************************************************/
 549
 550 void schedule_deferred_open_smb_message(uint16 mid)
 551 {
 552         struct pending_message_list *pml;
 553         int i = 0;
 554
 555         for (pml = deferred_open_queue; pml; pml = pml->next) {
 556                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 557
 558                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 559                         (unsigned int)msg_mid ));
 560
 561                 if (mid == msg_mid) {
 562                         struct timed_event *te;
 563
 564                         if (pml->processed) {
 565                                 /* A processed message should not be
 566                                  * rescheduled. */
 567                                 DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR "
 568                                         "message mid %u was already processed\n",
 569                                         msg_mid ));
 570                                 continue;
 571                         }
 572
 573                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 574                                 mid ));
 575
 576                         te = event_add_timed(smbd_event_context(),
 577                                              pml,
 578                                              timeval_zero(),
 579                                              smbd_deferred_open_timer,
 580                                              pml);
 581                         if (!te) {
 582                                 DEBUG(10,("schedule_deferred_open_smb_message: "
 583                                           "event_add_timed() failed, skipping mid %u\n",
 584                                           mid ));
 585                         }
 586
 587                         TALLOC_FREE(pml->te);
 588                         pml->te = te;
 589                         DLIST_PROMOTE(deferred_open_queue, pml);
 590                         return;
 591                 }
 592         }
 593
 594         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 595                 mid ));
 596 }
 597
 598 /****************************************************************************
 599  Return true if this mid is on the deferred queue and was not yet processed.
 600 ****************************************************************************/
 601
 602 bool open_was_deferred(uint16 mid)
 603 {
 604         struct pending_message_list *pml;
 605
 606         for (pml = deferred_open_queue; pml; pml = pml->next) {
 607                 if (SVAL(pml->buf.data,smb_mid) == mid && !pml->processed) {
 608                         return True;
 609                 }
 610         }
 611         return False;
 612 }
 613
 614 /****************************************************************************
 615  Return the message queued by this mid.
 616 ****************************************************************************/
 617
 618 struct pending_message_list *get_open_deferred_message(uint16 mid)
 619 {
 620         struct pending_message_list *pml;
 621
 622         for (pml = deferred_open_queue; pml; pml = pml->next) {
 623                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 624                         return pml;
 625                 }
 626         }
 627         return NULL;
 628 }
 629
 630 /****************************************************************************
 631  Function to push a deferred open smb message onto a linked list of local smb
 632  messages ready for processing.
 633 ****************************************************************************/
 634
 635 bool push_deferred_smb_message(struct smb_request *req,
 636                                struct timeval request_time,
 637                                struct timeval timeout,
 638                                char *private_data, size_t priv_len)
 639 {
 640         struct timeval end_time;
 641
 642         if (req->unread_bytes) {
 643                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 644                         "unread_bytes = %u\n",
 645                         (unsigned int)req->unread_bytes ));
 646                 smb_panic("push_deferred_smb_message: "
 647                         "logic error unread_bytes != 0" );
 648         }
 649
 650         end_time = timeval_sum(&request_time, &timeout);
 651
 652         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 653                   "timeout time [%u.%06u]\n",
 654                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 655                   (unsigned int)end_time.tv_sec,
 656                   (unsigned int)end_time.tv_usec));
 657
 658         return push_queued_message(req, request_time, end_time,
 659                                    private_data, priv_len);
 660 }
 661
 662 struct idle_event {
 663         struct timed_event *te;
 664         struct timeval interval;
 665         char *name;
 666         bool (*handler)(const struct timeval *now, void *private_data);
 667         void *private_data;
 668 };
 669
 670 static void smbd_idle_event_handler(struct event_context *ctx,
 671                                     struct timed_event *te,
 672                                     struct timeval now,
 673                                     void *private_data)
 674 {
 675         struct idle_event *event =
 676                 talloc_get_type_abort(private_data, struct idle_event);
 677
 678         TALLOC_FREE(event->te);
 679
 680         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 681                   event->name, event->te));
 682
 683         if (!event->handler(&now, event->private_data)) {
 684                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 685                           event->name, event->te));
 686                 /* Don't repeat, delete ourselves */
 687                 TALLOC_FREE(event);
 688                 return;
 689         }
 690
 691         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 692                   event->name, event->te));
 693
 694         event->te = event_add_timed(ctx, event,
 695                                     timeval_sum(&now, &event->interval),
 696                                     smbd_idle_event_handler, event);
 697
 698         /* We can't do much but fail here. */
 699         SMB_ASSERT(event->te != NULL);
 700 }
 701
 702 struct idle_event *event_add_idle(struct event_context *event_ctx,
 703                                   TALLOC_CTX *mem_ctx,
 704                                   struct timeval interval,
 705                                   const char *name,
 706                                   bool (*handler)(const struct timeval *now,
 707                                                   void *private_data),
 708                                   void *private_data)
 709 {
 710         struct idle_event *result;
 711         struct timeval now = timeval_current();
 712
 713         result = TALLOC_P(mem_ctx, struct idle_event);
 714         if (result == NULL) {
 715                 DEBUG(0, ("talloc failed\n"));
 716                 return NULL;
 717         }
 718
 719         result->interval = interval;
 720         result->handler = handler;
 721         result->private_data = private_data;
 722
 723         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 724                 DEBUG(0, ("talloc failed\n"));
 725                 TALLOC_FREE(result);
 726                 return NULL;
 727         }
 728
 729         result->te = event_add_timed(event_ctx, result,
 730                                      timeval_sum(&now, &interval),
 731                                      smbd_idle_event_handler, result);
 732         if (result->te == NULL) {
 733                 DEBUG(0, ("event_add_timed failed\n"));
 734                 TALLOC_FREE(result);
 735                 return NULL;
 736         }
 737
 738         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 739         return result;
 740 }
 741
 742 static void smbd_sig_term_handler(struct tevent_context *ev,
 743                                   struct tevent_signal *se,
 744                                   int signum,
 745                                   int count,
 746                                   void *siginfo,
 747                                   void *private_data)
 748 {
 749         exit_server_cleanly("termination signal");
 750 }
 751
 752 void smbd_setup_sig_term_handler(void)
 753 {
 754         struct tevent_signal *se;
 755
 756         se = tevent_add_signal(smbd_event_context(),
 757                                smbd_event_context(),
 758                                SIGTERM, 0,
 759                                smbd_sig_term_handler,
 760                                NULL);
 761         if (!se) {
 762                 exit_server("failed to setup SIGTERM handler");
 763         }
 764 }
 765
 766 static void smbd_sig_hup_handler(struct tevent_context *ev,
 767                                   struct tevent_signal *se,
 768                                   int signum,
 769                                   int count,
 770                                   void *siginfo,
 771                                   void *private_data)
 772 {
 773         change_to_root_user();
 774         DEBUG(1,("Reloading services after SIGHUP\n"));
 775         reload_services(False);
 776 }
 777
 778 void smbd_setup_sig_hup_handler(void)
 779 {
 780         struct tevent_signal *se;
 781
 782         se = tevent_add_signal(smbd_event_context(),
 783                                smbd_event_context(),
 784                                SIGHUP, 0,
 785                                smbd_sig_hup_handler,
 786                                NULL);
 787         if (!se) {
 788                 exit_server("failed to setup SIGHUP handler");
 789         }
 790 }
 791
 792 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 793 {
 794         fd_set r_fds, w_fds;
 795         int selrtn;
 796         struct timeval to;
 797         int maxfd = 0;
 798
 799         to.tv_sec = SMBD_SELECT_TIMEOUT;
 800         to.tv_usec = 0;
 801
 802         /*
 803          * Setup the select fd sets.
 804          */
 805
 806         FD_ZERO(&r_fds);
 807         FD_ZERO(&w_fds);
 808
 809         /*
 810          * Are there any timed events waiting ? If so, ensure we don't
 811          * select for longer than it would take to wait for them.
 812          */
 813
 814         {
 815                 struct timeval now;
 816                 GetTimeOfDay(&now);
 817
 818                 event_add_to_select_args(smbd_event_context(), &now,
 819                                          &r_fds, &w_fds, &to, &maxfd);
 820         }
 821
 822         /* Process a signal and timed events now... */
 823         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 824                 return NT_STATUS_RETRY;
 825         }
 826
 827         {
 828                 int sav;
 829                 START_PROFILE(smbd_idle);
 830
 831                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 832                 sav = errno;
 833
 834                 END_PROFILE(smbd_idle);
 835                 errno = sav;
 836         }
 837
 838         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 839                 return NT_STATUS_RETRY;
 840         }
 841
 842         /* Check if error */
 843         if (selrtn == -1) {
 844                 /* something is wrong. Maybe the socket is dead? */
 845                 return map_nt_error_from_unix(errno);
 846         }
 847
 848         /* Did we timeout ? */
 849         if (selrtn == 0) {
 850                 return NT_STATUS_RETRY;
 851         }
 852
 853         /* should not be reached */
 854         return NT_STATUS_INTERNAL_ERROR;
 855 }
 856
 857 /*
 858  * Only allow 5 outstanding trans requests. We're allocating memory, so
 859  * prevent a DoS.
 860  */
 861
 862 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 863 {
 864         int count = 0;
 865         for (; list != NULL; list = list->next) {
 866
 867                 if (list->mid == mid) {
 868                         return NT_STATUS_INVALID_PARAMETER;
 869                 }
 870
 871                 count += 1;
 872         }
 873         if (count > 5) {
 874                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 875         }
 876
 877         return NT_STATUS_OK;
 878 }
 879
 880 /*
 881 These flags determine some of the permissions required to do an operation
 882
 883 Note that I don't set NEED_WRITE on some write operations because they
 884 are used by some brain-dead clients when printing, and I don't want to
 885 force write permissions on print services.
 886 */
 887 #define AS_USER (1<<0)
 888 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 889 #define TIME_INIT (1<<2)
 890 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 891 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 892 #define DO_CHDIR (1<<6)
 893
 894 /*
 895    define a list of possible SMB messages and their corresponding
 896    functions. Any message that has a NULL function is unimplemented -
 897    please feel free to contribute implementations!
 898 */
 899 static const struct smb_message_struct {
 900         const char *name;
 901         void (*fn)(struct smb_request *req);
 902         int flags;
 903 } smb_messages[256] = {
 904
 905 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 906 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 907 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 908 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 909 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 910 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 911 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 912 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 913 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 914 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 915 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 916 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 917 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 918 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 919 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 920 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 921 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 922 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 923 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 924 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 925 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 926 /* 0x15 */ { NULL, NULL, 0 },
 927 /* 0x16 */ { NULL, NULL, 0 },
 928 /* 0x17 */ { NULL, NULL, 0 },
 929 /* 0x18 */ { NULL, NULL, 0 },
 930 /* 0x19 */ { NULL, NULL, 0 },
 931 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 932 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 933 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
 934 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 935 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 936 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 937 /* 0x20 */ { "SMBwritec", NULL,0},
 938 /* 0x21 */ { NULL, NULL, 0 },
 939 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 940 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 941 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 942 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 943 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 944 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 945 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
 946 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 947 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
 948 /* 0x2b */ { "SMBecho",reply_echo,0},
 949 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 950 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 951 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 952 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 953 /* 0x30 */ { NULL, NULL, 0 },
 954 /* 0x31 */ { NULL, NULL, 0 },
 955 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
 956 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
 957 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
 958 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
 959 /* 0x36 */ { NULL, NULL, 0 },
 960 /* 0x37 */ { NULL, NULL, 0 },
 961 /* 0x38 */ { NULL, NULL, 0 },
 962 /* 0x39 */ { NULL, NULL, 0 },
 963 /* 0x3a */ { NULL, NULL, 0 },
 964 /* 0x3b */ { NULL, NULL, 0 },
 965 /* 0x3c */ { NULL, NULL, 0 },
 966 /* 0x3d */ { NULL, NULL, 0 },
 967 /* 0x3e */ { NULL, NULL, 0 },
 968 /* 0x3f */ { NULL, NULL, 0 },
 969 /* 0x40 */ { NULL, NULL, 0 },
 970 /* 0x41 */ { NULL, NULL, 0 },
 971 /* 0x42 */ { NULL, NULL, 0 },
 972 /* 0x43 */ { NULL, NULL, 0 },
 973 /* 0x44 */ { NULL, NULL, 0 },
 974 /* 0x45 */ { NULL, NULL, 0 },
 975 /* 0x46 */ { NULL, NULL, 0 },
 976 /* 0x47 */ { NULL, NULL, 0 },
 977 /* 0x48 */ { NULL, NULL, 0 },
 978 /* 0x49 */ { NULL, NULL, 0 },
 979 /* 0x4a */ { NULL, NULL, 0 },
 980 /* 0x4b */ { NULL, NULL, 0 },
 981 /* 0x4c */ { NULL, NULL, 0 },
 982 /* 0x4d */ { NULL, NULL, 0 },
 983 /* 0x4e */ { NULL, NULL, 0 },
 984 /* 0x4f */ { NULL, NULL, 0 },
 985 /* 0x50 */ { NULL, NULL, 0 },
 986 /* 0x51 */ { NULL, NULL, 0 },
 987 /* 0x52 */ { NULL, NULL, 0 },
 988 /* 0x53 */ { NULL, NULL, 0 },
 989 /* 0x54 */ { NULL, NULL, 0 },
 990 /* 0x55 */ { NULL, NULL, 0 },
 991 /* 0x56 */ { NULL, NULL, 0 },
 992 /* 0x57 */ { NULL, NULL, 0 },
 993 /* 0x58 */ { NULL, NULL, 0 },
 994 /* 0x59 */ { NULL, NULL, 0 },
 995 /* 0x5a */ { NULL, NULL, 0 },
 996 /* 0x5b */ { NULL, NULL, 0 },
 997 /* 0x5c */ { NULL, NULL, 0 },
 998 /* 0x5d */ { NULL, NULL, 0 },
 999 /* 0x5e */ { NULL, NULL, 0 },
1000 /* 0x5f */ { NULL, NULL, 0 },
1001 /* 0x60 */ { NULL, NULL, 0 },
1002 /* 0x61 */ { NULL, NULL, 0 },
1003 /* 0x62 */ { NULL, NULL, 0 },
1004 /* 0x63 */ { NULL, NULL, 0 },
1005 /* 0x64 */ { NULL, NULL, 0 },
1006 /* 0x65 */ { NULL, NULL, 0 },
1007 /* 0x66 */ { NULL, NULL, 0 },
1008 /* 0x67 */ { NULL, NULL, 0 },
1009 /* 0x68 */ { NULL, NULL, 0 },
1010 /* 0x69 */ { NULL, NULL, 0 },
1011 /* 0x6a */ { NULL, NULL, 0 },
1012 /* 0x6b */ { NULL, NULL, 0 },
1013 /* 0x6c */ { NULL, NULL, 0 },
1014 /* 0x6d */ { NULL, NULL, 0 },
1015 /* 0x6e */ { NULL, NULL, 0 },
1016 /* 0x6f */ { NULL, NULL, 0 },
1017 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1018 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1019 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1020 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1021 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1022 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1023 /* 0x76 */ { NULL, NULL, 0 },
1024 /* 0x77 */ { NULL, NULL, 0 },
1025 /* 0x78 */ { NULL, NULL, 0 },
1026 /* 0x79 */ { NULL, NULL, 0 },
1027 /* 0x7a */ { NULL, NULL, 0 },
1028 /* 0x7b */ { NULL, NULL, 0 },
1029 /* 0x7c */ { NULL, NULL, 0 },
1030 /* 0x7d */ { NULL, NULL, 0 },
1031 /* 0x7e */ { NULL, NULL, 0 },
1032 /* 0x7f */ { NULL, NULL, 0 },
1033 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1034 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1035 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1036 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1037 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1038 /* 0x85 */ { NULL, NULL, 0 },
1039 /* 0x86 */ { NULL, NULL, 0 },
1040 /* 0x87 */ { NULL, NULL, 0 },
1041 /* 0x88 */ { NULL, NULL, 0 },
1042 /* 0x89 */ { NULL, NULL, 0 },
1043 /* 0x8a */ { NULL, NULL, 0 },
1044 /* 0x8b */ { NULL, NULL, 0 },
1045 /* 0x8c */ { NULL, NULL, 0 },
1046 /* 0x8d */ { NULL, NULL, 0 },
1047 /* 0x8e */ { NULL, NULL, 0 },
1048 /* 0x8f */ { NULL, NULL, 0 },
1049 /* 0x90 */ { NULL, NULL, 0 },
1050 /* 0x91 */ { NULL, NULL, 0 },
1051 /* 0x92 */ { NULL, NULL, 0 },
1052 /* 0x93 */ { NULL, NULL, 0 },
1053 /* 0x94 */ { NULL, NULL, 0 },
1054 /* 0x95 */ { NULL, NULL, 0 },
1055 /* 0x96 */ { NULL, NULL, 0 },
1056 /* 0x97 */ { NULL, NULL, 0 },
1057 /* 0x98 */ { NULL, NULL, 0 },
1058 /* 0x99 */ { NULL, NULL, 0 },
1059 /* 0x9a */ { NULL, NULL, 0 },
1060 /* 0x9b */ { NULL, NULL, 0 },
1061 /* 0x9c */ { NULL, NULL, 0 },
1062 /* 0x9d */ { NULL, NULL, 0 },
1063 /* 0x9e */ { NULL, NULL, 0 },
1064 /* 0x9f */ { NULL, NULL, 0 },
1065 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1066 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1067 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1068 /* 0xa3 */ { NULL, NULL, 0 },
1069 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1070 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1071 /* 0xa6 */ { NULL, NULL, 0 },
1072 /* 0xa7 */ { NULL, NULL, 0 },
1073 /* 0xa8 */ { NULL, NULL, 0 },
1074 /* 0xa9 */ { NULL, NULL, 0 },
1075 /* 0xaa */ { NULL, NULL, 0 },
1076 /* 0xab */ { NULL, NULL, 0 },
1077 /* 0xac */ { NULL, NULL, 0 },
1078 /* 0xad */ { NULL, NULL, 0 },
1079 /* 0xae */ { NULL, NULL, 0 },
1080 /* 0xaf */ { NULL, NULL, 0 },
1081 /* 0xb0 */ { NULL, NULL, 0 },
1082 /* 0xb1 */ { NULL, NULL, 0 },
1083 /* 0xb2 */ { NULL, NULL, 0 },
1084 /* 0xb3 */ { NULL, NULL, 0 },
1085 /* 0xb4 */ { NULL, NULL, 0 },
1086 /* 0xb5 */ { NULL, NULL, 0 },
1087 /* 0xb6 */ { NULL, NULL, 0 },
1088 /* 0xb7 */ { NULL, NULL, 0 },
1089 /* 0xb8 */ { NULL, NULL, 0 },
1090 /* 0xb9 */ { NULL, NULL, 0 },
1091 /* 0xba */ { NULL, NULL, 0 },
1092 /* 0xbb */ { NULL, NULL, 0 },
1093 /* 0xbc */ { NULL, NULL, 0 },
1094 /* 0xbd */ { NULL, NULL, 0 },
1095 /* 0xbe */ { NULL, NULL, 0 },
1096 /* 0xbf */ { NULL, NULL, 0 },
1097 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1098 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1099 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1100 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1101 /* 0xc4 */ { NULL, NULL, 0 },
1102 /* 0xc5 */ { NULL, NULL, 0 },
1103 /* 0xc6 */ { NULL, NULL, 0 },
1104 /* 0xc7 */ { NULL, NULL, 0 },
1105 /* 0xc8 */ { NULL, NULL, 0 },
1106 /* 0xc9 */ { NULL, NULL, 0 },
1107 /* 0xca */ { NULL, NULL, 0 },
1108 /* 0xcb */ { NULL, NULL, 0 },
1109 /* 0xcc */ { NULL, NULL, 0 },
1110 /* 0xcd */ { NULL, NULL, 0 },
1111 /* 0xce */ { NULL, NULL, 0 },
1112 /* 0xcf */ { NULL, NULL, 0 },
1113 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1114 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1115 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1116 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1117 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1118 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1119 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1120 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1121 /* 0xd8 */ { NULL, NULL, 0 },
1122 /* 0xd9 */ { NULL, NULL, 0 },
1123 /* 0xda */ { NULL, NULL, 0 },
1124 /* 0xdb */ { NULL, NULL, 0 },
1125 /* 0xdc */ { NULL, NULL, 0 },
1126 /* 0xdd */ { NULL, NULL, 0 },
1127 /* 0xde */ { NULL, NULL, 0 },
1128 /* 0xdf */ { NULL, NULL, 0 },
1129 /* 0xe0 */ { NULL, NULL, 0 },
1130 /* 0xe1 */ { NULL, NULL, 0 },
1131 /* 0xe2 */ { NULL, NULL, 0 },
1132 /* 0xe3 */ { NULL, NULL, 0 },
1133 /* 0xe4 */ { NULL, NULL, 0 },
1134 /* 0xe5 */ { NULL, NULL, 0 },
1135 /* 0xe6 */ { NULL, NULL, 0 },
1136 /* 0xe7 */ { NULL, NULL, 0 },
1137 /* 0xe8 */ { NULL, NULL, 0 },
1138 /* 0xe9 */ { NULL, NULL, 0 },
1139 /* 0xea */ { NULL, NULL, 0 },
1140 /* 0xeb */ { NULL, NULL, 0 },
1141 /* 0xec */ { NULL, NULL, 0 },
1142 /* 0xed */ { NULL, NULL, 0 },
1143 /* 0xee */ { NULL, NULL, 0 },
1144 /* 0xef */ { NULL, NULL, 0 },
1145 /* 0xf0 */ { NULL, NULL, 0 },
1146 /* 0xf1 */ { NULL, NULL, 0 },
1147 /* 0xf2 */ { NULL, NULL, 0 },
1148 /* 0xf3 */ { NULL, NULL, 0 },
1149 /* 0xf4 */ { NULL, NULL, 0 },
1150 /* 0xf5 */ { NULL, NULL, 0 },
1151 /* 0xf6 */ { NULL, NULL, 0 },
1152 /* 0xf7 */ { NULL, NULL, 0 },
1153 /* 0xf8 */ { NULL, NULL, 0 },
1154 /* 0xf9 */ { NULL, NULL, 0 },
1155 /* 0xfa */ { NULL, NULL, 0 },
1156 /* 0xfb */ { NULL, NULL, 0 },
1157 /* 0xfc */ { NULL, NULL, 0 },
1158 /* 0xfd */ { NULL, NULL, 0 },
1159 /* 0xfe */ { NULL, NULL, 0 },
1160 /* 0xff */ { NULL, NULL, 0 }
1161
1162 };
1163
1164 /*******************************************************************
1165  allocate and initialize a reply packet
1166 ********************************************************************/
1167
1168 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1169                           const char *inbuf, char **outbuf, uint8_t num_words,
1170                           uint32_t num_bytes)
1171 {
1172         /*
1173          * Protect against integer wrap
1174          */
1175         if ((num_bytes > 0xffffff)
1176             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1177                 char *msg;
1178                 if (asprintf(&msg, "num_bytes too large: %u",
1179                              (unsigned)num_bytes) == -1) {
1180                         msg = CONST_DISCARD(char *, "num_bytes too large");
1181                 }
1182                 smb_panic(msg);
1183         }
1184
1185         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1186                                smb_size + num_words*2 + num_bytes);
1187         if (*outbuf == NULL) {
1188                 return false;
1189         }
1190
1191         construct_reply_common(req, inbuf, *outbuf);
1192         srv_set_message(*outbuf, num_words, num_bytes, false);
1193         /*
1194          * Zero out the word area, the caller has to take care of the bcc area
1195          * himself
1196          */
1197         if (num_words != 0) {
1198                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1199         }
1200
1201         return true;
1202 }
1203
1204 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1205 {
1206         char *outbuf;
1207         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1208                            num_bytes)) {
1209                 smb_panic("could not allocate output buffer\n");
1210         }
1211         req->outbuf = (uint8_t *)outbuf;
1212 }
1213
1214
1215 /*******************************************************************
1216  Dump a packet to a file.
1217 ********************************************************************/
1218
1219 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1220 {
1221         int fd, i;
1222         char *fname = NULL;
1223         if (DEBUGLEVEL < 50) {
1224                 return;
1225         }
1226
1227         if (len < 4) len = smb_len(data)+4;
1228         for (i=1;i<100;i++) {
1229                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1230                              type ? "req" : "resp") == -1) {
1231                         return;
1232                 }
1233                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1234                 if (fd != -1 || errno != EEXIST) break;
1235         }
1236         if (fd != -1) {
1237                 ssize_t ret = write(fd, data, len);
1238                 if (ret != len)
1239                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1240                 close(fd);
1241                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1242         }
1243         SAFE_FREE(fname);
1244 }
1245
1246 /****************************************************************************
1247  Prepare everything for calling the actual request function, and potentially
1248  call the request function via the "new" interface.
1249
1250  Return False if the "legacy" function needs to be called, everything is
1251  prepared.
1252
1253  Return True if we're done.
1254
1255  I know this API sucks, but it is the one with the least code change I could
1256  find.
1257 ****************************************************************************/
1258
1259 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1260 {
1261         int flags;
1262         uint16 session_tag;
1263         connection_struct *conn = NULL;
1264
1265         errno = 0;
1266
1267         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1268          * so subtract 4 from it. */
1269         if (!valid_smb_header(req->inbuf)
1270             || (size < (smb_size - 4))) {
1271                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1272                          smb_len(req->inbuf)));
1273                 exit_server_cleanly("Non-SMB packet");
1274         }
1275
1276         if (smb_messages[type].fn == NULL) {
1277                 DEBUG(0,("Unknown message type %d!\n",type));
1278                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1279                 reply_unknown_new(req, type);
1280                 return NULL;
1281         }
1282
1283         flags = smb_messages[type].flags;
1284
1285         /* In share mode security we must ignore the vuid. */
1286         session_tag = (lp_security() == SEC_SHARE)
1287                 ? UID_FIELD_INVALID : req->vuid;
1288         conn = req->conn;
1289
1290         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1291                  (int)sys_getpid(), (unsigned long)conn));
1292
1293         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1294
1295         /* Ensure this value is replaced in the incoming packet. */
1296         SSVAL(req->inbuf,smb_uid,session_tag);
1297
1298         /*
1299          * Ensure the correct username is in current_user_info.  This is a
1300          * really ugly bugfix for problems with multiple session_setup_and_X's
1301          * being done and allowing %U and %G substitutions to work correctly.
1302          * There is a reason this code is done here, don't move it unless you
1303          * know what you're doing... :-).
1304          * JRA.
1305          */
1306
1307         if (session_tag != last_session_tag) {
1308                 user_struct *vuser = NULL;
1309
1310                 last_session_tag = session_tag;
1311                 if(session_tag != UID_FIELD_INVALID) {
1312                         vuser = get_valid_user_struct(session_tag);
1313                         if (vuser) {
1314                                 set_current_user_info(
1315                                         vuser->server_info->sanitized_username,
1316                                         vuser->server_info->unix_name,
1317                                         pdb_get_domain(vuser->server_info
1318                                                        ->sam_account));
1319                         }
1320                 }
1321         }
1322
1323         /* Does this call need to be run as the connected user? */
1324         if (flags & AS_USER) {
1325
1326                 /* Does this call need a valid tree connection? */
1327                 if (!conn) {
1328                         /*
1329                          * Amazingly, the error code depends on the command
1330                          * (from Samba4).
1331                          */
1332                         if (type == SMBntcreateX) {
1333                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1334                         } else {
1335                                 reply_doserror(req, ERRSRV, ERRinvnid);
1336                         }
1337                         return NULL;
1338                 }
1339
1340                 if (!change_to_user(conn,session_tag)) {
1341                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1342                         return conn;
1343                 }
1344
1345                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1346
1347                 /* Does it need write permission? */
1348                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1349                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1350                         return conn;
1351                 }
1352
1353                 /* IPC services are limited */
1354                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1355                         reply_doserror(req, ERRSRV,ERRaccess);
1356                         return conn;
1357                 }
1358         } else {
1359                 /* This call needs to be run as root */
1360                 change_to_root_user();
1361         }
1362
1363         /* load service specific parameters */
1364         if (conn) {
1365                 if (req->encrypted) {
1366                         conn->encrypted_tid = true;
1367                         /* encrypted required from now on. */
1368                         conn->encrypt_level = Required;
1369                 } else if (ENCRYPTION_REQUIRED(conn)) {
1370                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1371                                 exit_server_cleanly("encryption required "
1372                                         "on connection");
1373                                 return conn;
1374                         }
1375                 }
1376
1377                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1378                                          (flags & (AS_USER|DO_CHDIR)
1379                                           ?True:False))) {
1380                         reply_doserror(req, ERRSRV, ERRaccess);
1381                         return conn;
1382                 }
1383                 conn->num_smb_operations++;
1384         }
1385
1386         /* does this protocol need to be run as guest? */
1387         if ((flags & AS_GUEST)
1388             && (!change_to_guest() ||
1389                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1390                               lp_hostsdeny(-1)))) {
1391                 reply_doserror(req, ERRSRV, ERRaccess);
1392                 return conn;
1393         }
1394
1395         smb_messages[type].fn(req);
1396         return req->conn;
1397 }
1398
1399 /****************************************************************************
1400  Construct a reply to the incoming packet.
1401 ****************************************************************************/
1402
1403 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1404                             uint32_t seqnum, bool encrypted,
1405                             struct smb_perfcount_data *deferred_pcd)
1406 {
1407         connection_struct *conn;
1408         struct smb_request *req;
1409
1410         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1411                 smb_panic("could not allocate smb_request");
1412         }
1413
1414         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1415         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1416         req->seqnum = seqnum;
1417
1418         /* we popped this message off the queue - keep original perf data */
1419         if (deferred_pcd)
1420                 req->pcd = *deferred_pcd;
1421         else {
1422                 SMB_PERFCOUNT_START(&req->pcd);
1423                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1424                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1425         }
1426
1427         conn = switch_message(req->cmd, req, size);
1428
1429         if (req->unread_bytes) {
1430                 /* writeX failed. drain socket. */
1431                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1432                                 req->unread_bytes) {
1433                         smb_panic("failed to drain pending bytes");
1434                 }
1435                 req->unread_bytes = 0;
1436         }
1437
1438         if (req->done) {
1439                 TALLOC_FREE(req);
1440                 return;
1441         }
1442
1443         if (req->outbuf == NULL) {
1444                 return;
1445         }
1446
1447         if (CVAL(req->outbuf,0) == 0) {
1448                 show_msg((char *)req->outbuf);
1449         }
1450
1451         if (!srv_send_smb(smbd_server_fd(),
1452                         (char *)req->outbuf,
1453                         true, req->seqnum+1,
1454                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1455                         &req->pcd)) {
1456                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1457         }
1458
1459         TALLOC_FREE(req);
1460
1461         return;
1462 }
1463
1464 /****************************************************************************
1465  Process an smb from the client
1466 ****************************************************************************/
1467 static void process_smb(struct smbd_server_connection *conn,
1468                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1469                         uint32_t seqnum, bool encrypted,
1470                         struct smb_perfcount_data *deferred_pcd)
1471 {
1472         int msg_type = CVAL(inbuf,0);
1473
1474         DO_PROFILE_INC(smb_count);
1475
1476         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1477                     smb_len(inbuf) ) );
1478         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1479                                 (int)nread,
1480                                 (unsigned int)unread_bytes ));
1481
1482         if (msg_type != 0) {
1483                 /*
1484                  * NetBIOS session request, keepalive, etc.
1485                  */
1486                 reply_special((char *)inbuf);
1487                 goto done;
1488         }
1489
1490         show_msg((char *)inbuf);
1491
1492         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1493         trans_num++;
1494
1495 done:
1496         conn->num_requests++;
1497
1498         /* The timeout_processing function isn't run nearly
1499            often enough to implement 'max log size' without
1500            overrunning the size of the file by many megabytes.
1501            This is especially true if we are running at debug
1502            level 10.  Checking every 50 SMBs is a nice
1503            tradeoff of performance vs log file size overrun. */
1504
1505         if ((conn->num_requests % 50) == 0 &&
1506             need_to_check_log_size()) {
1507                 change_to_root_user();
1508                 check_log_size();
1509         }
1510 }
1511
1512 /****************************************************************************
1513  Return a string containing the function name of a SMB command.
1514 ****************************************************************************/
1515
1516 const char *smb_fn_name(int type)
1517 {
1518         const char *unknown_name = "SMBunknown";
1519
1520         if (smb_messages[type].name == NULL)
1521                 return(unknown_name);
1522
1523         return(smb_messages[type].name);
1524 }
1525
1526 /****************************************************************************
1527  Helper functions for contruct_reply.
1528 ****************************************************************************/
1529
1530 void add_to_common_flags2(uint32 v)
1531 {
1532         common_flags2 |= v;
1533 }
1534
1535 void remove_from_common_flags2(uint32 v)
1536 {
1537         common_flags2 &= ~v;
1538 }
1539
1540 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1541                                    char *outbuf)
1542 {
1543         srv_set_message(outbuf,0,0,false);
1544
1545         SCVAL(outbuf, smb_com, req->cmd);
1546         SIVAL(outbuf,smb_rcls,0);
1547         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1548         SSVAL(outbuf,smb_flg2,
1549                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1550                 common_flags2);
1551         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1552
1553         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1554         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1555         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1556         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1557 }
1558
1559 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1560 {
1561         construct_reply_common(req, (char *)req->inbuf, outbuf);
1562 }
1563
1564 /*
1565  * How many bytes have we already accumulated up to the current wct field
1566  * offset?
1567  */
1568
1569 size_t req_wct_ofs(struct smb_request *req)
1570 {
1571         size_t buf_size;
1572
1573         if (req->chain_outbuf == NULL) {
1574                 return smb_wct - 4;
1575         }
1576         buf_size = talloc_get_size(req->chain_outbuf);
1577         if ((buf_size % 4) != 0) {
1578                 buf_size += (4 - (buf_size % 4));
1579         }
1580         return buf_size - 4;
1581 }
1582
1583 /*
1584  * Hack around reply_nterror & friends not being aware of chained requests,
1585  * generating illegal (i.e. wct==0) chain replies.
1586  */
1587
1588 static void fixup_chain_error_packet(struct smb_request *req)
1589 {
1590         uint8_t *outbuf = req->outbuf;
1591         req->outbuf = NULL;
1592         reply_outbuf(req, 2, 0);
1593         memcpy(req->outbuf, outbuf, smb_wct);
1594         TALLOC_FREE(outbuf);
1595         SCVAL(req->outbuf, smb_vwv0, 0xff);
1596 }
1597
1598 /****************************************************************************
1599  Construct a chained reply and add it to the already made reply
1600 ****************************************************************************/
1601
1602 void chain_reply(struct smb_request *req)
1603 {
1604         size_t smblen = smb_len(req->inbuf);
1605         size_t already_used, length_needed;
1606         uint8_t chain_cmd;
1607         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1608
1609         uint8_t wct;
1610         uint16_t *vwv;
1611         uint16_t buflen;
1612         uint8_t *buf;
1613
1614         if (IVAL(req->outbuf, smb_rcls) != 0) {
1615                 fixup_chain_error_packet(req);
1616         }
1617
1618         /*
1619          * Any of the AndX requests and replies have at least a wct of
1620          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1621          * beginning of the SMB header to the next wct field.
1622          *
1623          * None of the AndX requests put anything valuable in vwv[0] and [1],
1624          * so we can overwrite it here to form the chain.
1625          */
1626
1627         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1628                 goto error;
1629         }
1630
1631         /*
1632          * Here we assume that this is the end of the chain. For that we need
1633          * to set "next command" to 0xff and the offset to 0. If we later find
1634          * more commands in the chain, this will be overwritten again.
1635          */
1636
1637         SCVAL(req->outbuf, smb_vwv0, 0xff);
1638         SCVAL(req->outbuf, smb_vwv0+1, 0);
1639         SSVAL(req->outbuf, smb_vwv1, 0);
1640
1641         if (req->chain_outbuf == NULL) {
1642                 /*
1643                  * In req->chain_outbuf we collect all the replies. Start the
1644                  * chain by copying in the first reply.
1645                  *
1646                  * We do the realloc because later on we depend on
1647                  * talloc_get_size to determine the length of
1648                  * chain_outbuf. The reply_xxx routines might have
1649                  * over-allocated (reply_pipe_read_and_X used to be such an
1650                  * example).
1651                  */
1652                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1653                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1654                 if (req->chain_outbuf == NULL) {
1655                         goto error;
1656                 }
1657                 req->outbuf = NULL;
1658         } else {
1659                 /*
1660                  * Update smb headers where subsequent chained commands
1661                  * may have updated them.
1662                  */
1663                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
1664                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
1665
1666                 if (!smb_splice_chain(&req->chain_outbuf,
1667                                       CVAL(req->outbuf, smb_com),
1668                                       CVAL(req->outbuf, smb_wct),
1669                                       (uint16_t *)(req->outbuf + smb_vwv),
1670                                       0, smb_buflen(req->outbuf),
1671                                       (uint8_t *)smb_buf(req->outbuf))) {
1672                         goto error;
1673                 }
1674                 TALLOC_FREE(req->outbuf);
1675         }
1676
1677         /*
1678          * We use the old request's vwv field to grab the next chained command
1679          * and offset into the chained fields.
1680          */
1681
1682         chain_cmd = CVAL(req->vwv+0, 0);
1683         chain_offset = SVAL(req->vwv+1, 0);
1684
1685         if (chain_cmd == 0xff) {
1686                 /*
1687                  * End of chain, no more requests from the client. So ship the
1688                  * replies.
1689                  */
1690                 smb_setlen((char *)(req->chain_outbuf),
1691                            talloc_get_size(req->chain_outbuf) - 4);
1692
1693                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1694                                   true, req->seqnum+1,
1695                                   IS_CONN_ENCRYPTED(req->conn)
1696                                   ||req->encrypted,
1697                                   &req->pcd)) {
1698                         exit_server_cleanly("chain_reply: srv_send_smb "
1699                                             "failed.");
1700                 }
1701                 TALLOC_FREE(req->chain_outbuf);
1702                 req->done = true;
1703                 return;
1704         }
1705
1706         /* add a new perfcounter for this element of chain */
1707         SMB_PERFCOUNT_ADD(&req->pcd);
1708         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
1709         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
1710
1711         /*
1712          * Check if the client tries to fool us. The request so far uses the
1713          * space to the end of the byte buffer in the request just
1714          * processed. The chain_offset can't point into that area. If that was
1715          * the case, we could end up with an endless processing of the chain,
1716          * we would always handle the same request.
1717          */
1718
1719         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1720         if (chain_offset < already_used) {
1721                 goto error;
1722         }
1723
1724         /*
1725          * Next check: Make sure the chain offset does not point beyond the
1726          * overall smb request length.
1727          */
1728
1729         length_needed = chain_offset+1; /* wct */
1730         if (length_needed > smblen) {
1731                 goto error;
1732         }
1733
1734         /*
1735          * Now comes the pointer magic. Goal here is to set up req->vwv and
1736          * req->buf correctly again to be able to call the subsequent
1737          * switch_message(). The chain offset (the former vwv[1]) points at
1738          * the new wct field.
1739          */
1740
1741         wct = CVAL(smb_base(req->inbuf), chain_offset);
1742
1743         /*
1744          * Next consistency check: Make the new vwv array fits in the overall
1745          * smb request.
1746          */
1747
1748         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1749         if (length_needed > smblen) {
1750                 goto error;
1751         }
1752         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1753
1754         /*
1755          * Now grab the new byte buffer....
1756          */
1757
1758         buflen = SVAL(vwv+wct, 0);
1759
1760         /*
1761          * .. and check that it fits.
1762          */
1763
1764         length_needed += buflen;
1765         if (length_needed > smblen) {
1766                 goto error;
1767         }
1768         buf = (uint8_t *)(vwv+wct+1);
1769
1770         req->cmd = chain_cmd;
1771         req->wct = wct;
1772         req->vwv = vwv;
1773         req->buflen = buflen;
1774         req->buf = buf;
1775
1776         switch_message(chain_cmd, req, smblen);
1777
1778         if (req->outbuf == NULL) {
1779                 /*
1780                  * This happens if the chained command has suspended itself or
1781                  * if it has called srv_send_smb() itself.
1782                  */
1783                 return;
1784         }
1785
1786         /*
1787          * We end up here if the chained command was not itself chained or
1788          * suspended, but for example a close() command. We now need to splice
1789          * the chained commands' outbuf into the already built up chain_outbuf
1790          * and ship the result.
1791          */
1792         goto done;
1793
1794  error:
1795         /*
1796          * We end up here if there's any error in the chain syntax. Report a
1797          * DOS error, just like Windows does.
1798          */
1799         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
1800         fixup_chain_error_packet(req);
1801
1802  done:
1803         if (!smb_splice_chain(&req->chain_outbuf,
1804                               CVAL(req->outbuf, smb_com),
1805                               CVAL(req->outbuf, smb_wct),
1806                               (uint16_t *)(req->outbuf + smb_vwv),
1807                               0, smb_buflen(req->outbuf),
1808                               (uint8_t *)smb_buf(req->outbuf))) {
1809                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
1810         }
1811         TALLOC_FREE(req->outbuf);
1812
1813         smb_setlen((char *)(req->chain_outbuf),
1814                    talloc_get_size(req->chain_outbuf) - 4);
1815
1816         show_msg((char *)(req->chain_outbuf));
1817
1818         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1819                           true, req->seqnum+1,
1820                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
1821                           &req->pcd)) {
1822                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1823         }
1824         TALLOC_FREE(req->chain_outbuf);
1825         req->done = true;
1826 }
1827
1828 /****************************************************************************
1829  Check if services need reloading.
1830 ****************************************************************************/
1831
1832 void check_reload(time_t t)
1833 {
1834         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1835
1836         if(last_smb_conf_reload_time == 0) {
1837                 last_smb_conf_reload_time = t;
1838                 /* Our printing subsystem might not be ready at smbd start up.
1839                    Then no printer is available till the first printers check
1840                    is performed.  A lower initial interval circumvents this. */
1841                 if ( printcap_cache_time > 60 )
1842                         last_printer_reload_time = t - printcap_cache_time + 60;
1843                 else
1844                         last_printer_reload_time = t;
1845         }
1846
1847         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1848                 /* randomize over 60 second the printcap reload to avoid all
1849                  * process hitting cupsd at the same time */
1850                 int time_range = 60;
1851
1852                 last_printer_reload_time += random() % time_range;
1853                 mypid = getpid();
1854         }
1855
1856         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
1857                 reload_services(True);
1858                 last_smb_conf_reload_time = t;
1859         }
1860
1861         /* 'printcap cache time = 0' disable the feature */
1862
1863         if ( printcap_cache_time != 0 )
1864         {
1865                 /* see if it's time to reload or if the clock has been set back */
1866
1867                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1868                         || (t-last_printer_reload_time  < 0) )
1869                 {
1870                         DEBUG( 3,( "Printcap cache time expired.\n"));
1871                         reload_printers();
1872                         last_printer_reload_time = t;
1873                 }
1874         }
1875 }
1876
1877 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
1878 {
1879         /* TODO: make write nonblocking */
1880 }
1881
1882 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
1883 {
1884         uint8_t *inbuf = NULL;
1885         size_t inbuf_len = 0;
1886         size_t unread_bytes = 0;
1887         bool encrypted = false;
1888         TALLOC_CTX *mem_ctx = talloc_tos();
1889         NTSTATUS status;
1890         uint32_t seqnum;
1891
1892         /* TODO: make this completely nonblocking */
1893
1894         status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
1895                                     (char **)(void *)&inbuf,
1896                                     0, /* timeout */
1897                                     &unread_bytes,
1898                                     &encrypted,
1899                                     &inbuf_len, &seqnum);
1900         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1901                 goto process;
1902         }
1903         if (NT_STATUS_IS_ERR(status)) {
1904                 exit_server_cleanly("failed to receive smb request");
1905         }
1906         if (!NT_STATUS_IS_OK(status)) {
1907                 return;
1908         }
1909
1910 process:
1911         process_smb(conn, inbuf, inbuf_len, unread_bytes,
1912                     seqnum, encrypted, NULL);
1913 }
1914
1915 static void smbd_server_connection_handler(struct event_context *ev,
1916                                            struct fd_event *fde,
1917                                            uint16_t flags,
1918                                            void *private_data)
1919 {
1920         struct smbd_server_connection *conn = talloc_get_type(private_data,
1921                                               struct smbd_server_connection);
1922
1923         if (flags & EVENT_FD_WRITE) {
1924                 smbd_server_connection_write_handler(conn);
1925         } else if (flags & EVENT_FD_READ) {
1926                 smbd_server_connection_read_handler(conn);
1927         }
1928 }
1929
1930
1931 /****************************************************************************
1932 received when we should release a specific IP
1933 ****************************************************************************/
1934 static void release_ip(const char *ip, void *priv)
1935 {
1936         char addr[INET6_ADDRSTRLEN];
1937         char *p = addr;
1938
1939         client_socket_addr(get_client_fd(),addr,sizeof(addr));
1940
1941         if (strncmp("::ffff:", addr, 7) == 0) {
1942                 p = addr + 7;
1943         }
1944
1945         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
1946                 /* we can't afford to do a clean exit - that involves
1947                    database writes, which would potentially mean we
1948                    are still running after the failover has finished -
1949                    we have to get rid of this process ID straight
1950                    away */
1951                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
1952                         ip));
1953                 /* note we must exit with non-zero status so the unclean handler gets
1954                    called in the parent, so that the brl database is tickled */
1955                 _exit(1);
1956         }
1957 }
1958
1959 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
1960                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
1961 {
1962         release_ip((char *)data->data, NULL);
1963 }
1964
1965 #ifdef CLUSTER_SUPPORT
1966 static int client_get_tcp_info(struct sockaddr_storage *server,
1967                                struct sockaddr_storage *client)
1968 {
1969         socklen_t length;
1970         if (server_fd == -1) {
1971                 return -1;
1972         }
1973         length = sizeof(*server);
1974         if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
1975                 return -1;
1976         }
1977         length = sizeof(*client);
1978         if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
1979                 return -1;
1980         }
1981         return 0;
1982 }
1983 #endif
1984
1985 /*
1986  * Send keepalive packets to our client
1987  */
1988 static bool keepalive_fn(const struct timeval *now, void *private_data)
1989 {
1990         if (!send_keepalive(smbd_server_fd())) {
1991                 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1992                 return False;
1993         }
1994         return True;
1995 }
1996
1997 /*
1998  * Do the recurring check if we're idle
1999  */
2000 static bool deadtime_fn(const struct timeval *now, void *private_data)
2001 {
2002         if ((conn_num_open() == 0)
2003             || (conn_idle_all(now->tv_sec))) {
2004                 DEBUG( 2, ( "Closing idle connection\n" ) );
2005                 messaging_send(smbd_messaging_context(), procid_self(),
2006                                MSG_SHUTDOWN, &data_blob_null);
2007                 return False;
2008         }
2009
2010         return True;
2011 }
2012
2013 /*
2014  * Do the recurring log file and smb.conf reload checks.
2015  */
2016
2017 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2018 {
2019         change_to_root_user();
2020
2021         /* update printer queue caches if necessary */
2022         update_monitored_printq_cache();
2023
2024         /* check if we need to reload services */
2025         check_reload(time(NULL));
2026
2027         /* Change machine password if neccessary. */
2028         attempt_machine_password_change();
2029
2030         /*
2031          * Force a log file check.
2032          */
2033         force_check_log_size();
2034         check_log_size();
2035         return true;
2036 }
2037
2038 /****************************************************************************
2039  Process commands from the client
2040 ****************************************************************************/
2041
2042 void smbd_process(void)
2043 {
2044         TALLOC_CTX *frame = talloc_stackframe();
2045         char remaddr[INET6_ADDRSTRLEN];
2046
2047         smbd_server_conn = talloc_zero(smbd_event_context(), struct smbd_server_connection);
2048         if (!smbd_server_conn) {
2049                 exit_server("failed to create smbd_server_connection");
2050         }
2051
2052         /* Ensure child is set to blocking mode */
2053         set_blocking(smbd_server_fd(),True);
2054
2055         set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2056         set_socket_options(smbd_server_fd(), lp_socket_options());
2057
2058         /* this is needed so that we get decent entries
2059            in smbstatus for port 445 connects */
2060         set_remote_machine_name(get_peer_addr(smbd_server_fd(),
2061                                               remaddr,
2062                                               sizeof(remaddr)),
2063                                               false);
2064         reload_services(true);
2065
2066         /*
2067          * Before the first packet, check the global hosts allow/ hosts deny
2068          * parameters before doing any parsing of packets passed to us by the
2069          * client. This prevents attacks on our parsing code from hosts not in
2070          * the hosts allow list.
2071          */
2072
2073         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2074                           lp_hostsdeny(-1))) {
2075                 char addr[INET6_ADDRSTRLEN];
2076
2077                 /*
2078                  * send a negative session response "not listening on calling
2079                  * name"
2080                  */
2081                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2082                 DEBUG( 1, ("Connection denied from %s\n",
2083                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
2084                 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2085                                    0, false, NULL);
2086                 exit_server_cleanly("connection denied");
2087         }
2088
2089         static_init_rpc;
2090
2091         init_modules();
2092
2093         smb_perfcount_init();
2094
2095         if (!init_account_policy()) {
2096                 exit_server("Could not open account policy tdb.\n");
2097         }
2098
2099         if (*lp_rootdir()) {
2100                 if (chroot(lp_rootdir()) != 0) {
2101                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2102                         exit_server("Failed to chroot()");
2103                 }
2104                 if (chdir("/") == -1) {
2105                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2106                         exit_server("Failed to chroot()");
2107                 }
2108                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2109         }
2110
2111         if (!srv_init_signing(smbd_server_conn)) {
2112                 exit_server("Failed to init smb_signing");
2113         }
2114
2115         /* Setup oplocks */
2116         if (!init_oplocks(smbd_messaging_context()))
2117                 exit_server("Failed to init oplocks");
2118
2119         /* Setup aio signal handler. */
2120         initialize_async_io_handler();
2121
2122         /* register our message handlers */
2123         messaging_register(smbd_messaging_context(), NULL,
2124                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
2125         messaging_register(smbd_messaging_context(), NULL,
2126                            MSG_SMB_RELEASE_IP, msg_release_ip);
2127         messaging_register(smbd_messaging_context(), NULL,
2128                            MSG_SMB_CLOSE_FILE, msg_close_file);
2129
2130         if ((lp_keepalive() != 0)
2131             && !(event_add_idle(smbd_event_context(), NULL,
2132                                 timeval_set(lp_keepalive(), 0),
2133                                 "keepalive", keepalive_fn,
2134                                 NULL))) {
2135                 DEBUG(0, ("Could not add keepalive event\n"));
2136                 exit(1);
2137         }
2138
2139         if (!(event_add_idle(smbd_event_context(), NULL,
2140                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
2141                              "deadtime", deadtime_fn, NULL))) {
2142                 DEBUG(0, ("Could not add deadtime event\n"));
2143                 exit(1);
2144         }
2145
2146         if (!(event_add_idle(smbd_event_context(), NULL,
2147                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
2148                              "housekeeping", housekeeping_fn, NULL))) {
2149                 DEBUG(0, ("Could not add housekeeping event\n"));
2150                 exit(1);
2151         }
2152
2153 #ifdef CLUSTER_SUPPORT
2154
2155         if (lp_clustering()) {
2156                 /*
2157                  * We need to tell ctdb about our client's TCP
2158                  * connection, so that for failover ctdbd can send
2159                  * tickle acks, triggering a reconnection by the
2160                  * client.
2161                  */
2162
2163                 struct sockaddr_storage srv, clnt;
2164
2165                 if (client_get_tcp_info(&srv, &clnt) == 0) {
2166
2167                         NTSTATUS status;
2168
2169                         status = ctdbd_register_ips(
2170                                 messaging_ctdbd_connection(),
2171                                 &srv, &clnt, release_ip, NULL);
2172
2173                         if (!NT_STATUS_IS_OK(status)) {
2174                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
2175                                           nt_errstr(status)));
2176                         }
2177                 } else
2178                 {
2179                         DEBUG(0,("Unable to get tcp info for "
2180                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
2181                                  strerror(errno)));
2182                 }
2183         }
2184
2185 #endif
2186
2187         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2188
2189         smbd_server_conn->fde = event_add_fd(smbd_event_context(),
2190                                              smbd_server_conn,
2191                                              smbd_server_fd(),
2192                                              EVENT_FD_READ,
2193                                              smbd_server_connection_handler,
2194                                              smbd_server_conn);
2195         if (!smbd_server_conn->fde) {
2196                 exit_server("failed to create smbd_server_connection fde");
2197         }
2198
2199         TALLOC_FREE(frame);
2200
2201         while (True) {
2202                 NTSTATUS status;
2203
2204                 frame = talloc_stackframe_pool(8192);
2205
2206                 errno = 0;
2207
2208                 status = smbd_server_connection_loop_once(smbd_server_conn);
2209                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
2210                     !NT_STATUS_IS_OK(status)) {
2211                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2212                                   " exiting\n", nt_errstr(status)));
2213                         break;
2214                 }
2215
2216                 TALLOC_FREE(frame);
2217         }
2218
2219         exit_server_cleanly(NULL);
2220 }
2221
2222 bool req_is_in_chain(struct smb_request *req)
2223 {
2224         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
2225                 /*
2226                  * We're right now handling a subsequent request, so we must
2227                  * be in a chain
2228                  */
2229                 return true;
2230         }
2231
2232         if (!is_andx_req(req->cmd)) {
2233                 return false;
2234         }
2235
2236         if (req->wct < 2) {
2237                 /*
2238                  * Okay, an illegal request, but definitely not chained :-)
2239                  */
2240                 return false;
2241         }
2242
2243         return (CVAL(req->vwv+0, 0) != 0xFF);
2244 }