source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 /*
  24  * Size of data we can send to client. Set
  25  *  by the client for all protocols above CORE.
  26  *  Set by us for CORE protocol.
  27  */
  28 int max_send = BUFFER_SIZE;
  29 /*
  30  * Size of the data we can receive. Set by us.
  31  * Can be modified by the max xmit parameter.
  32  */
  33 int max_recv = BUFFER_SIZE;
  34
  35 SIG_ATOMIC_T reload_after_sighup = 0;
  36 SIG_ATOMIC_T got_sig_term = 0;
  37 extern bool global_machine_password_needs_changing;
  38 extern int max_send;
  39
  40 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  41                                    char *outbuf);
  42
  43 /* Accessor function for smb_read_error for smbd functions. */
  44
  45 /****************************************************************************
  46  Send an smb to a fd.
  47 ****************************************************************************/
  48
  49 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  50 {
  51         size_t len;
  52         size_t nwritten=0;
  53         ssize_t ret;
  54         char *buf_out = buffer;
  55
  56         /* Sign the outgoing packet if required. */
  57         srv_calculate_sign_mac(buf_out);
  58
  59         if (do_encrypt) {
  60                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  61                 if (!NT_STATUS_IS_OK(status)) {
  62                         DEBUG(0, ("send_smb: SMB encryption failed "
  63                                 "on outgoing packet! Error %s\n",
  64                                 nt_errstr(status) ));
  65                         return false;
  66                 }
  67         }
  68
  69         len = smb_len(buf_out) + 4;
  70
  71         while (nwritten < len) {
  72                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  73                 if (ret <= 0) {
  74                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  75                                 (int)len,(int)ret, strerror(errno) ));
  76                         srv_free_enc_buffer(buf_out);
  77                         return false;
  78                 }
  79                 nwritten += ret;
  80         }
  81
  82         srv_free_enc_buffer(buf_out);
  83         return true;
  84 }
  85
  86 /*******************************************************************
  87  Setup the word count and byte count for a smb message.
  88 ********************************************************************/
  89
  90 int srv_set_message(char *buf,
  91                         int num_words,
  92                         int num_bytes,
  93                         bool zero)
  94 {
  95         if (zero && (num_words || num_bytes)) {
  96                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
  97         }
  98         SCVAL(buf,smb_wct,num_words);
  99         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 100         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 101         return (smb_size + num_words*2 + num_bytes);
 102 }
 103
 104 static bool valid_smb_header(const uint8_t *inbuf)
 105 {
 106         if (is_encrypted_packet(inbuf)) {
 107                 return true;
 108         }
 109         /*
 110          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 111          * but it just looks weird to call strncmp for this one.
 112          */
 113         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 114 }
 115
 116 /* Socket functions for smbd packet processing. */
 117
 118 static bool valid_packet_size(size_t len)
 119 {
 120         /*
 121          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 122          * of header. Don't print the error if this fits.... JRA.
 123          */
 124
 125         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 126                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 127                                         (unsigned long)len));
 128                 return false;
 129         }
 130         return true;
 131 }
 132
 133 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 134                                       unsigned int timeout, ssize_t len)
 135 {
 136         if (len <= 0) {
 137                 return NT_STATUS_OK;
 138         }
 139
 140         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
 141 }
 142
 143 /****************************************************************************
 144  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 145 ****************************************************************************/
 146
 147 /*
 148  * Unfortunately, earlier versions of smbclient/libsmbclient
 149  * don't send this "standard" writeX header. I've fixed this
 150  * for 3.2 but we'll use the old method with earlier versions.
 151  * Windows and CIFSFS at least use this standard size. Not
 152  * sure about MacOSX.
 153  */
 154
 155 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 156                                 (2*14) + /* word count (including bcc) */ \
 157                                 1 /* pad byte */)
 158
 159 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 160                                                     const char lenbuf[4],
 161                                                     int fd, char **buffer,
 162                                                     unsigned int timeout,
 163                                                     size_t *p_unread,
 164                                                     size_t *len_ret)
 165 {
 166         /* Size of a WRITEX call (+4 byte len). */
 167         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 168         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 169         ssize_t toread;
 170         NTSTATUS status;
 171
 172         memcpy(writeX_header, lenbuf, 4);
 173
 174         status = read_socket_with_timeout(
 175                 fd, writeX_header + 4,
 176                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 177                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 178                 timeout, NULL);
 179
 180         if (!NT_STATUS_IS_OK(status)) {
 181                 return status;
 182         }
 183
 184         /*
 185          * Ok - now try and see if this is a possible
 186          * valid writeX call.
 187          */
 188
 189         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 190                 /*
 191                  * If the data offset is beyond what
 192                  * we've read, drain the extra bytes.
 193                  */
 194                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 195                 ssize_t newlen;
 196
 197                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 198                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 199                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 200                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 201                                         " failed to drain pending bytes");
 202                         }
 203                 } else {
 204                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 205                 }
 206
 207                 /* Spoof down the length and null out the bcc. */
 208                 set_message_bcc(writeX_header, 0);
 209                 newlen = smb_len(writeX_header);
 210
 211                 /* Copy the header we've written. */
 212
 213                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 214                                 writeX_header,
 215                                 sizeof(writeX_header));
 216
 217                 if (*buffer == NULL) {
 218                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 219                                   (int)sizeof(writeX_header)));
 220                         return NT_STATUS_NO_MEMORY;
 221                 }
 222
 223                 /* Work out the remaining bytes. */
 224                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 225                 *len_ret = newlen + 4;
 226                 return NT_STATUS_OK;
 227         }
 228
 229         if (!valid_packet_size(len)) {
 230                 return NT_STATUS_INVALID_PARAMETER;
 231         }
 232
 233         /*
 234          * Not a valid writeX call. Just do the standard
 235          * talloc and return.
 236          */
 237
 238         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 239
 240         if (*buffer == NULL) {
 241                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 242                           (int)len+4));
 243                 return NT_STATUS_NO_MEMORY;
 244         }
 245
 246         /* Copy in what we already read. */
 247         memcpy(*buffer,
 248                 writeX_header,
 249                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 250         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 251
 252         if(toread > 0) {
 253                 status = read_packet_remainder(
 254                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 255                         timeout, toread);
 256
 257                 if (!NT_STATUS_IS_OK(status)) {
 258                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 259                                    nt_errstr(status)));
 260                         return status;
 261                 }
 262         }
 263
 264         *len_ret = len + 4;
 265         return NT_STATUS_OK;
 266 }
 267
 268 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 269                                        char **buffer, unsigned int timeout,
 270                                        size_t *p_unread, size_t *plen)
 271 {
 272         char lenbuf[4];
 273         size_t len;
 274         int min_recv_size = lp_min_receive_file_size();
 275         NTSTATUS status;
 276
 277         *p_unread = 0;
 278
 279         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 280         if (!NT_STATUS_IS_OK(status)) {
 281                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 282                 return status;
 283         }
 284
 285         if (CVAL(lenbuf,0) == 0 &&
 286                         min_recv_size &&
 287                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 288                         !srv_is_signing_active()) {
 289
 290                 return receive_smb_raw_talloc_partial_read(
 291                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 292         }
 293
 294         if (!valid_packet_size(len)) {
 295                 return NT_STATUS_INVALID_PARAMETER;
 296         }
 297
 298         /*
 299          * The +4 here can't wrap, we've checked the length above already.
 300          */
 301
 302         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 303
 304         if (*buffer == NULL) {
 305                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 306                           (int)len+4));
 307                 return NT_STATUS_NO_MEMORY;
 308         }
 309
 310         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 311
 312         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 313         if (!NT_STATUS_IS_OK(status)) {
 314                 return status;
 315         }
 316
 317         *plen = len + 4;
 318         return NT_STATUS_OK;
 319 }
 320
 321 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 322                                    char **buffer, unsigned int timeout,
 323                                    size_t *p_unread, bool *p_encrypted,
 324                                    size_t *p_len)
 325 {
 326         size_t len = 0;
 327         NTSTATUS status;
 328
 329         *p_encrypted = false;
 330
 331         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 332                                         p_unread, &len);
 333         if (!NT_STATUS_IS_OK(status)) {
 334                 return status;
 335         }
 336
 337         if (is_encrypted_packet((uint8_t *)*buffer)) {
 338                 status = srv_decrypt_buffer(*buffer);
 339                 if (!NT_STATUS_IS_OK(status)) {
 340                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 341                                 "incoming packet! Error %s\n",
 342                                 nt_errstr(status) ));
 343                         return status;
 344                 }
 345                 *p_encrypted = true;
 346         }
 347
 348         /* Check the incoming SMB signature. */
 349         if (!srv_check_sign_mac(*buffer, true)) {
 350                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 351                           "incoming packet!\n"));
 352                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 353         }
 354
 355         *p_len = len;
 356         return NT_STATUS_OK;
 357 }
 358
 359 /*
 360  * Initialize a struct smb_request from an inbuf
 361  */
 362
 363 void init_smb_request(struct smb_request *req,
 364                         const uint8 *inbuf,
 365                         size_t unread_bytes,
 366                         bool encrypted)
 367 {
 368         size_t req_size = smb_len(inbuf) + 4;
 369         /* Ensure we have at least smb_size bytes. */
 370         if (req_size < smb_size) {
 371                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 372                         (unsigned int)req_size ));
 373                 exit_server_cleanly("Invalid SMB request");
 374         }
 375         req->cmd    = CVAL(inbuf, smb_com);
 376         req->flags2 = SVAL(inbuf, smb_flg2);
 377         req->smbpid = SVAL(inbuf, smb_pid);
 378         req->mid    = SVAL(inbuf, smb_mid);
 379         req->vuid   = SVAL(inbuf, smb_uid);
 380         req->tid    = SVAL(inbuf, smb_tid);
 381         req->wct    = CVAL(inbuf, smb_wct);
 382         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 383         req->buflen = smb_buflen(inbuf);
 384         req->buf    = (const uint8_t *)smb_buf(inbuf);
 385         req->unread_bytes = unread_bytes;
 386         req->encrypted = encrypted;
 387         req->conn = conn_find(req->tid);
 388         req->chain_fsp = NULL;
 389
 390         /* Ensure we have at least wct words and 2 bytes of bcc. */
 391         if (smb_size + req->wct*2 > req_size) {
 392                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 393                         (unsigned int)req->wct,
 394                         (unsigned int)req_size));
 395                 exit_server_cleanly("Invalid SMB request");
 396         }
 397         /* Ensure bcc is correct. */
 398         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 399                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 400                         "(wct = %u, size %u)\n",
 401                         (unsigned int)req->buflen,
 402                         (unsigned int)req->wct,
 403                         (unsigned int)req_size));
 404                 exit_server_cleanly("Invalid SMB request");
 405         }
 406         req->outbuf = NULL;
 407 }
 408
 409 /****************************************************************************
 410  structure to hold a linked list of queued messages.
 411  for processing.
 412 ****************************************************************************/
 413
 414 static struct pending_message_list *deferred_open_queue;
 415
 416 /****************************************************************************
 417  Function to push a message onto the tail of a linked list of smb messages ready
 418  for processing.
 419 ****************************************************************************/
 420
 421 static bool push_queued_message(struct smb_request *req,
 422                                 struct timeval request_time,
 423                                 struct timeval end_time,
 424                                 char *private_data, size_t private_len)
 425 {
 426         int msg_len = smb_len(req->inbuf) + 4;
 427         struct pending_message_list *msg;
 428
 429         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 430
 431         if(msg == NULL) {
 432                 DEBUG(0,("push_message: malloc fail (1)\n"));
 433                 return False;
 434         }
 435
 436         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 437         if(msg->buf.data == NULL) {
 438                 DEBUG(0,("push_message: malloc fail (2)\n"));
 439                 TALLOC_FREE(msg);
 440                 return False;
 441         }
 442
 443         msg->request_time = request_time;
 444         msg->end_time = end_time;
 445         msg->encrypted = req->encrypted;
 446
 447         if (private_data) {
 448                 msg->private_data = data_blob_talloc(msg, private_data,
 449                                                      private_len);
 450                 if (msg->private_data.data == NULL) {
 451                         DEBUG(0,("push_message: malloc fail (3)\n"));
 452                         TALLOC_FREE(msg);
 453                         return False;
 454                 }
 455         }
 456
 457         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 458
 459         DEBUG(10,("push_message: pushed message length %u on "
 460                   "deferred_open_queue\n", (unsigned int)msg_len));
 461
 462         return True;
 463 }
 464
 465 /****************************************************************************
 466  Function to delete a sharing violation open message by mid.
 467 ****************************************************************************/
 468
 469 void remove_deferred_open_smb_message(uint16 mid)
 470 {
 471         struct pending_message_list *pml;
 472
 473         for (pml = deferred_open_queue; pml; pml = pml->next) {
 474                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 475                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 476                                   "deleting mid %u len %u\n",
 477                                   (unsigned int)mid,
 478                                   (unsigned int)pml->buf.length ));
 479                         DLIST_REMOVE(deferred_open_queue, pml);
 480                         TALLOC_FREE(pml);
 481                         return;
 482                 }
 483         }
 484 }
 485
 486 /****************************************************************************
 487  Move a sharing violation open retry message to the front of the list and
 488  schedule it for immediate processing.
 489 ****************************************************************************/
 490
 491 void schedule_deferred_open_smb_message(uint16 mid)
 492 {
 493         struct pending_message_list *pml;
 494         int i = 0;
 495
 496         for (pml = deferred_open_queue; pml; pml = pml->next) {
 497                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 498                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 499                         (unsigned int)msg_mid ));
 500                 if (mid == msg_mid) {
 501                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 502                                 mid ));
 503                         pml->end_time.tv_sec = 0;
 504                         pml->end_time.tv_usec = 0;
 505                         DLIST_PROMOTE(deferred_open_queue, pml);
 506                         return;
 507                 }
 508         }
 509
 510         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 511                 mid ));
 512 }
 513
 514 /****************************************************************************
 515  Return true if this mid is on the deferred queue.
 516 ****************************************************************************/
 517
 518 bool open_was_deferred(uint16 mid)
 519 {
 520         struct pending_message_list *pml;
 521
 522         for (pml = deferred_open_queue; pml; pml = pml->next) {
 523                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 524                         return True;
 525                 }
 526         }
 527         return False;
 528 }
 529
 530 /****************************************************************************
 531  Return the message queued by this mid.
 532 ****************************************************************************/
 533
 534 struct pending_message_list *get_open_deferred_message(uint16 mid)
 535 {
 536         struct pending_message_list *pml;
 537
 538         for (pml = deferred_open_queue; pml; pml = pml->next) {
 539                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 540                         return pml;
 541                 }
 542         }
 543         return NULL;
 544 }
 545
 546 /****************************************************************************
 547  Function to push a deferred open smb message onto a linked list of local smb
 548  messages ready for processing.
 549 ****************************************************************************/
 550
 551 bool push_deferred_smb_message(struct smb_request *req,
 552                                struct timeval request_time,
 553                                struct timeval timeout,
 554                                char *private_data, size_t priv_len)
 555 {
 556         struct timeval end_time;
 557
 558         if (req->unread_bytes) {
 559                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 560                         "unread_bytes = %u\n",
 561                         (unsigned int)req->unread_bytes ));
 562                 smb_panic("push_deferred_smb_message: "
 563                         "logic error unread_bytes != 0" );
 564         }
 565
 566         end_time = timeval_sum(&request_time, &timeout);
 567
 568         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 569                   "timeout time [%u.%06u]\n",
 570                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 571                   (unsigned int)end_time.tv_sec,
 572                   (unsigned int)end_time.tv_usec));
 573
 574         return push_queued_message(req, request_time, end_time,
 575                                    private_data, priv_len);
 576 }
 577
 578 struct idle_event {
 579         struct timed_event *te;
 580         struct timeval interval;
 581         char *name;
 582         bool (*handler)(const struct timeval *now, void *private_data);
 583         void *private_data;
 584 };
 585
 586 static void idle_event_handler(struct event_context *ctx,
 587                                struct timed_event *te,
 588                                const struct timeval *now,
 589                                void *private_data)
 590 {
 591         struct idle_event *event =
 592                 talloc_get_type_abort(private_data, struct idle_event);
 593
 594         TALLOC_FREE(event->te);
 595
 596         if (!event->handler(now, event->private_data)) {
 597                 /* Don't repeat, delete ourselves */
 598                 TALLOC_FREE(event);
 599                 return;
 600         }
 601
 602         event->te = event_add_timed(ctx, event,
 603                                     timeval_sum(now, &event->interval),
 604                                     event->name,
 605                                     idle_event_handler, event);
 606
 607         /* We can't do much but fail here. */
 608         SMB_ASSERT(event->te != NULL);
 609 }
 610
 611 struct idle_event *event_add_idle(struct event_context *event_ctx,
 612                                   TALLOC_CTX *mem_ctx,
 613                                   struct timeval interval,
 614                                   const char *name,
 615                                   bool (*handler)(const struct timeval *now,
 616                                                   void *private_data),
 617                                   void *private_data)
 618 {
 619         struct idle_event *result;
 620         struct timeval now = timeval_current();
 621
 622         result = TALLOC_P(mem_ctx, struct idle_event);
 623         if (result == NULL) {
 624                 DEBUG(0, ("talloc failed\n"));
 625                 return NULL;
 626         }
 627
 628         result->interval = interval;
 629         result->handler = handler;
 630         result->private_data = private_data;
 631
 632         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 633                 DEBUG(0, ("talloc failed\n"));
 634                 TALLOC_FREE(result);
 635                 return NULL;
 636         }
 637
 638         result->te = event_add_timed(event_ctx, result,
 639                                      timeval_sum(&now, &interval),
 640                                      result->name,
 641                                      idle_event_handler, result);
 642         if (result->te == NULL) {
 643                 DEBUG(0, ("event_add_timed failed\n"));
 644                 TALLOC_FREE(result);
 645                 return NULL;
 646         }
 647
 648         return result;
 649 }
 650
 651 /****************************************************************************
 652  Do all async processing in here. This includes kernel oplock messages, change
 653  notify events etc.
 654 ****************************************************************************/
 655
 656 static void async_processing(fd_set *pfds)
 657 {
 658         DEBUG(10,("async_processing: Doing async processing.\n"));
 659
 660         process_aio_queue();
 661
 662         process_kernel_oplocks(smbd_messaging_context(), pfds);
 663
 664         /* Do the aio check again after receive_local_message as it does a
 665            select and may have eaten our signal. */
 666         /* Is this till true? -- vl */
 667         process_aio_queue();
 668
 669         if (got_sig_term) {
 670                 exit_server_cleanly("termination signal");
 671         }
 672
 673         /* check for sighup processing */
 674         if (reload_after_sighup) {
 675                 change_to_root_user();
 676                 DEBUG(1,("Reloading services after SIGHUP\n"));
 677                 reload_services(False);
 678                 reload_after_sighup = 0;
 679         }
 680 }
 681
 682 /****************************************************************************
 683  Add a fd to the set we will be select(2)ing on.
 684 ****************************************************************************/
 685
 686 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 687 {
 688         if (fd != -1) {
 689                 FD_SET(fd, fds);
 690                 maxfd = MAX(maxfd, fd);
 691         }
 692
 693         return maxfd;
 694 }
 695
 696 /****************************************************************************
 697   Do a select on an two fd's - with timeout.
 698
 699   If a local udp message has been pushed onto the
 700   queue (this can only happen during oplock break
 701   processing) call async_processing()
 702
 703   If a pending smb message has been pushed onto the
 704   queue (this can only happen during oplock break
 705   processing) return this next.
 706
 707   If the first smbfd is ready then read an smb from it.
 708   if the second (loopback UDP) fd is ready then read a message
 709   from it and setup the buffer header to identify the length
 710   and from address.
 711   Returns False on timeout or error.
 712   Else returns True.
 713
 714 The timeout is in milliseconds
 715 ****************************************************************************/
 716
 717 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
 718                                        size_t *buffer_len,
 719                                        size_t *p_unread, bool *p_encrypted)
 720 {
 721         fd_set r_fds, w_fds;
 722         int selrtn;
 723         struct timeval to;
 724         int maxfd = 0;
 725         size_t len = 0;
 726         NTSTATUS status;
 727
 728         *p_unread = 0;
 729
 730  again:
 731
 732         to.tv_sec = SMBD_SELECT_TIMEOUT;
 733         to.tv_usec = 0;
 734
 735         /*
 736          * Note that this call must be before processing any SMB
 737          * messages as we need to synchronously process any messages
 738          * we may have sent to ourselves from the previous SMB.
 739          */
 740         message_dispatch(smbd_messaging_context());
 741
 742         /*
 743          * Check to see if we already have a message on the deferred open queue
 744          * and it's time to schedule.
 745          */
 746         if(deferred_open_queue != NULL) {
 747                 bool pop_message = False;
 748                 struct pending_message_list *msg = deferred_open_queue;
 749
 750                 if (timeval_is_zero(&msg->end_time)) {
 751                         pop_message = True;
 752                 } else {
 753                         struct timeval tv;
 754                         int64_t tdif;
 755
 756                         GetTimeOfDay(&tv);
 757                         tdif = usec_time_diff(&msg->end_time, &tv);
 758                         if (tdif <= 0) {
 759                                 /* Timed out. Schedule...*/
 760                                 pop_message = True;
 761                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 762                         } else {
 763                                 /* Make a more accurate select timeout. */
 764                                 to.tv_sec = tdif / 1000000;
 765                                 to.tv_usec = tdif % 1000000;
 766                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 767                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 768                         }
 769                 }
 770
 771                 if (pop_message) {
 772
 773                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 774                                                         msg->buf.length);
 775                         if (*buffer == NULL) {
 776                                 DEBUG(0, ("talloc failed\n"));
 777                                 return NT_STATUS_NO_MEMORY;
 778                         }
 779                         *buffer_len = msg->buf.length;
 780                         *p_encrypted = msg->encrypted;
 781
 782                         /* We leave this message on the queue so the open code can
 783                            know this is a retry. */
 784                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 785                         return NT_STATUS_OK;
 786                 }
 787         }
 788
 789         /*
 790          * Setup the select fd sets.
 791          */
 792
 793         FD_ZERO(&r_fds);
 794         FD_ZERO(&w_fds);
 795
 796         /*
 797          * Ensure we process oplock break messages by preference.
 798          * We have to do this before the select, after the select
 799          * and if the select returns EINTR. This is due to the fact
 800          * that the selects called from async_processing can eat an EINTR
 801          * caused by a signal (we can't take the break message there).
 802          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 803          */
 804
 805         if (oplock_message_waiting(&r_fds)) {
 806                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 807                 async_processing(&r_fds);
 808                 /*
 809                  * After async processing we must go and do the select again, as
 810                  * the state of the flag in fds for the server file descriptor is
 811                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 812                  */
 813                 goto again;
 814         }
 815
 816         /*
 817          * Are there any timed events waiting ? If so, ensure we don't
 818          * select for longer than it would take to wait for them.
 819          */
 820
 821         {
 822                 struct timeval now;
 823                 GetTimeOfDay(&now);
 824
 825                 event_add_to_select_args(smbd_event_context(), &now,
 826                                          &r_fds, &w_fds, &to, &maxfd);
 827         }
 828
 829         if (timeval_is_zero(&to)) {
 830                 /* Process a timed event now... */
 831                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 832                         goto again;
 833                 }
 834         }
 835
 836         {
 837                 int sav;
 838                 START_PROFILE(smbd_idle);
 839
 840                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 841                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 842
 843                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 844                 sav = errno;
 845
 846                 END_PROFILE(smbd_idle);
 847                 errno = sav;
 848         }
 849
 850         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 851                 goto again;
 852         }
 853
 854         /* if we get EINTR then maybe we have received an oplock
 855            signal - treat this as select returning 1. This is ugly, but
 856            is the best we can do until the oplock code knows more about
 857            signals */
 858         if (selrtn == -1 && errno == EINTR) {
 859                 async_processing(&r_fds);
 860                 /*
 861                  * After async processing we must go and do the select again, as
 862                  * the state of the flag in fds for the server file descriptor is
 863                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 864                  */
 865                 goto again;
 866         }
 867
 868         /* Check if error */
 869         if (selrtn == -1) {
 870                 /* something is wrong. Maybe the socket is dead? */
 871                 return map_nt_error_from_unix(errno);
 872         }
 873
 874         /* Did we timeout ? */
 875         if (selrtn == 0) {
 876                 goto again;
 877         }
 878
 879         /*
 880          * Ensure we process oplock break messages by preference.
 881          * This is IMPORTANT ! Otherwise we can starve other processes
 882          * sending us an oplock break message. JRA.
 883          */
 884
 885         if (oplock_message_waiting(&r_fds)) {
 886                 async_processing(&r_fds);
 887                 /*
 888                  * After async processing we must go and do the select again, as
 889                  * the state of the flag in fds for the server file descriptor is
 890                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 891                  */
 892                 goto again;
 893         }
 894
 895         /*
 896          * We've just woken up from a protentially long select sleep.
 897          * Ensure we process local messages as we need to synchronously
 898          * process any messages from other smbd's to avoid file rename race
 899          * conditions. This call is cheap if there are no messages waiting.
 900          * JRA.
 901          */
 902         message_dispatch(smbd_messaging_context());
 903
 904         status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
 905                                     p_unread, p_encrypted, &len);
 906
 907         if (!NT_STATUS_IS_OK(status)) {
 908                 return status;
 909         }
 910
 911         *buffer_len = len;
 912
 913         return NT_STATUS_OK;
 914 }
 915
 916 /*
 917  * Only allow 5 outstanding trans requests. We're allocating memory, so
 918  * prevent a DoS.
 919  */
 920
 921 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 922 {
 923         int count = 0;
 924         for (; list != NULL; list = list->next) {
 925
 926                 if (list->mid == mid) {
 927                         return NT_STATUS_INVALID_PARAMETER;
 928                 }
 929
 930                 count += 1;
 931         }
 932         if (count > 5) {
 933                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 934         }
 935
 936         return NT_STATUS_OK;
 937 }
 938
 939 /****************************************************************************
 940  We're terminating and have closed all our files/connections etc.
 941  If there are any pending local messages we need to respond to them
 942  before termination so that other smbds don't think we just died whilst
 943  holding oplocks.
 944 ****************************************************************************/
 945
 946 void respond_to_all_remaining_local_messages(void)
 947 {
 948         /*
 949          * Assert we have no exclusive open oplocks.
 950          */
 951
 952         if(get_number_of_exclusive_open_oplocks()) {
 953                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 954                         get_number_of_exclusive_open_oplocks() ));
 955                 return;
 956         }
 957
 958         process_kernel_oplocks(smbd_messaging_context(), NULL);
 959
 960         return;
 961 }
 962
 963
 964 /*
 965 These flags determine some of the permissions required to do an operation
 966
 967 Note that I don't set NEED_WRITE on some write operations because they
 968 are used by some brain-dead clients when printing, and I don't want to
 969 force write permissions on print services.
 970 */
 971 #define AS_USER (1<<0)
 972 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 973 #define TIME_INIT (1<<2)
 974 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 975 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 976 #define DO_CHDIR (1<<6)
 977
 978 /*
 979    define a list of possible SMB messages and their corresponding
 980    functions. Any message that has a NULL function is unimplemented -
 981    please feel free to contribute implementations!
 982 */
 983 static const struct smb_message_struct {
 984         const char *name;
 985         void (*fn)(struct smb_request *req);
 986         int flags;
 987 } smb_messages[256] = {
 988
 989 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 990 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 991 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 992 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 993 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 994 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 995 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 996 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 997 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 998 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 999 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1000 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1001 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1002 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1003 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1004 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1005 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1006 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1007 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1008 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1009 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1010 /* 0x15 */ { NULL, NULL, 0 },
1011 /* 0x16 */ { NULL, NULL, 0 },
1012 /* 0x17 */ { NULL, NULL, 0 },
1013 /* 0x18 */ { NULL, NULL, 0 },
1014 /* 0x19 */ { NULL, NULL, 0 },
1015 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1016 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1017 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1018 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1019 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1020 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1021 /* 0x20 */ { "SMBwritec", NULL,0},
1022 /* 0x21 */ { NULL, NULL, 0 },
1023 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1024 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1025 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1026 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1027 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1028 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1029 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1030 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1031 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1032 /* 0x2b */ { "SMBecho",reply_echo,0},
1033 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1034 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1035 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1036 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1037 /* 0x30 */ { NULL, NULL, 0 },
1038 /* 0x31 */ { NULL, NULL, 0 },
1039 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1040 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1041 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1042 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1043 /* 0x36 */ { NULL, NULL, 0 },
1044 /* 0x37 */ { NULL, NULL, 0 },
1045 /* 0x38 */ { NULL, NULL, 0 },
1046 /* 0x39 */ { NULL, NULL, 0 },
1047 /* 0x3a */ { NULL, NULL, 0 },
1048 /* 0x3b */ { NULL, NULL, 0 },
1049 /* 0x3c */ { NULL, NULL, 0 },
1050 /* 0x3d */ { NULL, NULL, 0 },
1051 /* 0x3e */ { NULL, NULL, 0 },
1052 /* 0x3f */ { NULL, NULL, 0 },
1053 /* 0x40 */ { NULL, NULL, 0 },
1054 /* 0x41 */ { NULL, NULL, 0 },
1055 /* 0x42 */ { NULL, NULL, 0 },
1056 /* 0x43 */ { NULL, NULL, 0 },
1057 /* 0x44 */ { NULL, NULL, 0 },
1058 /* 0x45 */ { NULL, NULL, 0 },
1059 /* 0x46 */ { NULL, NULL, 0 },
1060 /* 0x47 */ { NULL, NULL, 0 },
1061 /* 0x48 */ { NULL, NULL, 0 },
1062 /* 0x49 */ { NULL, NULL, 0 },
1063 /* 0x4a */ { NULL, NULL, 0 },
1064 /* 0x4b */ { NULL, NULL, 0 },
1065 /* 0x4c */ { NULL, NULL, 0 },
1066 /* 0x4d */ { NULL, NULL, 0 },
1067 /* 0x4e */ { NULL, NULL, 0 },
1068 /* 0x4f */ { NULL, NULL, 0 },
1069 /* 0x50 */ { NULL, NULL, 0 },
1070 /* 0x51 */ { NULL, NULL, 0 },
1071 /* 0x52 */ { NULL, NULL, 0 },
1072 /* 0x53 */ { NULL, NULL, 0 },
1073 /* 0x54 */ { NULL, NULL, 0 },
1074 /* 0x55 */ { NULL, NULL, 0 },
1075 /* 0x56 */ { NULL, NULL, 0 },
1076 /* 0x57 */ { NULL, NULL, 0 },
1077 /* 0x58 */ { NULL, NULL, 0 },
1078 /* 0x59 */ { NULL, NULL, 0 },
1079 /* 0x5a */ { NULL, NULL, 0 },
1080 /* 0x5b */ { NULL, NULL, 0 },
1081 /* 0x5c */ { NULL, NULL, 0 },
1082 /* 0x5d */ { NULL, NULL, 0 },
1083 /* 0x5e */ { NULL, NULL, 0 },
1084 /* 0x5f */ { NULL, NULL, 0 },
1085 /* 0x60 */ { NULL, NULL, 0 },
1086 /* 0x61 */ { NULL, NULL, 0 },
1087 /* 0x62 */ { NULL, NULL, 0 },
1088 /* 0x63 */ { NULL, NULL, 0 },
1089 /* 0x64 */ { NULL, NULL, 0 },
1090 /* 0x65 */ { NULL, NULL, 0 },
1091 /* 0x66 */ { NULL, NULL, 0 },
1092 /* 0x67 */ { NULL, NULL, 0 },
1093 /* 0x68 */ { NULL, NULL, 0 },
1094 /* 0x69 */ { NULL, NULL, 0 },
1095 /* 0x6a */ { NULL, NULL, 0 },
1096 /* 0x6b */ { NULL, NULL, 0 },
1097 /* 0x6c */ { NULL, NULL, 0 },
1098 /* 0x6d */ { NULL, NULL, 0 },
1099 /* 0x6e */ { NULL, NULL, 0 },
1100 /* 0x6f */ { NULL, NULL, 0 },
1101 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1102 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1103 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1104 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1105 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1106 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1107 /* 0x76 */ { NULL, NULL, 0 },
1108 /* 0x77 */ { NULL, NULL, 0 },
1109 /* 0x78 */ { NULL, NULL, 0 },
1110 /* 0x79 */ { NULL, NULL, 0 },
1111 /* 0x7a */ { NULL, NULL, 0 },
1112 /* 0x7b */ { NULL, NULL, 0 },
1113 /* 0x7c */ { NULL, NULL, 0 },
1114 /* 0x7d */ { NULL, NULL, 0 },
1115 /* 0x7e */ { NULL, NULL, 0 },
1116 /* 0x7f */ { NULL, NULL, 0 },
1117 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1118 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1119 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1120 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1121 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1122 /* 0x85 */ { NULL, NULL, 0 },
1123 /* 0x86 */ { NULL, NULL, 0 },
1124 /* 0x87 */ { NULL, NULL, 0 },
1125 /* 0x88 */ { NULL, NULL, 0 },
1126 /* 0x89 */ { NULL, NULL, 0 },
1127 /* 0x8a */ { NULL, NULL, 0 },
1128 /* 0x8b */ { NULL, NULL, 0 },
1129 /* 0x8c */ { NULL, NULL, 0 },
1130 /* 0x8d */ { NULL, NULL, 0 },
1131 /* 0x8e */ { NULL, NULL, 0 },
1132 /* 0x8f */ { NULL, NULL, 0 },
1133 /* 0x90 */ { NULL, NULL, 0 },
1134 /* 0x91 */ { NULL, NULL, 0 },
1135 /* 0x92 */ { NULL, NULL, 0 },
1136 /* 0x93 */ { NULL, NULL, 0 },
1137 /* 0x94 */ { NULL, NULL, 0 },
1138 /* 0x95 */ { NULL, NULL, 0 },
1139 /* 0x96 */ { NULL, NULL, 0 },
1140 /* 0x97 */ { NULL, NULL, 0 },
1141 /* 0x98 */ { NULL, NULL, 0 },
1142 /* 0x99 */ { NULL, NULL, 0 },
1143 /* 0x9a */ { NULL, NULL, 0 },
1144 /* 0x9b */ { NULL, NULL, 0 },
1145 /* 0x9c */ { NULL, NULL, 0 },
1146 /* 0x9d */ { NULL, NULL, 0 },
1147 /* 0x9e */ { NULL, NULL, 0 },
1148 /* 0x9f */ { NULL, NULL, 0 },
1149 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1150 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1151 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1152 /* 0xa3 */ { NULL, NULL, 0 },
1153 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1154 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1155 /* 0xa6 */ { NULL, NULL, 0 },
1156 /* 0xa7 */ { NULL, NULL, 0 },
1157 /* 0xa8 */ { NULL, NULL, 0 },
1158 /* 0xa9 */ { NULL, NULL, 0 },
1159 /* 0xaa */ { NULL, NULL, 0 },
1160 /* 0xab */ { NULL, NULL, 0 },
1161 /* 0xac */ { NULL, NULL, 0 },
1162 /* 0xad */ { NULL, NULL, 0 },
1163 /* 0xae */ { NULL, NULL, 0 },
1164 /* 0xaf */ { NULL, NULL, 0 },
1165 /* 0xb0 */ { NULL, NULL, 0 },
1166 /* 0xb1 */ { NULL, NULL, 0 },
1167 /* 0xb2 */ { NULL, NULL, 0 },
1168 /* 0xb3 */ { NULL, NULL, 0 },
1169 /* 0xb4 */ { NULL, NULL, 0 },
1170 /* 0xb5 */ { NULL, NULL, 0 },
1171 /* 0xb6 */ { NULL, NULL, 0 },
1172 /* 0xb7 */ { NULL, NULL, 0 },
1173 /* 0xb8 */ { NULL, NULL, 0 },
1174 /* 0xb9 */ { NULL, NULL, 0 },
1175 /* 0xba */ { NULL, NULL, 0 },
1176 /* 0xbb */ { NULL, NULL, 0 },
1177 /* 0xbc */ { NULL, NULL, 0 },
1178 /* 0xbd */ { NULL, NULL, 0 },
1179 /* 0xbe */ { NULL, NULL, 0 },
1180 /* 0xbf */ { NULL, NULL, 0 },
1181 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1182 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1183 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1184 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1185 /* 0xc4 */ { NULL, NULL, 0 },
1186 /* 0xc5 */ { NULL, NULL, 0 },
1187 /* 0xc6 */ { NULL, NULL, 0 },
1188 /* 0xc7 */ { NULL, NULL, 0 },
1189 /* 0xc8 */ { NULL, NULL, 0 },
1190 /* 0xc9 */ { NULL, NULL, 0 },
1191 /* 0xca */ { NULL, NULL, 0 },
1192 /* 0xcb */ { NULL, NULL, 0 },
1193 /* 0xcc */ { NULL, NULL, 0 },
1194 /* 0xcd */ { NULL, NULL, 0 },
1195 /* 0xce */ { NULL, NULL, 0 },
1196 /* 0xcf */ { NULL, NULL, 0 },
1197 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1198 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1199 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1200 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1201 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1202 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1203 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1204 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1205 /* 0xd8 */ { NULL, NULL, 0 },
1206 /* 0xd9 */ { NULL, NULL, 0 },
1207 /* 0xda */ { NULL, NULL, 0 },
1208 /* 0xdb */ { NULL, NULL, 0 },
1209 /* 0xdc */ { NULL, NULL, 0 },
1210 /* 0xdd */ { NULL, NULL, 0 },
1211 /* 0xde */ { NULL, NULL, 0 },
1212 /* 0xdf */ { NULL, NULL, 0 },
1213 /* 0xe0 */ { NULL, NULL, 0 },
1214 /* 0xe1 */ { NULL, NULL, 0 },
1215 /* 0xe2 */ { NULL, NULL, 0 },
1216 /* 0xe3 */ { NULL, NULL, 0 },
1217 /* 0xe4 */ { NULL, NULL, 0 },
1218 /* 0xe5 */ { NULL, NULL, 0 },
1219 /* 0xe6 */ { NULL, NULL, 0 },
1220 /* 0xe7 */ { NULL, NULL, 0 },
1221 /* 0xe8 */ { NULL, NULL, 0 },
1222 /* 0xe9 */ { NULL, NULL, 0 },
1223 /* 0xea */ { NULL, NULL, 0 },
1224 /* 0xeb */ { NULL, NULL, 0 },
1225 /* 0xec */ { NULL, NULL, 0 },
1226 /* 0xed */ { NULL, NULL, 0 },
1227 /* 0xee */ { NULL, NULL, 0 },
1228 /* 0xef */ { NULL, NULL, 0 },
1229 /* 0xf0 */ { NULL, NULL, 0 },
1230 /* 0xf1 */ { NULL, NULL, 0 },
1231 /* 0xf2 */ { NULL, NULL, 0 },
1232 /* 0xf3 */ { NULL, NULL, 0 },
1233 /* 0xf4 */ { NULL, NULL, 0 },
1234 /* 0xf5 */ { NULL, NULL, 0 },
1235 /* 0xf6 */ { NULL, NULL, 0 },
1236 /* 0xf7 */ { NULL, NULL, 0 },
1237 /* 0xf8 */ { NULL, NULL, 0 },
1238 /* 0xf9 */ { NULL, NULL, 0 },
1239 /* 0xfa */ { NULL, NULL, 0 },
1240 /* 0xfb */ { NULL, NULL, 0 },
1241 /* 0xfc */ { NULL, NULL, 0 },
1242 /* 0xfd */ { NULL, NULL, 0 },
1243 /* 0xfe */ { NULL, NULL, 0 },
1244 /* 0xff */ { NULL, NULL, 0 }
1245
1246 };
1247
1248 /*******************************************************************
1249  allocate and initialize a reply packet
1250 ********************************************************************/
1251
1252 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1253                           const char *inbuf, char **outbuf, uint8_t num_words,
1254                           uint32_t num_bytes)
1255 {
1256         /*
1257          * Protect against integer wrap
1258          */
1259         if ((num_bytes > 0xffffff)
1260             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1261                 char *msg;
1262                 if (asprintf(&msg, "num_bytes too large: %u",
1263                              (unsigned)num_bytes) == -1) {
1264                         msg = CONST_DISCARD(char *, "num_bytes too large");
1265                 }
1266                 smb_panic(msg);
1267         }
1268
1269         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1270                                smb_size + num_words*2 + num_bytes);
1271         if (*outbuf == NULL) {
1272                 return false;
1273         }
1274
1275         construct_reply_common(req, inbuf, *outbuf);
1276         srv_set_message(*outbuf, num_words, num_bytes, false);
1277         /*
1278          * Zero out the word area, the caller has to take care of the bcc area
1279          * himself
1280          */
1281         if (num_words != 0) {
1282                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1283         }
1284
1285         return true;
1286 }
1287
1288 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1289 {
1290         char *outbuf;
1291         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1292                            num_bytes)) {
1293                 smb_panic("could not allocate output buffer\n");
1294         }
1295         req->outbuf = (uint8_t *)outbuf;
1296 }
1297
1298
1299 /*******************************************************************
1300  Dump a packet to a file.
1301 ********************************************************************/
1302
1303 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1304 {
1305         int fd, i;
1306         char *fname = NULL;
1307         if (DEBUGLEVEL < 50) {
1308                 return;
1309         }
1310
1311         if (len < 4) len = smb_len(data)+4;
1312         for (i=1;i<100;i++) {
1313                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1314                              type ? "req" : "resp") == -1) {
1315                         return;
1316                 }
1317                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1318                 if (fd != -1 || errno != EEXIST) break;
1319         }
1320         if (fd != -1) {
1321                 ssize_t ret = write(fd, data, len);
1322                 if (ret != len)
1323                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1324                 close(fd);
1325                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1326         }
1327         SAFE_FREE(fname);
1328 }
1329
1330 /****************************************************************************
1331  Prepare everything for calling the actual request function, and potentially
1332  call the request function via the "new" interface.
1333
1334  Return False if the "legacy" function needs to be called, everything is
1335  prepared.
1336
1337  Return True if we're done.
1338
1339  I know this API sucks, but it is the one with the least code change I could
1340  find.
1341 ****************************************************************************/
1342
1343 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1344 {
1345         int flags;
1346         uint16 session_tag;
1347         connection_struct *conn = NULL;
1348
1349         static uint16 last_session_tag = UID_FIELD_INVALID;
1350
1351         errno = 0;
1352
1353         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1354          * so subtract 4 from it. */
1355         if (!valid_smb_header(req->inbuf)
1356             || (size < (smb_size - 4))) {
1357                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1358                          smb_len(req->inbuf)));
1359                 exit_server_cleanly("Non-SMB packet");
1360         }
1361
1362         if (smb_messages[type].fn == NULL) {
1363                 DEBUG(0,("Unknown message type %d!\n",type));
1364                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1365                 reply_unknown_new(req, type);
1366                 return NULL;
1367         }
1368
1369         flags = smb_messages[type].flags;
1370
1371         /* In share mode security we must ignore the vuid. */
1372         session_tag = (lp_security() == SEC_SHARE)
1373                 ? UID_FIELD_INVALID : req->vuid;
1374         conn = req->conn;
1375
1376         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1377                  (int)sys_getpid(), (unsigned long)conn));
1378
1379         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1380
1381         /* Ensure this value is replaced in the incoming packet. */
1382         SSVAL(req->inbuf,smb_uid,session_tag);
1383
1384         /*
1385          * Ensure the correct username is in current_user_info.  This is a
1386          * really ugly bugfix for problems with multiple session_setup_and_X's
1387          * being done and allowing %U and %G substitutions to work correctly.
1388          * There is a reason this code is done here, don't move it unless you
1389          * know what you're doing... :-).
1390          * JRA.
1391          */
1392
1393         if (session_tag != last_session_tag) {
1394                 user_struct *vuser = NULL;
1395
1396                 last_session_tag = session_tag;
1397                 if(session_tag != UID_FIELD_INVALID) {
1398                         vuser = get_valid_user_struct(session_tag);
1399                         if (vuser) {
1400                                 set_current_user_info(
1401                                         vuser->server_info->sanitized_username,
1402                                         vuser->server_info->unix_name,
1403                                         pdb_get_fullname(vuser->server_info
1404                                                          ->sam_account),
1405                                         pdb_get_domain(vuser->server_info
1406                                                        ->sam_account));
1407                         }
1408                 }
1409         }
1410
1411         /* Does this call need to be run as the connected user? */
1412         if (flags & AS_USER) {
1413
1414                 /* Does this call need a valid tree connection? */
1415                 if (!conn) {
1416                         /*
1417                          * Amazingly, the error code depends on the command
1418                          * (from Samba4).
1419                          */
1420                         if (type == SMBntcreateX) {
1421                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1422                         } else {
1423                                 reply_doserror(req, ERRSRV, ERRinvnid);
1424                         }
1425                         return NULL;
1426                 }
1427
1428                 if (!change_to_user(conn,session_tag)) {
1429                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1430                         remove_deferred_open_smb_message(req->mid);
1431                         return conn;
1432                 }
1433
1434                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1435
1436                 /* Does it need write permission? */
1437                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1438                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1439                         return conn;
1440                 }
1441
1442                 /* IPC services are limited */
1443                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1444                         reply_doserror(req, ERRSRV,ERRaccess);
1445                         return conn;
1446                 }
1447         } else {
1448                 /* This call needs to be run as root */
1449                 change_to_root_user();
1450         }
1451
1452         /* load service specific parameters */
1453         if (conn) {
1454                 if (req->encrypted) {
1455                         conn->encrypted_tid = true;
1456                         /* encrypted required from now on. */
1457                         conn->encrypt_level = Required;
1458                 } else if (ENCRYPTION_REQUIRED(conn)) {
1459                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1460                                 exit_server_cleanly("encryption required "
1461                                         "on connection");
1462                                 return conn;
1463                         }
1464                 }
1465
1466                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1467                                          (flags & (AS_USER|DO_CHDIR)
1468                                           ?True:False))) {
1469                         reply_doserror(req, ERRSRV, ERRaccess);
1470                         return conn;
1471                 }
1472                 conn->num_smb_operations++;
1473         }
1474
1475         /* does this protocol need to be run as guest? */
1476         if ((flags & AS_GUEST)
1477             && (!change_to_guest() ||
1478                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1479                               lp_hostsdeny(-1)))) {
1480                 reply_doserror(req, ERRSRV, ERRaccess);
1481                 return conn;
1482         }
1483
1484         smb_messages[type].fn(req);
1485         return req->conn;
1486 }
1487
1488 /****************************************************************************
1489  Construct a reply to the incoming packet.
1490 ****************************************************************************/
1491
1492 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1493 {
1494         connection_struct *conn;
1495         struct smb_request *req;
1496
1497         chain_size = 0;
1498
1499         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1500                 smb_panic("could not allocate smb_request");
1501         }
1502         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1503         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1504
1505         conn = switch_message(req->cmd, req, size);
1506
1507         if (req->unread_bytes) {
1508                 /* writeX failed. drain socket. */
1509                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1510                                 req->unread_bytes) {
1511                         smb_panic("failed to drain pending bytes");
1512                 }
1513                 req->unread_bytes = 0;
1514         }
1515
1516         if (req->outbuf == NULL) {
1517                 return;
1518         }
1519
1520         if (CVAL(req->outbuf,0) == 0) {
1521                 show_msg((char *)req->outbuf);
1522         }
1523
1524         if (!srv_send_smb(smbd_server_fd(),
1525                         (char *)req->outbuf,
1526                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1527                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1528         }
1529
1530         TALLOC_FREE(req);
1531
1532         return;
1533 }
1534
1535 /****************************************************************************
1536  Process an smb from the client
1537 ****************************************************************************/
1538
1539 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1540 {
1541         static int trans_num;
1542         int msg_type = CVAL(inbuf,0);
1543
1544         DO_PROFILE_INC(smb_count);
1545
1546         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1547                     smb_len(inbuf) ) );
1548         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1549                                 (int)nread,
1550                                 (unsigned int)unread_bytes ));
1551
1552         if (msg_type != 0) {
1553                 /*
1554                  * NetBIOS session request, keepalive, etc.
1555                  */
1556                 reply_special(inbuf);
1557                 return;
1558         }
1559
1560         show_msg(inbuf);
1561
1562         construct_reply(inbuf,nread,unread_bytes,encrypted);
1563
1564         trans_num++;
1565 }
1566
1567 /****************************************************************************
1568  Return a string containing the function name of a SMB command.
1569 ****************************************************************************/
1570
1571 const char *smb_fn_name(int type)
1572 {
1573         const char *unknown_name = "SMBunknown";
1574
1575         if (smb_messages[type].name == NULL)
1576                 return(unknown_name);
1577
1578         return(smb_messages[type].name);
1579 }
1580
1581 /****************************************************************************
1582  Helper functions for contruct_reply.
1583 ****************************************************************************/
1584
1585 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1586
1587 void add_to_common_flags2(uint32 v)
1588 {
1589         common_flags2 |= v;
1590 }
1591
1592 void remove_from_common_flags2(uint32 v)
1593 {
1594         common_flags2 &= ~v;
1595 }
1596
1597 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1598                                    char *outbuf)
1599 {
1600         srv_set_message(outbuf,0,0,false);
1601
1602         SCVAL(outbuf, smb_com, req->cmd);
1603         SIVAL(outbuf,smb_rcls,0);
1604         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1605         SSVAL(outbuf,smb_flg2,
1606                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1607                 common_flags2);
1608         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1609
1610         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1611         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1612         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1613         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1614 }
1615
1616 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1617 {
1618         construct_reply_common(req, (char *)req->inbuf, outbuf);
1619 }
1620
1621 /****************************************************************************
1622  Construct a chained reply and add it to the already made reply
1623 ****************************************************************************/
1624
1625 void chain_reply(struct smb_request *req)
1626 {
1627         static char *orig_inbuf;
1628
1629         /*
1630          * Dirty little const_discard: We mess with req->inbuf, which is
1631          * declared as const. If maybe at some point this routine gets
1632          * rewritten, this const_discard could go away.
1633          */
1634         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1635         int size = smb_len(req->inbuf)+4;
1636
1637         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1638         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1639         char *inbuf2;
1640         int outsize2;
1641         int new_size;
1642         char inbuf_saved[smb_wct];
1643         char *outbuf = (char *)req->outbuf;
1644         size_t outsize = smb_len(outbuf) + 4;
1645         size_t outsize_padded;
1646         size_t padding;
1647         size_t ofs, to_move;
1648
1649         struct smb_request *req2;
1650         size_t caller_outputlen;
1651         char *caller_output;
1652
1653         /* Maybe its not chained, or it's an error packet. */
1654         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1655                 SCVAL(outbuf,smb_vwv0,0xFF);
1656                 return;
1657         }
1658
1659         if (chain_size == 0) {
1660                 /* this is the first part of the chain */
1661                 orig_inbuf = inbuf;
1662         }
1663
1664         /*
1665          * We need to save the output the caller added to the chain so that we
1666          * can splice it into the final output buffer later.
1667          */
1668
1669         caller_outputlen = outsize - smb_wct;
1670
1671         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1672
1673         if (caller_output == NULL) {
1674                 /* TODO: NT_STATUS_NO_MEMORY */
1675                 smb_panic("could not dup outbuf");
1676         }
1677
1678         /*
1679          * The original Win95 redirector dies on a reply to
1680          * a lockingX and read chain unless the chain reply is
1681          * 4 byte aligned. JRA.
1682          */
1683
1684         outsize_padded = (outsize + 3) & ~3;
1685         padding = outsize_padded - outsize;
1686
1687         /*
1688          * remember how much the caller added to the chain, only counting
1689          * stuff after the parameter words
1690          */
1691         chain_size += (outsize_padded - smb_wct);
1692
1693         /*
1694          * work out pointers into the original packets. The
1695          * headers on these need to be filled in
1696          */
1697         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1698
1699         /* remember the original command type */
1700         smb_com1 = CVAL(orig_inbuf,smb_com);
1701
1702         /* save the data which will be overwritten by the new headers */
1703         memcpy(inbuf_saved,inbuf2,smb_wct);
1704
1705         /* give the new packet the same header as the last part of the SMB */
1706         memmove(inbuf2,inbuf,smb_wct);
1707
1708         /* create the in buffer */
1709         SCVAL(inbuf2,smb_com,smb_com2);
1710
1711         /* work out the new size for the in buffer. */
1712         new_size = size - (inbuf2 - inbuf);
1713         if (new_size < 0) {
1714                 DEBUG(0,("chain_reply: chain packet size incorrect "
1715                          "(orig size = %d, offset = %d)\n",
1716                          size, (int)(inbuf2 - inbuf) ));
1717                 exit_server_cleanly("Bad chained packet");
1718                 return;
1719         }
1720
1721         /* And set it in the header. */
1722         smb_setlen(inbuf2, new_size - 4);
1723
1724         DEBUG(3,("Chained message\n"));
1725         show_msg(inbuf2);
1726
1727         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1728                 smb_panic("could not allocate smb_request");
1729         }
1730         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1731         req2->inbuf = (uint8_t *)inbuf2;
1732         req2->chain_fsp = req->chain_fsp;
1733
1734         /* process the request */
1735         switch_message(smb_com2, req2, new_size);
1736
1737         /*
1738          * We don't accept deferred operations in chained requests.
1739          */
1740         SMB_ASSERT(req2->outbuf != NULL);
1741         outsize2 = smb_len(req2->outbuf)+4;
1742
1743         /*
1744          * Move away the new command output so that caller_output fits in,
1745          * copy in the caller_output saved above.
1746          */
1747
1748         SMB_ASSERT(outsize_padded >= smb_wct);
1749
1750         /*
1751          * "ofs" is the space we need for caller_output. Equal to
1752          * caller_outputlen plus the padding.
1753          */
1754
1755         ofs = outsize_padded - smb_wct;
1756
1757         /*
1758          * "to_move" is the amount of bytes the secondary routine gave us
1759          */
1760
1761         to_move = outsize2 - smb_wct;
1762
1763         if (to_move + ofs + smb_wct + chain_size > max_send) {
1764                 smb_panic("replies too large -- would have to cut");
1765         }
1766
1767         /*
1768          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1769          * the first request in the chain. So we have to re-allocate it. In
1770          * the "old" API the only outbuf ever used is the global OutBuffer
1771          * which is always large enough.
1772          */
1773
1774         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1775                                       to_move + ofs + smb_wct);
1776         if (outbuf == NULL) {
1777                 smb_panic("could not realloc outbuf");
1778         }
1779
1780         req->outbuf = (uint8 *)outbuf;
1781
1782         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1783         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1784
1785         /*
1786          * copy the new reply header over the old one but preserve the smb_com
1787          * field
1788          */
1789         memmove(outbuf, req2->outbuf, smb_wct);
1790         SCVAL(outbuf, smb_com, smb_com1);
1791
1792         /*
1793          * We've just copied in the whole "wct" area from the secondary
1794          * function. Fix up the chaining: com2 and the offset need to be
1795          * readjusted.
1796          */
1797
1798         SCVAL(outbuf, smb_vwv0, smb_com2);
1799         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1800
1801         if (padding != 0) {
1802
1803                 /*
1804                  * Due to padding we have some uninitialized bytes after the
1805                  * caller's output
1806                  */
1807
1808                 memset(outbuf + outsize, 0, padding);
1809         }
1810
1811         smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1812
1813         /*
1814          * restore the saved data, being careful not to overwrite any data
1815          * from the reply header
1816          */
1817         memcpy(inbuf2,inbuf_saved,smb_wct);
1818
1819         SAFE_FREE(caller_output);
1820         TALLOC_FREE(req2);
1821
1822         /*
1823          * Reset the chain_size for our caller's offset calculations
1824          */
1825
1826         chain_size -= (outsize_padded - smb_wct);
1827
1828         return;
1829 }
1830
1831 /****************************************************************************
1832  Check if services need reloading.
1833 ****************************************************************************/
1834
1835 void check_reload(time_t t)
1836 {
1837         static pid_t mypid = 0;
1838         static time_t last_smb_conf_reload_time = 0;
1839         static time_t last_printer_reload_time = 0;
1840         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1841
1842         if(last_smb_conf_reload_time == 0) {
1843                 last_smb_conf_reload_time = t;
1844                 /* Our printing subsystem might not be ready at smbd start up.
1845                    Then no printer is available till the first printers check
1846                    is performed.  A lower initial interval circumvents this. */
1847                 if ( printcap_cache_time > 60 )
1848                         last_printer_reload_time = t - printcap_cache_time + 60;
1849                 else
1850                         last_printer_reload_time = t;
1851         }
1852
1853         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1854                 /* randomize over 60 second the printcap reload to avoid all
1855                  * process hitting cupsd at the same time */
1856                 int time_range = 60;
1857
1858                 last_printer_reload_time += random() % time_range;
1859                 mypid = getpid();
1860         }
1861
1862         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1863                 reload_services(True);
1864                 reload_after_sighup = False;
1865                 last_smb_conf_reload_time = t;
1866         }
1867
1868         /* 'printcap cache time = 0' disable the feature */
1869
1870         if ( printcap_cache_time != 0 )
1871         {
1872                 /* see if it's time to reload or if the clock has been set back */
1873
1874                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1875                         || (t-last_printer_reload_time  < 0) )
1876                 {
1877                         DEBUG( 3,( "Printcap cache time expired.\n"));
1878                         reload_printers();
1879                         last_printer_reload_time = t;
1880                 }
1881         }
1882 }
1883
1884 /****************************************************************************
1885  Process commands from the client
1886 ****************************************************************************/
1887
1888 void smbd_process(void)
1889 {
1890         unsigned int num_smbs = 0;
1891         size_t unread_bytes = 0;
1892
1893         char addr[INET6_ADDRSTRLEN];
1894
1895         /*
1896          * Before the first packet, check the global hosts allow/ hosts deny
1897          * parameters before doing any parsing of packets passed to us by the
1898          * client. This prevents attacks on our parsing code from hosts not in
1899          * the hosts allow list.
1900          */
1901
1902         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1903                           lp_hostsdeny(-1))) {
1904                 /*
1905                  * send a negative session response "not listening on calling
1906                  * name"
1907                  */
1908                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1909                 DEBUG( 1, ("Connection denied from %s\n",
1910                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1911                 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1912                 exit_server_cleanly("connection denied");
1913         }
1914
1915         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1916
1917         while (True) {
1918                 NTSTATUS status;
1919                 char *inbuf = NULL;
1920                 size_t inbuf_len = 0;
1921                 bool encrypted = false;
1922                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1923
1924                 errno = 0;
1925
1926                 run_events(smbd_event_context(), 0, NULL, NULL);
1927
1928                 status = receive_message_or_smb(
1929                         talloc_tos(), &inbuf, &inbuf_len,
1930                         &unread_bytes, &encrypted);
1931
1932                 if (!NT_STATUS_IS_OK(status)) {
1933                         DEBUG(3, ("receive_message_or_smb failed: %s, "
1934                                   "exiting\n", nt_errstr(status)));
1935                         return;
1936                 }
1937
1938                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
1939
1940                 num_smbs++;
1941
1942                 /* The timeout_processing function isn't run nearly
1943                    often enough to implement 'max log size' without
1944                    overrunning the size of the file by many megabytes.
1945                    This is especially true if we are running at debug
1946                    level 10.  Checking every 50 SMBs is a nice
1947                    tradeoff of performance vs log file size overrun. */
1948
1949                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1950                         change_to_root_user();
1951                         check_log_size();
1952                 }
1953                 TALLOC_FREE(frame);
1954         }
1955 }