source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43
  44 /* Internal message queue for deferred opens. */
  45 struct pending_message_list {
  46         struct pending_message_list *next, *prev;
  47         struct timeval request_time; /* When was this first issued? */
  48         struct smbd_server_connection *sconn;
  49         struct tevent_timer *te;
  50         struct smb_perfcount_data pcd;
  51         uint32_t seqnum;
  52         bool encrypted;
  53         bool processed;
  54         DATA_BLOB buf;
  55         DATA_BLOB private_data;
  56 };
  57
  58 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  59                                    char *outbuf);
  60 static struct pending_message_list *get_deferred_open_message_smb(
  61         struct smbd_server_connection *sconn, uint64_t mid);
  62 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  63
  64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  65 {
  66         bool ok;
  67
  68         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  69                 return true;
  70         }
  71
  72         sconn->smb1.echo_handler.ref_count++;
  73
  74         if (sconn->smb1.echo_handler.ref_count > 1) {
  75                 return true;
  76         }
  77
  78         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
  79
  80         do {
  81                 ok = fcntl_lock(
  82                         sconn->smb1.echo_handler.socket_lock_fd,
  83                         F_SETLKW, 0, 0, F_WRLCK);
  84         } while (!ok && (errno == EINTR));
  85
  86         if (!ok) {
  87                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  88                 return false;
  89         }
  90
  91         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
  92
  93         return true;
  94 }
  95
  96 void smbd_lock_socket(struct smbd_server_connection *sconn)
  97 {
  98         if (!smbd_lock_socket_internal(sconn)) {
  99                 exit_server_cleanly("failed to lock socket");
 100         }
 101 }
 102
 103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 104 {
 105         bool ok;
 106
 107         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
 108                 return true;
 109         }
 110
 111         sconn->smb1.echo_handler.ref_count--;
 112
 113         if (sconn->smb1.echo_handler.ref_count > 0) {
 114                 return true;
 115         }
 116
 117         do {
 118                 ok = fcntl_lock(
 119                         sconn->smb1.echo_handler.socket_lock_fd,
 120                         F_SETLKW, 0, 0, F_UNLCK);
 121         } while (!ok && (errno == EINTR));
 122
 123         if (!ok) {
 124                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 125                 return false;
 126         }
 127
 128         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 129
 130         return true;
 131 }
 132
 133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 134 {
 135         if (!smbd_unlock_socket_internal(sconn)) {
 136                 exit_server_cleanly("failed to unlock socket");
 137         }
 138 }
 139
 140 /* Accessor function for smb_read_error for smbd functions. */
 141
 142 /****************************************************************************
 143  Send an smb to a fd.
 144 ****************************************************************************/
 145
 146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 147                   bool do_signing, uint32_t seqnum,
 148                   bool do_encrypt,
 149                   struct smb_perfcount_data *pcd)
 150 {
 151         size_t len = 0;
 152         ssize_t ret;
 153         char *buf_out = buffer;
 154
 155         if (!NT_STATUS_IS_OK(sconn->status)) {
 156                 /*
 157                  * we're not supposed to do any io
 158                  */
 159                 return true;
 160         }
 161
 162         smbd_lock_socket(sconn);
 163
 164         if (do_signing) {
 165                 /* Sign the outgoing packet if required. */
 166                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 167         }
 168
 169         if (do_encrypt) {
 170                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 171                 if (!NT_STATUS_IS_OK(status)) {
 172                         DEBUG(0, ("send_smb: SMB encryption failed "
 173                                 "on outgoing packet! Error %s\n",
 174                                 nt_errstr(status) ));
 175                         ret = -1;
 176                         goto out;
 177                 }
 178         }
 179
 180         len = smb_len_large(buf_out) + 4;
 181
 182         ret = write_data(sconn->sock, buf_out, len);
 183         if (ret <= 0) {
 184
 185                 char addr[INET6_ADDRSTRLEN];
 186                 /*
 187                  * Try and give an error message saying what
 188                  * client failed.
 189                  */
 190                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 191                          (int)getpid(), (int)len,
 192                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 193                          (int)ret, strerror(errno) ));
 194
 195                 srv_free_enc_buffer(sconn, buf_out);
 196                 goto out;
 197         }
 198
 199         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 200         srv_free_enc_buffer(sconn, buf_out);
 201 out:
 202         SMB_PERFCOUNT_END(pcd);
 203
 204         smbd_unlock_socket(sconn);
 205         return (ret > 0);
 206 }
 207
 208 /*******************************************************************
 209  Setup the word count and byte count for a smb message.
 210 ********************************************************************/
 211
 212 int srv_set_message(char *buf,
 213                         int num_words,
 214                         int num_bytes,
 215                         bool zero)
 216 {
 217         if (zero && (num_words || num_bytes)) {
 218                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 219         }
 220         SCVAL(buf,smb_wct,num_words);
 221         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 222         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 223         return (smb_size + num_words*2 + num_bytes);
 224 }
 225
 226 static bool valid_smb_header(struct smbd_server_connection *sconn,
 227                              const uint8_t *inbuf)
 228 {
 229         if (is_encrypted_packet(sconn, inbuf)) {
 230                 return true;
 231         }
 232         /*
 233          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 234          * but it just looks weird to call strncmp for this one.
 235          */
 236         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 237 }
 238
 239 /* Socket functions for smbd packet processing. */
 240
 241 static bool valid_packet_size(size_t len)
 242 {
 243         /*
 244          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 245          * of header. Don't print the error if this fits.... JRA.
 246          */
 247
 248         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 249                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 250                                         (unsigned long)len));
 251                 return false;
 252         }
 253         return true;
 254 }
 255
 256 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 257                                       unsigned int timeout, ssize_t len)
 258 {
 259         NTSTATUS status;
 260
 261         if (len <= 0) {
 262                 return NT_STATUS_OK;
 263         }
 264
 265         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 char addr[INET6_ADDRSTRLEN];
 268                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 269                           "error = %s.\n",
 270                           get_peer_addr(fd, addr, sizeof(addr)),
 271                           nt_errstr(status)));
 272         }
 273         return status;
 274 }
 275
 276 /****************************************************************************
 277  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 278 ****************************************************************************/
 279
 280 /*
 281  * Unfortunately, earlier versions of smbclient/libsmbclient
 282  * don't send this "standard" writeX header. I've fixed this
 283  * for 3.2 but we'll use the old method with earlier versions.
 284  * Windows and CIFSFS at least use this standard size. Not
 285  * sure about MacOSX.
 286  */
 287
 288 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 289                                 (2*14) + /* word count (including bcc) */ \
 290                                 1 /* pad byte */)
 291
 292 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 293                                                     const char lenbuf[4],
 294                                                     struct smbd_server_connection *sconn,
 295                                                     int sock,
 296                                                     char **buffer,
 297                                                     unsigned int timeout,
 298                                                     size_t *p_unread,
 299                                                     size_t *len_ret)
 300 {
 301         /* Size of a WRITEX call (+4 byte len). */
 302         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 303         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 304         ssize_t toread;
 305         NTSTATUS status;
 306
 307         memcpy(writeX_header, lenbuf, 4);
 308
 309         status = read_fd_with_timeout(
 310                 sock, writeX_header + 4,
 311                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 312                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 313                 timeout, NULL);
 314
 315         if (!NT_STATUS_IS_OK(status)) {
 316                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 317                           "error = %s.\n",
 318                           tsocket_address_string(sconn->remote_address,
 319                                                  talloc_tos()),
 320                           nt_errstr(status)));
 321                 return status;
 322         }
 323
 324         /*
 325          * Ok - now try and see if this is a possible
 326          * valid writeX call.
 327          */
 328
 329         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 330                 /*
 331                  * If the data offset is beyond what
 332                  * we've read, drain the extra bytes.
 333                  */
 334                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 335                 ssize_t newlen;
 336
 337                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 338                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 339                         if (drain_socket(sock, drain) != drain) {
 340                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 341                                         " failed to drain pending bytes");
 342                         }
 343                 } else {
 344                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 345                 }
 346
 347                 /* Spoof down the length and null out the bcc. */
 348                 set_message_bcc(writeX_header, 0);
 349                 newlen = smb_len(writeX_header);
 350
 351                 /* Copy the header we've written. */
 352
 353                 *buffer = (char *)talloc_memdup(mem_ctx,
 354                                 writeX_header,
 355                                 sizeof(writeX_header));
 356
 357                 if (*buffer == NULL) {
 358                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 359                                   (int)sizeof(writeX_header)));
 360                         return NT_STATUS_NO_MEMORY;
 361                 }
 362
 363                 /* Work out the remaining bytes. */
 364                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 365                 *len_ret = newlen + 4;
 366                 return NT_STATUS_OK;
 367         }
 368
 369         if (!valid_packet_size(len)) {
 370                 return NT_STATUS_INVALID_PARAMETER;
 371         }
 372
 373         /*
 374          * Not a valid writeX call. Just do the standard
 375          * talloc and return.
 376          */
 377
 378         *buffer = talloc_array(mem_ctx, char, len+4);
 379
 380         if (*buffer == NULL) {
 381                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 382                           (int)len+4));
 383                 return NT_STATUS_NO_MEMORY;
 384         }
 385
 386         /* Copy in what we already read. */
 387         memcpy(*buffer,
 388                 writeX_header,
 389                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 390         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 391
 392         if(toread > 0) {
 393                 status = read_packet_remainder(
 394                         sock,
 395                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 396                         timeout, toread);
 397
 398                 if (!NT_STATUS_IS_OK(status)) {
 399                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 400                                    nt_errstr(status)));
 401                         return status;
 402                 }
 403         }
 404
 405         *len_ret = len + 4;
 406         return NT_STATUS_OK;
 407 }
 408
 409 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 410                                        struct smbd_server_connection *sconn,
 411                                        int sock,
 412                                        char **buffer, unsigned int timeout,
 413                                        size_t *p_unread, size_t *plen)
 414 {
 415         char lenbuf[4];
 416         size_t len;
 417         int min_recv_size = lp_min_receive_file_size();
 418         NTSTATUS status;
 419
 420         *p_unread = 0;
 421
 422         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 423                                                   &len);
 424         if (!NT_STATUS_IS_OK(status)) {
 425                 return status;
 426         }
 427
 428         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 429             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 430                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 431             !srv_is_signing_active(sconn) &&
 432             sconn->smb1.echo_handler.trusted_fde == NULL) {
 433
 434                 return receive_smb_raw_talloc_partial_read(
 435                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 436                         p_unread, plen);
 437         }
 438
 439         if (!valid_packet_size(len)) {
 440                 return NT_STATUS_INVALID_PARAMETER;
 441         }
 442
 443         /*
 444          * The +4 here can't wrap, we've checked the length above already.
 445          */
 446
 447         *buffer = talloc_array(mem_ctx, char, len+4);
 448
 449         if (*buffer == NULL) {
 450                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 451                           (int)len+4));
 452                 return NT_STATUS_NO_MEMORY;
 453         }
 454
 455         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 456
 457         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 458         if (!NT_STATUS_IS_OK(status)) {
 459                 return status;
 460         }
 461
 462         *plen = len + 4;
 463         return NT_STATUS_OK;
 464 }
 465
 466 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 467                                    struct smbd_server_connection *sconn,
 468                                    int sock,
 469                                    char **buffer, unsigned int timeout,
 470                                    size_t *p_unread, bool *p_encrypted,
 471                                    size_t *p_len,
 472                                    uint32_t *seqnum,
 473                                    bool trusted_channel)
 474 {
 475         size_t len = 0;
 476         NTSTATUS status;
 477
 478         *p_encrypted = false;
 479
 480         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 481                                         p_unread, &len);
 482         if (!NT_STATUS_IS_OK(status)) {
 483                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 484                       ("receive_smb_raw_talloc failed for client %s "
 485                        "read error = %s.\n",
 486                        tsocket_address_string(sconn->remote_address,
 487                                               talloc_tos()),
 488                        nt_errstr(status)) );
 489                 return status;
 490         }
 491
 492         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 493                 status = srv_decrypt_buffer(sconn, *buffer);
 494                 if (!NT_STATUS_IS_OK(status)) {
 495                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 496                                 "incoming packet! Error %s\n",
 497                                 nt_errstr(status) ));
 498                         return status;
 499                 }
 500                 *p_encrypted = true;
 501         }
 502
 503         /* Check the incoming SMB signature. */
 504         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 505                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 506                           "incoming packet!\n"));
 507                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 508         }
 509
 510         *p_len = len;
 511         return NT_STATUS_OK;
 512 }
 513
 514 /*
 515  * Initialize a struct smb_request from an inbuf
 516  */
 517
 518 static bool init_smb_request(struct smb_request *req,
 519                              struct smbd_server_connection *sconn,
 520                              const uint8 *inbuf,
 521                              size_t unread_bytes, bool encrypted,
 522                              uint32_t seqnum)
 523 {
 524         struct smbXsrv_tcon *tcon;
 525         NTSTATUS status;
 526         NTTIME now;
 527         size_t req_size = smb_len(inbuf) + 4;
 528
 529         /* Ensure we have at least smb_size bytes. */
 530         if (req_size < smb_size) {
 531                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 532                         (unsigned int)req_size ));
 533                 return false;
 534         }
 535
 536         req->request_time = timeval_current();
 537         now = timeval_to_nttime(&req->request_time);
 538
 539         req->cmd    = CVAL(inbuf, smb_com);
 540         req->flags2 = SVAL(inbuf, smb_flg2);
 541         req->smbpid = SVAL(inbuf, smb_pid);
 542         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 543         req->seqnum = seqnum;
 544         req->vuid   = SVAL(inbuf, smb_uid);
 545         req->tid    = SVAL(inbuf, smb_tid);
 546         req->wct    = CVAL(inbuf, smb_wct);
 547         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 548         req->buflen = smb_buflen(inbuf);
 549         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 550         req->unread_bytes = unread_bytes;
 551         req->encrypted = encrypted;
 552         req->sconn = sconn;
 553         status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
 554         if (NT_STATUS_IS_OK(status)) {
 555                 req->conn = tcon->compat;
 556         } else {
 557                 req->conn = NULL;
 558         }
 559         req->chain_fsp = NULL;
 560         req->smb2req = NULL;
 561         req->priv_paths = NULL;
 562         req->chain = NULL;
 563         smb_init_perfcount_data(&req->pcd);
 564
 565         /* Ensure we have at least wct words and 2 bytes of bcc. */
 566         if (smb_size + req->wct*2 > req_size) {
 567                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 568                         (unsigned int)req->wct,
 569                         (unsigned int)req_size));
 570                 return false;
 571         }
 572         /* Ensure bcc is correct. */
 573         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 574                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 575                         "(wct = %u, size %u)\n",
 576                         (unsigned int)req->buflen,
 577                         (unsigned int)req->wct,
 578                         (unsigned int)req_size));
 579                 return false;
 580         }
 581
 582         req->outbuf = NULL;
 583         return true;
 584 }
 585
 586 static void process_smb(struct smbd_server_connection *conn,
 587                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 588                         uint32_t seqnum, bool encrypted,
 589                         struct smb_perfcount_data *deferred_pcd);
 590
 591 static void smbd_deferred_open_timer(struct tevent_context *ev,
 592                                      struct tevent_timer *te,
 593                                      struct timeval _tval,
 594                                      void *private_data)
 595 {
 596         struct pending_message_list *msg = talloc_get_type(private_data,
 597                                            struct pending_message_list);
 598         struct smbd_server_connection *sconn = msg->sconn;
 599         TALLOC_CTX *mem_ctx = talloc_tos();
 600         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 601         uint8_t *inbuf;
 602
 603         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 604                                          msg->buf.length);
 605         if (inbuf == NULL) {
 606                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 607                 return;
 608         }
 609
 610         /* We leave this message on the queue so the open code can
 611            know this is a retry. */
 612         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 613                 (unsigned long long)mid ));
 614
 615         /* Mark the message as processed so this is not
 616          * re-processed in error. */
 617         msg->processed = true;
 618
 619         process_smb(sconn, inbuf,
 620                     msg->buf.length, 0,
 621                     msg->seqnum, msg->encrypted, &msg->pcd);
 622
 623         /* If it's still there and was processed, remove it. */
 624         msg = get_deferred_open_message_smb(sconn, mid);
 625         if (msg && msg->processed) {
 626                 remove_deferred_open_message_smb(sconn, mid);
 627         }
 628 }
 629
 630 /****************************************************************************
 631  Function to push a message onto the tail of a linked list of smb messages ready
 632  for processing.
 633 ****************************************************************************/
 634
 635 static bool push_queued_message(struct smb_request *req,
 636                                 struct timeval request_time,
 637                                 struct timeval end_time,
 638                                 char *private_data, size_t private_len)
 639 {
 640         int msg_len = smb_len(req->inbuf) + 4;
 641         struct pending_message_list *msg;
 642
 643         msg = talloc_zero(NULL, struct pending_message_list);
 644
 645         if(msg == NULL) {
 646                 DEBUG(0,("push_message: malloc fail (1)\n"));
 647                 return False;
 648         }
 649         msg->sconn = req->sconn;
 650
 651         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 652         if(msg->buf.data == NULL) {
 653                 DEBUG(0,("push_message: malloc fail (2)\n"));
 654                 TALLOC_FREE(msg);
 655                 return False;
 656         }
 657
 658         msg->request_time = request_time;
 659         msg->seqnum = req->seqnum;
 660         msg->encrypted = req->encrypted;
 661         msg->processed = false;
 662         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 663
 664         if (private_data) {
 665                 msg->private_data = data_blob_talloc(msg, private_data,
 666                                                      private_len);
 667                 if (msg->private_data.data == NULL) {
 668                         DEBUG(0,("push_message: malloc fail (3)\n"));
 669                         TALLOC_FREE(msg);
 670                         return False;
 671                 }
 672         }
 673
 674 #if 0
 675         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 676                                    msg,
 677                                    end_time,
 678                                    smbd_deferred_open_timer,
 679                                    msg);
 680         if (!msg->te) {
 681                 DEBUG(0,("push_message: event_add_timed failed\n"));
 682                 TALLOC_FREE(msg);
 683                 return false;
 684         }
 685 #endif
 686
 687         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 688                       struct pending_message_list *);
 689
 690         DEBUG(10,("push_message: pushed message length %u on "
 691                   "deferred_open_queue\n", (unsigned int)msg_len));
 692
 693         return True;
 694 }
 695
 696 /****************************************************************************
 697  Function to delete a sharing violation open message by mid.
 698 ****************************************************************************/
 699
 700 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 701                                       uint64_t mid)
 702 {
 703         struct pending_message_list *pml;
 704
 705         if (sconn->using_smb2) {
 706                 remove_deferred_open_message_smb2(sconn, mid);
 707                 return;
 708         }
 709
 710         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 711                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 712                         DEBUG(10,("remove_deferred_open_message_smb: "
 713                                   "deleting mid %llu len %u\n",
 714                                   (unsigned long long)mid,
 715                                   (unsigned int)pml->buf.length ));
 716                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 717                         TALLOC_FREE(pml);
 718                         return;
 719                 }
 720         }
 721 }
 722
 723 /****************************************************************************
 724  Move a sharing violation open retry message to the front of the list and
 725  schedule it for immediate processing.
 726 ****************************************************************************/
 727
 728 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 729                                         uint64_t mid)
 730 {
 731         struct pending_message_list *pml;
 732         int i = 0;
 733
 734         if (sconn->using_smb2) {
 735                 return schedule_deferred_open_message_smb2(sconn, mid);
 736         }
 737
 738         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 739                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 740
 741                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 742                         "msg_mid = %llu\n",
 743                         i++,
 744                         (unsigned long long)msg_mid ));
 745
 746                 if (mid == msg_mid) {
 747                         struct tevent_timer *te;
 748
 749                         if (pml->processed) {
 750                                 /* A processed message should not be
 751                                  * rescheduled. */
 752                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 753                                         "message mid %llu was already processed\n",
 754                                         (unsigned long long)msg_mid ));
 755                                 continue;
 756                         }
 757
 758                         DEBUG(10,("schedule_deferred_open_message_smb: "
 759                                 "scheduling mid %llu\n",
 760                                 (unsigned long long)mid ));
 761
 762                         te = tevent_add_timer(pml->sconn->ev_ctx,
 763                                               pml,
 764                                               timeval_zero(),
 765                                               smbd_deferred_open_timer,
 766                                               pml);
 767                         if (!te) {
 768                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 769                                         "event_add_timed() failed, "
 770                                         "skipping mid %llu\n",
 771                                         (unsigned long long)msg_mid ));
 772                         }
 773
 774                         TALLOC_FREE(pml->te);
 775                         pml->te = te;
 776                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 777                         return true;
 778                 }
 779         }
 780
 781         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 782                 "find message mid %llu\n",
 783                 (unsigned long long)mid ));
 784
 785         return false;
 786 }
 787
 788 /****************************************************************************
 789  Return true if this mid is on the deferred queue and was not yet processed.
 790 ****************************************************************************/
 791
 792 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 793 {
 794         struct pending_message_list *pml;
 795
 796         if (sconn->using_smb2) {
 797                 return open_was_deferred_smb2(sconn, mid);
 798         }
 799
 800         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 801                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 802                         return True;
 803                 }
 804         }
 805         return False;
 806 }
 807
 808 /****************************************************************************
 809  Return the message queued by this mid.
 810 ****************************************************************************/
 811
 812 static struct pending_message_list *get_deferred_open_message_smb(
 813         struct smbd_server_connection *sconn, uint64_t mid)
 814 {
 815         struct pending_message_list *pml;
 816
 817         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 818                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 819                         return pml;
 820                 }
 821         }
 822         return NULL;
 823 }
 824
 825 /****************************************************************************
 826  Get the state data queued by this mid.
 827 ****************************************************************************/
 828
 829 bool get_deferred_open_message_state(struct smb_request *smbreq,
 830                                 struct timeval *p_request_time,
 831                                 void **pp_state)
 832 {
 833         struct pending_message_list *pml;
 834
 835         if (smbreq->sconn->using_smb2) {
 836                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 837                                         p_request_time,
 838                                         pp_state);
 839         }
 840
 841         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 842         if (!pml) {
 843                 return false;
 844         }
 845         if (p_request_time) {
 846                 *p_request_time = pml->request_time;
 847         }
 848         if (pp_state) {
 849                 *pp_state = (void *)pml->private_data.data;
 850         }
 851         return true;
 852 }
 853
 854 /****************************************************************************
 855  Function to push a deferred open smb message onto a linked list of local smb
 856  messages ready for processing.
 857 ****************************************************************************/
 858
 859 bool push_deferred_open_message_smb(struct smb_request *req,
 860                                struct timeval request_time,
 861                                struct timeval timeout,
 862                                struct file_id id,
 863                                char *private_data, size_t priv_len)
 864 {
 865         struct timeval end_time;
 866
 867         if (req->smb2req) {
 868                 return push_deferred_open_message_smb2(req->smb2req,
 869                                                 request_time,
 870                                                 timeout,
 871                                                 id,
 872                                                 private_data,
 873                                                 priv_len);
 874         }
 875
 876         if (req->unread_bytes) {
 877                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 878                         "unread_bytes = %u\n",
 879                         (unsigned int)req->unread_bytes ));
 880                 smb_panic("push_deferred_open_message_smb: "
 881                         "logic error unread_bytes != 0" );
 882         }
 883
 884         end_time = timeval_sum(&request_time, &timeout);
 885
 886         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 887                 "len %u mid %llu timeout time [%u.%06u]\n",
 888                 (unsigned int) smb_len(req->inbuf)+4,
 889                 (unsigned long long)req->mid,
 890                 (unsigned int)end_time.tv_sec,
 891                 (unsigned int)end_time.tv_usec));
 892
 893         return push_queued_message(req, request_time, end_time,
 894                                    private_data, priv_len);
 895 }
 896
 897 static void smbd_sig_term_handler(struct tevent_context *ev,
 898                                   struct tevent_signal *se,
 899                                   int signum,
 900                                   int count,
 901                                   void *siginfo,
 902                                   void *private_data)
 903 {
 904         exit_server_cleanly("termination signal");
 905 }
 906
 907 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 908 {
 909         struct tevent_signal *se;
 910
 911         se = tevent_add_signal(sconn->ev_ctx,
 912                                sconn,
 913                                SIGTERM, 0,
 914                                smbd_sig_term_handler,
 915                                sconn);
 916         if (!se) {
 917                 exit_server("failed to setup SIGTERM handler");
 918         }
 919 }
 920
 921 static void smbd_sig_hup_handler(struct tevent_context *ev,
 922                                   struct tevent_signal *se,
 923                                   int signum,
 924                                   int count,
 925                                   void *siginfo,
 926                                   void *private_data)
 927 {
 928         struct smbd_server_connection *sconn =
 929                 talloc_get_type_abort(private_data,
 930                 struct smbd_server_connection);
 931
 932         change_to_root_user();
 933         DEBUG(1,("Reloading services after SIGHUP\n"));
 934         reload_services(sconn, conn_snum_used, false);
 935 }
 936
 937 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
 938 {
 939         struct tevent_signal *se;
 940
 941         se = tevent_add_signal(sconn->ev_ctx,
 942                                sconn,
 943                                SIGHUP, 0,
 944                                smbd_sig_hup_handler,
 945                                sconn);
 946         if (!se) {
 947                 exit_server("failed to setup SIGHUP handler");
 948         }
 949 }
 950
 951 static void smbd_conf_updated(struct messaging_context *msg,
 952                               void *private_data,
 953                               uint32_t msg_type,
 954                               struct server_id server_id,
 955                               DATA_BLOB *data)
 956 {
 957         struct smbd_server_connection *sconn =
 958                 talloc_get_type_abort(private_data,
 959                 struct smbd_server_connection);
 960
 961         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
 962                   "updated. Reloading.\n"));
 963         change_to_root_user();
 964         reload_services(sconn, conn_snum_used, false);
 965 }
 966
 967 /*
 968  * Only allow 5 outstanding trans requests. We're allocating memory, so
 969  * prevent a DoS.
 970  */
 971
 972 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 973 {
 974         int count = 0;
 975         for (; list != NULL; list = list->next) {
 976
 977                 if (list->mid == mid) {
 978                         return NT_STATUS_INVALID_PARAMETER;
 979                 }
 980
 981                 count += 1;
 982         }
 983         if (count > 5) {
 984                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 985         }
 986
 987         return NT_STATUS_OK;
 988 }
 989
 990 /*
 991 These flags determine some of the permissions required to do an operation
 992
 993 Note that I don't set NEED_WRITE on some write operations because they
 994 are used by some brain-dead clients when printing, and I don't want to
 995 force write permissions on print services.
 996 */
 997 #define AS_USER (1<<0)
 998 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 999 #define TIME_INIT (1<<2)
1000 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1001 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1002 #define DO_CHDIR (1<<6)
1003
1004 /*
1005    define a list of possible SMB messages and their corresponding
1006    functions. Any message that has a NULL function is unimplemented -
1007    please feel free to contribute implementations!
1008 */
1009 static const struct smb_message_struct {
1010         const char *name;
1011         void (*fn)(struct smb_request *req);
1012         int flags;
1013 } smb_messages[256] = {
1014
1015 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1016 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1017 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1018 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1019 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1020 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1021 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1022 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1023 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1024 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1025 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1026 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1027 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1028 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1029 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1030 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1031 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1032 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1033 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1034 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1035 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1036 /* 0x15 */ { NULL, NULL, 0 },
1037 /* 0x16 */ { NULL, NULL, 0 },
1038 /* 0x17 */ { NULL, NULL, 0 },
1039 /* 0x18 */ { NULL, NULL, 0 },
1040 /* 0x19 */ { NULL, NULL, 0 },
1041 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1042 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1043 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1044 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1045 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1046 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1047 /* 0x20 */ { "SMBwritec", NULL,0},
1048 /* 0x21 */ { NULL, NULL, 0 },
1049 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1050 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1051 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1052 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1053 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1054 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1055 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1056 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1057 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1058 /* 0x2b */ { "SMBecho",reply_echo,0},
1059 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1060 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1061 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1062 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1063 /* 0x30 */ { NULL, NULL, 0 },
1064 /* 0x31 */ { NULL, NULL, 0 },
1065 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1066 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1067 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1068 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1069 /* 0x36 */ { NULL, NULL, 0 },
1070 /* 0x37 */ { NULL, NULL, 0 },
1071 /* 0x38 */ { NULL, NULL, 0 },
1072 /* 0x39 */ { NULL, NULL, 0 },
1073 /* 0x3a */ { NULL, NULL, 0 },
1074 /* 0x3b */ { NULL, NULL, 0 },
1075 /* 0x3c */ { NULL, NULL, 0 },
1076 /* 0x3d */ { NULL, NULL, 0 },
1077 /* 0x3e */ { NULL, NULL, 0 },
1078 /* 0x3f */ { NULL, NULL, 0 },
1079 /* 0x40 */ { NULL, NULL, 0 },
1080 /* 0x41 */ { NULL, NULL, 0 },
1081 /* 0x42 */ { NULL, NULL, 0 },
1082 /* 0x43 */ { NULL, NULL, 0 },
1083 /* 0x44 */ { NULL, NULL, 0 },
1084 /* 0x45 */ { NULL, NULL, 0 },
1085 /* 0x46 */ { NULL, NULL, 0 },
1086 /* 0x47 */ { NULL, NULL, 0 },
1087 /* 0x48 */ { NULL, NULL, 0 },
1088 /* 0x49 */ { NULL, NULL, 0 },
1089 /* 0x4a */ { NULL, NULL, 0 },
1090 /* 0x4b */ { NULL, NULL, 0 },
1091 /* 0x4c */ { NULL, NULL, 0 },
1092 /* 0x4d */ { NULL, NULL, 0 },
1093 /* 0x4e */ { NULL, NULL, 0 },
1094 /* 0x4f */ { NULL, NULL, 0 },
1095 /* 0x50 */ { NULL, NULL, 0 },
1096 /* 0x51 */ { NULL, NULL, 0 },
1097 /* 0x52 */ { NULL, NULL, 0 },
1098 /* 0x53 */ { NULL, NULL, 0 },
1099 /* 0x54 */ { NULL, NULL, 0 },
1100 /* 0x55 */ { NULL, NULL, 0 },
1101 /* 0x56 */ { NULL, NULL, 0 },
1102 /* 0x57 */ { NULL, NULL, 0 },
1103 /* 0x58 */ { NULL, NULL, 0 },
1104 /* 0x59 */ { NULL, NULL, 0 },
1105 /* 0x5a */ { NULL, NULL, 0 },
1106 /* 0x5b */ { NULL, NULL, 0 },
1107 /* 0x5c */ { NULL, NULL, 0 },
1108 /* 0x5d */ { NULL, NULL, 0 },
1109 /* 0x5e */ { NULL, NULL, 0 },
1110 /* 0x5f */ { NULL, NULL, 0 },
1111 /* 0x60 */ { NULL, NULL, 0 },
1112 /* 0x61 */ { NULL, NULL, 0 },
1113 /* 0x62 */ { NULL, NULL, 0 },
1114 /* 0x63 */ { NULL, NULL, 0 },
1115 /* 0x64 */ { NULL, NULL, 0 },
1116 /* 0x65 */ { NULL, NULL, 0 },
1117 /* 0x66 */ { NULL, NULL, 0 },
1118 /* 0x67 */ { NULL, NULL, 0 },
1119 /* 0x68 */ { NULL, NULL, 0 },
1120 /* 0x69 */ { NULL, NULL, 0 },
1121 /* 0x6a */ { NULL, NULL, 0 },
1122 /* 0x6b */ { NULL, NULL, 0 },
1123 /* 0x6c */ { NULL, NULL, 0 },
1124 /* 0x6d */ { NULL, NULL, 0 },
1125 /* 0x6e */ { NULL, NULL, 0 },
1126 /* 0x6f */ { NULL, NULL, 0 },
1127 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1128 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1129 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1130 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1131 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1132 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1133 /* 0x76 */ { NULL, NULL, 0 },
1134 /* 0x77 */ { NULL, NULL, 0 },
1135 /* 0x78 */ { NULL, NULL, 0 },
1136 /* 0x79 */ { NULL, NULL, 0 },
1137 /* 0x7a */ { NULL, NULL, 0 },
1138 /* 0x7b */ { NULL, NULL, 0 },
1139 /* 0x7c */ { NULL, NULL, 0 },
1140 /* 0x7d */ { NULL, NULL, 0 },
1141 /* 0x7e */ { NULL, NULL, 0 },
1142 /* 0x7f */ { NULL, NULL, 0 },
1143 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1144 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1145 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1146 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1147 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1148 /* 0x85 */ { NULL, NULL, 0 },
1149 /* 0x86 */ { NULL, NULL, 0 },
1150 /* 0x87 */ { NULL, NULL, 0 },
1151 /* 0x88 */ { NULL, NULL, 0 },
1152 /* 0x89 */ { NULL, NULL, 0 },
1153 /* 0x8a */ { NULL, NULL, 0 },
1154 /* 0x8b */ { NULL, NULL, 0 },
1155 /* 0x8c */ { NULL, NULL, 0 },
1156 /* 0x8d */ { NULL, NULL, 0 },
1157 /* 0x8e */ { NULL, NULL, 0 },
1158 /* 0x8f */ { NULL, NULL, 0 },
1159 /* 0x90 */ { NULL, NULL, 0 },
1160 /* 0x91 */ { NULL, NULL, 0 },
1161 /* 0x92 */ { NULL, NULL, 0 },
1162 /* 0x93 */ { NULL, NULL, 0 },
1163 /* 0x94 */ { NULL, NULL, 0 },
1164 /* 0x95 */ { NULL, NULL, 0 },
1165 /* 0x96 */ { NULL, NULL, 0 },
1166 /* 0x97 */ { NULL, NULL, 0 },
1167 /* 0x98 */ { NULL, NULL, 0 },
1168 /* 0x99 */ { NULL, NULL, 0 },
1169 /* 0x9a */ { NULL, NULL, 0 },
1170 /* 0x9b */ { NULL, NULL, 0 },
1171 /* 0x9c */ { NULL, NULL, 0 },
1172 /* 0x9d */ { NULL, NULL, 0 },
1173 /* 0x9e */ { NULL, NULL, 0 },
1174 /* 0x9f */ { NULL, NULL, 0 },
1175 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1176 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1177 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1178 /* 0xa3 */ { NULL, NULL, 0 },
1179 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1180 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1181 /* 0xa6 */ { NULL, NULL, 0 },
1182 /* 0xa7 */ { NULL, NULL, 0 },
1183 /* 0xa8 */ { NULL, NULL, 0 },
1184 /* 0xa9 */ { NULL, NULL, 0 },
1185 /* 0xaa */ { NULL, NULL, 0 },
1186 /* 0xab */ { NULL, NULL, 0 },
1187 /* 0xac */ { NULL, NULL, 0 },
1188 /* 0xad */ { NULL, NULL, 0 },
1189 /* 0xae */ { NULL, NULL, 0 },
1190 /* 0xaf */ { NULL, NULL, 0 },
1191 /* 0xb0 */ { NULL, NULL, 0 },
1192 /* 0xb1 */ { NULL, NULL, 0 },
1193 /* 0xb2 */ { NULL, NULL, 0 },
1194 /* 0xb3 */ { NULL, NULL, 0 },
1195 /* 0xb4 */ { NULL, NULL, 0 },
1196 /* 0xb5 */ { NULL, NULL, 0 },
1197 /* 0xb6 */ { NULL, NULL, 0 },
1198 /* 0xb7 */ { NULL, NULL, 0 },
1199 /* 0xb8 */ { NULL, NULL, 0 },
1200 /* 0xb9 */ { NULL, NULL, 0 },
1201 /* 0xba */ { NULL, NULL, 0 },
1202 /* 0xbb */ { NULL, NULL, 0 },
1203 /* 0xbc */ { NULL, NULL, 0 },
1204 /* 0xbd */ { NULL, NULL, 0 },
1205 /* 0xbe */ { NULL, NULL, 0 },
1206 /* 0xbf */ { NULL, NULL, 0 },
1207 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1208 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1209 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1210 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1211 /* 0xc4 */ { NULL, NULL, 0 },
1212 /* 0xc5 */ { NULL, NULL, 0 },
1213 /* 0xc6 */ { NULL, NULL, 0 },
1214 /* 0xc7 */ { NULL, NULL, 0 },
1215 /* 0xc8 */ { NULL, NULL, 0 },
1216 /* 0xc9 */ { NULL, NULL, 0 },
1217 /* 0xca */ { NULL, NULL, 0 },
1218 /* 0xcb */ { NULL, NULL, 0 },
1219 /* 0xcc */ { NULL, NULL, 0 },
1220 /* 0xcd */ { NULL, NULL, 0 },
1221 /* 0xce */ { NULL, NULL, 0 },
1222 /* 0xcf */ { NULL, NULL, 0 },
1223 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1224 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1225 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1226 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1227 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1228 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1229 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1230 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1231 /* 0xd8 */ { NULL, NULL, 0 },
1232 /* 0xd9 */ { NULL, NULL, 0 },
1233 /* 0xda */ { NULL, NULL, 0 },
1234 /* 0xdb */ { NULL, NULL, 0 },
1235 /* 0xdc */ { NULL, NULL, 0 },
1236 /* 0xdd */ { NULL, NULL, 0 },
1237 /* 0xde */ { NULL, NULL, 0 },
1238 /* 0xdf */ { NULL, NULL, 0 },
1239 /* 0xe0 */ { NULL, NULL, 0 },
1240 /* 0xe1 */ { NULL, NULL, 0 },
1241 /* 0xe2 */ { NULL, NULL, 0 },
1242 /* 0xe3 */ { NULL, NULL, 0 },
1243 /* 0xe4 */ { NULL, NULL, 0 },
1244 /* 0xe5 */ { NULL, NULL, 0 },
1245 /* 0xe6 */ { NULL, NULL, 0 },
1246 /* 0xe7 */ { NULL, NULL, 0 },
1247 /* 0xe8 */ { NULL, NULL, 0 },
1248 /* 0xe9 */ { NULL, NULL, 0 },
1249 /* 0xea */ { NULL, NULL, 0 },
1250 /* 0xeb */ { NULL, NULL, 0 },
1251 /* 0xec */ { NULL, NULL, 0 },
1252 /* 0xed */ { NULL, NULL, 0 },
1253 /* 0xee */ { NULL, NULL, 0 },
1254 /* 0xef */ { NULL, NULL, 0 },
1255 /* 0xf0 */ { NULL, NULL, 0 },
1256 /* 0xf1 */ { NULL, NULL, 0 },
1257 /* 0xf2 */ { NULL, NULL, 0 },
1258 /* 0xf3 */ { NULL, NULL, 0 },
1259 /* 0xf4 */ { NULL, NULL, 0 },
1260 /* 0xf5 */ { NULL, NULL, 0 },
1261 /* 0xf6 */ { NULL, NULL, 0 },
1262 /* 0xf7 */ { NULL, NULL, 0 },
1263 /* 0xf8 */ { NULL, NULL, 0 },
1264 /* 0xf9 */ { NULL, NULL, 0 },
1265 /* 0xfa */ { NULL, NULL, 0 },
1266 /* 0xfb */ { NULL, NULL, 0 },
1267 /* 0xfc */ { NULL, NULL, 0 },
1268 /* 0xfd */ { NULL, NULL, 0 },
1269 /* 0xfe */ { NULL, NULL, 0 },
1270 /* 0xff */ { NULL, NULL, 0 }
1271
1272 };
1273
1274 /*******************************************************************
1275  allocate and initialize a reply packet
1276 ********************************************************************/
1277
1278 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1279                           const char *inbuf, char **outbuf, uint8_t num_words,
1280                           uint32_t num_bytes)
1281 {
1282         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1283
1284         /*
1285          * Protect against integer wrap.
1286          * The SMB layer reply can be up to 0xFFFFFF bytes.
1287          */
1288         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1289                 char *msg;
1290                 if (asprintf(&msg, "num_bytes too large: %u",
1291                              (unsigned)num_bytes) == -1) {
1292                         msg = discard_const_p(char, "num_bytes too large");
1293                 }
1294                 smb_panic(msg);
1295         }
1296
1297         /*
1298          * Here we include the NBT header for now.
1299          */
1300         *outbuf = talloc_array(mem_ctx, char,
1301                                NBT_HDR_SIZE + smb_len);
1302         if (*outbuf == NULL) {
1303                 return false;
1304         }
1305
1306         construct_reply_common(req, inbuf, *outbuf);
1307         srv_set_message(*outbuf, num_words, num_bytes, false);
1308         /*
1309          * Zero out the word area, the caller has to take care of the bcc area
1310          * himself
1311          */
1312         if (num_words != 0) {
1313                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1314         }
1315
1316         return true;
1317 }
1318
1319 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1320 {
1321         char *outbuf;
1322         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1323                            num_bytes)) {
1324                 smb_panic("could not allocate output buffer\n");
1325         }
1326         req->outbuf = (uint8_t *)outbuf;
1327 }
1328
1329
1330 /*******************************************************************
1331  Dump a packet to a file.
1332 ********************************************************************/
1333
1334 static void smb_dump(const char *name, int type, const char *data)
1335 {
1336         size_t len;
1337         int fd, i;
1338         char *fname = NULL;
1339         if (DEBUGLEVEL < 50) {
1340                 return;
1341         }
1342
1343         len = smb_len_tcp(data)+4;
1344         for (i=1;i<100;i++) {
1345                 fname = talloc_asprintf(talloc_tos(),
1346                                 "/tmp/%s.%d.%s",
1347                                 name,
1348                                 i,
1349                                 type ? "req" : "resp");
1350                 if (fname == NULL) {
1351                         return;
1352                 }
1353                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1354                 if (fd != -1 || errno != EEXIST) break;
1355                 TALLOC_FREE(fname);
1356         }
1357         if (fd != -1) {
1358                 ssize_t ret = write(fd, data, len);
1359                 if (ret != len)
1360                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1361                 close(fd);
1362                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1363         }
1364         TALLOC_FREE(fname);
1365 }
1366
1367 /****************************************************************************
1368  Prepare everything for calling the actual request function, and potentially
1369  call the request function via the "new" interface.
1370
1371  Return False if the "legacy" function needs to be called, everything is
1372  prepared.
1373
1374  Return True if we're done.
1375
1376  I know this API sucks, but it is the one with the least code change I could
1377  find.
1378 ****************************************************************************/
1379
1380 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1381 {
1382         int flags;
1383         uint64_t session_tag;
1384         connection_struct *conn = NULL;
1385         struct smbd_server_connection *sconn = req->sconn;
1386         NTTIME now = timeval_to_nttime(&req->request_time);
1387         struct smbXsrv_session *session = NULL;
1388         NTSTATUS status;
1389
1390         errno = 0;
1391
1392         if (smb_messages[type].fn == NULL) {
1393                 DEBUG(0,("Unknown message type %d!\n",type));
1394                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1395                 reply_unknown_new(req, type);
1396                 return NULL;
1397         }
1398
1399         flags = smb_messages[type].flags;
1400
1401         /* In share mode security we must ignore the vuid. */
1402         session_tag = req->vuid;
1403         conn = req->conn;
1404
1405         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1406                  (int)getpid(), (unsigned long)conn));
1407
1408         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1409
1410         /* Ensure this value is replaced in the incoming packet. */
1411         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1412
1413         /*
1414          * Ensure the correct username is in current_user_info.  This is a
1415          * really ugly bugfix for problems with multiple session_setup_and_X's
1416          * being done and allowing %U and %G substitutions to work correctly.
1417          * There is a reason this code is done here, don't move it unless you
1418          * know what you're doing... :-).
1419          * JRA.
1420          */
1421
1422         /*
1423          * lookup an existing session
1424          *
1425          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1426          * here, the main check is still in change_to_user()
1427          */
1428         status = smb1srv_session_lookup(sconn->conn,
1429                                         session_tag,
1430                                         now,
1431                                         &session);
1432         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1433                 switch (type) {
1434                 case SMBsesssetupX:
1435                         status = NT_STATUS_OK;
1436                         break;
1437                 default:
1438                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1439                                  (unsigned long long)session_tag,
1440                                  (unsigned long long)req->mid));
1441                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1442                         return conn;
1443                 }
1444         }
1445
1446         if (session_tag != sconn->conn->last_session_id) {
1447                 struct user_struct *vuser = NULL;
1448
1449                 sconn->conn->last_session_id = session_tag;
1450                 if (session) {
1451                         vuser = session->compat;
1452                 }
1453                 if (vuser) {
1454                         set_current_user_info(
1455                                 vuser->session_info->unix_info->sanitized_username,
1456                                 vuser->session_info->unix_info->unix_name,
1457                                 vuser->session_info->info->domain_name);
1458                 }
1459         }
1460
1461         /* Does this call need to be run as the connected user? */
1462         if (flags & AS_USER) {
1463
1464                 /* Does this call need a valid tree connection? */
1465                 if (!conn) {
1466                         /*
1467                          * Amazingly, the error code depends on the command
1468                          * (from Samba4).
1469                          */
1470                         if (type == SMBntcreateX) {
1471                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1472                         } else {
1473                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1474                         }
1475                         return NULL;
1476                 }
1477
1478                 if (!change_to_user(conn,session_tag)) {
1479                         DEBUG(0, ("Error: Could not change to user. Removing "
1480                                 "deferred open, mid=%llu.\n",
1481                                 (unsigned long long)req->mid));
1482                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1483                         return conn;
1484                 }
1485
1486                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1487
1488                 /* Does it need write permission? */
1489                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1490                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1491                         return conn;
1492                 }
1493
1494                 /* IPC services are limited */
1495                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1496                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1497                         return conn;
1498                 }
1499         } else {
1500                 /* This call needs to be run as root */
1501                 change_to_root_user();
1502         }
1503
1504         /* load service specific parameters */
1505         if (conn) {
1506                 if (req->encrypted) {
1507                         conn->encrypted_tid = true;
1508                         /* encrypted required from now on. */
1509                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1510                 } else if (ENCRYPTION_REQUIRED(conn)) {
1511                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1512                                 DEBUG(1,("service[%s] requires encryption"
1513                                         "%s ACCESS_DENIED. mid=%llu\n",
1514                                         lp_servicename(talloc_tos(), SNUM(conn)),
1515                                         smb_fn_name(type),
1516                                         (unsigned long long)req->mid));
1517                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1518                                 return conn;
1519                         }
1520                 }
1521
1522                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1523                                          (flags & (AS_USER|DO_CHDIR)
1524                                           ?True:False))) {
1525                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1526                         return conn;
1527                 }
1528                 conn->num_smb_operations++;
1529         }
1530
1531         /*
1532          * Does this protocol need to be run as guest? (Only archane
1533          * messenger service requests have this...)
1534          */
1535         if (flags & AS_GUEST) {
1536                 char *raddr;
1537                 bool ok;
1538
1539                 if (!change_to_guest()) {
1540                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1541                         return conn;
1542                 }
1543
1544                 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1545                                                          talloc_tos());
1546                 if (raddr == NULL) {
1547                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1548                         return conn;
1549                 }
1550
1551                 /*
1552                  * Haven't we checked this in smbd_process already???
1553                  */
1554
1555                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1556                                   sconn->remote_hostname, raddr);
1557                 TALLOC_FREE(raddr);
1558
1559                 if (!ok) {
1560                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1561                         return conn;
1562                 }
1563         }
1564
1565         smb_messages[type].fn(req);
1566         return req->conn;
1567 }
1568
1569 /****************************************************************************
1570  Construct a reply to the incoming packet.
1571 ****************************************************************************/
1572
1573 static void construct_reply(struct smbd_server_connection *sconn,
1574                             char *inbuf, int size, size_t unread_bytes,
1575                             uint32_t seqnum, bool encrypted,
1576                             struct smb_perfcount_data *deferred_pcd)
1577 {
1578         connection_struct *conn;
1579         struct smb_request *req;
1580
1581         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1582                 smb_panic("could not allocate smb_request");
1583         }
1584
1585         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1586                               encrypted, seqnum)) {
1587                 exit_server_cleanly("Invalid SMB request");
1588         }
1589
1590         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1591
1592         /* we popped this message off the queue - keep original perf data */
1593         if (deferred_pcd)
1594                 req->pcd = *deferred_pcd;
1595         else {
1596                 SMB_PERFCOUNT_START(&req->pcd);
1597                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1598                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1599         }
1600
1601         conn = switch_message(req->cmd, req);
1602
1603         if (req->outbuf == NULL) {
1604                 return;
1605         }
1606
1607         if (CVAL(req->outbuf,0) == 0) {
1608                 show_msg((char *)req->outbuf);
1609         }
1610
1611         if (!srv_send_smb(req->sconn,
1612                         (char *)req->outbuf,
1613                         true, req->seqnum+1,
1614                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1615                         &req->pcd)) {
1616                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1617         }
1618
1619         TALLOC_FREE(req);
1620
1621         return;
1622 }
1623
1624 static void construct_reply_chain(struct smbd_server_connection *sconn,
1625                                   char *inbuf, int size, uint32_t seqnum,
1626                                   bool encrypted,
1627                                   struct smb_perfcount_data *deferred_pcd)
1628 {
1629         struct smb_request **reqs = NULL;
1630         struct smb_request *req;
1631         unsigned num_reqs;
1632         bool ok;
1633
1634         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1635                               seqnum, &reqs, &num_reqs);
1636         if (!ok) {
1637                 char errbuf[smb_size];
1638                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1639                              __LINE__, __FILE__);
1640                 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1641                                   NULL)) {
1642                         exit_server_cleanly("construct_reply_chain: "
1643                                             "srv_send_smb failed.");
1644                 }
1645                 return;
1646         }
1647
1648         req = reqs[0];
1649         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1650
1651         req->conn = switch_message(req->cmd, req);
1652
1653         if (req->outbuf == NULL) {
1654                 /*
1655                  * Request has suspended itself, will come
1656                  * back here.
1657                  */
1658                 return;
1659         }
1660         smb_request_done(req);
1661 }
1662
1663 /*
1664  * To be called from an async SMB handler that is potentially chained
1665  * when it is finished for shipping.
1666  */
1667
1668 void smb_request_done(struct smb_request *req)
1669 {
1670         struct smb_request **reqs = NULL;
1671         struct smb_request *first_req;
1672         size_t i, num_reqs, next_index;
1673         NTSTATUS status;
1674
1675         if (req->chain == NULL) {
1676                 first_req = req;
1677                 goto shipit;
1678         }
1679
1680         reqs = req->chain;
1681         num_reqs = talloc_array_length(reqs);
1682
1683         for (i=0; i<num_reqs; i++) {
1684                 if (reqs[i] == req) {
1685                         break;
1686                 }
1687         }
1688         if (i == num_reqs) {
1689                 /*
1690                  * Invalid chain, should not happen
1691                  */
1692                 status = NT_STATUS_INTERNAL_ERROR;
1693                 goto error;
1694         }
1695         next_index = i+1;
1696
1697         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1698                 struct smb_request *next = reqs[next_index];
1699                 struct smbXsrv_tcon *tcon;
1700                 NTTIME now = timeval_to_nttime(&req->request_time);
1701
1702                 next->vuid = SVAL(req->outbuf, smb_uid);
1703                 next->tid  = SVAL(req->outbuf, smb_tid);
1704                 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1705                                              now, &tcon);
1706                 if (NT_STATUS_IS_OK(status)) {
1707                         req->conn = tcon->compat;
1708                 } else {
1709                         req->conn = NULL;
1710                 }
1711                 next->chain_fsp = req->chain_fsp;
1712                 next->inbuf = req->inbuf;
1713
1714                 req = next;
1715                 req->conn = switch_message(req->cmd, req);
1716
1717                 if (req->outbuf == NULL) {
1718                         /*
1719                          * Request has suspended itself, will come
1720                          * back here.
1721                          */
1722                         return;
1723                 }
1724                 next_index += 1;
1725         }
1726
1727         first_req = reqs[0];
1728
1729         for (i=1; i<next_index; i++) {
1730                 bool ok;
1731
1732                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1733                 if (!ok) {
1734                         status = NT_STATUS_INTERNAL_ERROR;
1735                         goto error;
1736                 }
1737         }
1738
1739         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1740         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1741
1742         /*
1743          * This scary statement intends to set the
1744          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1745          * to the value last_req->outbuf carries
1746          */
1747         SSVAL(first_req->outbuf, smb_flg2,
1748               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1749               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1750
1751         /*
1752          * Transfer the error codes from the subrequest to the main one
1753          */
1754         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1755         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1756
1757         _smb_setlen_large(
1758                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1759
1760 shipit:
1761         if (!srv_send_smb(first_req->sconn,
1762                           (char *)first_req->outbuf,
1763                           true, first_req->seqnum+1,
1764                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1765                           &first_req->pcd)) {
1766                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1767                                     "failed.");
1768         }
1769         TALLOC_FREE(req);       /* non-chained case */
1770         TALLOC_FREE(reqs);      /* chained case */
1771         return;
1772
1773 error:
1774         {
1775                 char errbuf[smb_size];
1776                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1777                 if (!srv_send_smb(req->sconn, errbuf, true,
1778                                   req->seqnum+1, req->encrypted,
1779                                   NULL)) {
1780                         exit_server_cleanly("construct_reply_chain: "
1781                                             "srv_send_smb failed.");
1782                 }
1783         }
1784         TALLOC_FREE(req);       /* non-chained case */
1785         TALLOC_FREE(reqs);      /* chained case */
1786 }
1787
1788 /****************************************************************************
1789  Process an smb from the client
1790 ****************************************************************************/
1791 static void process_smb(struct smbd_server_connection *sconn,
1792                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1793                         uint32_t seqnum, bool encrypted,
1794                         struct smb_perfcount_data *deferred_pcd)
1795 {
1796         int msg_type = CVAL(inbuf,0);
1797
1798         DO_PROFILE_INC(smb_count);
1799
1800         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1801                     smb_len(inbuf) ) );
1802         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1803                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1804
1805         if (msg_type != NBSSmessage) {
1806                 /*
1807                  * NetBIOS session request, keepalive, etc.
1808                  */
1809                 reply_special(sconn, (char *)inbuf, nread);
1810                 goto done;
1811         }
1812
1813         if (sconn->using_smb2) {
1814                 /* At this point we're not really using smb2,
1815                  * we make the decision here.. */
1816                 if (smbd_is_smb2_header(inbuf, nread)) {
1817                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1818                         return;
1819                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1820                                 && CVAL(inbuf, smb_com) != 0x72) {
1821                         /* This is a non-negprot SMB1 packet.
1822                            Disable SMB2 from now on. */
1823                         sconn->using_smb2 = false;
1824                 }
1825         }
1826
1827         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1828          * so subtract 4 from it. */
1829         if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1830                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1831                          smb_len(inbuf)));
1832
1833                 /* special magic for immediate exit */
1834                 if ((nread == 9) &&
1835                     (IVAL(inbuf, 4) == 0x74697865) &&
1836                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1837                         uint8_t exitcode = CVAL(inbuf, 8);
1838                         DEBUG(1, ("Exiting immediately with code %d\n",
1839                                   (int)exitcode));
1840                         exit(exitcode);
1841                 }
1842
1843                 exit_server_cleanly("Non-SMB packet");
1844         }
1845
1846         show_msg((char *)inbuf);
1847
1848         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1849                 construct_reply_chain(sconn, (char *)inbuf, nread,
1850                                       seqnum, encrypted, deferred_pcd);
1851         } else {
1852                 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1853                                 seqnum, encrypted, deferred_pcd);
1854         }
1855
1856         sconn->trans_num++;
1857
1858 done:
1859         sconn->num_requests++;
1860
1861         /* The timeout_processing function isn't run nearly
1862            often enough to implement 'max log size' without
1863            overrunning the size of the file by many megabytes.
1864            This is especially true if we are running at debug
1865            level 10.  Checking every 50 SMBs is a nice
1866            tradeoff of performance vs log file size overrun. */
1867
1868         if ((sconn->num_requests % 50) == 0 &&
1869             need_to_check_log_size()) {
1870                 change_to_root_user();
1871                 check_log_size();
1872         }
1873 }
1874
1875 /****************************************************************************
1876  Return a string containing the function name of a SMB command.
1877 ****************************************************************************/
1878
1879 const char *smb_fn_name(int type)
1880 {
1881         const char *unknown_name = "SMBunknown";
1882
1883         if (smb_messages[type].name == NULL)
1884                 return(unknown_name);
1885
1886         return(smb_messages[type].name);
1887 }
1888
1889 /****************************************************************************
1890  Helper functions for contruct_reply.
1891 ****************************************************************************/
1892
1893 void add_to_common_flags2(uint32 v)
1894 {
1895         common_flags2 |= v;
1896 }
1897
1898 void remove_from_common_flags2(uint32 v)
1899 {
1900         common_flags2 &= ~v;
1901 }
1902
1903 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1904                                    char *outbuf)
1905 {
1906         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1907         uint16_t out_flags2 = common_flags2;
1908
1909         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1910         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1911         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1912
1913         srv_set_message(outbuf,0,0,false);
1914
1915         SCVAL(outbuf, smb_com, req->cmd);
1916         SIVAL(outbuf,smb_rcls,0);
1917         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1918         SSVAL(outbuf,smb_flg2, out_flags2);
1919         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1920         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1921
1922         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1923         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1924         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1925         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1926 }
1927
1928 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1929 {
1930         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1931 }
1932
1933 /**
1934  * @brief Find the smb_cmd offset of the last command pushed
1935  * @param[in] buf       The buffer we're building up
1936  * @retval              Where can we put our next andx cmd?
1937  *
1938  * While chaining requests, the "next" request we're looking at needs to put
1939  * its SMB_Command before the data the previous request already built up added
1940  * to the chain. Find the offset to the place where we have to put our cmd.
1941  */
1942
1943 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1944 {
1945         uint8_t cmd;
1946         size_t ofs;
1947
1948         cmd = CVAL(buf, smb_com);
1949
1950         if (!is_andx_req(cmd)) {
1951                 return false;
1952         }
1953
1954         ofs = smb_vwv0;
1955
1956         while (CVAL(buf, ofs) != 0xff) {
1957
1958                 if (!is_andx_req(CVAL(buf, ofs))) {
1959                         return false;
1960                 }
1961
1962                 /*
1963                  * ofs is from start of smb header, so add the 4 length
1964                  * bytes. The next cmd is right after the wct field.
1965                  */
1966                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1967
1968                 if (ofs+4 >= talloc_get_size(buf)) {
1969                         return false;
1970                 }
1971         }
1972
1973         *pofs = ofs;
1974         return true;
1975 }
1976
1977 /**
1978  * @brief Do the smb chaining at a buffer level
1979  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1980  * @param[in] andx_buf          Buffer to be appended
1981  */
1982
1983 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1984 {
1985         uint8_t smb_command     = CVAL(andx_buf, smb_com);
1986         uint8_t wct             = CVAL(andx_buf, smb_wct);
1987         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
1988         uint32_t num_bytes      = smb_buflen(andx_buf);
1989         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
1990
1991         uint8_t *outbuf;
1992         size_t old_size, new_size;
1993         size_t ofs;
1994         size_t chain_padding = 0;
1995         size_t andx_cmd_ofs;
1996
1997
1998         old_size = talloc_get_size(*poutbuf);
1999
2000         if ((old_size % 4) != 0) {
2001                 /*
2002                  * Align the wct field of subsequent requests to a 4-byte
2003                  * boundary
2004                  */
2005                 chain_padding = 4 - (old_size % 4);
2006         }
2007
2008         /*
2009          * After the old request comes the new wct field (1 byte), the vwv's
2010          * and the num_bytes field.
2011          */
2012
2013         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2014         new_size += num_bytes;
2015
2016         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2017                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2018                           (unsigned)new_size));
2019                 return false;
2020         }
2021
2022         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2023         if (outbuf == NULL) {
2024                 DEBUG(0, ("talloc failed\n"));
2025                 return false;
2026         }
2027         *poutbuf = outbuf;
2028
2029         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2030                 DEBUG(1, ("invalid command chain\n"));
2031                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2032                 return false;
2033         }
2034
2035         if (chain_padding != 0) {
2036                 memset(outbuf + old_size, 0, chain_padding);
2037                 old_size += chain_padding;
2038         }
2039
2040         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2041         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2042
2043         ofs = old_size;
2044
2045         /*
2046          * Push the chained request:
2047          *
2048          * wct field
2049          */
2050
2051         SCVAL(outbuf, ofs, wct);
2052         ofs += 1;
2053
2054         /*
2055          * vwv array
2056          */
2057
2058         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2059
2060         /*
2061          * HACK ALERT
2062          *
2063          * Read&X has an offset into its data buffer at
2064          * vwv[6]. reply_read_andx has no idea anymore that it's
2065          * running from within a chain, so we have to fix up the
2066          * offset here.
2067          *
2068          * Although it looks disgusting at this place, I want to keep
2069          * it here. The alternative would be to push knowledge about
2070          * the andx chain down into read&x again.
2071          */
2072
2073         if (smb_command == SMBreadX) {
2074                 uint8_t *bytes_addr;
2075
2076                 if (wct < 7) {
2077                         /*
2078                          * Invalid read&x response
2079                          */
2080                         return false;
2081                 }
2082
2083                 bytes_addr = outbuf + ofs        /* vwv start */
2084                         + sizeof(uint16_t) * wct /* vwv array */
2085                         + sizeof(uint16_t);      /* bcc */
2086
2087                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2088                       bytes_addr - outbuf - 4);
2089         }
2090
2091         ofs += sizeof(uint16_t) * wct;
2092
2093         /*
2094          * bcc (byte count)
2095          */
2096
2097         SSVAL(outbuf, ofs, num_bytes);
2098         ofs += sizeof(uint16_t);
2099
2100         /*
2101          * The bytes field
2102          */
2103
2104         memcpy(outbuf + ofs, bytes, num_bytes);
2105
2106         return true;
2107 }
2108
2109 bool smb1_is_chain(const uint8_t *buf)
2110 {
2111         uint8_t cmd, wct, andx_cmd;
2112
2113         cmd = CVAL(buf, smb_com);
2114         if (!is_andx_req(cmd)) {
2115                 return false;
2116         }
2117         wct = CVAL(buf, smb_wct);
2118         if (wct < 2) {
2119                 return false;
2120         }
2121         andx_cmd = CVAL(buf, smb_vwv);
2122         return (andx_cmd != 0xFF);
2123 }
2124
2125 bool smb1_walk_chain(const uint8_t *buf,
2126                      bool (*fn)(uint8_t cmd,
2127                                 uint8_t wct, const uint16_t *vwv,
2128                                 uint16_t num_bytes, const uint8_t *bytes,
2129                                 void *private_data),
2130                      void *private_data)
2131 {
2132         size_t smblen = smb_len(buf);
2133         const char *smb_buf = smb_base(buf);
2134         uint8_t cmd, chain_cmd;
2135         uint8_t wct;
2136         const uint16_t *vwv;
2137         uint16_t num_bytes;
2138         const uint8_t *bytes;
2139
2140         cmd = CVAL(buf, smb_com);
2141         wct = CVAL(buf, smb_wct);
2142         vwv = (const uint16_t *)(buf + smb_vwv);
2143         num_bytes = smb_buflen(buf);
2144         bytes = (const uint8_t *)smb_buf_const(buf);
2145
2146         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2147                 return false;
2148         }
2149
2150         if (!is_andx_req(cmd)) {
2151                 return true;
2152         }
2153         if (wct < 2) {
2154                 return false;
2155         }
2156
2157         chain_cmd = CVAL(vwv, 0);
2158
2159         while (chain_cmd != 0xff) {
2160                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2161                 size_t length_needed;
2162                 ptrdiff_t vwv_offset;
2163
2164                 chain_offset = SVAL(vwv+1, 0);
2165
2166                 /*
2167                  * Check if the client tries to fool us. The chain
2168                  * offset needs to point beyond the current request in
2169                  * the chain, it needs to strictly grow. Otherwise we
2170                  * might be tricked into an endless loop always
2171                  * processing the same request over and over again. We
2172                  * used to assume that vwv and the byte buffer array
2173                  * in a chain are always attached, but OS/2 the
2174                  * Write&X/Read&X chain puts the Read&X vwv array
2175                  * right behind the Write&X vwv chain. The Write&X bcc
2176                  * array is put behind the Read&X vwv array. So now we
2177                  * check whether the chain offset points strictly
2178                  * behind the previous vwv array. req->buf points
2179                  * right after the vwv array of the previous
2180                  * request. See
2181                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2182                  * more information.
2183                  */
2184
2185                 vwv_offset = ((const char *)vwv - smb_buf);
2186                 if (chain_offset <= vwv_offset) {
2187                         return false;
2188                 }
2189
2190                 /*
2191                  * Next check: Make sure the chain offset does not
2192                  * point beyond the overall smb request length.
2193                  */
2194
2195                 length_needed = chain_offset+1; /* wct */
2196                 if (length_needed > smblen) {
2197                         return false;
2198                 }
2199
2200                 /*
2201                  * Now comes the pointer magic. Goal here is to set up
2202                  * vwv and buf correctly again. The chain offset (the
2203                  * former vwv[1]) points at the new wct field.
2204                  */
2205
2206                 wct = CVAL(smb_buf, chain_offset);
2207
2208                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2209                         return false;
2210                 }
2211
2212                 /*
2213                  * Next consistency check: Make the new vwv array fits
2214                  * in the overall smb request.
2215                  */
2216
2217                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2218                 if (length_needed > smblen) {
2219                         return false;
2220                 }
2221                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2222
2223                 /*
2224                  * Now grab the new byte buffer....
2225                  */
2226
2227                 num_bytes = SVAL(vwv+wct, 0);
2228
2229                 /*
2230                  * .. and check that it fits.
2231                  */
2232
2233                 length_needed += num_bytes;
2234                 if (length_needed > smblen) {
2235                         return false;
2236                 }
2237                 bytes = (const uint8_t *)(vwv+wct+1);
2238
2239                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2240                         return false;
2241                 }
2242
2243                 if (!is_andx_req(chain_cmd)) {
2244                         return true;
2245                 }
2246                 chain_cmd = CVAL(vwv, 0);
2247         }
2248         return true;
2249 }
2250
2251 static bool smb1_chain_length_cb(uint8_t cmd,
2252                                  uint8_t wct, const uint16_t *vwv,
2253                                  uint16_t num_bytes, const uint8_t *bytes,
2254                                  void *private_data)
2255 {
2256         unsigned *count = (unsigned *)private_data;
2257         *count += 1;
2258         return true;
2259 }
2260
2261 unsigned smb1_chain_length(const uint8_t *buf)
2262 {
2263         unsigned count = 0;
2264
2265         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2266                 return 0;
2267         }
2268         return count;
2269 }
2270
2271 struct smb1_parse_chain_state {
2272         TALLOC_CTX *mem_ctx;
2273         const uint8_t *buf;
2274         struct smbd_server_connection *sconn;
2275         bool encrypted;
2276         uint32_t seqnum;
2277
2278         struct smb_request **reqs;
2279         unsigned num_reqs;
2280 };
2281
2282 static bool smb1_parse_chain_cb(uint8_t cmd,
2283                                 uint8_t wct, const uint16_t *vwv,
2284                                 uint16_t num_bytes, const uint8_t *bytes,
2285                                 void *private_data)
2286 {
2287         struct smb1_parse_chain_state *state =
2288                 (struct smb1_parse_chain_state *)private_data;
2289         struct smb_request **reqs;
2290         struct smb_request *req;
2291         bool ok;
2292
2293         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2294                               struct smb_request *, state->num_reqs+1);
2295         if (reqs == NULL) {
2296                 return false;
2297         }
2298         state->reqs = reqs;
2299
2300         req = talloc(reqs, struct smb_request);
2301         if (req == NULL) {
2302                 return false;
2303         }
2304
2305         ok = init_smb_request(req, state->sconn, state->buf, 0,
2306                               state->encrypted, state->seqnum);
2307         if (!ok) {
2308                 return false;
2309         }
2310         req->cmd = cmd;
2311         req->wct = wct;
2312         req->vwv = vwv;
2313         req->buflen = num_bytes;
2314         req->buf = bytes;
2315
2316         reqs[state->num_reqs] = req;
2317         state->num_reqs += 1;
2318         return true;
2319 }
2320
2321 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2322                       struct smbd_server_connection *sconn,
2323                       bool encrypted, uint32_t seqnum,
2324                       struct smb_request ***reqs, unsigned *num_reqs)
2325 {
2326         struct smb1_parse_chain_state state;
2327         unsigned i;
2328
2329         state.mem_ctx = mem_ctx;
2330         state.buf = buf;
2331         state.sconn = sconn;
2332         state.encrypted = encrypted;
2333         state.seqnum = seqnum;
2334         state.reqs = NULL;
2335         state.num_reqs = 0;
2336
2337         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2338                 TALLOC_FREE(state.reqs);
2339                 return false;
2340         }
2341         for (i=0; i<state.num_reqs; i++) {
2342                 state.reqs[i]->chain = state.reqs;
2343         }
2344         *reqs = state.reqs;
2345         *num_reqs = state.num_reqs;
2346         return true;
2347 }
2348
2349 /****************************************************************************
2350  Check if services need reloading.
2351 ****************************************************************************/
2352
2353 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2354 {
2355
2356         if (last_smb_conf_reload_time == 0) {
2357                 last_smb_conf_reload_time = t;
2358         }
2359
2360         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2361                 reload_services(sconn, conn_snum_used, true);
2362                 last_smb_conf_reload_time = t;
2363         }
2364 }
2365
2366 static bool fd_is_readable(int fd)
2367 {
2368         int ret, revents;
2369
2370         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2371
2372         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2373
2374 }
2375
2376 static void smbd_server_connection_write_handler(
2377         struct smbd_server_connection *sconn)
2378 {
2379         /* TODO: make write nonblocking */
2380 }
2381
2382 static void smbd_server_connection_read_handler(
2383         struct smbd_server_connection *sconn, int fd)
2384 {
2385         uint8_t *inbuf = NULL;
2386         size_t inbuf_len = 0;
2387         size_t unread_bytes = 0;
2388         bool encrypted = false;
2389         TALLOC_CTX *mem_ctx = talloc_tos();
2390         NTSTATUS status;
2391         uint32_t seqnum;
2392
2393         bool async_echo = lp_async_smb_echo_handler();
2394         bool from_client = false;
2395
2396         if (async_echo) {
2397                 if (fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2398                         /*
2399                          * This is the super-ugly hack to prefer the packets
2400                          * forwarded by the echo handler over the ones by the
2401                          * client directly
2402                          */
2403                         fd = sconn->smb1.echo_handler.trusted_fd;
2404                 }
2405         }
2406
2407         from_client = (sconn->sock == fd);
2408
2409         if (async_echo && from_client) {
2410                 smbd_lock_socket(sconn);
2411
2412                 if (!fd_is_readable(fd)) {
2413                         DEBUG(10,("the echo listener was faster\n"));
2414                         smbd_unlock_socket(sconn);
2415                         return;
2416                 }
2417         }
2418
2419         /* TODO: make this completely nonblocking */
2420         status = receive_smb_talloc(mem_ctx, sconn, fd,
2421                                     (char **)(void *)&inbuf,
2422                                     0, /* timeout */
2423                                     &unread_bytes,
2424                                     &encrypted,
2425                                     &inbuf_len, &seqnum,
2426                                     !from_client /* trusted channel */);
2427
2428         if (async_echo && from_client) {
2429                 smbd_unlock_socket(sconn);
2430         }
2431
2432         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2433                 goto process;
2434         }
2435         if (NT_STATUS_IS_ERR(status)) {
2436                 exit_server_cleanly("failed to receive smb request");
2437         }
2438         if (!NT_STATUS_IS_OK(status)) {
2439                 return;
2440         }
2441
2442 process:
2443         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2444                     seqnum, encrypted, NULL);
2445 }
2446
2447 static void smbd_server_connection_handler(struct tevent_context *ev,
2448                                            struct tevent_fd *fde,
2449                                            uint16_t flags,
2450                                            void *private_data)
2451 {
2452         struct smbd_server_connection *conn = talloc_get_type(private_data,
2453                                               struct smbd_server_connection);
2454
2455         if (!NT_STATUS_IS_OK(conn->status)) {
2456                 /*
2457                  * we're not supposed to do any io
2458                  */
2459                 TEVENT_FD_NOT_READABLE(conn->smb1.fde);
2460                 TEVENT_FD_NOT_WRITEABLE(conn->smb1.fde);
2461                 return;
2462         }
2463
2464         if (flags & TEVENT_FD_WRITE) {
2465                 smbd_server_connection_write_handler(conn);
2466                 return;
2467         }
2468         if (flags & TEVENT_FD_READ) {
2469                 smbd_server_connection_read_handler(conn, conn->sock);
2470                 return;
2471         }
2472 }
2473
2474 static void smbd_server_echo_handler(struct tevent_context *ev,
2475                                      struct tevent_fd *fde,
2476                                      uint16_t flags,
2477                                      void *private_data)
2478 {
2479         struct smbd_server_connection *conn = talloc_get_type(private_data,
2480                                               struct smbd_server_connection);
2481
2482         if (!NT_STATUS_IS_OK(conn->status)) {
2483                 /*
2484                  * we're not supposed to do any io
2485                  */
2486                 TEVENT_FD_NOT_READABLE(conn->smb1.echo_handler.trusted_fde);
2487                 TEVENT_FD_NOT_WRITEABLE(conn->smb1.echo_handler.trusted_fde);
2488                 return;
2489         }
2490
2491         if (flags & TEVENT_FD_WRITE) {
2492                 smbd_server_connection_write_handler(conn);
2493                 return;
2494         }
2495         if (flags & TEVENT_FD_READ) {
2496                 smbd_server_connection_read_handler(
2497                         conn, conn->smb1.echo_handler.trusted_fd);
2498                 return;
2499         }
2500 }
2501
2502 struct smbd_release_ip_state {
2503         struct smbd_server_connection *sconn;
2504         struct tevent_immediate *im;
2505         char addr[INET6_ADDRSTRLEN];
2506 };
2507
2508 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2509                                       struct tevent_immediate *im,
2510                                       void *private_data)
2511 {
2512         struct smbd_release_ip_state *state =
2513                 talloc_get_type_abort(private_data,
2514                 struct smbd_release_ip_state);
2515
2516         if (!NT_STATUS_EQUAL(state->sconn->status, NT_STATUS_ADDRESS_CLOSED)) {
2517                 /*
2518                  * smbd_server_connection_terminate() already triggered ?
2519                  */
2520                 return;
2521         }
2522
2523         smbd_server_connection_terminate(state->sconn, "CTDB_SRVID_RELEASE_IP");
2524 }
2525
2526 /****************************************************************************
2527 received when we should release a specific IP
2528 ****************************************************************************/
2529 static bool release_ip(const char *ip, void *priv)
2530 {
2531         struct smbd_release_ip_state *state =
2532                 talloc_get_type_abort(priv,
2533                 struct smbd_release_ip_state);
2534         const char *addr = state->addr;
2535         const char *p = addr;
2536
2537         if (!NT_STATUS_IS_OK(state->sconn->status)) {
2538                 /* avoid recursion */
2539                 return false;
2540         }
2541
2542         if (strncmp("::ffff:", addr, 7) == 0) {
2543                 p = addr + 7;
2544         }
2545
2546         DEBUG(10, ("Got release IP message for %s, "
2547                    "our address is %s\n", ip, p));
2548
2549         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2550                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2551                         ip));
2552                 /*
2553                  * With SMB2 we should do a clean disconnect,
2554                  * the previous_session_id in the session setup
2555                  * will cleanup the old session, tcons and opens.
2556                  *
2557                  * A clean disconnect is needed in order to support
2558                  * durable handles.
2559                  *
2560                  * Note: typically this is never triggered
2561                  *       as we got a TCP RST (triggered by ctdb event scripts)
2562                  *       before we get CTDB_SRVID_RELEASE_IP.
2563                  *
2564                  * We used to call _exit(1) here, but as this was mostly never
2565                  * triggered and has implication on our process model,
2566                  * we can just use smbd_server_connection_terminate()
2567                  * (also for SMB1).
2568                  *
2569                  * We don't call smbd_server_connection_terminate() directly
2570                  * as we might be called from within ctdbd_migrate(),
2571                  * we need to defer our action to the next event loop
2572                  */
2573                 tevent_schedule_immediate(state->im, state->sconn->ev_ctx,
2574                                           smbd_release_ip_immediate, state);
2575
2576                 /*
2577                  * Make sure we don't get any io on the connection.
2578                  */
2579                 state->sconn->status = NT_STATUS_ADDRESS_CLOSED;
2580                 return true;
2581         }
2582
2583         return false;
2584 }
2585
2586 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2587                                   struct sockaddr_storage *srv,
2588                                   struct sockaddr_storage *clnt)
2589 {
2590         struct smbd_release_ip_state *state;
2591         struct ctdbd_connection *cconn;
2592
2593         cconn = messaging_ctdbd_connection();
2594         if (cconn == NULL) {
2595                 return NT_STATUS_NO_MEMORY;
2596         }
2597
2598         state = talloc_zero(sconn, struct smbd_release_ip_state);
2599         if (state == NULL) {
2600                 return NT_STATUS_NO_MEMORY;
2601         }
2602         state->sconn = sconn;
2603         state->im = tevent_create_immediate(state);
2604         if (state->im == NULL) {
2605                 return NT_STATUS_NO_MEMORY;
2606         }
2607         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2608                 return NT_STATUS_NO_MEMORY;
2609         }
2610
2611         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2612 }
2613
2614 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2615                                struct sockaddr_storage *client)
2616 {
2617         socklen_t length;
2618         length = sizeof(*server);
2619         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2620                 return -1;
2621         }
2622         length = sizeof(*client);
2623         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2624                 return -1;
2625         }
2626         return 0;
2627 }
2628
2629 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2630                                   void *private_data, uint32_t msg_type,
2631                                   struct server_id server_id, DATA_BLOB *data)
2632 {
2633         struct smbd_server_connection *sconn = talloc_get_type_abort(
2634                 private_data, struct smbd_server_connection);
2635         const char *ip = (char *) data->data;
2636         char *client_ip;
2637
2638         DEBUG(10, ("Got kill request for client IP %s\n", ip));
2639
2640         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2641                                                      talloc_tos());
2642         if (client_ip == NULL) {
2643                 return;
2644         }
2645
2646         if (strequal(ip, client_ip)) {
2647                 DEBUG(1, ("Got kill client message for %s - "
2648                           "exiting immediately\n", ip));
2649                 exit_server_cleanly("Forced disconnect for client");
2650         }
2651
2652         TALLOC_FREE(client_ip);
2653 }
2654
2655 /*
2656  * Send keepalive packets to our client
2657  */
2658 static bool keepalive_fn(const struct timeval *now, void *private_data)
2659 {
2660         struct smbd_server_connection *sconn = talloc_get_type_abort(
2661                 private_data, struct smbd_server_connection);
2662         bool ret;
2663
2664         if (sconn->using_smb2) {
2665                 /* Don't do keepalives on an SMB2 connection. */
2666                 return false;
2667         }
2668
2669         smbd_lock_socket(sconn);
2670         ret = send_keepalive(sconn->sock);
2671         smbd_unlock_socket(sconn);
2672
2673         if (!ret) {
2674                 char addr[INET6_ADDRSTRLEN];
2675                 /*
2676                  * Try and give an error message saying what
2677                  * client failed.
2678                  */
2679                 DEBUG(0, ("send_keepalive failed for client %s. "
2680                           "Error %s - exiting\n",
2681                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2682                           strerror(errno)));
2683                 return False;
2684         }
2685         return True;
2686 }
2687
2688 /*
2689  * Do the recurring check if we're idle
2690  */
2691 static bool deadtime_fn(const struct timeval *now, void *private_data)
2692 {
2693         struct smbd_server_connection *sconn =
2694                 (struct smbd_server_connection *)private_data;
2695
2696         if ((conn_num_open(sconn) == 0)
2697             || (conn_idle_all(sconn, now->tv_sec))) {
2698                 DEBUG( 2, ( "Closing idle connection\n" ) );
2699                 messaging_send(sconn->msg_ctx,
2700                                messaging_server_id(sconn->msg_ctx),
2701                                MSG_SHUTDOWN, &data_blob_null);
2702                 return False;
2703         }
2704
2705         return True;
2706 }
2707
2708 /*
2709  * Do the recurring log file and smb.conf reload checks.
2710  */
2711
2712 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2713 {
2714         struct smbd_server_connection *sconn = talloc_get_type_abort(
2715                 private_data, struct smbd_server_connection);
2716
2717         DEBUG(5, ("housekeeping\n"));
2718
2719         change_to_root_user();
2720
2721         /* update printer queue caches if necessary */
2722         update_monitored_printq_cache(sconn->msg_ctx);
2723
2724         /* check if we need to reload services */
2725         check_reload(sconn, time_mono(NULL));
2726
2727         /*
2728          * Force a log file check.
2729          */
2730         force_check_log_size();
2731         check_log_size();
2732         return true;
2733 }
2734
2735 /*
2736  * Read an smb packet in the echo handler child, giving the parent
2737  * smbd one second to react once the socket becomes readable.
2738  */
2739
2740 struct smbd_echo_read_state {
2741         struct tevent_context *ev;
2742         struct smbd_server_connection *sconn;
2743
2744         char *buf;
2745         size_t buflen;
2746         uint32_t seqnum;
2747 };
2748
2749 static void smbd_echo_read_readable(struct tevent_req *subreq);
2750 static void smbd_echo_read_waited(struct tevent_req *subreq);
2751
2752 static struct tevent_req *smbd_echo_read_send(
2753         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2754         struct smbd_server_connection *sconn)
2755 {
2756         struct tevent_req *req, *subreq;
2757         struct smbd_echo_read_state *state;
2758
2759         req = tevent_req_create(mem_ctx, &state,
2760                                 struct smbd_echo_read_state);
2761         if (req == NULL) {
2762                 return NULL;
2763         }
2764         state->ev = ev;
2765         state->sconn = sconn;
2766
2767         subreq = wait_for_read_send(state, ev, sconn->sock);
2768         if (tevent_req_nomem(subreq, req)) {
2769                 return tevent_req_post(req, ev);
2770         }
2771         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2772         return req;
2773 }
2774
2775 static void smbd_echo_read_readable(struct tevent_req *subreq)
2776 {
2777         struct tevent_req *req = tevent_req_callback_data(
2778                 subreq, struct tevent_req);
2779         struct smbd_echo_read_state *state = tevent_req_data(
2780                 req, struct smbd_echo_read_state);
2781         bool ok;
2782         int err;
2783
2784         ok = wait_for_read_recv(subreq, &err);
2785         TALLOC_FREE(subreq);
2786         if (!ok) {
2787                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2788                 return;
2789         }
2790
2791         /*
2792          * Give the parent smbd one second to step in
2793          */
2794
2795         subreq = tevent_wakeup_send(
2796                 state, state->ev, timeval_current_ofs(1, 0));
2797         if (tevent_req_nomem(subreq, req)) {
2798                 return;
2799         }
2800         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2801 }
2802
2803 static void smbd_echo_read_waited(struct tevent_req *subreq)
2804 {
2805         struct tevent_req *req = tevent_req_callback_data(
2806                 subreq, struct tevent_req);
2807         struct smbd_echo_read_state *state = tevent_req_data(
2808                 req, struct smbd_echo_read_state);
2809         struct smbd_server_connection *sconn = state->sconn;
2810         bool ok;
2811         NTSTATUS status;
2812         size_t unread = 0;
2813         bool encrypted;
2814
2815         ok = tevent_wakeup_recv(subreq);
2816         TALLOC_FREE(subreq);
2817         if (!ok) {
2818                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2819                 return;
2820         }
2821
2822         ok = smbd_lock_socket_internal(sconn);
2823         if (!ok) {
2824                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2825                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2826                 return;
2827         }
2828
2829         if (!fd_is_readable(sconn->sock)) {
2830                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2831                           (int)getpid()));
2832
2833                 ok = smbd_unlock_socket_internal(sconn);
2834                 if (!ok) {
2835                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2836                         DEBUG(1, ("%s: failed to unlock socket\n",
2837                                 __location__));
2838                         return;
2839                 }
2840
2841                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2842                 if (tevent_req_nomem(subreq, req)) {
2843                         return;
2844                 }
2845                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2846                 return;
2847         }
2848
2849         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2850                                     0 /* timeout */,
2851                                     &unread,
2852                                     &encrypted,
2853                                     &state->buflen,
2854                                     &state->seqnum,
2855                                     false /* trusted_channel*/);
2856
2857         if (tevent_req_nterror(req, status)) {
2858                 tevent_req_nterror(req, status);
2859                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2860                           (int)getpid(), nt_errstr(status)));
2861                 return;
2862         }
2863
2864         ok = smbd_unlock_socket_internal(sconn);
2865         if (!ok) {
2866                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2867                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2868                 return;
2869         }
2870         tevent_req_done(req);
2871 }
2872
2873 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2874                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2875 {
2876         struct smbd_echo_read_state *state = tevent_req_data(
2877                 req, struct smbd_echo_read_state);
2878         NTSTATUS status;
2879
2880         if (tevent_req_is_nterror(req, &status)) {
2881                 return status;
2882         }
2883         *pbuf = talloc_move(mem_ctx, &state->buf);
2884         *pbuflen = state->buflen;
2885         *pseqnum = state->seqnum;
2886         return NT_STATUS_OK;
2887 }
2888
2889 struct smbd_echo_state {
2890         struct tevent_context *ev;
2891         struct iovec *pending;
2892         struct smbd_server_connection *sconn;
2893         int parent_pipe;
2894
2895         struct tevent_fd *parent_fde;
2896
2897         struct tevent_req *write_req;
2898 };
2899
2900 static void smbd_echo_writer_done(struct tevent_req *req);
2901
2902 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2903 {
2904         int num_pending;
2905
2906         if (state->write_req != NULL) {
2907                 return;
2908         }
2909
2910         num_pending = talloc_array_length(state->pending);
2911         if (num_pending == 0) {
2912                 return;
2913         }
2914
2915         state->write_req = writev_send(state, state->ev, NULL,
2916                                        state->parent_pipe, false,
2917                                        state->pending, num_pending);
2918         if (state->write_req == NULL) {
2919                 DEBUG(1, ("writev_send failed\n"));
2920                 exit(1);
2921         }
2922
2923         talloc_steal(state->write_req, state->pending);
2924         state->pending = NULL;
2925
2926         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2927                                 state);
2928 }
2929
2930 static void smbd_echo_writer_done(struct tevent_req *req)
2931 {
2932         struct smbd_echo_state *state = tevent_req_callback_data(
2933                 req, struct smbd_echo_state);
2934         ssize_t written;
2935         int err;
2936
2937         written = writev_recv(req, &err);
2938         TALLOC_FREE(req);
2939         state->write_req = NULL;
2940         if (written == -1) {
2941                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2942                 exit(1);
2943         }
2944         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2945         smbd_echo_activate_writer(state);
2946 }
2947
2948 static bool smbd_echo_reply(struct smbd_echo_state *state,
2949                             uint8_t *inbuf, size_t inbuf_len,
2950                             uint32_t seqnum)
2951 {
2952         struct smb_request req;
2953         uint16_t num_replies;
2954         char *outbuf;
2955         bool ok;
2956
2957         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2958                 DEBUG(10, ("Got netbios keepalive\n"));
2959                 /*
2960                  * Just swallow it
2961                  */
2962                 return true;
2963         }
2964
2965         if (inbuf_len < smb_size) {
2966                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2967                 return false;
2968         }
2969         if (!valid_smb_header(state->sconn, inbuf)) {
2970                 DEBUG(10, ("Got invalid SMB header\n"));
2971                 return false;
2972         }
2973
2974         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2975                               seqnum)) {
2976                 return false;
2977         }
2978         req.inbuf = inbuf;
2979
2980         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2981                    smb_messages[req.cmd].name
2982                    ? smb_messages[req.cmd].name : "unknown"));
2983
2984         if (req.cmd != SMBecho) {
2985                 return false;
2986         }
2987         if (req.wct < 1) {
2988                 return false;
2989         }
2990
2991         num_replies = SVAL(req.vwv+0, 0);
2992         if (num_replies != 1) {
2993                 /* Not a Windows "Hey, you're still there?" request */
2994                 return false;
2995         }
2996
2997         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2998                            1, req.buflen)) {
2999                 DEBUG(10, ("create_outbuf failed\n"));
3000                 return false;
3001         }
3002         req.outbuf = (uint8_t *)outbuf;
3003
3004         SSVAL(req.outbuf, smb_vwv0, num_replies);
3005
3006         if (req.buflen > 0) {
3007                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3008         }
3009
3010         ok = srv_send_smb(req.sconn,
3011                           (char *)outbuf,
3012                           true, seqnum+1,
3013                           false, &req.pcd);
3014         TALLOC_FREE(outbuf);
3015         if (!ok) {
3016                 exit(1);
3017         }
3018
3019         return true;
3020 }
3021
3022 static void smbd_echo_exit(struct tevent_context *ev,
3023                            struct tevent_fd *fde, uint16_t flags,
3024                            void *private_data)
3025 {
3026         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3027         exit(0);
3028 }
3029
3030 static void smbd_echo_got_packet(struct tevent_req *req);
3031
3032 static void smbd_echo_loop(struct smbd_server_connection *sconn,
3033                            int parent_pipe)
3034 {
3035         struct smbd_echo_state *state;
3036         struct tevent_req *read_req;
3037
3038         state = talloc_zero(sconn, struct smbd_echo_state);
3039         if (state == NULL) {
3040                 DEBUG(1, ("talloc failed\n"));
3041                 return;
3042         }
3043         state->sconn = sconn;
3044         state->parent_pipe = parent_pipe;
3045         state->ev = s3_tevent_context_init(state);
3046         if (state->ev == NULL) {
3047                 DEBUG(1, ("tevent_context_init failed\n"));
3048                 TALLOC_FREE(state);
3049                 return;
3050         }
3051         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3052                                         TEVENT_FD_READ, smbd_echo_exit,
3053                                         state);
3054         if (state->parent_fde == NULL) {
3055                 DEBUG(1, ("tevent_add_fd failed\n"));
3056                 TALLOC_FREE(state);
3057                 return;
3058         }
3059
3060         read_req = smbd_echo_read_send(state, state->ev, sconn);
3061         if (read_req == NULL) {
3062                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3063                 TALLOC_FREE(state);
3064                 return;
3065         }
3066         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3067
3068         while (true) {
3069                 if (tevent_loop_once(state->ev) == -1) {
3070                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3071                                   strerror(errno)));
3072                         break;
3073                 }
3074         }
3075         TALLOC_FREE(state);
3076 }
3077
3078 static void smbd_echo_got_packet(struct tevent_req *req)
3079 {
3080         struct smbd_echo_state *state = tevent_req_callback_data(
3081                 req, struct smbd_echo_state);
3082         NTSTATUS status;
3083         char *buf = NULL;
3084         size_t buflen = 0;
3085         uint32_t seqnum = 0;
3086         bool reply;
3087
3088         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3089         TALLOC_FREE(req);
3090         if (!NT_STATUS_IS_OK(status)) {
3091                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3092                           nt_errstr(status)));
3093                 exit(1);
3094         }
3095
3096         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3097         if (!reply) {
3098                 size_t num_pending;
3099                 struct iovec *tmp;
3100                 struct iovec *iov;
3101
3102                 num_pending = talloc_array_length(state->pending);
3103                 tmp = talloc_realloc(state, state->pending, struct iovec,
3104                                      num_pending+1);
3105                 if (tmp == NULL) {
3106                         DEBUG(1, ("talloc_realloc failed\n"));
3107                         exit(1);
3108                 }
3109                 state->pending = tmp;
3110
3111                 if (buflen >= smb_size) {
3112                         /*
3113                          * place the seqnum in the packet so that the main process
3114                          * can reply with signing
3115                          */
3116                         SIVAL(buf, smb_ss_field, seqnum);
3117                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3118                 }
3119
3120                 iov = &state->pending[num_pending];
3121                 iov->iov_base = talloc_move(state->pending, &buf);
3122                 iov->iov_len = buflen;
3123
3124                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3125                           (int)getpid()));
3126                 smbd_echo_activate_writer(state);
3127         }
3128
3129         req = smbd_echo_read_send(state, state->ev, state->sconn);
3130         if (req == NULL) {
3131                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3132                 exit(1);
3133         }
3134         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3135 }
3136
3137
3138 /*
3139  * Handle SMBecho requests in a forked child process
3140  */
3141 bool fork_echo_handler(struct smbd_server_connection *sconn)
3142 {
3143         int listener_pipe[2];
3144         int res;
3145         pid_t child;
3146
3147         res = pipe(listener_pipe);
3148         if (res == -1) {
3149                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3150                 return false;
3151         }
3152         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lock_directory());
3153         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3154                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
3155                 goto fail;
3156         }
3157
3158         child = fork();
3159         if (child == 0) {
3160                 NTSTATUS status;
3161
3162                 close(listener_pipe[0]);
3163                 set_blocking(listener_pipe[1], false);
3164
3165                 status = reinit_after_fork(sconn->msg_ctx,
3166                                            sconn->ev_ctx,
3167                                            true);
3168                 if (!NT_STATUS_IS_OK(status)) {
3169                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3170                                   nt_errstr(status)));
3171                         exit(1);
3172                 }
3173                 smbd_echo_loop(sconn, listener_pipe[1]);
3174                 exit(0);
3175         }
3176         close(listener_pipe[1]);
3177         listener_pipe[1] = -1;
3178         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3179
3180         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3181
3182         /*
3183          * Without smb signing this is the same as the normal smbd
3184          * listener. This needs to change once signing comes in.
3185          */
3186         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3187                                         sconn,
3188                                         sconn->smb1.echo_handler.trusted_fd,
3189                                         TEVENT_FD_READ,
3190                                         smbd_server_echo_handler,
3191                                         sconn);
3192         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3193                 DEBUG(1, ("event_add_fd failed\n"));
3194                 goto fail;
3195         }
3196
3197         return true;
3198
3199 fail:
3200         if (listener_pipe[0] != -1) {
3201                 close(listener_pipe[0]);
3202         }
3203         if (listener_pipe[1] != -1) {
3204                 close(listener_pipe[1]);
3205         }
3206         sconn->smb1.echo_handler.trusted_fd = -1;
3207         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3208                 close(sconn->smb1.echo_handler.socket_lock_fd);
3209         }
3210         sconn->smb1.echo_handler.trusted_fd = -1;
3211         sconn->smb1.echo_handler.socket_lock_fd = -1;
3212         return false;
3213 }
3214
3215 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3216 {
3217         while (user) {
3218                 if (user->session_info &&
3219                     (user->session_info->unix_token->uid == uid)) {
3220                         return true;
3221                 }
3222                 user = user->next;
3223         }
3224         return false;
3225 }
3226
3227 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3228 {
3229         while (user) {
3230                 if (user->session_info != NULL) {
3231                         int i;
3232                         struct security_unix_token *utok;
3233
3234                         utok = user->session_info->unix_token;
3235                         if (utok->gid == gid) {
3236                                 return true;
3237                         }
3238                         for(i=0; i<utok->ngroups; i++) {
3239                                 if (utok->groups[i] == gid) {
3240                                         return true;
3241                                 }
3242                         }
3243                 }
3244                 user = user->next;
3245         }
3246         return false;
3247 }
3248
3249 static bool sid_in_use(const struct user_struct *user,
3250                        const struct dom_sid *psid)
3251 {
3252         while (user) {
3253                 struct security_token *tok;
3254
3255                 if (user->session_info == NULL) {
3256                         continue;
3257                 }
3258                 tok = user->session_info->security_token;
3259                 if (tok == NULL) {
3260                         /*
3261                          * Not sure session_info->security_token can
3262                          * ever be NULL. This check might be not
3263                          * necessary.
3264                          */
3265                         continue;
3266                 }
3267                 if (security_token_has_sid(tok, psid)) {
3268                         return true;
3269                 }
3270                 user = user->next;
3271         }
3272         return false;
3273 }
3274
3275 static bool id_in_use(const struct user_struct *user,
3276                       const struct id_cache_ref *id)
3277 {
3278         switch(id->type) {
3279         case UID:
3280                 return uid_in_use(user, id->id.uid);
3281         case GID:
3282                 return gid_in_use(user, id->id.gid);
3283         case SID:
3284                 return sid_in_use(user, &id->id.sid);
3285         default:
3286                 break;
3287         }
3288         return false;
3289 }
3290
3291 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3292                                void *private_data,
3293                                uint32_t msg_type,
3294                                struct server_id server_id,
3295                                DATA_BLOB* data)
3296 {
3297         const char *msg = (data && data->data)
3298                 ? (const char *)data->data : "<NULL>";
3299         struct id_cache_ref id;
3300         struct smbd_server_connection *sconn =
3301                 talloc_get_type_abort(private_data,
3302                 struct smbd_server_connection);
3303
3304         if (!id_cache_ref_parse(msg, &id)) {
3305                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3306                 return;
3307         }
3308
3309         if (id_in_use(sconn->users, &id)) {
3310                 exit_server_cleanly(msg);
3311         }
3312         id_cache_delete_from_cache(&id);
3313 }
3314
3315 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3316                                         enum protocol_types protocol)
3317 {
3318         NTSTATUS status;
3319
3320         set_Protocol(protocol);
3321         conn->protocol = protocol;
3322
3323         if (protocol >= PROTOCOL_SMB2_02) {
3324                 status = smb2srv_session_table_init(conn);
3325                 if (!NT_STATUS_IS_OK(status)) {
3326                         return status;
3327                 }
3328
3329                 status = smb2srv_open_table_init(conn);
3330                 if (!NT_STATUS_IS_OK(status)) {
3331                         return status;
3332                 }
3333         } else {
3334                 status = smb1srv_session_table_init(conn);
3335                 if (!NT_STATUS_IS_OK(status)) {
3336                         return status;
3337                 }
3338
3339                 status = smb1srv_tcon_table_init(conn);
3340                 if (!NT_STATUS_IS_OK(status)) {
3341                         return status;
3342                 }
3343
3344                 status = smb1srv_open_table_init(conn);
3345                 if (!NT_STATUS_IS_OK(status)) {
3346                         return status;
3347                 }
3348         }
3349
3350         return NT_STATUS_OK;
3351 }
3352
3353 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3354                                        void *private_data)
3355 {
3356         struct smbXsrv_connection *conn =
3357                 talloc_get_type_abort(private_data,
3358                 struct smbXsrv_connection);
3359
3360         switch (point) {
3361         case TEVENT_TRACE_BEFORE_WAIT:
3362                 /*
3363                  * This just removes compiler warning
3364                  * without profile support
3365                  */
3366                 conn->smbd_idle_profstamp = 0;
3367                 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3368                 break;
3369         case TEVENT_TRACE_AFTER_WAIT:
3370                 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3371                 break;
3372 #ifdef TEVENT_HAS_LOOP_ONCE_TRACE_POINTS
3373         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3374         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3375                 break;
3376 #endif
3377         }
3378 }
3379
3380 /****************************************************************************
3381  Process commands from the client
3382 ****************************************************************************/
3383
3384 void smbd_process(struct tevent_context *ev_ctx,
3385                   struct messaging_context *msg_ctx,
3386                   int sock_fd,
3387                   bool interactive)
3388 {
3389         TALLOC_CTX *frame = talloc_stackframe();
3390         struct smbXsrv_connection *conn;
3391         struct smbd_server_connection *sconn;
3392         struct sockaddr_storage ss;
3393         struct sockaddr *sa = NULL;
3394         socklen_t sa_socklen;
3395         struct tsocket_address *local_address = NULL;
3396         struct tsocket_address *remote_address = NULL;
3397         const char *locaddr = NULL;
3398         const char *remaddr = NULL;
3399         char *rhost;
3400         int ret;
3401         int tmp;
3402
3403         conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3404         if (conn == NULL) {
3405                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3406                 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3407         }
3408
3409         conn->ev_ctx = ev_ctx;
3410         conn->msg_ctx = msg_ctx;
3411
3412         sconn = talloc_zero(conn, struct smbd_server_connection);
3413         if (!sconn) {
3414                 exit_server("failed to create smbd_server_connection");
3415         }
3416
3417         conn->sconn = sconn;
3418         sconn->conn = conn;
3419
3420         /*
3421          * TODO: remove this...:-)
3422          */
3423         global_smbXsrv_connection = conn;
3424
3425         sconn->ev_ctx = ev_ctx;
3426         sconn->msg_ctx = msg_ctx;
3427         sconn->sock = sock_fd;
3428         sconn->smb1.echo_handler.trusted_fd = -1;
3429         sconn->smb1.echo_handler.socket_lock_fd = -1;
3430
3431         if (!interactive) {
3432                 smbd_setup_sig_term_handler(sconn);
3433                 smbd_setup_sig_hup_handler(sconn);
3434
3435                 if (!serverid_register(messaging_server_id(msg_ctx),
3436                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3437                                        |FLAG_MSG_DBWRAP
3438                                        |FLAG_MSG_PRINT_GENERAL)) {
3439                         exit_server_cleanly("Could not register myself in "
3440                                             "serverid.tdb");
3441                 }
3442         }
3443
3444         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3445                 /*
3446                  * We're not making the decision here,
3447                  * we're just allowing the client
3448                  * to decide between SMB1 and SMB2
3449                  * with the first negprot
3450                  * packet.
3451                  */
3452                 sconn->using_smb2 = true;
3453         }
3454
3455         /* Ensure child is set to blocking mode */
3456         set_blocking(sconn->sock,True);
3457
3458         set_socket_options(sconn->sock, "SO_KEEPALIVE");
3459         set_socket_options(sconn->sock, lp_socket_options());
3460
3461         sa = (struct sockaddr *)(void *)&ss;
3462         sa_socklen = sizeof(ss);
3463         ret = getpeername(sconn->sock, sa, &sa_socklen);
3464         if (ret != 0) {
3465                 int level = (errno == ENOTCONN)?2:0;
3466                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3467                 exit_server_cleanly("getpeername() failed.\n");
3468         }
3469         ret = tsocket_address_bsd_from_sockaddr(sconn,
3470                                                 sa, sa_socklen,
3471                                                 &remote_address);
3472         if (ret != 0) {
3473                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3474                         __location__, strerror(errno)));
3475                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3476         }
3477
3478         sa = (struct sockaddr *)(void *)&ss;
3479         sa_socklen = sizeof(ss);
3480         ret = getsockname(sconn->sock, sa, &sa_socklen);
3481         if (ret != 0) {
3482                 int level = (errno == ENOTCONN)?2:0;
3483                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3484                 exit_server_cleanly("getsockname() failed.\n");
3485         }
3486         ret = tsocket_address_bsd_from_sockaddr(sconn,
3487                                                 sa, sa_socklen,
3488                                                 &local_address);
3489         if (ret != 0) {
3490                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3491                         __location__, strerror(errno)));
3492                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3493         }
3494
3495         sconn->local_address = local_address;
3496         sconn->remote_address = remote_address;
3497
3498         if (tsocket_address_is_inet(local_address, "ip")) {
3499                 locaddr = tsocket_address_inet_addr_string(
3500                                 sconn->local_address,
3501                                 talloc_tos());
3502                 if (locaddr == NULL) {
3503                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3504                                  __location__, strerror(errno)));
3505                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3506                 }
3507         } else {
3508                 locaddr = "0.0.0.0";
3509         }
3510
3511         if (tsocket_address_is_inet(remote_address, "ip")) {
3512                 remaddr = tsocket_address_inet_addr_string(
3513                                 sconn->remote_address,
3514                                 talloc_tos());
3515                 if (remaddr == NULL) {
3516                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3517                                  __location__, strerror(errno)));
3518                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3519                 }
3520         } else {
3521                 remaddr = "0.0.0.0";
3522         }
3523
3524         /* this is needed so that we get decent entries
3525            in smbstatus for port 445 connects */
3526         set_remote_machine_name(remaddr, false);
3527         reload_services(sconn, conn_snum_used, true);
3528
3529         /*
3530          * Before the first packet, check the global hosts allow/ hosts deny
3531          * parameters before doing any parsing of packets passed to us by the
3532          * client. This prevents attacks on our parsing code from hosts not in
3533          * the hosts allow list.
3534          */
3535
3536         ret = get_remote_hostname(remote_address,
3537                                   &rhost,
3538                                   talloc_tos());
3539         if (ret < 0) {
3540                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3541                         __location__, strerror(errno)));
3542                 exit_server_cleanly("get_remote_hostname failed.\n");
3543         }
3544         if (strequal(rhost, "UNKNOWN")) {
3545                 rhost = talloc_strdup(talloc_tos(), remaddr);
3546         }
3547         sconn->remote_hostname = talloc_move(sconn, &rhost);
3548
3549         sub_set_socket_ids(remaddr,
3550                            sconn->remote_hostname,
3551                            locaddr);
3552
3553         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3554                           sconn->remote_hostname,
3555                           remaddr)) {
3556                 /*
3557                  * send a negative session response "not listening on calling
3558                  * name"
3559                  */
3560                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3561                 DEBUG( 1, ("Connection denied from %s to %s\n",
3562                            tsocket_address_string(remote_address, talloc_tos()),
3563                            tsocket_address_string(local_address, talloc_tos())));
3564                 (void)srv_send_smb(sconn,(char *)buf, false,
3565                                    0, false, NULL);
3566                 exit_server_cleanly("connection denied");
3567         }
3568
3569         DEBUG(10, ("Connection allowed from %s to %s\n",
3570                    tsocket_address_string(remote_address, talloc_tos()),
3571                    tsocket_address_string(local_address, talloc_tos())));
3572
3573         if (lp_preload_modules()) {
3574                 smb_load_modules(lp_preload_modules());
3575         }
3576
3577         smb_perfcount_init();
3578
3579         if (!init_account_policy()) {
3580                 exit_server("Could not open account policy tdb.\n");
3581         }
3582
3583         if (*lp_root_directory(talloc_tos())) {
3584                 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3585                         DEBUG(0,("Failed to change root to %s\n",
3586                                  lp_root_directory(talloc_tos())));
3587                         exit_server("Failed to chroot()");
3588                 }
3589                 if (chdir("/") == -1) {
3590                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3591                         exit_server("Failed to chroot()");
3592                 }
3593                 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3594         }
3595
3596         if (!srv_init_signing(sconn)) {
3597                 exit_server("Failed to init smb_signing");
3598         }
3599
3600         if (!file_init(sconn)) {
3601                 exit_server("file_init() failed");
3602         }
3603
3604         /* Setup oplocks */
3605         if (!init_oplocks(sconn))
3606                 exit_server("Failed to init oplocks");
3607
3608         /* register our message handlers */
3609         messaging_register(sconn->msg_ctx, sconn,
3610                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3611         messaging_register(sconn->msg_ctx, sconn,
3612                            MSG_SMB_CLOSE_FILE, msg_close_file);
3613         messaging_register(sconn->msg_ctx, sconn,
3614                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3615
3616         id_cache_register_msgs(sconn->msg_ctx);
3617         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3618         messaging_register(sconn->msg_ctx, sconn,
3619                            ID_CACHE_KILL, smbd_id_cache_kill);
3620
3621         messaging_deregister(sconn->msg_ctx,
3622                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3623         messaging_register(sconn->msg_ctx, sconn,
3624                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3625
3626         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3627                              NULL);
3628         messaging_register(sconn->msg_ctx, sconn,
3629                            MSG_SMB_KILL_CLIENT_IP,
3630                            msg_kill_client_ip);
3631
3632         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3633
3634         /*
3635          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3636          * MSGs to all child processes
3637          */
3638         messaging_deregister(sconn->msg_ctx,
3639                              MSG_DEBUG, NULL);
3640         messaging_register(sconn->msg_ctx, NULL,
3641                            MSG_DEBUG, debug_message);
3642
3643         if ((lp_keepalive() != 0)
3644             && !(event_add_idle(ev_ctx, NULL,
3645                                 timeval_set(lp_keepalive(), 0),
3646                                 "keepalive", keepalive_fn,
3647                                 sconn))) {
3648                 DEBUG(0, ("Could not add keepalive event\n"));
3649                 exit(1);
3650         }
3651
3652         if (!(event_add_idle(ev_ctx, NULL,
3653                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3654                              "deadtime", deadtime_fn, sconn))) {
3655                 DEBUG(0, ("Could not add deadtime event\n"));
3656                 exit(1);
3657         }
3658
3659         if (!(event_add_idle(ev_ctx, NULL,
3660                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3661                              "housekeeping", housekeeping_fn, sconn))) {
3662                 DEBUG(0, ("Could not add housekeeping event\n"));
3663                 exit(1);
3664         }
3665
3666         if (lp_clustering()) {
3667                 /*
3668                  * We need to tell ctdb about our client's TCP
3669                  * connection, so that for failover ctdbd can send
3670                  * tickle acks, triggering a reconnection by the
3671                  * client.
3672                  */
3673
3674                 struct sockaddr_storage srv, clnt;
3675
3676                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3677                         NTSTATUS status;
3678                         status = smbd_register_ips(sconn, &srv, &clnt);
3679                         if (!NT_STATUS_IS_OK(status)) {
3680                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3681                                           nt_errstr(status)));
3682                         }
3683                 } else {
3684                         int level = (errno == ENOTCONN)?2:0;
3685                         DEBUG(level,("Unable to get tcp info for "
3686                                      "smbd_register_ips: %s\n",
3687                                      strerror(errno)));
3688                         exit_server_cleanly("client_get_tcp_info() failed.\n");
3689                 }
3690         }
3691
3692         sconn->nbt.got_session = false;
3693
3694         tmp = lp_max_xmit();
3695         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3696         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3697
3698         sconn->smb1.negprot.max_recv = tmp;
3699
3700         sconn->smb1.sessions.done_sesssetup = false;
3701         sconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3702
3703         if (!init_dptrs(sconn)) {
3704                 exit_server("init_dptrs() failed");
3705         }
3706
3707         sconn->smb1.fde = tevent_add_fd(ev_ctx,
3708                                                   sconn,
3709                                                   sconn->sock,
3710                                                   TEVENT_FD_READ,
3711                                                   smbd_server_connection_handler,
3712                                                   sconn);
3713         if (!sconn->smb1.fde) {
3714                 exit_server("failed to create smbd_server_connection fde");
3715         }
3716
3717         sconn->conn->local_address = sconn->local_address;
3718         sconn->conn->remote_address = sconn->remote_address;
3719         sconn->conn->remote_hostname = sconn->remote_hostname;
3720         sconn->conn->protocol = PROTOCOL_NONE;
3721
3722         TALLOC_FREE(frame);
3723
3724         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3725
3726         while (True) {
3727                 frame = talloc_stackframe_pool(8192);
3728
3729                 errno = 0;
3730                 if (tevent_loop_once(ev_ctx) == -1) {
3731                         if (errno != EINTR) {
3732                                 DEBUG(3, ("tevent_loop_once failed: %s,"
3733                                           " exiting\n", strerror(errno) ));
3734                                 break;
3735                         }
3736                 }
3737
3738                 TALLOC_FREE(frame);
3739         }
3740
3741         exit_server_cleanly(NULL);
3742 }
3743
3744 bool req_is_in_chain(const struct smb_request *req)
3745 {
3746         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3747                 /*
3748                  * We're right now handling a subsequent request, so we must
3749                  * be in a chain
3750                  */
3751                 return true;
3752         }
3753
3754         if (!is_andx_req(req->cmd)) {
3755                 return false;
3756         }
3757
3758         if (req->wct < 2) {
3759                 /*
3760                  * Okay, an illegal request, but definitely not chained :-)
3761                  */
3762                 return false;
3763         }
3764
3765         return (CVAL(req->vwv+0, 0) != 0xFF);
3766 }