source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43 #include "system/threads.h"
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct tevent_timer *te;
  51         struct smb_perfcount_data pcd;
  52         uint32_t seqnum;
  53         bool encrypted;
  54         bool processed;
  55         DATA_BLOB buf;
  56         struct deferred_open_record *open_rec;
  57 };
  58
  59 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  60                                    char *outbuf);
  61 static struct pending_message_list *get_deferred_open_message_smb(
  62         struct smbd_server_connection *sconn, uint64_t mid);
  63 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  64
  65 static void smbd_echo_init(struct smbXsrv_connection *xconn)
  66 {
  67         xconn->smb1.echo_handler.trusted_fd = -1;
  68         xconn->smb1.echo_handler.socket_lock_fd = -1;
  69 #ifdef HAVE_ROBUST_MUTEXES
  70         xconn->smb1.echo_handler.socket_mutex = NULL;
  71 #endif
  72 }
  73
  74 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
  75 {
  76         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
  77                 return true;
  78         }
  79
  80 #ifdef HAVE_ROBUST_MUTEXES
  81         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
  82                 return true;
  83         }
  84 #endif
  85
  86         return false;
  87 }
  88
  89 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  90 {
  91         struct smbXsrv_connection *xconn = sconn->conn;
  92
  93         if (!smbd_echo_active(xconn)) {
  94                 return true;
  95         }
  96
  97         xconn->smb1.echo_handler.ref_count++;
  98
  99         if (xconn->smb1.echo_handler.ref_count > 1) {
 100                 return true;
 101         }
 102
 103         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 104
 105 #ifdef HAVE_ROBUST_MUTEXES
 106         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 107                 int ret = EINTR;
 108
 109                 while (ret == EINTR) {
 110                         ret = pthread_mutex_lock(
 111                                 xconn->smb1.echo_handler.socket_mutex);
 112                         if (ret == 0) {
 113                                 break;
 114                         }
 115                 }
 116                 if (ret != 0) {
 117                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 118                                   strerror(ret)));
 119                         return false;
 120                 }
 121         }
 122 #endif
 123
 124         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 125                 bool ok;
 126
 127                 do {
 128                         ok = fcntl_lock(
 129                                 xconn->smb1.echo_handler.socket_lock_fd,
 130                                 F_SETLKW, 0, 0, F_WRLCK);
 131                 } while (!ok && (errno == EINTR));
 132
 133                 if (!ok) {
 134                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 135                         return false;
 136                 }
 137         }
 138
 139         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 140
 141         return true;
 142 }
 143
 144 void smbd_lock_socket(struct smbd_server_connection *sconn)
 145 {
 146         if (!smbd_lock_socket_internal(sconn)) {
 147                 exit_server_cleanly("failed to lock socket");
 148         }
 149 }
 150
 151 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 152 {
 153         struct smbXsrv_connection *xconn = sconn->conn;
 154
 155         if (!smbd_echo_active(xconn)) {
 156                 return true;
 157         }
 158
 159         xconn->smb1.echo_handler.ref_count--;
 160
 161         if (xconn->smb1.echo_handler.ref_count > 0) {
 162                 return true;
 163         }
 164
 165 #ifdef HAVE_ROBUST_MUTEXES
 166         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 167                 int ret = EINTR;
 168
 169                 while (ret == EINTR) {
 170                         ret = pthread_mutex_unlock(
 171                                 xconn->smb1.echo_handler.socket_mutex);
 172                         if (ret == 0) {
 173                                 break;
 174                         }
 175                 }
 176                 if (ret != 0) {
 177                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 178                                   strerror(ret)));
 179                         return false;
 180                 }
 181         }
 182 #endif
 183
 184         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 185                 bool ok;
 186
 187                 do {
 188                         ok = fcntl_lock(
 189                                 xconn->smb1.echo_handler.socket_lock_fd,
 190                                 F_SETLKW, 0, 0, F_UNLCK);
 191                 } while (!ok && (errno == EINTR));
 192
 193                 if (!ok) {
 194                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 195                         return false;
 196                 }
 197         }
 198
 199         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 200
 201         return true;
 202 }
 203
 204 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 205 {
 206         if (!smbd_unlock_socket_internal(sconn)) {
 207                 exit_server_cleanly("failed to unlock socket");
 208         }
 209 }
 210
 211 /* Accessor function for smb_read_error for smbd functions. */
 212
 213 /****************************************************************************
 214  Send an smb to a fd.
 215 ****************************************************************************/
 216
 217 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 218                   bool do_signing, uint32_t seqnum,
 219                   bool do_encrypt,
 220                   struct smb_perfcount_data *pcd)
 221 {
 222         struct smbXsrv_connection *xconn = sconn->conn;
 223         size_t len = 0;
 224         ssize_t ret;
 225         char *buf_out = buffer;
 226
 227         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 228                 /*
 229                  * we're not supposed to do any io
 230                  */
 231                 return true;
 232         }
 233
 234         smbd_lock_socket(sconn);
 235
 236         if (do_signing) {
 237                 /* Sign the outgoing packet if required. */
 238                 srv_calculate_sign_mac(xconn, buf_out, seqnum);
 239         }
 240
 241         if (do_encrypt) {
 242                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 243                 if (!NT_STATUS_IS_OK(status)) {
 244                         DEBUG(0, ("send_smb: SMB encryption failed "
 245                                 "on outgoing packet! Error %s\n",
 246                                 nt_errstr(status) ));
 247                         ret = -1;
 248                         goto out;
 249                 }
 250         }
 251
 252         len = smb_len_large(buf_out) + 4;
 253
 254         ret = write_data(xconn->transport.sock, buf_out, len);
 255         if (ret <= 0) {
 256                 int saved_errno = errno;
 257                 /*
 258                  * Try and give an error message saying what
 259                  * client failed.
 260                  */
 261                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 262                          (int)getpid(), (int)len,
 263                          smbXsrv_connection_dbg(xconn),
 264                          (int)ret, strerror(saved_errno)));
 265                 errno = saved_errno;
 266
 267                 srv_free_enc_buffer(sconn, buf_out);
 268                 goto out;
 269         }
 270
 271         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 272         srv_free_enc_buffer(sconn, buf_out);
 273 out:
 274         SMB_PERFCOUNT_END(pcd);
 275
 276         smbd_unlock_socket(sconn);
 277         return (ret > 0);
 278 }
 279
 280 /*******************************************************************
 281  Setup the word count and byte count for a smb message.
 282 ********************************************************************/
 283
 284 int srv_set_message(char *buf,
 285                         int num_words,
 286                         int num_bytes,
 287                         bool zero)
 288 {
 289         if (zero && (num_words || num_bytes)) {
 290                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 291         }
 292         SCVAL(buf,smb_wct,num_words);
 293         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 294         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 295         return (smb_size + num_words*2 + num_bytes);
 296 }
 297
 298 static bool valid_smb_header(struct smbd_server_connection *sconn,
 299                              const uint8_t *inbuf)
 300 {
 301         if (is_encrypted_packet(sconn, inbuf)) {
 302                 return true;
 303         }
 304         /*
 305          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 306          * but it just looks weird to call strncmp for this one.
 307          */
 308         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 309 }
 310
 311 /* Socket functions for smbd packet processing. */
 312
 313 static bool valid_packet_size(size_t len)
 314 {
 315         /*
 316          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 317          * of header. Don't print the error if this fits.... JRA.
 318          */
 319
 320         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 321                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 322                                         (unsigned long)len));
 323                 return false;
 324         }
 325         return true;
 326 }
 327
 328 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 329                                       unsigned int timeout, ssize_t len)
 330 {
 331         NTSTATUS status;
 332
 333         if (len <= 0) {
 334                 return NT_STATUS_OK;
 335         }
 336
 337         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 338         if (!NT_STATUS_IS_OK(status)) {
 339                 char addr[INET6_ADDRSTRLEN];
 340                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 341                           "error = %s.\n",
 342                           get_peer_addr(fd, addr, sizeof(addr)),
 343                           nt_errstr(status)));
 344         }
 345         return status;
 346 }
 347
 348 /****************************************************************************
 349  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 350 ****************************************************************************/
 351
 352 /*
 353  * Unfortunately, earlier versions of smbclient/libsmbclient
 354  * don't send this "standard" writeX header. I've fixed this
 355  * for 3.2 but we'll use the old method with earlier versions.
 356  * Windows and CIFSFS at least use this standard size. Not
 357  * sure about MacOSX.
 358  */
 359
 360 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 361                                 (2*14) + /* word count (including bcc) */ \
 362                                 1 /* pad byte */)
 363
 364 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 365                                                     const char lenbuf[4],
 366                                                     struct smbd_server_connection *sconn,
 367                                                     int sock,
 368                                                     char **buffer,
 369                                                     unsigned int timeout,
 370                                                     size_t *p_unread,
 371                                                     size_t *len_ret)
 372 {
 373         /* Size of a WRITEX call (+4 byte len). */
 374         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 375         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 376         ssize_t toread;
 377         NTSTATUS status;
 378
 379         memcpy(writeX_header, lenbuf, 4);
 380
 381         status = read_fd_with_timeout(
 382                 sock, writeX_header + 4,
 383                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 384                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 385                 timeout, NULL);
 386
 387         if (!NT_STATUS_IS_OK(status)) {
 388                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 389                           "error = %s.\n",
 390                           tsocket_address_string(sconn->remote_address,
 391                                                  talloc_tos()),
 392                           nt_errstr(status)));
 393                 return status;
 394         }
 395
 396         /*
 397          * Ok - now try and see if this is a possible
 398          * valid writeX call.
 399          */
 400
 401         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 402                 /*
 403                  * If the data offset is beyond what
 404                  * we've read, drain the extra bytes.
 405                  */
 406                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 407                 ssize_t newlen;
 408
 409                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 410                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 411                         if (drain_socket(sock, drain) != drain) {
 412                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 413                                         " failed to drain pending bytes");
 414                         }
 415                 } else {
 416                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 417                 }
 418
 419                 /* Spoof down the length and null out the bcc. */
 420                 set_message_bcc(writeX_header, 0);
 421                 newlen = smb_len(writeX_header);
 422
 423                 /* Copy the header we've written. */
 424
 425                 *buffer = (char *)talloc_memdup(mem_ctx,
 426                                 writeX_header,
 427                                 sizeof(writeX_header));
 428
 429                 if (*buffer == NULL) {
 430                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 431                                   (int)sizeof(writeX_header)));
 432                         return NT_STATUS_NO_MEMORY;
 433                 }
 434
 435                 /* Work out the remaining bytes. */
 436                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 437                 *len_ret = newlen + 4;
 438                 return NT_STATUS_OK;
 439         }
 440
 441         if (!valid_packet_size(len)) {
 442                 return NT_STATUS_INVALID_PARAMETER;
 443         }
 444
 445         /*
 446          * Not a valid writeX call. Just do the standard
 447          * talloc and return.
 448          */
 449
 450         *buffer = talloc_array(mem_ctx, char, len+4);
 451
 452         if (*buffer == NULL) {
 453                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 454                           (int)len+4));
 455                 return NT_STATUS_NO_MEMORY;
 456         }
 457
 458         /* Copy in what we already read. */
 459         memcpy(*buffer,
 460                 writeX_header,
 461                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 462         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 463
 464         if(toread > 0) {
 465                 status = read_packet_remainder(
 466                         sock,
 467                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 468                         timeout, toread);
 469
 470                 if (!NT_STATUS_IS_OK(status)) {
 471                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 472                                    nt_errstr(status)));
 473                         return status;
 474                 }
 475         }
 476
 477         *len_ret = len + 4;
 478         return NT_STATUS_OK;
 479 }
 480
 481 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 482                                        struct smbd_server_connection *sconn,
 483                                        int sock,
 484                                        char **buffer, unsigned int timeout,
 485                                        size_t *p_unread, size_t *plen)
 486 {
 487         struct smbXsrv_connection *xconn = sconn->conn;
 488         char lenbuf[4];
 489         size_t len;
 490         int min_recv_size = lp_min_receive_file_size();
 491         NTSTATUS status;
 492
 493         *p_unread = 0;
 494
 495         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 496                                                   &len);
 497         if (!NT_STATUS_IS_OK(status)) {
 498                 return status;
 499         }
 500
 501         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 502             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 503                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 504             !srv_is_signing_active(xconn) &&
 505             xconn->smb1.echo_handler.trusted_fde == NULL) {
 506
 507                 return receive_smb_raw_talloc_partial_read(
 508                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 509                         p_unread, plen);
 510         }
 511
 512         if (!valid_packet_size(len)) {
 513                 return NT_STATUS_INVALID_PARAMETER;
 514         }
 515
 516         /*
 517          * The +4 here can't wrap, we've checked the length above already.
 518          */
 519
 520         *buffer = talloc_array(mem_ctx, char, len+4);
 521
 522         if (*buffer == NULL) {
 523                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 524                           (int)len+4));
 525                 return NT_STATUS_NO_MEMORY;
 526         }
 527
 528         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 529
 530         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 531         if (!NT_STATUS_IS_OK(status)) {
 532                 return status;
 533         }
 534
 535         *plen = len + 4;
 536         return NT_STATUS_OK;
 537 }
 538
 539 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 540                                    struct smbd_server_connection *sconn,
 541                                    int sock,
 542                                    char **buffer, unsigned int timeout,
 543                                    size_t *p_unread, bool *p_encrypted,
 544                                    size_t *p_len,
 545                                    uint32_t *seqnum,
 546                                    bool trusted_channel)
 547 {
 548         struct smbXsrv_connection *xconn = sconn->conn;
 549         size_t len = 0;
 550         NTSTATUS status;
 551
 552         *p_encrypted = false;
 553
 554         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 555                                         p_unread, &len);
 556         if (!NT_STATUS_IS_OK(status)) {
 557                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 558                       ("receive_smb_raw_talloc failed for client %s "
 559                        "read error = %s.\n",
 560                        tsocket_address_string(sconn->remote_address,
 561                                               talloc_tos()),
 562                        nt_errstr(status)) );
 563                 return status;
 564         }
 565
 566         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 567                 status = srv_decrypt_buffer(sconn, *buffer);
 568                 if (!NT_STATUS_IS_OK(status)) {
 569                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 570                                 "incoming packet! Error %s\n",
 571                                 nt_errstr(status) ));
 572                         return status;
 573                 }
 574                 *p_encrypted = true;
 575         }
 576
 577         /* Check the incoming SMB signature. */
 578         if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
 579                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 580                           "incoming packet!\n"));
 581                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 582         }
 583
 584         *p_len = len;
 585         return NT_STATUS_OK;
 586 }
 587
 588 /*
 589  * Initialize a struct smb_request from an inbuf
 590  */
 591
 592 static bool init_smb_request(struct smb_request *req,
 593                              struct smbd_server_connection *sconn,
 594                              struct smbXsrv_connection *xconn,
 595                              const uint8 *inbuf,
 596                              size_t unread_bytes, bool encrypted,
 597                              uint32_t seqnum)
 598 {
 599         struct smbXsrv_tcon *tcon;
 600         NTSTATUS status;
 601         NTTIME now;
 602         size_t req_size = smb_len(inbuf) + 4;
 603
 604         /* Ensure we have at least smb_size bytes. */
 605         if (req_size < smb_size) {
 606                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 607                         (unsigned int)req_size ));
 608                 return false;
 609         }
 610
 611         req->request_time = timeval_current();
 612         now = timeval_to_nttime(&req->request_time);
 613
 614         req->cmd    = CVAL(inbuf, smb_com);
 615         req->flags2 = SVAL(inbuf, smb_flg2);
 616         req->smbpid = SVAL(inbuf, smb_pid);
 617         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 618         req->seqnum = seqnum;
 619         req->vuid   = SVAL(inbuf, smb_uid);
 620         req->tid    = SVAL(inbuf, smb_tid);
 621         req->wct    = CVAL(inbuf, smb_wct);
 622         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 623         req->buflen = smb_buflen(inbuf);
 624         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 625         req->unread_bytes = unread_bytes;
 626         req->encrypted = encrypted;
 627         req->sconn = sconn;
 628         req->xconn = xconn;
 629         status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
 630         if (NT_STATUS_IS_OK(status)) {
 631                 req->conn = tcon->compat;
 632         } else {
 633                 req->conn = NULL;
 634         }
 635         req->chain_fsp = NULL;
 636         req->smb2req = NULL;
 637         req->priv_paths = NULL;
 638         req->chain = NULL;
 639         smb_init_perfcount_data(&req->pcd);
 640
 641         /* Ensure we have at least wct words and 2 bytes of bcc. */
 642         if (smb_size + req->wct*2 > req_size) {
 643                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 644                         (unsigned int)req->wct,
 645                         (unsigned int)req_size));
 646                 return false;
 647         }
 648         /* Ensure bcc is correct. */
 649         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 650                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 651                         "(wct = %u, size %u)\n",
 652                         (unsigned int)req->buflen,
 653                         (unsigned int)req->wct,
 654                         (unsigned int)req_size));
 655                 return false;
 656         }
 657
 658         req->outbuf = NULL;
 659         return true;
 660 }
 661
 662 static void process_smb(struct smbd_server_connection *conn,
 663                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 664                         uint32_t seqnum, bool encrypted,
 665                         struct smb_perfcount_data *deferred_pcd);
 666
 667 static void smbd_deferred_open_timer(struct tevent_context *ev,
 668                                      struct tevent_timer *te,
 669                                      struct timeval _tval,
 670                                      void *private_data)
 671 {
 672         struct pending_message_list *msg = talloc_get_type(private_data,
 673                                            struct pending_message_list);
 674         struct smbd_server_connection *sconn = msg->sconn;
 675         TALLOC_CTX *mem_ctx = talloc_tos();
 676         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 677         uint8_t *inbuf;
 678
 679         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 680                                          msg->buf.length);
 681         if (inbuf == NULL) {
 682                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 683                 return;
 684         }
 685
 686         /* We leave this message on the queue so the open code can
 687            know this is a retry. */
 688         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 689                 (unsigned long long)mid ));
 690
 691         /* Mark the message as processed so this is not
 692          * re-processed in error. */
 693         msg->processed = true;
 694
 695         process_smb(sconn, inbuf,
 696                     msg->buf.length, 0,
 697                     msg->seqnum, msg->encrypted, &msg->pcd);
 698
 699         /* If it's still there and was processed, remove it. */
 700         msg = get_deferred_open_message_smb(sconn, mid);
 701         if (msg && msg->processed) {
 702                 remove_deferred_open_message_smb(sconn, mid);
 703         }
 704 }
 705
 706 /****************************************************************************
 707  Function to push a message onto the tail of a linked list of smb messages ready
 708  for processing.
 709 ****************************************************************************/
 710
 711 static bool push_queued_message(struct smb_request *req,
 712                                 struct timeval request_time,
 713                                 struct timeval end_time,
 714                                 struct deferred_open_record *open_rec)
 715 {
 716         int msg_len = smb_len(req->inbuf) + 4;
 717         struct pending_message_list *msg;
 718
 719         msg = talloc_zero(NULL, struct pending_message_list);
 720
 721         if(msg == NULL) {
 722                 DEBUG(0,("push_message: malloc fail (1)\n"));
 723                 return False;
 724         }
 725         msg->sconn = req->sconn;
 726
 727         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 728         if(msg->buf.data == NULL) {
 729                 DEBUG(0,("push_message: malloc fail (2)\n"));
 730                 TALLOC_FREE(msg);
 731                 return False;
 732         }
 733
 734         msg->request_time = request_time;
 735         msg->seqnum = req->seqnum;
 736         msg->encrypted = req->encrypted;
 737         msg->processed = false;
 738         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 739
 740         if (open_rec) {
 741                 msg->open_rec = talloc_move(msg, &open_rec);
 742         }
 743
 744 #if 0
 745         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 746                                    msg,
 747                                    end_time,
 748                                    smbd_deferred_open_timer,
 749                                    msg);
 750         if (!msg->te) {
 751                 DEBUG(0,("push_message: event_add_timed failed\n"));
 752                 TALLOC_FREE(msg);
 753                 return false;
 754         }
 755 #endif
 756
 757         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 758                       struct pending_message_list *);
 759
 760         DEBUG(10,("push_message: pushed message length %u on "
 761                   "deferred_open_queue\n", (unsigned int)msg_len));
 762
 763         return True;
 764 }
 765
 766 /****************************************************************************
 767  Function to delete a sharing violation open message by mid.
 768 ****************************************************************************/
 769
 770 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 771                                       uint64_t mid)
 772 {
 773         struct pending_message_list *pml;
 774
 775         if (sconn->using_smb2) {
 776                 remove_deferred_open_message_smb2(sconn, mid);
 777                 return;
 778         }
 779
 780         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 781                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 782                         DEBUG(10,("remove_deferred_open_message_smb: "
 783                                   "deleting mid %llu len %u\n",
 784                                   (unsigned long long)mid,
 785                                   (unsigned int)pml->buf.length ));
 786                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 787                         TALLOC_FREE(pml);
 788                         return;
 789                 }
 790         }
 791 }
 792
 793 /****************************************************************************
 794  Move a sharing violation open retry message to the front of the list and
 795  schedule it for immediate processing.
 796 ****************************************************************************/
 797
 798 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 799                                         uint64_t mid)
 800 {
 801         struct pending_message_list *pml;
 802         int i = 0;
 803
 804         if (sconn->using_smb2) {
 805                 return schedule_deferred_open_message_smb2(sconn, mid);
 806         }
 807
 808         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 809                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 810
 811                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 812                         "msg_mid = %llu\n",
 813                         i++,
 814                         (unsigned long long)msg_mid ));
 815
 816                 if (mid == msg_mid) {
 817                         struct tevent_timer *te;
 818
 819                         if (pml->processed) {
 820                                 /* A processed message should not be
 821                                  * rescheduled. */
 822                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 823                                         "message mid %llu was already processed\n",
 824                                         (unsigned long long)msg_mid ));
 825                                 continue;
 826                         }
 827
 828                         DEBUG(10,("schedule_deferred_open_message_smb: "
 829                                 "scheduling mid %llu\n",
 830                                 (unsigned long long)mid ));
 831
 832                         te = tevent_add_timer(pml->sconn->ev_ctx,
 833                                               pml,
 834                                               timeval_zero(),
 835                                               smbd_deferred_open_timer,
 836                                               pml);
 837                         if (!te) {
 838                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 839                                         "event_add_timed() failed, "
 840                                         "skipping mid %llu\n",
 841                                         (unsigned long long)msg_mid ));
 842                         }
 843
 844                         TALLOC_FREE(pml->te);
 845                         pml->te = te;
 846                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 847                         return true;
 848                 }
 849         }
 850
 851         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 852                 "find message mid %llu\n",
 853                 (unsigned long long)mid ));
 854
 855         return false;
 856 }
 857
 858 /****************************************************************************
 859  Return true if this mid is on the deferred queue and was not yet processed.
 860 ****************************************************************************/
 861
 862 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 863 {
 864         struct pending_message_list *pml;
 865
 866         if (sconn->using_smb2) {
 867                 return open_was_deferred_smb2(sconn, mid);
 868         }
 869
 870         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 871                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 872                         return True;
 873                 }
 874         }
 875         return False;
 876 }
 877
 878 /****************************************************************************
 879  Return the message queued by this mid.
 880 ****************************************************************************/
 881
 882 static struct pending_message_list *get_deferred_open_message_smb(
 883         struct smbd_server_connection *sconn, uint64_t mid)
 884 {
 885         struct pending_message_list *pml;
 886
 887         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 888                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 889                         return pml;
 890                 }
 891         }
 892         return NULL;
 893 }
 894
 895 /****************************************************************************
 896  Get the state data queued by this mid.
 897 ****************************************************************************/
 898
 899 bool get_deferred_open_message_state(struct smb_request *smbreq,
 900                                 struct timeval *p_request_time,
 901                                 struct deferred_open_record **open_rec)
 902 {
 903         struct pending_message_list *pml;
 904
 905         if (smbreq->sconn->using_smb2) {
 906                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 907                                         p_request_time,
 908                                         open_rec);
 909         }
 910
 911         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 912         if (!pml) {
 913                 return false;
 914         }
 915         if (p_request_time) {
 916                 *p_request_time = pml->request_time;
 917         }
 918         if (open_rec != NULL) {
 919                 *open_rec = pml->open_rec;
 920         }
 921         return true;
 922 }
 923
 924 /****************************************************************************
 925  Function to push a deferred open smb message onto a linked list of local smb
 926  messages ready for processing.
 927 ****************************************************************************/
 928
 929 bool push_deferred_open_message_smb(struct smb_request *req,
 930                                struct timeval request_time,
 931                                struct timeval timeout,
 932                                struct file_id id,
 933                                struct deferred_open_record *open_rec)
 934 {
 935         struct timeval end_time;
 936
 937         if (req->smb2req) {
 938                 return push_deferred_open_message_smb2(req->smb2req,
 939                                                 request_time,
 940                                                 timeout,
 941                                                 id,
 942                                                 open_rec);
 943         }
 944
 945         if (req->unread_bytes) {
 946                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 947                         "unread_bytes = %u\n",
 948                         (unsigned int)req->unread_bytes ));
 949                 smb_panic("push_deferred_open_message_smb: "
 950                         "logic error unread_bytes != 0" );
 951         }
 952
 953         end_time = timeval_sum(&request_time, &timeout);
 954
 955         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 956                 "len %u mid %llu timeout time [%u.%06u]\n",
 957                 (unsigned int) smb_len(req->inbuf)+4,
 958                 (unsigned long long)req->mid,
 959                 (unsigned int)end_time.tv_sec,
 960                 (unsigned int)end_time.tv_usec));
 961
 962         return push_queued_message(req, request_time, end_time, open_rec);
 963 }
 964
 965 static void smbd_sig_term_handler(struct tevent_context *ev,
 966                                   struct tevent_signal *se,
 967                                   int signum,
 968                                   int count,
 969                                   void *siginfo,
 970                                   void *private_data)
 971 {
 972         exit_server_cleanly("termination signal");
 973 }
 974
 975 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 976 {
 977         struct tevent_signal *se;
 978
 979         se = tevent_add_signal(sconn->ev_ctx,
 980                                sconn,
 981                                SIGTERM, 0,
 982                                smbd_sig_term_handler,
 983                                sconn);
 984         if (!se) {
 985                 exit_server("failed to setup SIGTERM handler");
 986         }
 987 }
 988
 989 static void smbd_sig_hup_handler(struct tevent_context *ev,
 990                                   struct tevent_signal *se,
 991                                   int signum,
 992                                   int count,
 993                                   void *siginfo,
 994                                   void *private_data)
 995 {
 996         struct smbd_server_connection *sconn =
 997                 talloc_get_type_abort(private_data,
 998                 struct smbd_server_connection);
 999
1000         change_to_root_user();
1001         DEBUG(1,("Reloading services after SIGHUP\n"));
1002         reload_services(sconn, conn_snum_used, false);
1003 }
1004
1005 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1006 {
1007         struct tevent_signal *se;
1008
1009         se = tevent_add_signal(sconn->ev_ctx,
1010                                sconn,
1011                                SIGHUP, 0,
1012                                smbd_sig_hup_handler,
1013                                sconn);
1014         if (!se) {
1015                 exit_server("failed to setup SIGHUP handler");
1016         }
1017 }
1018
1019 static void smbd_conf_updated(struct messaging_context *msg,
1020                               void *private_data,
1021                               uint32_t msg_type,
1022                               struct server_id server_id,
1023                               DATA_BLOB *data)
1024 {
1025         struct smbd_server_connection *sconn =
1026                 talloc_get_type_abort(private_data,
1027                 struct smbd_server_connection);
1028
1029         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1030                   "updated. Reloading.\n"));
1031         change_to_root_user();
1032         reload_services(sconn, conn_snum_used, false);
1033 }
1034
1035 /*
1036  * Only allow 5 outstanding trans requests. We're allocating memory, so
1037  * prevent a DoS.
1038  */
1039
1040 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1041 {
1042         int count = 0;
1043         for (; list != NULL; list = list->next) {
1044
1045                 if (list->mid == mid) {
1046                         return NT_STATUS_INVALID_PARAMETER;
1047                 }
1048
1049                 count += 1;
1050         }
1051         if (count > 5) {
1052                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1053         }
1054
1055         return NT_STATUS_OK;
1056 }
1057
1058 /*
1059 These flags determine some of the permissions required to do an operation
1060
1061 Note that I don't set NEED_WRITE on some write operations because they
1062 are used by some brain-dead clients when printing, and I don't want to
1063 force write permissions on print services.
1064 */
1065 #define AS_USER (1<<0)
1066 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1067 #define TIME_INIT (1<<2)
1068 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1069 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1070 #define DO_CHDIR (1<<6)
1071
1072 /*
1073    define a list of possible SMB messages and their corresponding
1074    functions. Any message that has a NULL function is unimplemented -
1075    please feel free to contribute implementations!
1076 */
1077 static const struct smb_message_struct {
1078         const char *name;
1079         void (*fn)(struct smb_request *req);
1080         int flags;
1081 } smb_messages[256] = {
1082
1083 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1084 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1085 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1086 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1087 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1088 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1089 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1090 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1091 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1092 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1093 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1094 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1095 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1096 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1097 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1098 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1099 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1100 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1101 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1102 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1103 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1104 /* 0x15 */ { NULL, NULL, 0 },
1105 /* 0x16 */ { NULL, NULL, 0 },
1106 /* 0x17 */ { NULL, NULL, 0 },
1107 /* 0x18 */ { NULL, NULL, 0 },
1108 /* 0x19 */ { NULL, NULL, 0 },
1109 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1110 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1111 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1112 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1113 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1114 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1115 /* 0x20 */ { "SMBwritec", NULL,0},
1116 /* 0x21 */ { NULL, NULL, 0 },
1117 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1118 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1119 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1120 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1121 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1122 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1123 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1124 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1125 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1126 /* 0x2b */ { "SMBecho",reply_echo,0},
1127 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1128 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1129 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1130 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1131 /* 0x30 */ { NULL, NULL, 0 },
1132 /* 0x31 */ { NULL, NULL, 0 },
1133 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1134 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1135 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1136 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1137 /* 0x36 */ { NULL, NULL, 0 },
1138 /* 0x37 */ { NULL, NULL, 0 },
1139 /* 0x38 */ { NULL, NULL, 0 },
1140 /* 0x39 */ { NULL, NULL, 0 },
1141 /* 0x3a */ { NULL, NULL, 0 },
1142 /* 0x3b */ { NULL, NULL, 0 },
1143 /* 0x3c */ { NULL, NULL, 0 },
1144 /* 0x3d */ { NULL, NULL, 0 },
1145 /* 0x3e */ { NULL, NULL, 0 },
1146 /* 0x3f */ { NULL, NULL, 0 },
1147 /* 0x40 */ { NULL, NULL, 0 },
1148 /* 0x41 */ { NULL, NULL, 0 },
1149 /* 0x42 */ { NULL, NULL, 0 },
1150 /* 0x43 */ { NULL, NULL, 0 },
1151 /* 0x44 */ { NULL, NULL, 0 },
1152 /* 0x45 */ { NULL, NULL, 0 },
1153 /* 0x46 */ { NULL, NULL, 0 },
1154 /* 0x47 */ { NULL, NULL, 0 },
1155 /* 0x48 */ { NULL, NULL, 0 },
1156 /* 0x49 */ { NULL, NULL, 0 },
1157 /* 0x4a */ { NULL, NULL, 0 },
1158 /* 0x4b */ { NULL, NULL, 0 },
1159 /* 0x4c */ { NULL, NULL, 0 },
1160 /* 0x4d */ { NULL, NULL, 0 },
1161 /* 0x4e */ { NULL, NULL, 0 },
1162 /* 0x4f */ { NULL, NULL, 0 },
1163 /* 0x50 */ { NULL, NULL, 0 },
1164 /* 0x51 */ { NULL, NULL, 0 },
1165 /* 0x52 */ { NULL, NULL, 0 },
1166 /* 0x53 */ { NULL, NULL, 0 },
1167 /* 0x54 */ { NULL, NULL, 0 },
1168 /* 0x55 */ { NULL, NULL, 0 },
1169 /* 0x56 */ { NULL, NULL, 0 },
1170 /* 0x57 */ { NULL, NULL, 0 },
1171 /* 0x58 */ { NULL, NULL, 0 },
1172 /* 0x59 */ { NULL, NULL, 0 },
1173 /* 0x5a */ { NULL, NULL, 0 },
1174 /* 0x5b */ { NULL, NULL, 0 },
1175 /* 0x5c */ { NULL, NULL, 0 },
1176 /* 0x5d */ { NULL, NULL, 0 },
1177 /* 0x5e */ { NULL, NULL, 0 },
1178 /* 0x5f */ { NULL, NULL, 0 },
1179 /* 0x60 */ { NULL, NULL, 0 },
1180 /* 0x61 */ { NULL, NULL, 0 },
1181 /* 0x62 */ { NULL, NULL, 0 },
1182 /* 0x63 */ { NULL, NULL, 0 },
1183 /* 0x64 */ { NULL, NULL, 0 },
1184 /* 0x65 */ { NULL, NULL, 0 },
1185 /* 0x66 */ { NULL, NULL, 0 },
1186 /* 0x67 */ { NULL, NULL, 0 },
1187 /* 0x68 */ { NULL, NULL, 0 },
1188 /* 0x69 */ { NULL, NULL, 0 },
1189 /* 0x6a */ { NULL, NULL, 0 },
1190 /* 0x6b */ { NULL, NULL, 0 },
1191 /* 0x6c */ { NULL, NULL, 0 },
1192 /* 0x6d */ { NULL, NULL, 0 },
1193 /* 0x6e */ { NULL, NULL, 0 },
1194 /* 0x6f */ { NULL, NULL, 0 },
1195 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1196 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1197 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1198 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1199 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1200 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1201 /* 0x76 */ { NULL, NULL, 0 },
1202 /* 0x77 */ { NULL, NULL, 0 },
1203 /* 0x78 */ { NULL, NULL, 0 },
1204 /* 0x79 */ { NULL, NULL, 0 },
1205 /* 0x7a */ { NULL, NULL, 0 },
1206 /* 0x7b */ { NULL, NULL, 0 },
1207 /* 0x7c */ { NULL, NULL, 0 },
1208 /* 0x7d */ { NULL, NULL, 0 },
1209 /* 0x7e */ { NULL, NULL, 0 },
1210 /* 0x7f */ { NULL, NULL, 0 },
1211 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1212 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1213 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1214 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1215 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1216 /* 0x85 */ { NULL, NULL, 0 },
1217 /* 0x86 */ { NULL, NULL, 0 },
1218 /* 0x87 */ { NULL, NULL, 0 },
1219 /* 0x88 */ { NULL, NULL, 0 },
1220 /* 0x89 */ { NULL, NULL, 0 },
1221 /* 0x8a */ { NULL, NULL, 0 },
1222 /* 0x8b */ { NULL, NULL, 0 },
1223 /* 0x8c */ { NULL, NULL, 0 },
1224 /* 0x8d */ { NULL, NULL, 0 },
1225 /* 0x8e */ { NULL, NULL, 0 },
1226 /* 0x8f */ { NULL, NULL, 0 },
1227 /* 0x90 */ { NULL, NULL, 0 },
1228 /* 0x91 */ { NULL, NULL, 0 },
1229 /* 0x92 */ { NULL, NULL, 0 },
1230 /* 0x93 */ { NULL, NULL, 0 },
1231 /* 0x94 */ { NULL, NULL, 0 },
1232 /* 0x95 */ { NULL, NULL, 0 },
1233 /* 0x96 */ { NULL, NULL, 0 },
1234 /* 0x97 */ { NULL, NULL, 0 },
1235 /* 0x98 */ { NULL, NULL, 0 },
1236 /* 0x99 */ { NULL, NULL, 0 },
1237 /* 0x9a */ { NULL, NULL, 0 },
1238 /* 0x9b */ { NULL, NULL, 0 },
1239 /* 0x9c */ { NULL, NULL, 0 },
1240 /* 0x9d */ { NULL, NULL, 0 },
1241 /* 0x9e */ { NULL, NULL, 0 },
1242 /* 0x9f */ { NULL, NULL, 0 },
1243 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1244 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1245 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1246 /* 0xa3 */ { NULL, NULL, 0 },
1247 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1248 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1249 /* 0xa6 */ { NULL, NULL, 0 },
1250 /* 0xa7 */ { NULL, NULL, 0 },
1251 /* 0xa8 */ { NULL, NULL, 0 },
1252 /* 0xa9 */ { NULL, NULL, 0 },
1253 /* 0xaa */ { NULL, NULL, 0 },
1254 /* 0xab */ { NULL, NULL, 0 },
1255 /* 0xac */ { NULL, NULL, 0 },
1256 /* 0xad */ { NULL, NULL, 0 },
1257 /* 0xae */ { NULL, NULL, 0 },
1258 /* 0xaf */ { NULL, NULL, 0 },
1259 /* 0xb0 */ { NULL, NULL, 0 },
1260 /* 0xb1 */ { NULL, NULL, 0 },
1261 /* 0xb2 */ { NULL, NULL, 0 },
1262 /* 0xb3 */ { NULL, NULL, 0 },
1263 /* 0xb4 */ { NULL, NULL, 0 },
1264 /* 0xb5 */ { NULL, NULL, 0 },
1265 /* 0xb6 */ { NULL, NULL, 0 },
1266 /* 0xb7 */ { NULL, NULL, 0 },
1267 /* 0xb8 */ { NULL, NULL, 0 },
1268 /* 0xb9 */ { NULL, NULL, 0 },
1269 /* 0xba */ { NULL, NULL, 0 },
1270 /* 0xbb */ { NULL, NULL, 0 },
1271 /* 0xbc */ { NULL, NULL, 0 },
1272 /* 0xbd */ { NULL, NULL, 0 },
1273 /* 0xbe */ { NULL, NULL, 0 },
1274 /* 0xbf */ { NULL, NULL, 0 },
1275 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1276 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1277 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1278 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1279 /* 0xc4 */ { NULL, NULL, 0 },
1280 /* 0xc5 */ { NULL, NULL, 0 },
1281 /* 0xc6 */ { NULL, NULL, 0 },
1282 /* 0xc7 */ { NULL, NULL, 0 },
1283 /* 0xc8 */ { NULL, NULL, 0 },
1284 /* 0xc9 */ { NULL, NULL, 0 },
1285 /* 0xca */ { NULL, NULL, 0 },
1286 /* 0xcb */ { NULL, NULL, 0 },
1287 /* 0xcc */ { NULL, NULL, 0 },
1288 /* 0xcd */ { NULL, NULL, 0 },
1289 /* 0xce */ { NULL, NULL, 0 },
1290 /* 0xcf */ { NULL, NULL, 0 },
1291 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1292 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1293 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1294 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1295 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1296 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1297 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1298 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1299 /* 0xd8 */ { NULL, NULL, 0 },
1300 /* 0xd9 */ { NULL, NULL, 0 },
1301 /* 0xda */ { NULL, NULL, 0 },
1302 /* 0xdb */ { NULL, NULL, 0 },
1303 /* 0xdc */ { NULL, NULL, 0 },
1304 /* 0xdd */ { NULL, NULL, 0 },
1305 /* 0xde */ { NULL, NULL, 0 },
1306 /* 0xdf */ { NULL, NULL, 0 },
1307 /* 0xe0 */ { NULL, NULL, 0 },
1308 /* 0xe1 */ { NULL, NULL, 0 },
1309 /* 0xe2 */ { NULL, NULL, 0 },
1310 /* 0xe3 */ { NULL, NULL, 0 },
1311 /* 0xe4 */ { NULL, NULL, 0 },
1312 /* 0xe5 */ { NULL, NULL, 0 },
1313 /* 0xe6 */ { NULL, NULL, 0 },
1314 /* 0xe7 */ { NULL, NULL, 0 },
1315 /* 0xe8 */ { NULL, NULL, 0 },
1316 /* 0xe9 */ { NULL, NULL, 0 },
1317 /* 0xea */ { NULL, NULL, 0 },
1318 /* 0xeb */ { NULL, NULL, 0 },
1319 /* 0xec */ { NULL, NULL, 0 },
1320 /* 0xed */ { NULL, NULL, 0 },
1321 /* 0xee */ { NULL, NULL, 0 },
1322 /* 0xef */ { NULL, NULL, 0 },
1323 /* 0xf0 */ { NULL, NULL, 0 },
1324 /* 0xf1 */ { NULL, NULL, 0 },
1325 /* 0xf2 */ { NULL, NULL, 0 },
1326 /* 0xf3 */ { NULL, NULL, 0 },
1327 /* 0xf4 */ { NULL, NULL, 0 },
1328 /* 0xf5 */ { NULL, NULL, 0 },
1329 /* 0xf6 */ { NULL, NULL, 0 },
1330 /* 0xf7 */ { NULL, NULL, 0 },
1331 /* 0xf8 */ { NULL, NULL, 0 },
1332 /* 0xf9 */ { NULL, NULL, 0 },
1333 /* 0xfa */ { NULL, NULL, 0 },
1334 /* 0xfb */ { NULL, NULL, 0 },
1335 /* 0xfc */ { NULL, NULL, 0 },
1336 /* 0xfd */ { NULL, NULL, 0 },
1337 /* 0xfe */ { NULL, NULL, 0 },
1338 /* 0xff */ { NULL, NULL, 0 }
1339
1340 };
1341
1342 /*******************************************************************
1343  allocate and initialize a reply packet
1344 ********************************************************************/
1345
1346 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1347                           const char *inbuf, char **outbuf, uint8_t num_words,
1348                           uint32_t num_bytes)
1349 {
1350         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1351
1352         /*
1353          * Protect against integer wrap.
1354          * The SMB layer reply can be up to 0xFFFFFF bytes.
1355          */
1356         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1357                 char *msg;
1358                 if (asprintf(&msg, "num_bytes too large: %u",
1359                              (unsigned)num_bytes) == -1) {
1360                         msg = discard_const_p(char, "num_bytes too large");
1361                 }
1362                 smb_panic(msg);
1363         }
1364
1365         /*
1366          * Here we include the NBT header for now.
1367          */
1368         *outbuf = talloc_array(mem_ctx, char,
1369                                NBT_HDR_SIZE + smb_len);
1370         if (*outbuf == NULL) {
1371                 return false;
1372         }
1373
1374         construct_reply_common(req, inbuf, *outbuf);
1375         srv_set_message(*outbuf, num_words, num_bytes, false);
1376         /*
1377          * Zero out the word area, the caller has to take care of the bcc area
1378          * himself
1379          */
1380         if (num_words != 0) {
1381                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1382         }
1383
1384         return true;
1385 }
1386
1387 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1388 {
1389         char *outbuf;
1390         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1391                            num_bytes)) {
1392                 smb_panic("could not allocate output buffer\n");
1393         }
1394         req->outbuf = (uint8_t *)outbuf;
1395 }
1396
1397
1398 /*******************************************************************
1399  Dump a packet to a file.
1400 ********************************************************************/
1401
1402 static void smb_dump(const char *name, int type, const char *data)
1403 {
1404         size_t len;
1405         int fd, i;
1406         char *fname = NULL;
1407         if (DEBUGLEVEL < 50) {
1408                 return;
1409         }
1410
1411         len = smb_len_tcp(data)+4;
1412         for (i=1;i<100;i++) {
1413                 fname = talloc_asprintf(talloc_tos(),
1414                                 "/tmp/%s.%d.%s",
1415                                 name,
1416                                 i,
1417                                 type ? "req" : "resp");
1418                 if (fname == NULL) {
1419                         return;
1420                 }
1421                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1422                 if (fd != -1 || errno != EEXIST) break;
1423                 TALLOC_FREE(fname);
1424         }
1425         if (fd != -1) {
1426                 ssize_t ret = write(fd, data, len);
1427                 if (ret != len)
1428                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1429                 close(fd);
1430                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1431         }
1432         TALLOC_FREE(fname);
1433 }
1434
1435 /****************************************************************************
1436  Prepare everything for calling the actual request function, and potentially
1437  call the request function via the "new" interface.
1438
1439  Return False if the "legacy" function needs to be called, everything is
1440  prepared.
1441
1442  Return True if we're done.
1443
1444  I know this API sucks, but it is the one with the least code change I could
1445  find.
1446 ****************************************************************************/
1447
1448 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1449 {
1450         int flags;
1451         uint64_t session_tag;
1452         connection_struct *conn = NULL;
1453         struct smbXsrv_connection *xconn = req->xconn;
1454         NTTIME now = timeval_to_nttime(&req->request_time);
1455         struct smbXsrv_session *session = NULL;
1456         NTSTATUS status;
1457
1458         errno = 0;
1459
1460         if (smb_messages[type].fn == NULL) {
1461                 DEBUG(0,("Unknown message type %d!\n",type));
1462                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1463                 reply_unknown_new(req, type);
1464                 return NULL;
1465         }
1466
1467         flags = smb_messages[type].flags;
1468
1469         /* In share mode security we must ignore the vuid. */
1470         session_tag = req->vuid;
1471         conn = req->conn;
1472
1473         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1474                  (int)getpid(), (unsigned long)conn));
1475
1476         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1477
1478         /* Ensure this value is replaced in the incoming packet. */
1479         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1480
1481         /*
1482          * Ensure the correct username is in current_user_info.  This is a
1483          * really ugly bugfix for problems with multiple session_setup_and_X's
1484          * being done and allowing %U and %G substitutions to work correctly.
1485          * There is a reason this code is done here, don't move it unless you
1486          * know what you're doing... :-).
1487          * JRA.
1488          */
1489
1490         /*
1491          * lookup an existing session
1492          *
1493          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1494          * here, the main check is still in change_to_user()
1495          */
1496         status = smb1srv_session_lookup(xconn,
1497                                         session_tag,
1498                                         now,
1499                                         &session);
1500         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1501                 switch (type) {
1502                 case SMBsesssetupX:
1503                         status = NT_STATUS_OK;
1504                         break;
1505                 default:
1506                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1507                                  (unsigned long long)session_tag,
1508                                  (unsigned long long)req->mid));
1509                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1510                         return conn;
1511                 }
1512         }
1513
1514         if (session_tag != xconn->last_session_id) {
1515                 struct user_struct *vuser = NULL;
1516
1517                 xconn->last_session_id = session_tag;
1518                 if (session) {
1519                         vuser = session->compat;
1520                 }
1521                 if (vuser) {
1522                         set_current_user_info(
1523                                 vuser->session_info->unix_info->sanitized_username,
1524                                 vuser->session_info->unix_info->unix_name,
1525                                 vuser->session_info->info->domain_name);
1526                 }
1527         }
1528
1529         /* Does this call need to be run as the connected user? */
1530         if (flags & AS_USER) {
1531
1532                 /* Does this call need a valid tree connection? */
1533                 if (!conn) {
1534                         /*
1535                          * Amazingly, the error code depends on the command
1536                          * (from Samba4).
1537                          */
1538                         if (type == SMBntcreateX) {
1539                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1540                         } else {
1541                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1542                         }
1543                         return NULL;
1544                 }
1545
1546                 if (!change_to_user(conn,session_tag)) {
1547                         DEBUG(0, ("Error: Could not change to user. Removing "
1548                                 "deferred open, mid=%llu.\n",
1549                                 (unsigned long long)req->mid));
1550                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1551                         return conn;
1552                 }
1553
1554                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1555
1556                 /* Does it need write permission? */
1557                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1558                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1559                         return conn;
1560                 }
1561
1562                 /* IPC services are limited */
1563                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1564                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1565                         return conn;
1566                 }
1567         } else {
1568                 /* This call needs to be run as root */
1569                 change_to_root_user();
1570         }
1571
1572         /* load service specific parameters */
1573         if (conn) {
1574                 if (req->encrypted) {
1575                         conn->encrypted_tid = true;
1576                         /* encrypted required from now on. */
1577                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1578                 } else if (ENCRYPTION_REQUIRED(conn)) {
1579                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1580                                 DEBUG(1,("service[%s] requires encryption"
1581                                         "%s ACCESS_DENIED. mid=%llu\n",
1582                                         lp_servicename(talloc_tos(), SNUM(conn)),
1583                                         smb_fn_name(type),
1584                                         (unsigned long long)req->mid));
1585                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1586                                 return conn;
1587                         }
1588                 }
1589
1590                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1591                                          (flags & (AS_USER|DO_CHDIR)
1592                                           ?True:False))) {
1593                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1594                         return conn;
1595                 }
1596                 conn->num_smb_operations++;
1597         }
1598
1599         /*
1600          * Does this protocol need to be run as guest? (Only archane
1601          * messenger service requests have this...)
1602          */
1603         if (flags & AS_GUEST) {
1604                 char *raddr;
1605                 bool ok;
1606
1607                 if (!change_to_guest()) {
1608                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1609                         return conn;
1610                 }
1611
1612                 raddr = tsocket_address_inet_addr_string(xconn->remote_address,
1613                                                          talloc_tos());
1614                 if (raddr == NULL) {
1615                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1616                         return conn;
1617                 }
1618
1619                 /*
1620                  * Haven't we checked this in smbd_process already???
1621                  */
1622
1623                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1624                                   xconn->remote_hostname, raddr);
1625                 TALLOC_FREE(raddr);
1626
1627                 if (!ok) {
1628                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1629                         return conn;
1630                 }
1631         }
1632
1633         smb_messages[type].fn(req);
1634         return req->conn;
1635 }
1636
1637 /****************************************************************************
1638  Construct a reply to the incoming packet.
1639 ****************************************************************************/
1640
1641 static void construct_reply(struct smbd_server_connection *sconn,
1642                             char *inbuf, int size, size_t unread_bytes,
1643                             uint32_t seqnum, bool encrypted,
1644                             struct smb_perfcount_data *deferred_pcd)
1645 {
1646         struct smbXsrv_connection *xconn = sconn->conn;
1647         connection_struct *conn;
1648         struct smb_request *req;
1649
1650         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1651                 smb_panic("could not allocate smb_request");
1652         }
1653
1654         if (!init_smb_request(req, sconn, xconn, (uint8 *)inbuf, unread_bytes,
1655                               encrypted, seqnum)) {
1656                 exit_server_cleanly("Invalid SMB request");
1657         }
1658
1659         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1660
1661         /* we popped this message off the queue - keep original perf data */
1662         if (deferred_pcd)
1663                 req->pcd = *deferred_pcd;
1664         else {
1665                 SMB_PERFCOUNT_START(&req->pcd);
1666                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1667                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1668         }
1669
1670         conn = switch_message(req->cmd, req);
1671
1672         if (req->outbuf == NULL) {
1673                 return;
1674         }
1675
1676         if (CVAL(req->outbuf,0) == 0) {
1677                 show_msg((char *)req->outbuf);
1678         }
1679
1680         if (!srv_send_smb(req->sconn,
1681                         (char *)req->outbuf,
1682                         true, req->seqnum+1,
1683                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1684                         &req->pcd)) {
1685                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1686         }
1687
1688         TALLOC_FREE(req);
1689
1690         return;
1691 }
1692
1693 static void construct_reply_chain(struct smbd_server_connection *sconn,
1694                                   char *inbuf, int size, uint32_t seqnum,
1695                                   bool encrypted,
1696                                   struct smb_perfcount_data *deferred_pcd)
1697 {
1698         struct smb_request **reqs = NULL;
1699         struct smb_request *req;
1700         unsigned num_reqs;
1701         bool ok;
1702
1703         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1704                               seqnum, &reqs, &num_reqs);
1705         if (!ok) {
1706                 char errbuf[smb_size];
1707                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1708                              __LINE__, __FILE__);
1709                 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1710                                   NULL)) {
1711                         exit_server_cleanly("construct_reply_chain: "
1712                                             "srv_send_smb failed.");
1713                 }
1714                 return;
1715         }
1716
1717         req = reqs[0];
1718         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1719
1720         req->conn = switch_message(req->cmd, req);
1721
1722         if (req->outbuf == NULL) {
1723                 /*
1724                  * Request has suspended itself, will come
1725                  * back here.
1726                  */
1727                 return;
1728         }
1729         smb_request_done(req);
1730 }
1731
1732 /*
1733  * To be called from an async SMB handler that is potentially chained
1734  * when it is finished for shipping.
1735  */
1736
1737 void smb_request_done(struct smb_request *req)
1738 {
1739         struct smb_request **reqs = NULL;
1740         struct smb_request *first_req;
1741         size_t i, num_reqs, next_index;
1742         NTSTATUS status;
1743
1744         if (req->chain == NULL) {
1745                 first_req = req;
1746                 goto shipit;
1747         }
1748
1749         reqs = req->chain;
1750         num_reqs = talloc_array_length(reqs);
1751
1752         for (i=0; i<num_reqs; i++) {
1753                 if (reqs[i] == req) {
1754                         break;
1755                 }
1756         }
1757         if (i == num_reqs) {
1758                 /*
1759                  * Invalid chain, should not happen
1760                  */
1761                 status = NT_STATUS_INTERNAL_ERROR;
1762                 goto error;
1763         }
1764         next_index = i+1;
1765
1766         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1767                 struct smb_request *next = reqs[next_index];
1768                 struct smbXsrv_tcon *tcon;
1769                 NTTIME now = timeval_to_nttime(&req->request_time);
1770
1771                 next->vuid = SVAL(req->outbuf, smb_uid);
1772                 next->tid  = SVAL(req->outbuf, smb_tid);
1773                 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1774                                              now, &tcon);
1775                 if (NT_STATUS_IS_OK(status)) {
1776                         req->conn = tcon->compat;
1777                 } else {
1778                         req->conn = NULL;
1779                 }
1780                 next->chain_fsp = req->chain_fsp;
1781                 next->inbuf = req->inbuf;
1782
1783                 req = next;
1784                 req->conn = switch_message(req->cmd, req);
1785
1786                 if (req->outbuf == NULL) {
1787                         /*
1788                          * Request has suspended itself, will come
1789                          * back here.
1790                          */
1791                         return;
1792                 }
1793                 next_index += 1;
1794         }
1795
1796         first_req = reqs[0];
1797
1798         for (i=1; i<next_index; i++) {
1799                 bool ok;
1800
1801                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1802                 if (!ok) {
1803                         status = NT_STATUS_INTERNAL_ERROR;
1804                         goto error;
1805                 }
1806         }
1807
1808         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1809         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1810
1811         /*
1812          * This scary statement intends to set the
1813          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1814          * to the value last_req->outbuf carries
1815          */
1816         SSVAL(first_req->outbuf, smb_flg2,
1817               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1818               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1819
1820         /*
1821          * Transfer the error codes from the subrequest to the main one
1822          */
1823         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1824         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1825
1826         _smb_setlen_large(
1827                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1828
1829 shipit:
1830         if (!srv_send_smb(first_req->sconn,
1831                           (char *)first_req->outbuf,
1832                           true, first_req->seqnum+1,
1833                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1834                           &first_req->pcd)) {
1835                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1836                                     "failed.");
1837         }
1838         TALLOC_FREE(req);       /* non-chained case */
1839         TALLOC_FREE(reqs);      /* chained case */
1840         return;
1841
1842 error:
1843         {
1844                 char errbuf[smb_size];
1845                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1846                 if (!srv_send_smb(req->sconn, errbuf, true,
1847                                   req->seqnum+1, req->encrypted,
1848                                   NULL)) {
1849                         exit_server_cleanly("construct_reply_chain: "
1850                                             "srv_send_smb failed.");
1851                 }
1852         }
1853         TALLOC_FREE(req);       /* non-chained case */
1854         TALLOC_FREE(reqs);      /* chained case */
1855 }
1856
1857 /****************************************************************************
1858  Process an smb from the client
1859 ****************************************************************************/
1860 static void process_smb(struct smbd_server_connection *sconn,
1861                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1862                         uint32_t seqnum, bool encrypted,
1863                         struct smb_perfcount_data *deferred_pcd)
1864 {
1865         int msg_type = CVAL(inbuf,0);
1866
1867         DO_PROFILE_INC(smb_count);
1868
1869         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1870                     smb_len(inbuf) ) );
1871         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1872                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1873
1874         if (msg_type != NBSSmessage) {
1875                 /*
1876                  * NetBIOS session request, keepalive, etc.
1877                  */
1878                 reply_special(sconn, (char *)inbuf, nread);
1879                 goto done;
1880         }
1881
1882         if (sconn->using_smb2) {
1883                 /* At this point we're not really using smb2,
1884                  * we make the decision here.. */
1885                 if (smbd_is_smb2_header(inbuf, nread)) {
1886                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1887                         return;
1888                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1889                                 && CVAL(inbuf, smb_com) != 0x72) {
1890                         /* This is a non-negprot SMB1 packet.
1891                            Disable SMB2 from now on. */
1892                         sconn->using_smb2 = false;
1893                 }
1894         }
1895
1896         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1897          * so subtract 4 from it. */
1898         if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1899                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1900                          smb_len(inbuf)));
1901
1902                 /* special magic for immediate exit */
1903                 if ((nread == 9) &&
1904                     (IVAL(inbuf, 4) == 0x74697865) &&
1905                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1906                         uint8_t exitcode = CVAL(inbuf, 8);
1907                         DEBUG(1, ("Exiting immediately with code %d\n",
1908                                   (int)exitcode));
1909                         exit(exitcode);
1910                 }
1911
1912                 exit_server_cleanly("Non-SMB packet");
1913         }
1914
1915         show_msg((char *)inbuf);
1916
1917         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1918                 construct_reply_chain(sconn, (char *)inbuf, nread,
1919                                       seqnum, encrypted, deferred_pcd);
1920         } else {
1921                 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1922                                 seqnum, encrypted, deferred_pcd);
1923         }
1924
1925         sconn->trans_num++;
1926
1927 done:
1928         sconn->num_requests++;
1929
1930         /* The timeout_processing function isn't run nearly
1931            often enough to implement 'max log size' without
1932            overrunning the size of the file by many megabytes.
1933            This is especially true if we are running at debug
1934            level 10.  Checking every 50 SMBs is a nice
1935            tradeoff of performance vs log file size overrun. */
1936
1937         if ((sconn->num_requests % 50) == 0 &&
1938             need_to_check_log_size()) {
1939                 change_to_root_user();
1940                 check_log_size();
1941         }
1942 }
1943
1944 /****************************************************************************
1945  Return a string containing the function name of a SMB command.
1946 ****************************************************************************/
1947
1948 const char *smb_fn_name(int type)
1949 {
1950         const char *unknown_name = "SMBunknown";
1951
1952         if (smb_messages[type].name == NULL)
1953                 return(unknown_name);
1954
1955         return(smb_messages[type].name);
1956 }
1957
1958 /****************************************************************************
1959  Helper functions for contruct_reply.
1960 ****************************************************************************/
1961
1962 void add_to_common_flags2(uint32 v)
1963 {
1964         common_flags2 |= v;
1965 }
1966
1967 void remove_from_common_flags2(uint32 v)
1968 {
1969         common_flags2 &= ~v;
1970 }
1971
1972 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1973                                    char *outbuf)
1974 {
1975         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1976         uint16_t out_flags2 = common_flags2;
1977
1978         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1979         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1980         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1981
1982         srv_set_message(outbuf,0,0,false);
1983
1984         SCVAL(outbuf, smb_com, req->cmd);
1985         SIVAL(outbuf,smb_rcls,0);
1986         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1987         SSVAL(outbuf,smb_flg2, out_flags2);
1988         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1989         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1990
1991         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1992         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1993         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1994         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1995 }
1996
1997 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1998 {
1999         construct_reply_common(req, (const char *)req->inbuf, outbuf);
2000 }
2001
2002 /**
2003  * @brief Find the smb_cmd offset of the last command pushed
2004  * @param[in] buf       The buffer we're building up
2005  * @retval              Where can we put our next andx cmd?
2006  *
2007  * While chaining requests, the "next" request we're looking at needs to put
2008  * its SMB_Command before the data the previous request already built up added
2009  * to the chain. Find the offset to the place where we have to put our cmd.
2010  */
2011
2012 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2013 {
2014         uint8_t cmd;
2015         size_t ofs;
2016
2017         cmd = CVAL(buf, smb_com);
2018
2019         if (!is_andx_req(cmd)) {
2020                 return false;
2021         }
2022
2023         ofs = smb_vwv0;
2024
2025         while (CVAL(buf, ofs) != 0xff) {
2026
2027                 if (!is_andx_req(CVAL(buf, ofs))) {
2028                         return false;
2029                 }
2030
2031                 /*
2032                  * ofs is from start of smb header, so add the 4 length
2033                  * bytes. The next cmd is right after the wct field.
2034                  */
2035                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2036
2037                 if (ofs+4 >= talloc_get_size(buf)) {
2038                         return false;
2039                 }
2040         }
2041
2042         *pofs = ofs;
2043         return true;
2044 }
2045
2046 /**
2047  * @brief Do the smb chaining at a buffer level
2048  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2049  * @param[in] andx_buf          Buffer to be appended
2050  */
2051
2052 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2053 {
2054         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2055         uint8_t wct             = CVAL(andx_buf, smb_wct);
2056         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2057         uint32_t num_bytes      = smb_buflen(andx_buf);
2058         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2059
2060         uint8_t *outbuf;
2061         size_t old_size, new_size;
2062         size_t ofs;
2063         size_t chain_padding = 0;
2064         size_t andx_cmd_ofs;
2065
2066
2067         old_size = talloc_get_size(*poutbuf);
2068
2069         if ((old_size % 4) != 0) {
2070                 /*
2071                  * Align the wct field of subsequent requests to a 4-byte
2072                  * boundary
2073                  */
2074                 chain_padding = 4 - (old_size % 4);
2075         }
2076
2077         /*
2078          * After the old request comes the new wct field (1 byte), the vwv's
2079          * and the num_bytes field.
2080          */
2081
2082         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2083         new_size += num_bytes;
2084
2085         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2086                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2087                           (unsigned)new_size));
2088                 return false;
2089         }
2090
2091         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2092         if (outbuf == NULL) {
2093                 DEBUG(0, ("talloc failed\n"));
2094                 return false;
2095         }
2096         *poutbuf = outbuf;
2097
2098         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2099                 DEBUG(1, ("invalid command chain\n"));
2100                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2101                 return false;
2102         }
2103
2104         if (chain_padding != 0) {
2105                 memset(outbuf + old_size, 0, chain_padding);
2106                 old_size += chain_padding;
2107         }
2108
2109         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2110         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2111
2112         ofs = old_size;
2113
2114         /*
2115          * Push the chained request:
2116          *
2117          * wct field
2118          */
2119
2120         SCVAL(outbuf, ofs, wct);
2121         ofs += 1;
2122
2123         /*
2124          * vwv array
2125          */
2126
2127         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2128
2129         /*
2130          * HACK ALERT
2131          *
2132          * Read&X has an offset into its data buffer at
2133          * vwv[6]. reply_read_andx has no idea anymore that it's
2134          * running from within a chain, so we have to fix up the
2135          * offset here.
2136          *
2137          * Although it looks disgusting at this place, I want to keep
2138          * it here. The alternative would be to push knowledge about
2139          * the andx chain down into read&x again.
2140          */
2141
2142         if (smb_command == SMBreadX) {
2143                 uint8_t *bytes_addr;
2144
2145                 if (wct < 7) {
2146                         /*
2147                          * Invalid read&x response
2148                          */
2149                         return false;
2150                 }
2151
2152                 bytes_addr = outbuf + ofs        /* vwv start */
2153                         + sizeof(uint16_t) * wct /* vwv array */
2154                         + sizeof(uint16_t);      /* bcc */
2155
2156                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2157                       bytes_addr - outbuf - 4);
2158         }
2159
2160         ofs += sizeof(uint16_t) * wct;
2161
2162         /*
2163          * bcc (byte count)
2164          */
2165
2166         SSVAL(outbuf, ofs, num_bytes);
2167         ofs += sizeof(uint16_t);
2168
2169         /*
2170          * The bytes field
2171          */
2172
2173         memcpy(outbuf + ofs, bytes, num_bytes);
2174
2175         return true;
2176 }
2177
2178 bool smb1_is_chain(const uint8_t *buf)
2179 {
2180         uint8_t cmd, wct, andx_cmd;
2181
2182         cmd = CVAL(buf, smb_com);
2183         if (!is_andx_req(cmd)) {
2184                 return false;
2185         }
2186         wct = CVAL(buf, smb_wct);
2187         if (wct < 2) {
2188                 return false;
2189         }
2190         andx_cmd = CVAL(buf, smb_vwv);
2191         return (andx_cmd != 0xFF);
2192 }
2193
2194 bool smb1_walk_chain(const uint8_t *buf,
2195                      bool (*fn)(uint8_t cmd,
2196                                 uint8_t wct, const uint16_t *vwv,
2197                                 uint16_t num_bytes, const uint8_t *bytes,
2198                                 void *private_data),
2199                      void *private_data)
2200 {
2201         size_t smblen = smb_len(buf);
2202         const char *smb_buf = smb_base(buf);
2203         uint8_t cmd, chain_cmd;
2204         uint8_t wct;
2205         const uint16_t *vwv;
2206         uint16_t num_bytes;
2207         const uint8_t *bytes;
2208
2209         cmd = CVAL(buf, smb_com);
2210         wct = CVAL(buf, smb_wct);
2211         vwv = (const uint16_t *)(buf + smb_vwv);
2212         num_bytes = smb_buflen(buf);
2213         bytes = (const uint8_t *)smb_buf_const(buf);
2214
2215         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2216                 return false;
2217         }
2218
2219         if (!is_andx_req(cmd)) {
2220                 return true;
2221         }
2222         if (wct < 2) {
2223                 return false;
2224         }
2225
2226         chain_cmd = CVAL(vwv, 0);
2227
2228         while (chain_cmd != 0xff) {
2229                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2230                 size_t length_needed;
2231                 ptrdiff_t vwv_offset;
2232
2233                 chain_offset = SVAL(vwv+1, 0);
2234
2235                 /*
2236                  * Check if the client tries to fool us. The chain
2237                  * offset needs to point beyond the current request in
2238                  * the chain, it needs to strictly grow. Otherwise we
2239                  * might be tricked into an endless loop always
2240                  * processing the same request over and over again. We
2241                  * used to assume that vwv and the byte buffer array
2242                  * in a chain are always attached, but OS/2 the
2243                  * Write&X/Read&X chain puts the Read&X vwv array
2244                  * right behind the Write&X vwv chain. The Write&X bcc
2245                  * array is put behind the Read&X vwv array. So now we
2246                  * check whether the chain offset points strictly
2247                  * behind the previous vwv array. req->buf points
2248                  * right after the vwv array of the previous
2249                  * request. See
2250                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2251                  * more information.
2252                  */
2253
2254                 vwv_offset = ((const char *)vwv - smb_buf);
2255                 if (chain_offset <= vwv_offset) {
2256                         return false;
2257                 }
2258
2259                 /*
2260                  * Next check: Make sure the chain offset does not
2261                  * point beyond the overall smb request length.
2262                  */
2263
2264                 length_needed = chain_offset+1; /* wct */
2265                 if (length_needed > smblen) {
2266                         return false;
2267                 }
2268
2269                 /*
2270                  * Now comes the pointer magic. Goal here is to set up
2271                  * vwv and buf correctly again. The chain offset (the
2272                  * former vwv[1]) points at the new wct field.
2273                  */
2274
2275                 wct = CVAL(smb_buf, chain_offset);
2276
2277                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2278                         return false;
2279                 }
2280
2281                 /*
2282                  * Next consistency check: Make the new vwv array fits
2283                  * in the overall smb request.
2284                  */
2285
2286                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2287                 if (length_needed > smblen) {
2288                         return false;
2289                 }
2290                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2291
2292                 /*
2293                  * Now grab the new byte buffer....
2294                  */
2295
2296                 num_bytes = SVAL(vwv+wct, 0);
2297
2298                 /*
2299                  * .. and check that it fits.
2300                  */
2301
2302                 length_needed += num_bytes;
2303                 if (length_needed > smblen) {
2304                         return false;
2305                 }
2306                 bytes = (const uint8_t *)(vwv+wct+1);
2307
2308                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2309                         return false;
2310                 }
2311
2312                 if (!is_andx_req(chain_cmd)) {
2313                         return true;
2314                 }
2315                 chain_cmd = CVAL(vwv, 0);
2316         }
2317         return true;
2318 }
2319
2320 static bool smb1_chain_length_cb(uint8_t cmd,
2321                                  uint8_t wct, const uint16_t *vwv,
2322                                  uint16_t num_bytes, const uint8_t *bytes,
2323                                  void *private_data)
2324 {
2325         unsigned *count = (unsigned *)private_data;
2326         *count += 1;
2327         return true;
2328 }
2329
2330 unsigned smb1_chain_length(const uint8_t *buf)
2331 {
2332         unsigned count = 0;
2333
2334         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2335                 return 0;
2336         }
2337         return count;
2338 }
2339
2340 struct smb1_parse_chain_state {
2341         TALLOC_CTX *mem_ctx;
2342         const uint8_t *buf;
2343         struct smbd_server_connection *sconn;
2344         struct smbXsrv_connection *xconn;
2345         bool encrypted;
2346         uint32_t seqnum;
2347
2348         struct smb_request **reqs;
2349         unsigned num_reqs;
2350 };
2351
2352 static bool smb1_parse_chain_cb(uint8_t cmd,
2353                                 uint8_t wct, const uint16_t *vwv,
2354                                 uint16_t num_bytes, const uint8_t *bytes,
2355                                 void *private_data)
2356 {
2357         struct smb1_parse_chain_state *state =
2358                 (struct smb1_parse_chain_state *)private_data;
2359         struct smb_request **reqs;
2360         struct smb_request *req;
2361         bool ok;
2362
2363         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2364                               struct smb_request *, state->num_reqs+1);
2365         if (reqs == NULL) {
2366                 return false;
2367         }
2368         state->reqs = reqs;
2369
2370         req = talloc(reqs, struct smb_request);
2371         if (req == NULL) {
2372                 return false;
2373         }
2374
2375         ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2376                               state->encrypted, state->seqnum);
2377         if (!ok) {
2378                 return false;
2379         }
2380         req->cmd = cmd;
2381         req->wct = wct;
2382         req->vwv = vwv;
2383         req->buflen = num_bytes;
2384         req->buf = bytes;
2385
2386         reqs[state->num_reqs] = req;
2387         state->num_reqs += 1;
2388         return true;
2389 }
2390
2391 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2392                       struct smbd_server_connection *sconn,
2393                       bool encrypted, uint32_t seqnum,
2394                       struct smb_request ***reqs, unsigned *num_reqs)
2395 {
2396         struct smbXsrv_connection *xconn = sconn->conn;
2397         struct smb1_parse_chain_state state;
2398         unsigned i;
2399
2400         state.mem_ctx = mem_ctx;
2401         state.buf = buf;
2402         state.sconn = sconn;
2403         state.xconn = xconn;
2404         state.encrypted = encrypted;
2405         state.seqnum = seqnum;
2406         state.reqs = NULL;
2407         state.num_reqs = 0;
2408
2409         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2410                 TALLOC_FREE(state.reqs);
2411                 return false;
2412         }
2413         for (i=0; i<state.num_reqs; i++) {
2414                 state.reqs[i]->chain = state.reqs;
2415         }
2416         *reqs = state.reqs;
2417         *num_reqs = state.num_reqs;
2418         return true;
2419 }
2420
2421 /****************************************************************************
2422  Check if services need reloading.
2423 ****************************************************************************/
2424
2425 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2426 {
2427
2428         if (last_smb_conf_reload_time == 0) {
2429                 last_smb_conf_reload_time = t;
2430         }
2431
2432         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2433                 reload_services(sconn, conn_snum_used, true);
2434                 last_smb_conf_reload_time = t;
2435         }
2436 }
2437
2438 static bool fd_is_readable(int fd)
2439 {
2440         int ret, revents;
2441
2442         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2443
2444         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2445
2446 }
2447
2448 static void smbd_server_connection_write_handler(
2449         struct smbd_server_connection *sconn)
2450 {
2451         /* TODO: make write nonblocking */
2452 }
2453
2454 static void smbd_server_connection_read_handler(
2455         struct smbd_server_connection *sconn, int fd)
2456 {
2457         struct smbXsrv_connection *xconn = sconn->conn;
2458         uint8_t *inbuf = NULL;
2459         size_t inbuf_len = 0;
2460         size_t unread_bytes = 0;
2461         bool encrypted = false;
2462         TALLOC_CTX *mem_ctx = talloc_tos();
2463         NTSTATUS status;
2464         uint32_t seqnum;
2465
2466         bool async_echo = lp_async_smb_echo_handler();
2467         bool from_client = false;
2468
2469         if (async_echo) {
2470                 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2471                         /*
2472                          * This is the super-ugly hack to prefer the packets
2473                          * forwarded by the echo handler over the ones by the
2474                          * client directly
2475                          */
2476                         fd = xconn->smb1.echo_handler.trusted_fd;
2477                 }
2478         }
2479
2480         from_client = (xconn->transport.sock == fd);
2481
2482         if (async_echo && from_client) {
2483                 smbd_lock_socket(sconn);
2484
2485                 if (!fd_is_readable(fd)) {
2486                         DEBUG(10,("the echo listener was faster\n"));
2487                         smbd_unlock_socket(sconn);
2488                         return;
2489                 }
2490         }
2491
2492         /* TODO: make this completely nonblocking */
2493         status = receive_smb_talloc(mem_ctx, sconn, fd,
2494                                     (char **)(void *)&inbuf,
2495                                     0, /* timeout */
2496                                     &unread_bytes,
2497                                     &encrypted,
2498                                     &inbuf_len, &seqnum,
2499                                     !from_client /* trusted channel */);
2500
2501         if (async_echo && from_client) {
2502                 smbd_unlock_socket(sconn);
2503         }
2504
2505         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2506                 goto process;
2507         }
2508         if (NT_STATUS_IS_ERR(status)) {
2509                 exit_server_cleanly("failed to receive smb request");
2510         }
2511         if (!NT_STATUS_IS_OK(status)) {
2512                 return;
2513         }
2514
2515 process:
2516         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2517                     seqnum, encrypted, NULL);
2518 }
2519
2520 static void smbd_server_connection_handler(struct tevent_context *ev,
2521                                            struct tevent_fd *fde,
2522                                            uint16_t flags,
2523                                            void *private_data)
2524 {
2525         struct smbd_server_connection *conn = talloc_get_type(private_data,
2526                                               struct smbd_server_connection);
2527         struct smbXsrv_connection *xconn = conn->conn;
2528
2529         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2530                 /*
2531                  * we're not supposed to do any io
2532                  */
2533                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2534                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2535                 return;
2536         }
2537
2538         if (flags & TEVENT_FD_WRITE) {
2539                 smbd_server_connection_write_handler(conn);
2540                 return;
2541         }
2542         if (flags & TEVENT_FD_READ) {
2543                 smbd_server_connection_read_handler(conn, xconn->transport.sock);
2544                 return;
2545         }
2546 }
2547
2548 static void smbd_server_echo_handler(struct tevent_context *ev,
2549                                      struct tevent_fd *fde,
2550                                      uint16_t flags,
2551                                      void *private_data)
2552 {
2553         struct smbd_server_connection *conn = talloc_get_type(private_data,
2554                                               struct smbd_server_connection);
2555         struct smbXsrv_connection *xconn = conn->conn;
2556
2557         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2558                 /*
2559                  * we're not supposed to do any io
2560                  */
2561                 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2562                 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2563                 return;
2564         }
2565
2566         if (flags & TEVENT_FD_WRITE) {
2567                 smbd_server_connection_write_handler(conn);
2568                 return;
2569         }
2570         if (flags & TEVENT_FD_READ) {
2571                 smbd_server_connection_read_handler(
2572                         conn, xconn->smb1.echo_handler.trusted_fd);
2573                 return;
2574         }
2575 }
2576
2577 struct smbd_release_ip_state {
2578         struct smbXsrv_connection *xconn;
2579         struct tevent_immediate *im;
2580         char addr[INET6_ADDRSTRLEN];
2581 };
2582
2583 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2584                                       struct tevent_immediate *im,
2585                                       void *private_data)
2586 {
2587         struct smbd_release_ip_state *state =
2588                 talloc_get_type_abort(private_data,
2589                 struct smbd_release_ip_state);
2590         struct smbXsrv_connection *xconn = state->xconn;
2591         struct smbd_server_connection *sconn = xconn->sconn;
2592
2593         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2594                 /*
2595                  * smbd_server_connection_terminate() already triggered ?
2596                  */
2597                 return;
2598         }
2599
2600         smbd_server_connection_terminate(sconn, "CTDB_SRVID_RELEASE_IP");
2601 }
2602
2603 /****************************************************************************
2604 received when we should release a specific IP
2605 ****************************************************************************/
2606 static bool release_ip(const char *ip, void *priv)
2607 {
2608         struct smbd_release_ip_state *state =
2609                 talloc_get_type_abort(priv,
2610                 struct smbd_release_ip_state);
2611         struct smbXsrv_connection *xconn = state->xconn;
2612         const char *addr = state->addr;
2613         const char *p = addr;
2614
2615         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2616                 /* avoid recursion */
2617                 return false;
2618         }
2619
2620         if (strncmp("::ffff:", addr, 7) == 0) {
2621                 p = addr + 7;
2622         }
2623
2624         DEBUG(10, ("Got release IP message for %s, "
2625                    "our address is %s\n", ip, p));
2626
2627         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2628                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2629                         ip));
2630                 /*
2631                  * With SMB2 we should do a clean disconnect,
2632                  * the previous_session_id in the session setup
2633                  * will cleanup the old session, tcons and opens.
2634                  *
2635                  * A clean disconnect is needed in order to support
2636                  * durable handles.
2637                  *
2638                  * Note: typically this is never triggered
2639                  *       as we got a TCP RST (triggered by ctdb event scripts)
2640                  *       before we get CTDB_SRVID_RELEASE_IP.
2641                  *
2642                  * We used to call _exit(1) here, but as this was mostly never
2643                  * triggered and has implication on our process model,
2644                  * we can just use smbd_server_connection_terminate()
2645                  * (also for SMB1).
2646                  *
2647                  * We don't call smbd_server_connection_terminate() directly
2648                  * as we might be called from within ctdbd_migrate(),
2649                  * we need to defer our action to the next event loop
2650                  */
2651                 tevent_schedule_immediate(state->im, xconn->ev_ctx,
2652                                           smbd_release_ip_immediate, state);
2653
2654                 /*
2655                  * Make sure we don't get any io on the connection.
2656                  */
2657                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2658                 return true;
2659         }
2660
2661         return false;
2662 }
2663
2664 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2665                                   struct sockaddr_storage *srv,
2666                                   struct sockaddr_storage *clnt)
2667 {
2668         struct smbd_release_ip_state *state;
2669         struct ctdbd_connection *cconn;
2670
2671         cconn = messaging_ctdbd_connection();
2672         if (cconn == NULL) {
2673                 return NT_STATUS_NO_MEMORY;
2674         }
2675
2676         state = talloc_zero(xconn, struct smbd_release_ip_state);
2677         if (state == NULL) {
2678                 return NT_STATUS_NO_MEMORY;
2679         }
2680         state->xconn = xconn;
2681         state->im = tevent_create_immediate(state);
2682         if (state->im == NULL) {
2683                 return NT_STATUS_NO_MEMORY;
2684         }
2685         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2686                 return NT_STATUS_NO_MEMORY;
2687         }
2688
2689         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2690 }
2691
2692 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2693                                   void *private_data, uint32_t msg_type,
2694                                   struct server_id server_id, DATA_BLOB *data)
2695 {
2696         struct smbd_server_connection *sconn = talloc_get_type_abort(
2697                 private_data, struct smbd_server_connection);
2698         const char *ip = (char *) data->data;
2699         char *client_ip;
2700
2701         DEBUG(10, ("Got kill request for client IP %s\n", ip));
2702
2703         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2704                                                      talloc_tos());
2705         if (client_ip == NULL) {
2706                 return;
2707         }
2708
2709         if (strequal(ip, client_ip)) {
2710                 DEBUG(1, ("Got kill client message for %s - "
2711                           "exiting immediately\n", ip));
2712                 exit_server_cleanly("Forced disconnect for client");
2713         }
2714
2715         TALLOC_FREE(client_ip);
2716 }
2717
2718 /*
2719  * Send keepalive packets to our client
2720  */
2721 static bool keepalive_fn(const struct timeval *now, void *private_data)
2722 {
2723         struct smbd_server_connection *sconn = talloc_get_type_abort(
2724                 private_data, struct smbd_server_connection);
2725         struct smbXsrv_connection *xconn = sconn->conn;
2726         bool ret;
2727
2728         if (sconn->using_smb2) {
2729                 /* Don't do keepalives on an SMB2 connection. */
2730                 return false;
2731         }
2732
2733         smbd_lock_socket(sconn);
2734         ret = send_keepalive(xconn->transport.sock);
2735         smbd_unlock_socket(sconn);
2736
2737         if (!ret) {
2738                 int saved_errno = errno;
2739                 /*
2740                  * Try and give an error message saying what
2741                  * client failed.
2742                  */
2743                 DEBUG(0, ("send_keepalive failed for client %s. "
2744                           "Error %s - exiting\n",
2745                           smbXsrv_connection_dbg(xconn),
2746                           strerror(saved_errno)));
2747                 errno = saved_errno;
2748                 return False;
2749         }
2750         return True;
2751 }
2752
2753 /*
2754  * Do the recurring check if we're idle
2755  */
2756 static bool deadtime_fn(const struct timeval *now, void *private_data)
2757 {
2758         struct smbd_server_connection *sconn =
2759                 (struct smbd_server_connection *)private_data;
2760
2761         if ((conn_num_open(sconn) == 0)
2762             || (conn_idle_all(sconn, now->tv_sec))) {
2763                 DEBUG( 2, ( "Closing idle connection\n" ) );
2764                 messaging_send(sconn->msg_ctx,
2765                                messaging_server_id(sconn->msg_ctx),
2766                                MSG_SHUTDOWN, &data_blob_null);
2767                 return False;
2768         }
2769
2770         return True;
2771 }
2772
2773 /*
2774  * Do the recurring log file and smb.conf reload checks.
2775  */
2776
2777 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2778 {
2779         struct smbd_server_connection *sconn = talloc_get_type_abort(
2780                 private_data, struct smbd_server_connection);
2781
2782         DEBUG(5, ("housekeeping\n"));
2783
2784         change_to_root_user();
2785
2786         /* update printer queue caches if necessary */
2787         update_monitored_printq_cache(sconn->msg_ctx);
2788
2789         /* check if we need to reload services */
2790         check_reload(sconn, time_mono(NULL));
2791
2792         /*
2793          * Force a log file check.
2794          */
2795         force_check_log_size();
2796         check_log_size();
2797         return true;
2798 }
2799
2800 /*
2801  * Read an smb packet in the echo handler child, giving the parent
2802  * smbd one second to react once the socket becomes readable.
2803  */
2804
2805 struct smbd_echo_read_state {
2806         struct tevent_context *ev;
2807         struct smbd_server_connection *sconn;
2808
2809         char *buf;
2810         size_t buflen;
2811         uint32_t seqnum;
2812 };
2813
2814 static void smbd_echo_read_readable(struct tevent_req *subreq);
2815 static void smbd_echo_read_waited(struct tevent_req *subreq);
2816
2817 static struct tevent_req *smbd_echo_read_send(
2818         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2819         struct smbd_server_connection *sconn)
2820 {
2821         struct tevent_req *req, *subreq;
2822         struct smbd_echo_read_state *state;
2823         struct smbXsrv_connection *xconn = sconn->conn;
2824
2825         req = tevent_req_create(mem_ctx, &state,
2826                                 struct smbd_echo_read_state);
2827         if (req == NULL) {
2828                 return NULL;
2829         }
2830         state->ev = ev;
2831         state->sconn = sconn;
2832
2833         subreq = wait_for_read_send(state, ev, xconn->transport.sock);
2834         if (tevent_req_nomem(subreq, req)) {
2835                 return tevent_req_post(req, ev);
2836         }
2837         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2838         return req;
2839 }
2840
2841 static void smbd_echo_read_readable(struct tevent_req *subreq)
2842 {
2843         struct tevent_req *req = tevent_req_callback_data(
2844                 subreq, struct tevent_req);
2845         struct smbd_echo_read_state *state = tevent_req_data(
2846                 req, struct smbd_echo_read_state);
2847         bool ok;
2848         int err;
2849
2850         ok = wait_for_read_recv(subreq, &err);
2851         TALLOC_FREE(subreq);
2852         if (!ok) {
2853                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2854                 return;
2855         }
2856
2857         /*
2858          * Give the parent smbd one second to step in
2859          */
2860
2861         subreq = tevent_wakeup_send(
2862                 state, state->ev, timeval_current_ofs(1, 0));
2863         if (tevent_req_nomem(subreq, req)) {
2864                 return;
2865         }
2866         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2867 }
2868
2869 static void smbd_echo_read_waited(struct tevent_req *subreq)
2870 {
2871         struct tevent_req *req = tevent_req_callback_data(
2872                 subreq, struct tevent_req);
2873         struct smbd_echo_read_state *state = tevent_req_data(
2874                 req, struct smbd_echo_read_state);
2875         struct smbd_server_connection *sconn = state->sconn;
2876         struct smbXsrv_connection *xconn = sconn->conn;
2877         bool ok;
2878         NTSTATUS status;
2879         size_t unread = 0;
2880         bool encrypted;
2881
2882         ok = tevent_wakeup_recv(subreq);
2883         TALLOC_FREE(subreq);
2884         if (!ok) {
2885                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2886                 return;
2887         }
2888
2889         ok = smbd_lock_socket_internal(sconn);
2890         if (!ok) {
2891                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2892                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2893                 return;
2894         }
2895
2896         if (!fd_is_readable(xconn->transport.sock)) {
2897                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2898                           (int)getpid()));
2899
2900                 ok = smbd_unlock_socket_internal(sconn);
2901                 if (!ok) {
2902                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2903                         DEBUG(1, ("%s: failed to unlock socket\n",
2904                                 __location__));
2905                         return;
2906                 }
2907
2908                 subreq = wait_for_read_send(state, state->ev,
2909                                             xconn->transport.sock);
2910                 if (tevent_req_nomem(subreq, req)) {
2911                         return;
2912                 }
2913                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2914                 return;
2915         }
2916
2917         status = receive_smb_talloc(state, sconn,
2918                                     xconn->transport.sock,
2919                                     &state->buf,
2920                                     0 /* timeout */,
2921                                     &unread,
2922                                     &encrypted,
2923                                     &state->buflen,
2924                                     &state->seqnum,
2925                                     false /* trusted_channel*/);
2926
2927         if (tevent_req_nterror(req, status)) {
2928                 tevent_req_nterror(req, status);
2929                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2930                           (int)getpid(), nt_errstr(status)));
2931                 return;
2932         }
2933
2934         ok = smbd_unlock_socket_internal(sconn);
2935         if (!ok) {
2936                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2937                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2938                 return;
2939         }
2940         tevent_req_done(req);
2941 }
2942
2943 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2944                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2945 {
2946         struct smbd_echo_read_state *state = tevent_req_data(
2947                 req, struct smbd_echo_read_state);
2948         NTSTATUS status;
2949
2950         if (tevent_req_is_nterror(req, &status)) {
2951                 return status;
2952         }
2953         *pbuf = talloc_move(mem_ctx, &state->buf);
2954         *pbuflen = state->buflen;
2955         *pseqnum = state->seqnum;
2956         return NT_STATUS_OK;
2957 }
2958
2959 struct smbd_echo_state {
2960         struct tevent_context *ev;
2961         struct iovec *pending;
2962         struct smbd_server_connection *sconn;
2963         struct smbXsrv_connection *xconn;
2964         int parent_pipe;
2965
2966         struct tevent_fd *parent_fde;
2967
2968         struct tevent_req *write_req;
2969 };
2970
2971 static void smbd_echo_writer_done(struct tevent_req *req);
2972
2973 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2974 {
2975         int num_pending;
2976
2977         if (state->write_req != NULL) {
2978                 return;
2979         }
2980
2981         num_pending = talloc_array_length(state->pending);
2982         if (num_pending == 0) {
2983                 return;
2984         }
2985
2986         state->write_req = writev_send(state, state->ev, NULL,
2987                                        state->parent_pipe, false,
2988                                        state->pending, num_pending);
2989         if (state->write_req == NULL) {
2990                 DEBUG(1, ("writev_send failed\n"));
2991                 exit(1);
2992         }
2993
2994         talloc_steal(state->write_req, state->pending);
2995         state->pending = NULL;
2996
2997         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2998                                 state);
2999 }
3000
3001 static void smbd_echo_writer_done(struct tevent_req *req)
3002 {
3003         struct smbd_echo_state *state = tevent_req_callback_data(
3004                 req, struct smbd_echo_state);
3005         ssize_t written;
3006         int err;
3007
3008         written = writev_recv(req, &err);
3009         TALLOC_FREE(req);
3010         state->write_req = NULL;
3011         if (written == -1) {
3012                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3013                 exit(1);
3014         }
3015         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3016         smbd_echo_activate_writer(state);
3017 }
3018
3019 static bool smbd_echo_reply(struct smbd_echo_state *state,
3020                             uint8_t *inbuf, size_t inbuf_len,
3021                             uint32_t seqnum)
3022 {
3023         struct smb_request req;
3024         uint16_t num_replies;
3025         char *outbuf;
3026         bool ok;
3027
3028         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3029                 DEBUG(10, ("Got netbios keepalive\n"));
3030                 /*
3031                  * Just swallow it
3032                  */
3033                 return true;
3034         }
3035
3036         if (inbuf_len < smb_size) {
3037                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3038                 return false;
3039         }
3040         if (!valid_smb_header(state->sconn, inbuf)) {
3041                 DEBUG(10, ("Got invalid SMB header\n"));
3042                 return false;
3043         }
3044
3045         if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3046                               seqnum)) {
3047                 return false;
3048         }
3049         req.inbuf = inbuf;
3050
3051         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3052                    smb_messages[req.cmd].name
3053                    ? smb_messages[req.cmd].name : "unknown"));
3054
3055         if (req.cmd != SMBecho) {
3056                 return false;
3057         }
3058         if (req.wct < 1) {
3059                 return false;
3060         }
3061
3062         num_replies = SVAL(req.vwv+0, 0);
3063         if (num_replies != 1) {
3064                 /* Not a Windows "Hey, you're still there?" request */
3065                 return false;
3066         }
3067
3068         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
3069                            1, req.buflen)) {
3070                 DEBUG(10, ("create_outbuf failed\n"));
3071                 return false;
3072         }
3073         req.outbuf = (uint8_t *)outbuf;
3074
3075         SSVAL(req.outbuf, smb_vwv0, num_replies);
3076
3077         if (req.buflen > 0) {
3078                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3079         }
3080
3081         ok = srv_send_smb(req.sconn,
3082                           (char *)outbuf,
3083                           true, seqnum+1,
3084                           false, &req.pcd);
3085         TALLOC_FREE(outbuf);
3086         if (!ok) {
3087                 exit(1);
3088         }
3089
3090         return true;
3091 }
3092
3093 static void smbd_echo_exit(struct tevent_context *ev,
3094                            struct tevent_fd *fde, uint16_t flags,
3095                            void *private_data)
3096 {
3097         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3098         exit(0);
3099 }
3100
3101 static void smbd_echo_got_packet(struct tevent_req *req);
3102
3103 static void smbd_echo_loop(struct smbd_server_connection *sconn,
3104                            int parent_pipe)
3105 {
3106         struct smbXsrv_connection *xconn = sconn->conn;
3107         struct smbd_echo_state *state;
3108         struct tevent_req *read_req;
3109
3110         state = talloc_zero(sconn, struct smbd_echo_state);
3111         if (state == NULL) {
3112                 DEBUG(1, ("talloc failed\n"));
3113                 return;
3114         }
3115         state->sconn = sconn;
3116         state->xconn = xconn;
3117         state->parent_pipe = parent_pipe;
3118         state->ev = s3_tevent_context_init(state);
3119         if (state->ev == NULL) {
3120                 DEBUG(1, ("tevent_context_init failed\n"));
3121                 TALLOC_FREE(state);
3122                 return;
3123         }
3124         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3125                                         TEVENT_FD_READ, smbd_echo_exit,
3126                                         state);
3127         if (state->parent_fde == NULL) {
3128                 DEBUG(1, ("tevent_add_fd failed\n"));
3129                 TALLOC_FREE(state);
3130                 return;
3131         }
3132
3133         read_req = smbd_echo_read_send(state, state->ev, sconn);
3134         if (read_req == NULL) {
3135                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3136                 TALLOC_FREE(state);
3137                 return;
3138         }
3139         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3140
3141         while (true) {
3142                 if (tevent_loop_once(state->ev) == -1) {
3143                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3144                                   strerror(errno)));
3145                         break;
3146                 }
3147         }
3148         TALLOC_FREE(state);
3149 }
3150
3151 static void smbd_echo_got_packet(struct tevent_req *req)
3152 {
3153         struct smbd_echo_state *state = tevent_req_callback_data(
3154                 req, struct smbd_echo_state);
3155         NTSTATUS status;
3156         char *buf = NULL;
3157         size_t buflen = 0;
3158         uint32_t seqnum = 0;
3159         bool reply;
3160
3161         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3162         TALLOC_FREE(req);
3163         if (!NT_STATUS_IS_OK(status)) {
3164                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3165                           nt_errstr(status)));
3166                 exit(1);
3167         }
3168
3169         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3170         if (!reply) {
3171                 size_t num_pending;
3172                 struct iovec *tmp;
3173                 struct iovec *iov;
3174
3175                 num_pending = talloc_array_length(state->pending);
3176                 tmp = talloc_realloc(state, state->pending, struct iovec,
3177                                      num_pending+1);
3178                 if (tmp == NULL) {
3179                         DEBUG(1, ("talloc_realloc failed\n"));
3180                         exit(1);
3181                 }
3182                 state->pending = tmp;
3183
3184                 if (buflen >= smb_size) {
3185                         /*
3186                          * place the seqnum in the packet so that the main process
3187                          * can reply with signing
3188                          */
3189                         SIVAL(buf, smb_ss_field, seqnum);
3190                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3191                 }
3192
3193                 iov = &state->pending[num_pending];
3194                 iov->iov_base = talloc_move(state->pending, &buf);
3195                 iov->iov_len = buflen;
3196
3197                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3198                           (int)getpid()));
3199                 smbd_echo_activate_writer(state);
3200         }
3201
3202         req = smbd_echo_read_send(state, state->ev, state->sconn);
3203         if (req == NULL) {
3204                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3205                 exit(1);
3206         }
3207         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3208 }
3209
3210
3211 /*
3212  * Handle SMBecho requests in a forked child process
3213  */
3214 bool fork_echo_handler(struct smbd_server_connection *sconn)
3215 {
3216         struct smbXsrv_connection *xconn = sconn->conn;
3217         int listener_pipe[2];
3218         int res;
3219         pid_t child;
3220         bool use_mutex = false;
3221
3222         res = pipe(listener_pipe);
3223         if (res == -1) {
3224                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3225                 return false;
3226         }
3227
3228 #ifdef HAVE_ROBUST_MUTEXES
3229         use_mutex = tdb_runtime_check_for_robust_mutexes();
3230
3231         if (use_mutex) {
3232                 pthread_mutexattr_t a;
3233
3234                 xconn->smb1.echo_handler.socket_mutex =
3235                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3236                 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3237                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3238                                   strerror(errno)));
3239                         goto fail;
3240                 }
3241
3242                 res = pthread_mutexattr_init(&a);
3243                 if (res != 0) {
3244                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3245                                   strerror(res)));
3246                         goto fail;
3247                 }
3248                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3249                 if (res != 0) {
3250                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3251                                   strerror(res)));
3252                         pthread_mutexattr_destroy(&a);
3253                         goto fail;
3254                 }
3255                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3256                 if (res != 0) {
3257                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3258                                   strerror(res)));
3259                         pthread_mutexattr_destroy(&a);
3260                         goto fail;
3261                 }
3262                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3263                 if (res != 0) {
3264                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3265                                   "%s\n", strerror(res)));
3266                         pthread_mutexattr_destroy(&a);
3267                         goto fail;
3268                 }
3269                 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3270                                          &a);
3271                 pthread_mutexattr_destroy(&a);
3272                 if (res != 0) {
3273                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3274                                   strerror(res)));
3275                         goto fail;
3276                 }
3277         }
3278 #endif
3279
3280         if (!use_mutex) {
3281                 xconn->smb1.echo_handler.socket_lock_fd =
3282                         create_unlink_tmp(lp_lock_directory());
3283                 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3284                         DEBUG(1, ("Could not create lock fd: %s\n",
3285                                   strerror(errno)));
3286                         goto fail;
3287                 }
3288         }
3289
3290         child = fork();
3291         if (child == 0) {
3292                 NTSTATUS status;
3293
3294                 close(listener_pipe[0]);
3295                 set_blocking(listener_pipe[1], false);
3296
3297                 status = reinit_after_fork(sconn->msg_ctx,
3298                                            sconn->ev_ctx,
3299                                            true);
3300                 if (!NT_STATUS_IS_OK(status)) {
3301                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3302                                   nt_errstr(status)));
3303                         exit(1);
3304                 }
3305                 smbd_echo_loop(sconn, listener_pipe[1]);
3306                 exit(0);
3307         }
3308         close(listener_pipe[1]);
3309         listener_pipe[1] = -1;
3310         xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3311
3312         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3313
3314         /*
3315          * Without smb signing this is the same as the normal smbd
3316          * listener. This needs to change once signing comes in.
3317          */
3318         xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3319                                         sconn,
3320                                         xconn->smb1.echo_handler.trusted_fd,
3321                                         TEVENT_FD_READ,
3322                                         smbd_server_echo_handler,
3323                                         sconn);
3324         if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3325                 DEBUG(1, ("event_add_fd failed\n"));
3326                 goto fail;
3327         }
3328
3329         return true;
3330
3331 fail:
3332         if (listener_pipe[0] != -1) {
3333                 close(listener_pipe[0]);
3334         }
3335         if (listener_pipe[1] != -1) {
3336                 close(listener_pipe[1]);
3337         }
3338         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3339                 close(xconn->smb1.echo_handler.socket_lock_fd);
3340         }
3341 #ifdef HAVE_ROBUST_MUTEXES
3342         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3343                 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3344                 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3345         }
3346 #endif
3347         smbd_echo_init(xconn);
3348
3349         return false;
3350 }
3351
3352 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3353 {
3354         while (user) {
3355                 if (user->session_info &&
3356                     (user->session_info->unix_token->uid == uid)) {
3357                         return true;
3358                 }
3359                 user = user->next;
3360         }
3361         return false;
3362 }
3363
3364 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3365 {
3366         while (user) {
3367                 if (user->session_info != NULL) {
3368                         int i;
3369                         struct security_unix_token *utok;
3370
3371                         utok = user->session_info->unix_token;
3372                         if (utok->gid == gid) {
3373                                 return true;
3374                         }
3375                         for(i=0; i<utok->ngroups; i++) {
3376                                 if (utok->groups[i] == gid) {
3377                                         return true;
3378                                 }
3379                         }
3380                 }
3381                 user = user->next;
3382         }
3383         return false;
3384 }
3385
3386 static bool sid_in_use(const struct user_struct *user,
3387                        const struct dom_sid *psid)
3388 {
3389         while (user) {
3390                 struct security_token *tok;
3391
3392                 if (user->session_info == NULL) {
3393                         continue;
3394                 }
3395                 tok = user->session_info->security_token;
3396                 if (tok == NULL) {
3397                         /*
3398                          * Not sure session_info->security_token can
3399                          * ever be NULL. This check might be not
3400                          * necessary.
3401                          */
3402                         continue;
3403                 }
3404                 if (security_token_has_sid(tok, psid)) {
3405                         return true;
3406                 }
3407                 user = user->next;
3408         }
3409         return false;
3410 }
3411
3412 static bool id_in_use(const struct user_struct *user,
3413                       const struct id_cache_ref *id)
3414 {
3415         switch(id->type) {
3416         case UID:
3417                 return uid_in_use(user, id->id.uid);
3418         case GID:
3419                 return gid_in_use(user, id->id.gid);
3420         case SID:
3421                 return sid_in_use(user, &id->id.sid);
3422         default:
3423                 break;
3424         }
3425         return false;
3426 }
3427
3428 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3429                                void *private_data,
3430                                uint32_t msg_type,
3431                                struct server_id server_id,
3432                                DATA_BLOB* data)
3433 {
3434         const char *msg = (data && data->data)
3435                 ? (const char *)data->data : "<NULL>";
3436         struct id_cache_ref id;
3437         struct smbd_server_connection *sconn =
3438                 talloc_get_type_abort(private_data,
3439                 struct smbd_server_connection);
3440
3441         if (!id_cache_ref_parse(msg, &id)) {
3442                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3443                 return;
3444         }
3445
3446         if (id_in_use(sconn->users, &id)) {
3447                 exit_server_cleanly(msg);
3448         }
3449         id_cache_delete_from_cache(&id);
3450 }
3451
3452 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3453                                         enum protocol_types protocol)
3454 {
3455         NTSTATUS status;
3456
3457         set_Protocol(protocol);
3458         conn->protocol = protocol;
3459
3460         if (protocol >= PROTOCOL_SMB2_02) {
3461                 status = smb2srv_session_table_init(conn);
3462                 if (!NT_STATUS_IS_OK(status)) {
3463                         return status;
3464                 }
3465
3466                 status = smb2srv_open_table_init(conn);
3467                 if (!NT_STATUS_IS_OK(status)) {
3468                         return status;
3469                 }
3470         } else {
3471                 status = smb1srv_session_table_init(conn);
3472                 if (!NT_STATUS_IS_OK(status)) {
3473                         return status;
3474                 }
3475
3476                 status = smb1srv_tcon_table_init(conn);
3477                 if (!NT_STATUS_IS_OK(status)) {
3478                         return status;
3479                 }
3480
3481                 status = smb1srv_open_table_init(conn);
3482                 if (!NT_STATUS_IS_OK(status)) {
3483                         return status;
3484                 }
3485         }
3486
3487         return NT_STATUS_OK;
3488 }
3489
3490 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3491                                        void *private_data)
3492 {
3493         struct smbXsrv_connection *conn =
3494                 talloc_get_type_abort(private_data,
3495                 struct smbXsrv_connection);
3496
3497         switch (point) {
3498         case TEVENT_TRACE_BEFORE_WAIT:
3499                 /*
3500                  * This just removes compiler warning
3501                  * without profile support
3502                  */
3503                 conn->smbd_idle_profstamp = 0;
3504                 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3505                 break;
3506         case TEVENT_TRACE_AFTER_WAIT:
3507                 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3508                 break;
3509 #ifdef TEVENT_HAS_LOOP_ONCE_TRACE_POINTS
3510         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3511         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3512                 break;
3513 #endif
3514         }
3515 }
3516
3517 /**
3518  * Create a debug string for the connection
3519  *
3520  * This is allocated to talloc_tos() or a string constant
3521  * in certain corner cases. The returned string should
3522  * hence not be free'd directly but only via the talloc stack.
3523  */
3524 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3525 {
3526         const char *ret;
3527
3528         /*
3529          * TODO: this can be improved later
3530          * maybe including the client guid or more
3531          */
3532         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3533         if (ret == NULL) {
3534                 return "<tsocket_address_string() failed>";
3535         }
3536
3537         return ret;
3538 }
3539
3540 /****************************************************************************
3541  Process commands from the client
3542 ****************************************************************************/
3543
3544 void smbd_process(struct tevent_context *ev_ctx,
3545                   struct messaging_context *msg_ctx,
3546                   int sock_fd,
3547                   bool interactive)
3548 {
3549         TALLOC_CTX *frame = talloc_stackframe();
3550         struct smbXsrv_connection *xconn;
3551         struct smbd_server_connection *sconn;
3552         struct sockaddr_storage ss_srv;
3553         void *sp_srv = (void *)&ss_srv;
3554         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3555         struct sockaddr_storage ss_clnt;
3556         void *sp_clnt = (void *)&ss_clnt;
3557         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3558         socklen_t sa_socklen;
3559         struct tsocket_address *local_address = NULL;
3560         struct tsocket_address *remote_address = NULL;
3561         const char *locaddr = NULL;
3562         const char *remaddr = NULL;
3563         char *rhost;
3564         int ret;
3565         int tmp;
3566
3567         xconn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3568         if (xconn == NULL) {
3569                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3570                 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3571         }
3572
3573         xconn->ev_ctx = ev_ctx;
3574         xconn->msg_ctx = msg_ctx;
3575         xconn->transport.sock = sock_fd;
3576         smbd_echo_init(xconn);
3577
3578         sconn = talloc_zero(xconn, struct smbd_server_connection);
3579         if (!sconn) {
3580                 exit_server("failed to create smbd_server_connection");
3581         }
3582
3583         xconn->sconn = sconn;
3584         sconn->conn = xconn;
3585
3586         /*
3587          * TODO: remove this...:-)
3588          */
3589         global_smbXsrv_connection = xconn;
3590
3591         sconn->ev_ctx = ev_ctx;
3592         sconn->msg_ctx = msg_ctx;
3593
3594         if (!interactive) {
3595                 smbd_setup_sig_term_handler(sconn);
3596                 smbd_setup_sig_hup_handler(sconn);
3597
3598                 if (!serverid_register(messaging_server_id(msg_ctx),
3599                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3600                                        |FLAG_MSG_DBWRAP
3601                                        |FLAG_MSG_PRINT_GENERAL)) {
3602                         exit_server_cleanly("Could not register myself in "
3603                                             "serverid.tdb");
3604                 }
3605         }
3606
3607         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3608                 /*
3609                  * We're not making the decision here,
3610                  * we're just allowing the client
3611                  * to decide between SMB1 and SMB2
3612                  * with the first negprot
3613                  * packet.
3614                  */
3615                 sconn->using_smb2 = true;
3616         }
3617
3618         /* Ensure child is set to blocking mode */
3619         set_blocking(sock_fd,True);
3620
3621         set_socket_options(sock_fd, "SO_KEEPALIVE");
3622         set_socket_options(sock_fd, lp_socket_options());
3623
3624         sa_socklen = sizeof(ss_clnt);
3625         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3626         if (ret != 0) {
3627                 int level = (errno == ENOTCONN)?2:0;
3628                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3629                 exit_server_cleanly("getpeername() failed.\n");
3630         }
3631         ret = tsocket_address_bsd_from_sockaddr(sconn,
3632                                                 sa_clnt, sa_socklen,
3633                                                 &remote_address);
3634         if (ret != 0) {
3635                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3636                         __location__, strerror(errno)));
3637                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3638         }
3639
3640         sa_socklen = sizeof(ss_srv);
3641         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3642         if (ret != 0) {
3643                 int level = (errno == ENOTCONN)?2:0;
3644                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3645                 exit_server_cleanly("getsockname() failed.\n");
3646         }
3647         ret = tsocket_address_bsd_from_sockaddr(sconn,
3648                                                 sa_srv, sa_socklen,
3649                                                 &local_address);
3650         if (ret != 0) {
3651                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3652                         __location__, strerror(errno)));
3653                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3654         }
3655
3656         sconn->local_address = local_address;
3657         sconn->remote_address = remote_address;
3658
3659         if (tsocket_address_is_inet(local_address, "ip")) {
3660                 locaddr = tsocket_address_inet_addr_string(
3661                                 sconn->local_address,
3662                                 talloc_tos());
3663                 if (locaddr == NULL) {
3664                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3665                                  __location__, strerror(errno)));
3666                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3667                 }
3668         } else {
3669                 locaddr = "0.0.0.0";
3670         }
3671
3672         if (tsocket_address_is_inet(remote_address, "ip")) {
3673                 remaddr = tsocket_address_inet_addr_string(
3674                                 sconn->remote_address,
3675                                 talloc_tos());
3676                 if (remaddr == NULL) {
3677                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3678                                  __location__, strerror(errno)));
3679                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3680                 }
3681         } else {
3682                 remaddr = "0.0.0.0";
3683         }
3684
3685         /* this is needed so that we get decent entries
3686            in smbstatus for port 445 connects */
3687         set_remote_machine_name(remaddr, false);
3688         reload_services(sconn, conn_snum_used, true);
3689
3690         /*
3691          * Before the first packet, check the global hosts allow/ hosts deny
3692          * parameters before doing any parsing of packets passed to us by the
3693          * client. This prevents attacks on our parsing code from hosts not in
3694          * the hosts allow list.
3695          */
3696
3697         ret = get_remote_hostname(remote_address,
3698                                   &rhost,
3699                                   talloc_tos());
3700         if (ret < 0) {
3701                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3702                         __location__, strerror(errno)));
3703                 exit_server_cleanly("get_remote_hostname failed.\n");
3704         }
3705         if (strequal(rhost, "UNKNOWN")) {
3706                 rhost = talloc_strdup(talloc_tos(), remaddr);
3707         }
3708         sconn->remote_hostname = talloc_move(sconn, &rhost);
3709
3710         sub_set_socket_ids(remaddr,
3711                            sconn->remote_hostname,
3712                            locaddr);
3713
3714         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3715                           sconn->remote_hostname,
3716                           remaddr)) {
3717                 /*
3718                  * send a negative session response "not listening on calling
3719                  * name"
3720                  */
3721                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3722                 DEBUG( 1, ("Connection denied from %s to %s\n",
3723                            tsocket_address_string(remote_address, talloc_tos()),
3724                            tsocket_address_string(local_address, talloc_tos())));
3725                 (void)srv_send_smb(sconn,(char *)buf, false,
3726                                    0, false, NULL);
3727                 exit_server_cleanly("connection denied");
3728         }
3729
3730         DEBUG(10, ("Connection allowed from %s to %s\n",
3731                    tsocket_address_string(remote_address, talloc_tos()),
3732                    tsocket_address_string(local_address, talloc_tos())));
3733
3734         if (lp_preload_modules()) {
3735                 smb_load_modules(lp_preload_modules());
3736         }
3737
3738         smb_perfcount_init();
3739
3740         if (!init_account_policy()) {
3741                 exit_server("Could not open account policy tdb.\n");
3742         }
3743
3744         if (*lp_root_directory(talloc_tos())) {
3745                 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3746                         DEBUG(0,("Failed to change root to %s\n",
3747                                  lp_root_directory(talloc_tos())));
3748                         exit_server("Failed to chroot()");
3749                 }
3750                 if (chdir("/") == -1) {
3751                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3752                         exit_server("Failed to chroot()");
3753                 }
3754                 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3755         }
3756
3757         if (!srv_init_signing(xconn)) {
3758                 exit_server("Failed to init smb_signing");
3759         }
3760
3761         if (!file_init(sconn)) {
3762                 exit_server("file_init() failed");
3763         }
3764
3765         /* Setup oplocks */
3766         if (!init_oplocks(sconn))
3767                 exit_server("Failed to init oplocks");
3768
3769         /* register our message handlers */
3770         messaging_register(sconn->msg_ctx, sconn,
3771                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3772         messaging_register(sconn->msg_ctx, sconn,
3773                            MSG_SMB_CLOSE_FILE, msg_close_file);
3774         messaging_register(sconn->msg_ctx, sconn,
3775                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3776
3777         id_cache_register_msgs(sconn->msg_ctx);
3778         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3779         messaging_register(sconn->msg_ctx, sconn,
3780                            ID_CACHE_KILL, smbd_id_cache_kill);
3781
3782         messaging_deregister(sconn->msg_ctx,
3783                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3784         messaging_register(sconn->msg_ctx, sconn,
3785                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3786
3787         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3788                              NULL);
3789         messaging_register(sconn->msg_ctx, sconn,
3790                            MSG_SMB_KILL_CLIENT_IP,
3791                            msg_kill_client_ip);
3792
3793         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3794
3795         /*
3796          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3797          * MSGs to all child processes
3798          */
3799         messaging_deregister(sconn->msg_ctx,
3800                              MSG_DEBUG, NULL);
3801         messaging_register(sconn->msg_ctx, NULL,
3802                            MSG_DEBUG, debug_message);
3803
3804         if ((lp_keepalive() != 0)
3805             && !(event_add_idle(ev_ctx, NULL,
3806                                 timeval_set(lp_keepalive(), 0),
3807                                 "keepalive", keepalive_fn,
3808                                 sconn))) {
3809                 DEBUG(0, ("Could not add keepalive event\n"));
3810                 exit(1);
3811         }
3812
3813         if (!(event_add_idle(ev_ctx, NULL,
3814                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3815                              "deadtime", deadtime_fn, sconn))) {
3816                 DEBUG(0, ("Could not add deadtime event\n"));
3817                 exit(1);
3818         }
3819
3820         if (!(event_add_idle(ev_ctx, NULL,
3821                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3822                              "housekeeping", housekeeping_fn, sconn))) {
3823                 DEBUG(0, ("Could not add housekeeping event\n"));
3824                 exit(1);
3825         }
3826
3827         if (lp_clustering()) {
3828                 /*
3829                  * We need to tell ctdb about our client's TCP
3830                  * connection, so that for failover ctdbd can send
3831                  * tickle acks, triggering a reconnection by the
3832                  * client.
3833                  */
3834                 NTSTATUS status;
3835
3836                 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3837                 if (!NT_STATUS_IS_OK(status)) {
3838                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3839                                   nt_errstr(status)));
3840                 }
3841         }
3842
3843         tmp = lp_max_xmit();
3844         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3845         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3846
3847         xconn->smb1.negprot.max_recv = tmp;
3848
3849         xconn->smb1.sessions.done_sesssetup = false;
3850         xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3851
3852         if (!init_dptrs(sconn)) {
3853                 exit_server("init_dptrs() failed");
3854         }
3855
3856         xconn->transport.fde = tevent_add_fd(ev_ctx,
3857                                              sconn,
3858                                              sock_fd,
3859                                              TEVENT_FD_READ,
3860                                              smbd_server_connection_handler,
3861                                              sconn);
3862         if (!xconn->transport.fde) {
3863                 exit_server("failed to create smbd_server_connection fde");
3864         }
3865
3866         sconn->conn->local_address = sconn->local_address;
3867         sconn->conn->remote_address = sconn->remote_address;
3868         sconn->conn->remote_hostname = sconn->remote_hostname;
3869         sconn->conn->protocol = PROTOCOL_NONE;
3870
3871         TALLOC_FREE(frame);
3872
3873         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, xconn);
3874
3875         while (True) {
3876                 frame = talloc_stackframe_pool(8192);
3877
3878                 errno = 0;
3879                 if (tevent_loop_once(ev_ctx) == -1) {
3880                         if (errno != EINTR) {
3881                                 DEBUG(3, ("tevent_loop_once failed: %s,"
3882                                           " exiting\n", strerror(errno) ));
3883                                 break;
3884                         }
3885                 }
3886
3887                 TALLOC_FREE(frame);
3888         }
3889
3890         exit_server_cleanly(NULL);
3891 }
3892
3893 bool req_is_in_chain(const struct smb_request *req)
3894 {
3895         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3896                 /*
3897                  * We're right now handling a subsequent request, so we must
3898                  * be in a chain
3899                  */
3900                 return true;
3901         }
3902
3903         if (!is_andx_req(req->cmd)) {
3904                 return false;
3905         }
3906
3907         if (req->wct < 2) {
3908                 /*
3909                  * Okay, an illegal request, but definitely not chained :-)
3910                  */
3911                 return false;
3912         }
3913
3914         return (CVAL(req->vwv+0, 0) != 0xFF);
3915 }