source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23
  24 extern bool global_machine_password_needs_changing;
  25
  26 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  27                                    char *outbuf);
  28
  29 /* Accessor function for smb_read_error for smbd functions. */
  30
  31 /****************************************************************************
  32  Send an smb to a fd.
  33 ****************************************************************************/
  34
  35 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  36 {
  37         size_t len;
  38         size_t nwritten=0;
  39         ssize_t ret;
  40         char *buf_out = buffer;
  41
  42         /* Sign the outgoing packet if required. */
  43         srv_calculate_sign_mac(buf_out);
  44
  45         if (do_encrypt) {
  46                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  47                 if (!NT_STATUS_IS_OK(status)) {
  48                         DEBUG(0, ("send_smb: SMB encryption failed "
  49                                 "on outgoing packet! Error %s\n",
  50                                 nt_errstr(status) ));
  51                         return false;
  52                 }
  53         }
  54
  55         len = smb_len(buf_out) + 4;
  56
  57         while (nwritten < len) {
  58                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  59                 if (ret <= 0) {
  60                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  61                                 (int)len,(int)ret, strerror(errno) ));
  62                         srv_free_enc_buffer(buf_out);
  63                         return false;
  64                 }
  65                 nwritten += ret;
  66         }
  67
  68         srv_free_enc_buffer(buf_out);
  69         return true;
  70 }
  71
  72 /*******************************************************************
  73  Setup the word count and byte count for a smb message.
  74 ********************************************************************/
  75
  76 int srv_set_message(char *buf,
  77                         int num_words,
  78                         int num_bytes,
  79                         bool zero)
  80 {
  81         if (zero && (num_words || num_bytes)) {
  82                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
  83         }
  84         SCVAL(buf,smb_wct,num_words);
  85         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
  86         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
  87         return (smb_size + num_words*2 + num_bytes);
  88 }
  89
  90 static bool valid_smb_header(const uint8_t *inbuf)
  91 {
  92         if (is_encrypted_packet(inbuf)) {
  93                 return true;
  94         }
  95         /*
  96          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
  97          * but it just looks weird to call strncmp for this one.
  98          */
  99         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 100 }
 101
 102 /* Socket functions for smbd packet processing. */
 103
 104 static bool valid_packet_size(size_t len)
 105 {
 106         /*
 107          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 108          * of header. Don't print the error if this fits.... JRA.
 109          */
 110
 111         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 112                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 113                                         (unsigned long)len));
 114                 return false;
 115         }
 116         return true;
 117 }
 118
 119 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 120                                       unsigned int timeout, ssize_t len)
 121 {
 122         if (len <= 0) {
 123                 return NT_STATUS_OK;
 124         }
 125
 126         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
 127 }
 128
 129 /****************************************************************************
 130  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 131 ****************************************************************************/
 132
 133 /*
 134  * Unfortunately, earlier versions of smbclient/libsmbclient
 135  * don't send this "standard" writeX header. I've fixed this
 136  * for 3.2 but we'll use the old method with earlier versions.
 137  * Windows and CIFSFS at least use this standard size. Not
 138  * sure about MacOSX.
 139  */
 140
 141 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 142                                 (2*14) + /* word count (including bcc) */ \
 143                                 1 /* pad byte */)
 144
 145 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 146                                                     const char lenbuf[4],
 147                                                     int fd, char **buffer,
 148                                                     unsigned int timeout,
 149                                                     size_t *p_unread,
 150                                                     size_t *len_ret)
 151 {
 152         /* Size of a WRITEX call (+4 byte len). */
 153         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 154         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 155         ssize_t toread;
 156         NTSTATUS status;
 157
 158         memcpy(writeX_header, lenbuf, 4);
 159
 160         status = read_socket_with_timeout(
 161                 fd, writeX_header + 4,
 162                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 163                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 164                 timeout, NULL);
 165
 166         if (!NT_STATUS_IS_OK(status)) {
 167                 return status;
 168         }
 169
 170         /*
 171          * Ok - now try and see if this is a possible
 172          * valid writeX call.
 173          */
 174
 175         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 176                 /*
 177                  * If the data offset is beyond what
 178                  * we've read, drain the extra bytes.
 179                  */
 180                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 181                 ssize_t newlen;
 182
 183                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 184                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 185                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 186                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 187                                         " failed to drain pending bytes");
 188                         }
 189                 } else {
 190                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 191                 }
 192
 193                 /* Spoof down the length and null out the bcc. */
 194                 set_message_bcc(writeX_header, 0);
 195                 newlen = smb_len(writeX_header);
 196
 197                 /* Copy the header we've written. */
 198
 199                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 200                                 writeX_header,
 201                                 sizeof(writeX_header));
 202
 203                 if (*buffer == NULL) {
 204                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 205                                   (int)sizeof(writeX_header)));
 206                         return NT_STATUS_NO_MEMORY;
 207                 }
 208
 209                 /* Work out the remaining bytes. */
 210                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 211                 *len_ret = newlen + 4;
 212                 return NT_STATUS_OK;
 213         }
 214
 215         if (!valid_packet_size(len)) {
 216                 return NT_STATUS_INVALID_PARAMETER;
 217         }
 218
 219         /*
 220          * Not a valid writeX call. Just do the standard
 221          * talloc and return.
 222          */
 223
 224         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 225
 226         if (*buffer == NULL) {
 227                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 228                           (int)len+4));
 229                 return NT_STATUS_NO_MEMORY;
 230         }
 231
 232         /* Copy in what we already read. */
 233         memcpy(*buffer,
 234                 writeX_header,
 235                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 236         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 237
 238         if(toread > 0) {
 239                 status = read_packet_remainder(
 240                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 241                         timeout, toread);
 242
 243                 if (!NT_STATUS_IS_OK(status)) {
 244                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 245                                    nt_errstr(status)));
 246                         return status;
 247                 }
 248         }
 249
 250         *len_ret = len + 4;
 251         return NT_STATUS_OK;
 252 }
 253
 254 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 255                                        char **buffer, unsigned int timeout,
 256                                        size_t *p_unread, size_t *plen)
 257 {
 258         char lenbuf[4];
 259         size_t len;
 260         int min_recv_size = lp_min_receive_file_size();
 261         NTSTATUS status;
 262
 263         *p_unread = 0;
 264
 265         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 268                 return status;
 269         }
 270
 271         if (CVAL(lenbuf,0) == 0 &&
 272                         min_recv_size &&
 273                         smb_len_large(lenbuf) > (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE) && /* Could be a UNIX large writeX. */
 274                         !srv_is_signing_active()) {
 275
 276                 return receive_smb_raw_talloc_partial_read(
 277                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 278         }
 279
 280         if (!valid_packet_size(len)) {
 281                 return NT_STATUS_INVALID_PARAMETER;
 282         }
 283
 284         /*
 285          * The +4 here can't wrap, we've checked the length above already.
 286          */
 287
 288         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 289
 290         if (*buffer == NULL) {
 291                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 292                           (int)len+4));
 293                 return NT_STATUS_NO_MEMORY;
 294         }
 295
 296         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 297
 298         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 299         if (!NT_STATUS_IS_OK(status)) {
 300                 return status;
 301         }
 302
 303         *plen = len + 4;
 304         return NT_STATUS_OK;
 305 }
 306
 307 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 308                                    char **buffer, unsigned int timeout,
 309                                    size_t *p_unread, bool *p_encrypted,
 310                                    size_t *p_len)
 311 {
 312         size_t len = 0;
 313         NTSTATUS status;
 314
 315         *p_encrypted = false;
 316
 317         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 318                                         p_unread, &len);
 319         if (!NT_STATUS_IS_OK(status)) {
 320                 return status;
 321         }
 322
 323         if (is_encrypted_packet((uint8_t *)*buffer)) {
 324                 status = srv_decrypt_buffer(*buffer);
 325                 if (!NT_STATUS_IS_OK(status)) {
 326                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 327                                 "incoming packet! Error %s\n",
 328                                 nt_errstr(status) ));
 329                         return status;
 330                 }
 331                 *p_encrypted = true;
 332         }
 333
 334         /* Check the incoming SMB signature. */
 335         if (!srv_check_sign_mac(*buffer, true)) {
 336                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 337                           "incoming packet!\n"));
 338                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 339         }
 340
 341         *p_len = len;
 342         return NT_STATUS_OK;
 343 }
 344
 345 /*
 346  * Initialize a struct smb_request from an inbuf
 347  */
 348
 349 void init_smb_request(struct smb_request *req,
 350                         const uint8 *inbuf,
 351                         size_t unread_bytes,
 352                         bool encrypted)
 353 {
 354         size_t req_size = smb_len(inbuf) + 4;
 355         /* Ensure we have at least smb_size bytes. */
 356         if (req_size < smb_size) {
 357                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 358                         (unsigned int)req_size ));
 359                 exit_server_cleanly("Invalid SMB request");
 360         }
 361         req->cmd    = CVAL(inbuf, smb_com);
 362         req->flags2 = SVAL(inbuf, smb_flg2);
 363         req->smbpid = SVAL(inbuf, smb_pid);
 364         req->mid    = SVAL(inbuf, smb_mid);
 365         req->vuid   = SVAL(inbuf, smb_uid);
 366         req->tid    = SVAL(inbuf, smb_tid);
 367         req->wct    = CVAL(inbuf, smb_wct);
 368         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 369         req->buflen = smb_buflen(inbuf);
 370         req->buf    = (const uint8_t *)smb_buf(inbuf);
 371         req->unread_bytes = unread_bytes;
 372         req->encrypted = encrypted;
 373         req->conn = conn_find(req->tid);
 374         req->chain_fsp = NULL;
 375         req->chain_outbuf = NULL;
 376
 377         /* Ensure we have at least wct words and 2 bytes of bcc. */
 378         if (smb_size + req->wct*2 > req_size) {
 379                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 380                         (unsigned int)req->wct,
 381                         (unsigned int)req_size));
 382                 exit_server_cleanly("Invalid SMB request");
 383         }
 384         /* Ensure bcc is correct. */
 385         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 386                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 387                         "(wct = %u, size %u)\n",
 388                         (unsigned int)req->buflen,
 389                         (unsigned int)req->wct,
 390                         (unsigned int)req_size));
 391                 exit_server_cleanly("Invalid SMB request");
 392         }
 393         req->outbuf = NULL;
 394 }
 395
 396 static void process_smb(struct smbd_server_connection *conn,
 397                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 398                         bool encrypted);
 399
 400 static void smbd_deferred_open_timer(struct event_context *ev,
 401                                      struct timed_event *te,
 402                                      struct timeval _tval,
 403                                      void *private_data)
 404 {
 405         struct pending_message_list *msg = talloc_get_type(private_data,
 406                                            struct pending_message_list);
 407         TALLOC_CTX *mem_ctx = talloc_tos();
 408         uint8_t *inbuf;
 409
 410         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 411                                          msg->buf.length);
 412         if (inbuf == NULL) {
 413                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 414                 return;
 415         }
 416
 417         /* We leave this message on the queue so the open code can
 418            know this is a retry. */
 419         DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
 420                 (unsigned int)SVAL(msg->buf.data,smb_mid)));
 421
 422         process_smb(smbd_server_conn, inbuf,
 423                     msg->buf.length, 0,
 424                     msg->encrypted);
 425 }
 426
 427 /****************************************************************************
 428  Function to push a message onto the tail of a linked list of smb messages ready
 429  for processing.
 430 ****************************************************************************/
 431
 432 static bool push_queued_message(struct smb_request *req,
 433                                 struct timeval request_time,
 434                                 struct timeval end_time,
 435                                 char *private_data, size_t private_len)
 436 {
 437         int msg_len = smb_len(req->inbuf) + 4;
 438         struct pending_message_list *msg;
 439
 440         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 441
 442         if(msg == NULL) {
 443                 DEBUG(0,("push_message: malloc fail (1)\n"));
 444                 return False;
 445         }
 446
 447         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 448         if(msg->buf.data == NULL) {
 449                 DEBUG(0,("push_message: malloc fail (2)\n"));
 450                 TALLOC_FREE(msg);
 451                 return False;
 452         }
 453
 454         msg->request_time = request_time;
 455         msg->encrypted = req->encrypted;
 456
 457         if (private_data) {
 458                 msg->private_data = data_blob_talloc(msg, private_data,
 459                                                      private_len);
 460                 if (msg->private_data.data == NULL) {
 461                         DEBUG(0,("push_message: malloc fail (3)\n"));
 462                         TALLOC_FREE(msg);
 463                         return False;
 464                 }
 465         }
 466
 467         msg->te = event_add_timed(smbd_event_context(),
 468                                   msg,
 469                                   end_time,
 470                                   smbd_deferred_open_timer,
 471                                   msg);
 472         if (!msg->te) {
 473                 DEBUG(0,("push_message: event_add_timed failed\n"));
 474                 TALLOC_FREE(msg);
 475                 return false;
 476         }
 477
 478         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 479
 480         DEBUG(10,("push_message: pushed message length %u on "
 481                   "deferred_open_queue\n", (unsigned int)msg_len));
 482
 483         return True;
 484 }
 485
 486 /****************************************************************************
 487  Function to delete a sharing violation open message by mid.
 488 ****************************************************************************/
 489
 490 void remove_deferred_open_smb_message(uint16 mid)
 491 {
 492         struct pending_message_list *pml;
 493
 494         for (pml = deferred_open_queue; pml; pml = pml->next) {
 495                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 496                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 497                                   "deleting mid %u len %u\n",
 498                                   (unsigned int)mid,
 499                                   (unsigned int)pml->buf.length ));
 500                         DLIST_REMOVE(deferred_open_queue, pml);
 501                         TALLOC_FREE(pml);
 502                         return;
 503                 }
 504         }
 505 }
 506
 507 /****************************************************************************
 508  Move a sharing violation open retry message to the front of the list and
 509  schedule it for immediate processing.
 510 ****************************************************************************/
 511
 512 void schedule_deferred_open_smb_message(uint16 mid)
 513 {
 514         struct pending_message_list *pml;
 515         int i = 0;
 516
 517         for (pml = deferred_open_queue; pml; pml = pml->next) {
 518                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 519
 520                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 521                         (unsigned int)msg_mid ));
 522
 523                 if (mid == msg_mid) {
 524                         struct timed_event *te;
 525
 526                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 527                                 mid ));
 528
 529                         te = event_add_timed(smbd_event_context(),
 530                                              pml,
 531                                              timeval_zero(),
 532                                              smbd_deferred_open_timer,
 533                                              pml);
 534                         if (!te) {
 535                                 DEBUG(10,("schedule_deferred_open_smb_message: "
 536                                           "event_add_timed() failed, skipping mid %u\n",
 537                                           mid ));
 538                         }
 539
 540                         TALLOC_FREE(pml->te);
 541                         pml->te = te;
 542                         DLIST_PROMOTE(deferred_open_queue, pml);
 543                         return;
 544                 }
 545         }
 546
 547         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 548                 mid ));
 549 }
 550
 551 /****************************************************************************
 552  Return true if this mid is on the deferred queue.
 553 ****************************************************************************/
 554
 555 bool open_was_deferred(uint16 mid)
 556 {
 557         struct pending_message_list *pml;
 558
 559         for (pml = deferred_open_queue; pml; pml = pml->next) {
 560                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 561                         return True;
 562                 }
 563         }
 564         return False;
 565 }
 566
 567 /****************************************************************************
 568  Return the message queued by this mid.
 569 ****************************************************************************/
 570
 571 struct pending_message_list *get_open_deferred_message(uint16 mid)
 572 {
 573         struct pending_message_list *pml;
 574
 575         for (pml = deferred_open_queue; pml; pml = pml->next) {
 576                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 577                         return pml;
 578                 }
 579         }
 580         return NULL;
 581 }
 582
 583 /****************************************************************************
 584  Function to push a deferred open smb message onto a linked list of local smb
 585  messages ready for processing.
 586 ****************************************************************************/
 587
 588 bool push_deferred_smb_message(struct smb_request *req,
 589                                struct timeval request_time,
 590                                struct timeval timeout,
 591                                char *private_data, size_t priv_len)
 592 {
 593         struct timeval end_time;
 594
 595         if (req->unread_bytes) {
 596                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 597                         "unread_bytes = %u\n",
 598                         (unsigned int)req->unread_bytes ));
 599                 smb_panic("push_deferred_smb_message: "
 600                         "logic error unread_bytes != 0" );
 601         }
 602
 603         end_time = timeval_sum(&request_time, &timeout);
 604
 605         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 606                   "timeout time [%u.%06u]\n",
 607                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 608                   (unsigned int)end_time.tv_sec,
 609                   (unsigned int)end_time.tv_usec));
 610
 611         return push_queued_message(req, request_time, end_time,
 612                                    private_data, priv_len);
 613 }
 614
 615 struct idle_event {
 616         struct timed_event *te;
 617         struct timeval interval;
 618         char *name;
 619         bool (*handler)(const struct timeval *now, void *private_data);
 620         void *private_data;
 621 };
 622
 623 static void smbd_idle_event_handler(struct event_context *ctx,
 624                                     struct timed_event *te,
 625                                     struct timeval now,
 626                                     void *private_data)
 627 {
 628         struct idle_event *event =
 629                 talloc_get_type_abort(private_data, struct idle_event);
 630
 631         TALLOC_FREE(event->te);
 632
 633         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 634                   event->name, event->te));
 635
 636         if (!event->handler(&now, event->private_data)) {
 637                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 638                           event->name, event->te));
 639                 /* Don't repeat, delete ourselves */
 640                 TALLOC_FREE(event);
 641                 return;
 642         }
 643
 644         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 645                   event->name, event->te));
 646
 647         event->te = event_add_timed(ctx, event,
 648                                     timeval_sum(&now, &event->interval),
 649                                     smbd_idle_event_handler, event);
 650
 651         /* We can't do much but fail here. */
 652         SMB_ASSERT(event->te != NULL);
 653 }
 654
 655 struct idle_event *event_add_idle(struct event_context *event_ctx,
 656                                   TALLOC_CTX *mem_ctx,
 657                                   struct timeval interval,
 658                                   const char *name,
 659                                   bool (*handler)(const struct timeval *now,
 660                                                   void *private_data),
 661                                   void *private_data)
 662 {
 663         struct idle_event *result;
 664         struct timeval now = timeval_current();
 665
 666         result = TALLOC_P(mem_ctx, struct idle_event);
 667         if (result == NULL) {
 668                 DEBUG(0, ("talloc failed\n"));
 669                 return NULL;
 670         }
 671
 672         result->interval = interval;
 673         result->handler = handler;
 674         result->private_data = private_data;
 675
 676         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 677                 DEBUG(0, ("talloc failed\n"));
 678                 TALLOC_FREE(result);
 679                 return NULL;
 680         }
 681
 682         result->te = event_add_timed(event_ctx, result,
 683                                      timeval_sum(&now, &interval),
 684                                      smbd_idle_event_handler, result);
 685         if (result->te == NULL) {
 686                 DEBUG(0, ("event_add_timed failed\n"));
 687                 TALLOC_FREE(result);
 688                 return NULL;
 689         }
 690
 691         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 692         return result;
 693 }
 694
 695 /****************************************************************************
 696  Do all async processing in here. This includes kernel oplock messages, change
 697  notify events etc.
 698 ****************************************************************************/
 699
 700 static void async_processing(void)
 701 {
 702         DEBUG(10,("async_processing: Doing async processing.\n"));
 703
 704         process_aio_queue();
 705
 706         process_kernel_oplocks(smbd_messaging_context());
 707
 708         /* Do the aio check again after receive_local_message as it does a
 709            select and may have eaten our signal. */
 710         /* Is this till true? -- vl */
 711         process_aio_queue();
 712
 713         if (got_sig_term) {
 714                 exit_server_cleanly("termination signal");
 715         }
 716
 717         /* check for sighup processing */
 718         if (reload_after_sighup) {
 719                 change_to_root_user();
 720                 DEBUG(1,("Reloading services after SIGHUP\n"));
 721                 reload_services(False);
 722                 reload_after_sighup = 0;
 723         }
 724 }
 725
 726 /****************************************************************************
 727   Do a select on an two fd's - with timeout.
 728
 729   If a local udp message has been pushed onto the
 730   queue (this can only happen during oplock break
 731   processing) call async_processing()
 732
 733   If a pending smb message has been pushed onto the
 734   queue (this can only happen during oplock break
 735   processing) return this next.
 736
 737   If the first smbfd is ready then read an smb from it.
 738   if the second (loopback UDP) fd is ready then read a message
 739   from it and setup the buffer header to identify the length
 740   and from address.
 741   Returns False on timeout or error.
 742   Else returns True.
 743
 744 The timeout is in milliseconds
 745 ****************************************************************************/
 746
 747 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 748 {
 749         fd_set r_fds, w_fds;
 750         int selrtn;
 751         struct timeval to;
 752         int maxfd = 0;
 753
 754         to.tv_sec = SMBD_SELECT_TIMEOUT;
 755         to.tv_usec = 0;
 756
 757         /*
 758          * Setup the select fd sets.
 759          */
 760
 761         FD_ZERO(&r_fds);
 762         FD_ZERO(&w_fds);
 763
 764         /*
 765          * Ensure we process oplock break messages by preference.
 766          * We have to do this before the select, after the select
 767          * and if the select returns EINTR. This is due to the fact
 768          * that the selects called from async_processing can eat an EINTR
 769          * caused by a signal (we can't take the break message there).
 770          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 771          */
 772
 773         if (oplock_message_waiting()) {
 774                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 775                 async_processing();
 776                 /*
 777                  * After async processing we must go and do the select again, as
 778                  * the state of the flag in fds for the server file descriptor is
 779                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 780                  */
 781                 return NT_STATUS_RETRY;
 782         }
 783
 784         /*
 785          * Are there any timed events waiting ? If so, ensure we don't
 786          * select for longer than it would take to wait for them.
 787          */
 788
 789         {
 790                 struct timeval now;
 791                 GetTimeOfDay(&now);
 792
 793                 event_add_to_select_args(smbd_event_context(), &now,
 794                                          &r_fds, &w_fds, &to, &maxfd);
 795         }
 796
 797         /* Process a signal and timed events now... */
 798         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 799                 return NT_STATUS_RETRY;
 800         }
 801
 802         {
 803                 int sav;
 804                 START_PROFILE(smbd_idle);
 805
 806                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 807                 sav = errno;
 808
 809                 END_PROFILE(smbd_idle);
 810                 errno = sav;
 811         }
 812
 813         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 814                 return NT_STATUS_RETRY;
 815         }
 816
 817         /* if we get EINTR then maybe we have received an oplock
 818            signal - treat this as select returning 1. This is ugly, but
 819            is the best we can do until the oplock code knows more about
 820            signals */
 821         if (selrtn == -1 && errno == EINTR) {
 822                 async_processing();
 823                 /*
 824                  * After async processing we must go and do the select again, as
 825                  * the state of the flag in fds for the server file descriptor is
 826                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 827                  */
 828                 return NT_STATUS_RETRY;
 829         }
 830
 831         /* Check if error */
 832         if (selrtn == -1) {
 833                 /* something is wrong. Maybe the socket is dead? */
 834                 return map_nt_error_from_unix(errno);
 835         }
 836
 837         /* Did we timeout ? */
 838         if (selrtn == 0) {
 839                 return NT_STATUS_RETRY;
 840         }
 841
 842         /* should not be reached */
 843         return NT_STATUS_INTERNAL_ERROR;
 844 }
 845
 846 /*
 847  * Only allow 5 outstanding trans requests. We're allocating memory, so
 848  * prevent a DoS.
 849  */
 850
 851 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 852 {
 853         int count = 0;
 854         for (; list != NULL; list = list->next) {
 855
 856                 if (list->mid == mid) {
 857                         return NT_STATUS_INVALID_PARAMETER;
 858                 }
 859
 860                 count += 1;
 861         }
 862         if (count > 5) {
 863                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 864         }
 865
 866         return NT_STATUS_OK;
 867 }
 868
 869 /****************************************************************************
 870  We're terminating and have closed all our files/connections etc.
 871  If there are any pending local messages we need to respond to them
 872  before termination so that other smbds don't think we just died whilst
 873  holding oplocks.
 874 ****************************************************************************/
 875
 876 void respond_to_all_remaining_local_messages(void)
 877 {
 878         /*
 879          * Assert we have no exclusive open oplocks.
 880          */
 881
 882         if(get_number_of_exclusive_open_oplocks()) {
 883                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 884                         get_number_of_exclusive_open_oplocks() ));
 885                 return;
 886         }
 887
 888         process_kernel_oplocks(smbd_messaging_context());
 889
 890         return;
 891 }
 892
 893
 894 /*
 895 These flags determine some of the permissions required to do an operation
 896
 897 Note that I don't set NEED_WRITE on some write operations because they
 898 are used by some brain-dead clients when printing, and I don't want to
 899 force write permissions on print services.
 900 */
 901 #define AS_USER (1<<0)
 902 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 903 #define TIME_INIT (1<<2)
 904 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 905 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 906 #define DO_CHDIR (1<<6)
 907
 908 /*
 909    define a list of possible SMB messages and their corresponding
 910    functions. Any message that has a NULL function is unimplemented -
 911    please feel free to contribute implementations!
 912 */
 913 static const struct smb_message_struct {
 914         const char *name;
 915         void (*fn)(struct smb_request *req);
 916         int flags;
 917 } smb_messages[256] = {
 918
 919 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 920 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 921 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 922 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 923 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 924 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 925 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 926 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 927 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 928 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 929 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 930 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 931 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 932 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 933 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 934 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 935 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 936 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 937 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 938 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 939 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 940 /* 0x15 */ { NULL, NULL, 0 },
 941 /* 0x16 */ { NULL, NULL, 0 },
 942 /* 0x17 */ { NULL, NULL, 0 },
 943 /* 0x18 */ { NULL, NULL, 0 },
 944 /* 0x19 */ { NULL, NULL, 0 },
 945 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 946 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 947 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
 948 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 949 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 950 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 951 /* 0x20 */ { "SMBwritec", NULL,0},
 952 /* 0x21 */ { NULL, NULL, 0 },
 953 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 954 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 955 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 956 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 957 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 958 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 959 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
 960 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 961 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
 962 /* 0x2b */ { "SMBecho",reply_echo,0},
 963 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 964 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 965 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 966 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 967 /* 0x30 */ { NULL, NULL, 0 },
 968 /* 0x31 */ { NULL, NULL, 0 },
 969 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
 970 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
 971 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
 972 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
 973 /* 0x36 */ { NULL, NULL, 0 },
 974 /* 0x37 */ { NULL, NULL, 0 },
 975 /* 0x38 */ { NULL, NULL, 0 },
 976 /* 0x39 */ { NULL, NULL, 0 },
 977 /* 0x3a */ { NULL, NULL, 0 },
 978 /* 0x3b */ { NULL, NULL, 0 },
 979 /* 0x3c */ { NULL, NULL, 0 },
 980 /* 0x3d */ { NULL, NULL, 0 },
 981 /* 0x3e */ { NULL, NULL, 0 },
 982 /* 0x3f */ { NULL, NULL, 0 },
 983 /* 0x40 */ { NULL, NULL, 0 },
 984 /* 0x41 */ { NULL, NULL, 0 },
 985 /* 0x42 */ { NULL, NULL, 0 },
 986 /* 0x43 */ { NULL, NULL, 0 },
 987 /* 0x44 */ { NULL, NULL, 0 },
 988 /* 0x45 */ { NULL, NULL, 0 },
 989 /* 0x46 */ { NULL, NULL, 0 },
 990 /* 0x47 */ { NULL, NULL, 0 },
 991 /* 0x48 */ { NULL, NULL, 0 },
 992 /* 0x49 */ { NULL, NULL, 0 },
 993 /* 0x4a */ { NULL, NULL, 0 },
 994 /* 0x4b */ { NULL, NULL, 0 },
 995 /* 0x4c */ { NULL, NULL, 0 },
 996 /* 0x4d */ { NULL, NULL, 0 },
 997 /* 0x4e */ { NULL, NULL, 0 },
 998 /* 0x4f */ { NULL, NULL, 0 },
 999 /* 0x50 */ { NULL, NULL, 0 },
1000 /* 0x51 */ { NULL, NULL, 0 },
1001 /* 0x52 */ { NULL, NULL, 0 },
1002 /* 0x53 */ { NULL, NULL, 0 },
1003 /* 0x54 */ { NULL, NULL, 0 },
1004 /* 0x55 */ { NULL, NULL, 0 },
1005 /* 0x56 */ { NULL, NULL, 0 },
1006 /* 0x57 */ { NULL, NULL, 0 },
1007 /* 0x58 */ { NULL, NULL, 0 },
1008 /* 0x59 */ { NULL, NULL, 0 },
1009 /* 0x5a */ { NULL, NULL, 0 },
1010 /* 0x5b */ { NULL, NULL, 0 },
1011 /* 0x5c */ { NULL, NULL, 0 },
1012 /* 0x5d */ { NULL, NULL, 0 },
1013 /* 0x5e */ { NULL, NULL, 0 },
1014 /* 0x5f */ { NULL, NULL, 0 },
1015 /* 0x60 */ { NULL, NULL, 0 },
1016 /* 0x61 */ { NULL, NULL, 0 },
1017 /* 0x62 */ { NULL, NULL, 0 },
1018 /* 0x63 */ { NULL, NULL, 0 },
1019 /* 0x64 */ { NULL, NULL, 0 },
1020 /* 0x65 */ { NULL, NULL, 0 },
1021 /* 0x66 */ { NULL, NULL, 0 },
1022 /* 0x67 */ { NULL, NULL, 0 },
1023 /* 0x68 */ { NULL, NULL, 0 },
1024 /* 0x69 */ { NULL, NULL, 0 },
1025 /* 0x6a */ { NULL, NULL, 0 },
1026 /* 0x6b */ { NULL, NULL, 0 },
1027 /* 0x6c */ { NULL, NULL, 0 },
1028 /* 0x6d */ { NULL, NULL, 0 },
1029 /* 0x6e */ { NULL, NULL, 0 },
1030 /* 0x6f */ { NULL, NULL, 0 },
1031 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1032 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1033 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1034 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1035 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1036 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1037 /* 0x76 */ { NULL, NULL, 0 },
1038 /* 0x77 */ { NULL, NULL, 0 },
1039 /* 0x78 */ { NULL, NULL, 0 },
1040 /* 0x79 */ { NULL, NULL, 0 },
1041 /* 0x7a */ { NULL, NULL, 0 },
1042 /* 0x7b */ { NULL, NULL, 0 },
1043 /* 0x7c */ { NULL, NULL, 0 },
1044 /* 0x7d */ { NULL, NULL, 0 },
1045 /* 0x7e */ { NULL, NULL, 0 },
1046 /* 0x7f */ { NULL, NULL, 0 },
1047 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1048 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1049 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1050 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1051 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1052 /* 0x85 */ { NULL, NULL, 0 },
1053 /* 0x86 */ { NULL, NULL, 0 },
1054 /* 0x87 */ { NULL, NULL, 0 },
1055 /* 0x88 */ { NULL, NULL, 0 },
1056 /* 0x89 */ { NULL, NULL, 0 },
1057 /* 0x8a */ { NULL, NULL, 0 },
1058 /* 0x8b */ { NULL, NULL, 0 },
1059 /* 0x8c */ { NULL, NULL, 0 },
1060 /* 0x8d */ { NULL, NULL, 0 },
1061 /* 0x8e */ { NULL, NULL, 0 },
1062 /* 0x8f */ { NULL, NULL, 0 },
1063 /* 0x90 */ { NULL, NULL, 0 },
1064 /* 0x91 */ { NULL, NULL, 0 },
1065 /* 0x92 */ { NULL, NULL, 0 },
1066 /* 0x93 */ { NULL, NULL, 0 },
1067 /* 0x94 */ { NULL, NULL, 0 },
1068 /* 0x95 */ { NULL, NULL, 0 },
1069 /* 0x96 */ { NULL, NULL, 0 },
1070 /* 0x97 */ { NULL, NULL, 0 },
1071 /* 0x98 */ { NULL, NULL, 0 },
1072 /* 0x99 */ { NULL, NULL, 0 },
1073 /* 0x9a */ { NULL, NULL, 0 },
1074 /* 0x9b */ { NULL, NULL, 0 },
1075 /* 0x9c */ { NULL, NULL, 0 },
1076 /* 0x9d */ { NULL, NULL, 0 },
1077 /* 0x9e */ { NULL, NULL, 0 },
1078 /* 0x9f */ { NULL, NULL, 0 },
1079 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1080 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1081 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1082 /* 0xa3 */ { NULL, NULL, 0 },
1083 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1084 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1085 /* 0xa6 */ { NULL, NULL, 0 },
1086 /* 0xa7 */ { NULL, NULL, 0 },
1087 /* 0xa8 */ { NULL, NULL, 0 },
1088 /* 0xa9 */ { NULL, NULL, 0 },
1089 /* 0xaa */ { NULL, NULL, 0 },
1090 /* 0xab */ { NULL, NULL, 0 },
1091 /* 0xac */ { NULL, NULL, 0 },
1092 /* 0xad */ { NULL, NULL, 0 },
1093 /* 0xae */ { NULL, NULL, 0 },
1094 /* 0xaf */ { NULL, NULL, 0 },
1095 /* 0xb0 */ { NULL, NULL, 0 },
1096 /* 0xb1 */ { NULL, NULL, 0 },
1097 /* 0xb2 */ { NULL, NULL, 0 },
1098 /* 0xb3 */ { NULL, NULL, 0 },
1099 /* 0xb4 */ { NULL, NULL, 0 },
1100 /* 0xb5 */ { NULL, NULL, 0 },
1101 /* 0xb6 */ { NULL, NULL, 0 },
1102 /* 0xb7 */ { NULL, NULL, 0 },
1103 /* 0xb8 */ { NULL, NULL, 0 },
1104 /* 0xb9 */ { NULL, NULL, 0 },
1105 /* 0xba */ { NULL, NULL, 0 },
1106 /* 0xbb */ { NULL, NULL, 0 },
1107 /* 0xbc */ { NULL, NULL, 0 },
1108 /* 0xbd */ { NULL, NULL, 0 },
1109 /* 0xbe */ { NULL, NULL, 0 },
1110 /* 0xbf */ { NULL, NULL, 0 },
1111 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1112 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1113 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1114 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1115 /* 0xc4 */ { NULL, NULL, 0 },
1116 /* 0xc5 */ { NULL, NULL, 0 },
1117 /* 0xc6 */ { NULL, NULL, 0 },
1118 /* 0xc7 */ { NULL, NULL, 0 },
1119 /* 0xc8 */ { NULL, NULL, 0 },
1120 /* 0xc9 */ { NULL, NULL, 0 },
1121 /* 0xca */ { NULL, NULL, 0 },
1122 /* 0xcb */ { NULL, NULL, 0 },
1123 /* 0xcc */ { NULL, NULL, 0 },
1124 /* 0xcd */ { NULL, NULL, 0 },
1125 /* 0xce */ { NULL, NULL, 0 },
1126 /* 0xcf */ { NULL, NULL, 0 },
1127 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1128 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1129 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1130 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1131 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1132 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1133 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1134 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1135 /* 0xd8 */ { NULL, NULL, 0 },
1136 /* 0xd9 */ { NULL, NULL, 0 },
1137 /* 0xda */ { NULL, NULL, 0 },
1138 /* 0xdb */ { NULL, NULL, 0 },
1139 /* 0xdc */ { NULL, NULL, 0 },
1140 /* 0xdd */ { NULL, NULL, 0 },
1141 /* 0xde */ { NULL, NULL, 0 },
1142 /* 0xdf */ { NULL, NULL, 0 },
1143 /* 0xe0 */ { NULL, NULL, 0 },
1144 /* 0xe1 */ { NULL, NULL, 0 },
1145 /* 0xe2 */ { NULL, NULL, 0 },
1146 /* 0xe3 */ { NULL, NULL, 0 },
1147 /* 0xe4 */ { NULL, NULL, 0 },
1148 /* 0xe5 */ { NULL, NULL, 0 },
1149 /* 0xe6 */ { NULL, NULL, 0 },
1150 /* 0xe7 */ { NULL, NULL, 0 },
1151 /* 0xe8 */ { NULL, NULL, 0 },
1152 /* 0xe9 */ { NULL, NULL, 0 },
1153 /* 0xea */ { NULL, NULL, 0 },
1154 /* 0xeb */ { NULL, NULL, 0 },
1155 /* 0xec */ { NULL, NULL, 0 },
1156 /* 0xed */ { NULL, NULL, 0 },
1157 /* 0xee */ { NULL, NULL, 0 },
1158 /* 0xef */ { NULL, NULL, 0 },
1159 /* 0xf0 */ { NULL, NULL, 0 },
1160 /* 0xf1 */ { NULL, NULL, 0 },
1161 /* 0xf2 */ { NULL, NULL, 0 },
1162 /* 0xf3 */ { NULL, NULL, 0 },
1163 /* 0xf4 */ { NULL, NULL, 0 },
1164 /* 0xf5 */ { NULL, NULL, 0 },
1165 /* 0xf6 */ { NULL, NULL, 0 },
1166 /* 0xf7 */ { NULL, NULL, 0 },
1167 /* 0xf8 */ { NULL, NULL, 0 },
1168 /* 0xf9 */ { NULL, NULL, 0 },
1169 /* 0xfa */ { NULL, NULL, 0 },
1170 /* 0xfb */ { NULL, NULL, 0 },
1171 /* 0xfc */ { NULL, NULL, 0 },
1172 /* 0xfd */ { NULL, NULL, 0 },
1173 /* 0xfe */ { NULL, NULL, 0 },
1174 /* 0xff */ { NULL, NULL, 0 }
1175
1176 };
1177
1178 /*******************************************************************
1179  allocate and initialize a reply packet
1180 ********************************************************************/
1181
1182 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1183                           const char *inbuf, char **outbuf, uint8_t num_words,
1184                           uint32_t num_bytes)
1185 {
1186         /*
1187          * Protect against integer wrap
1188          */
1189         if ((num_bytes > 0xffffff)
1190             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1191                 char *msg;
1192                 if (asprintf(&msg, "num_bytes too large: %u",
1193                              (unsigned)num_bytes) == -1) {
1194                         msg = CONST_DISCARD(char *, "num_bytes too large");
1195                 }
1196                 smb_panic(msg);
1197         }
1198
1199         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1200                                smb_size + num_words*2 + num_bytes);
1201         if (*outbuf == NULL) {
1202                 return false;
1203         }
1204
1205         construct_reply_common(req, inbuf, *outbuf);
1206         srv_set_message(*outbuf, num_words, num_bytes, false);
1207         /*
1208          * Zero out the word area, the caller has to take care of the bcc area
1209          * himself
1210          */
1211         if (num_words != 0) {
1212                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1213         }
1214
1215         return true;
1216 }
1217
1218 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1219 {
1220         char *outbuf;
1221         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1222                            num_bytes)) {
1223                 smb_panic("could not allocate output buffer\n");
1224         }
1225         req->outbuf = (uint8_t *)outbuf;
1226 }
1227
1228
1229 /*******************************************************************
1230  Dump a packet to a file.
1231 ********************************************************************/
1232
1233 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1234 {
1235         int fd, i;
1236         char *fname = NULL;
1237         if (DEBUGLEVEL < 50) {
1238                 return;
1239         }
1240
1241         if (len < 4) len = smb_len(data)+4;
1242         for (i=1;i<100;i++) {
1243                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1244                              type ? "req" : "resp") == -1) {
1245                         return;
1246                 }
1247                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1248                 if (fd != -1 || errno != EEXIST) break;
1249         }
1250         if (fd != -1) {
1251                 ssize_t ret = write(fd, data, len);
1252                 if (ret != len)
1253                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1254                 close(fd);
1255                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1256         }
1257         SAFE_FREE(fname);
1258 }
1259
1260 /****************************************************************************
1261  Prepare everything for calling the actual request function, and potentially
1262  call the request function via the "new" interface.
1263
1264  Return False if the "legacy" function needs to be called, everything is
1265  prepared.
1266
1267  Return True if we're done.
1268
1269  I know this API sucks, but it is the one with the least code change I could
1270  find.
1271 ****************************************************************************/
1272
1273 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1274 {
1275         int flags;
1276         uint16 session_tag;
1277         connection_struct *conn = NULL;
1278
1279         errno = 0;
1280
1281         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1282          * so subtract 4 from it. */
1283         if (!valid_smb_header(req->inbuf)
1284             || (size < (smb_size - 4))) {
1285                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1286                          smb_len(req->inbuf)));
1287                 exit_server_cleanly("Non-SMB packet");
1288         }
1289
1290         if (smb_messages[type].fn == NULL) {
1291                 DEBUG(0,("Unknown message type %d!\n",type));
1292                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1293                 reply_unknown_new(req, type);
1294                 return NULL;
1295         }
1296
1297         flags = smb_messages[type].flags;
1298
1299         /* In share mode security we must ignore the vuid. */
1300         session_tag = (lp_security() == SEC_SHARE)
1301                 ? UID_FIELD_INVALID : req->vuid;
1302         conn = req->conn;
1303
1304         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1305                  (int)sys_getpid(), (unsigned long)conn));
1306
1307         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1308
1309         /* Ensure this value is replaced in the incoming packet. */
1310         SSVAL(req->inbuf,smb_uid,session_tag);
1311
1312         /*
1313          * Ensure the correct username is in current_user_info.  This is a
1314          * really ugly bugfix for problems with multiple session_setup_and_X's
1315          * being done and allowing %U and %G substitutions to work correctly.
1316          * There is a reason this code is done here, don't move it unless you
1317          * know what you're doing... :-).
1318          * JRA.
1319          */
1320
1321         if (session_tag != last_session_tag) {
1322                 user_struct *vuser = NULL;
1323
1324                 last_session_tag = session_tag;
1325                 if(session_tag != UID_FIELD_INVALID) {
1326                         vuser = get_valid_user_struct(session_tag);
1327                         if (vuser) {
1328                                 set_current_user_info(
1329                                         vuser->server_info->sanitized_username,
1330                                         vuser->server_info->unix_name,
1331                                         pdb_get_domain(vuser->server_info
1332                                                        ->sam_account));
1333                         }
1334                 }
1335         }
1336
1337         /* Does this call need to be run as the connected user? */
1338         if (flags & AS_USER) {
1339
1340                 /* Does this call need a valid tree connection? */
1341                 if (!conn) {
1342                         /*
1343                          * Amazingly, the error code depends on the command
1344                          * (from Samba4).
1345                          */
1346                         if (type == SMBntcreateX) {
1347                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1348                         } else {
1349                                 reply_doserror(req, ERRSRV, ERRinvnid);
1350                         }
1351                         return NULL;
1352                 }
1353
1354                 if (!change_to_user(conn,session_tag)) {
1355                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1356                         remove_deferred_open_smb_message(req->mid);
1357                         return conn;
1358                 }
1359
1360                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1361
1362                 /* Does it need write permission? */
1363                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1364                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1365                         return conn;
1366                 }
1367
1368                 /* IPC services are limited */
1369                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1370                         reply_doserror(req, ERRSRV,ERRaccess);
1371                         return conn;
1372                 }
1373         } else {
1374                 /* This call needs to be run as root */
1375                 change_to_root_user();
1376         }
1377
1378         /* load service specific parameters */
1379         if (conn) {
1380                 if (req->encrypted) {
1381                         conn->encrypted_tid = true;
1382                         /* encrypted required from now on. */
1383                         conn->encrypt_level = Required;
1384                 } else if (ENCRYPTION_REQUIRED(conn)) {
1385                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1386                                 exit_server_cleanly("encryption required "
1387                                         "on connection");
1388                                 return conn;
1389                         }
1390                 }
1391
1392                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1393                                          (flags & (AS_USER|DO_CHDIR)
1394                                           ?True:False))) {
1395                         reply_doserror(req, ERRSRV, ERRaccess);
1396                         return conn;
1397                 }
1398                 conn->num_smb_operations++;
1399         }
1400
1401         /* does this protocol need to be run as guest? */
1402         if ((flags & AS_GUEST)
1403             && (!change_to_guest() ||
1404                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1405                               lp_hostsdeny(-1)))) {
1406                 reply_doserror(req, ERRSRV, ERRaccess);
1407                 return conn;
1408         }
1409
1410         smb_messages[type].fn(req);
1411         return req->conn;
1412 }
1413
1414 /****************************************************************************
1415  Construct a reply to the incoming packet.
1416 ****************************************************************************/
1417
1418 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1419 {
1420         connection_struct *conn;
1421         struct smb_request *req;
1422
1423         chain_size = 0;
1424
1425         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1426                 smb_panic("could not allocate smb_request");
1427         }
1428         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1429         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1430
1431         conn = switch_message(req->cmd, req, size);
1432
1433         if (req->unread_bytes) {
1434                 /* writeX failed. drain socket. */
1435                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1436                                 req->unread_bytes) {
1437                         smb_panic("failed to drain pending bytes");
1438                 }
1439                 req->unread_bytes = 0;
1440         }
1441
1442         if (req->outbuf == NULL) {
1443                 return;
1444         }
1445
1446         if (CVAL(req->outbuf,0) == 0) {
1447                 show_msg((char *)req->outbuf);
1448         }
1449
1450         if (!srv_send_smb(smbd_server_fd(),
1451                         (char *)req->outbuf,
1452                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1453                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1454         }
1455
1456         TALLOC_FREE(req);
1457
1458         return;
1459 }
1460
1461 /****************************************************************************
1462  Process an smb from the client
1463 ****************************************************************************/
1464
1465 static void process_smb(struct smbd_server_connection *conn,
1466                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1467                         bool encrypted)
1468 {
1469         int msg_type = CVAL(inbuf,0);
1470
1471         DO_PROFILE_INC(smb_count);
1472
1473         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1474                     smb_len(inbuf) ) );
1475         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1476                                 (int)nread,
1477                                 (unsigned int)unread_bytes ));
1478
1479         if (msg_type != 0) {
1480                 /*
1481                  * NetBIOS session request, keepalive, etc.
1482                  */
1483                 reply_special((char *)inbuf);
1484                 goto done;
1485         }
1486
1487         show_msg((char *)inbuf);
1488
1489         construct_reply((char *)inbuf,nread,unread_bytes,encrypted);
1490
1491         trans_num++;
1492
1493 done:
1494         conn->num_requests++;
1495
1496         /* The timeout_processing function isn't run nearly
1497            often enough to implement 'max log size' without
1498            overrunning the size of the file by many megabytes.
1499            This is especially true if we are running at debug
1500            level 10.  Checking every 50 SMBs is a nice
1501            tradeoff of performance vs log file size overrun. */
1502
1503         if ((conn->num_requests % 50) == 0 &&
1504             need_to_check_log_size()) {
1505                 change_to_root_user();
1506                 check_log_size();
1507         }
1508 }
1509
1510 /****************************************************************************
1511  Return a string containing the function name of a SMB command.
1512 ****************************************************************************/
1513
1514 const char *smb_fn_name(int type)
1515 {
1516         const char *unknown_name = "SMBunknown";
1517
1518         if (smb_messages[type].name == NULL)
1519                 return(unknown_name);
1520
1521         return(smb_messages[type].name);
1522 }
1523
1524 /****************************************************************************
1525  Helper functions for contruct_reply.
1526 ****************************************************************************/
1527
1528 void add_to_common_flags2(uint32 v)
1529 {
1530         common_flags2 |= v;
1531 }
1532
1533 void remove_from_common_flags2(uint32 v)
1534 {
1535         common_flags2 &= ~v;
1536 }
1537
1538 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1539                                    char *outbuf)
1540 {
1541         srv_set_message(outbuf,0,0,false);
1542
1543         SCVAL(outbuf, smb_com, req->cmd);
1544         SIVAL(outbuf,smb_rcls,0);
1545         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1546         SSVAL(outbuf,smb_flg2,
1547                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1548                 common_flags2);
1549         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1550
1551         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1552         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1553         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1554         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1555 }
1556
1557 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1558 {
1559         construct_reply_common(req, (char *)req->inbuf, outbuf);
1560 }
1561
1562 /*
1563  * How many bytes have we already accumulated up to the current wct field
1564  * offset?
1565  */
1566
1567 size_t req_wct_ofs(struct smb_request *req)
1568 {
1569         size_t buf_size;
1570
1571         if (req->chain_outbuf == NULL) {
1572                 return smb_wct - 4;
1573         }
1574         buf_size = talloc_get_size(req->chain_outbuf);
1575         if ((buf_size % 4) != 0) {
1576                 buf_size += (4 - (buf_size % 4));
1577         }
1578         return buf_size - 4;
1579 }
1580
1581 /*
1582  * Hack around reply_nterror & friends not being aware of chained requests,
1583  * generating illegal (i.e. wct==0) chain replies.
1584  */
1585
1586 static void fixup_chain_error_packet(struct smb_request *req)
1587 {
1588         uint8_t *outbuf = req->outbuf;
1589         req->outbuf = NULL;
1590         reply_outbuf(req, 2, 0);
1591         memcpy(req->outbuf, outbuf, smb_wct);
1592         TALLOC_FREE(outbuf);
1593         SCVAL(req->outbuf, smb_vwv0, 0xff);
1594 }
1595
1596 /****************************************************************************
1597  Construct a chained reply and add it to the already made reply
1598 ****************************************************************************/
1599
1600 void chain_reply(struct smb_request *req)
1601 {
1602         size_t smblen = smb_len(req->inbuf);
1603         size_t already_used, length_needed;
1604         uint8_t chain_cmd;
1605         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1606
1607         uint8_t wct;
1608         uint16_t *vwv;
1609         uint16_t buflen;
1610         uint8_t *buf;
1611
1612         if (IVAL(req->outbuf, smb_rcls) != 0) {
1613                 fixup_chain_error_packet(req);
1614         }
1615
1616         /*
1617          * Any of the AndX requests and replies have at least a wct of
1618          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1619          * beginning of the SMB header to the next wct field.
1620          *
1621          * None of the AndX requests put anything valuable in vwv[0] and [1],
1622          * so we can overwrite it here to form the chain.
1623          */
1624
1625         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1626                 goto error;
1627         }
1628
1629         /*
1630          * Here we assume that this is the end of the chain. For that we need
1631          * to set "next command" to 0xff and the offset to 0. If we later find
1632          * more commands in the chain, this will be overwritten again.
1633          */
1634
1635         SCVAL(req->outbuf, smb_vwv0, 0xff);
1636         SCVAL(req->outbuf, smb_vwv0+1, 0);
1637         SSVAL(req->outbuf, smb_vwv1, 0);
1638
1639         if (req->chain_outbuf == NULL) {
1640                 /*
1641                  * In req->chain_outbuf we collect all the replies. Start the
1642                  * chain by copying in the first reply.
1643                  */
1644                 req->chain_outbuf = req->outbuf;
1645                 req->outbuf = NULL;
1646         } else {
1647                 if (!smb_splice_chain(&req->chain_outbuf,
1648                                       CVAL(req->outbuf, smb_com),
1649                                       CVAL(req->outbuf, smb_wct),
1650                                       (uint16_t *)(req->outbuf + smb_vwv),
1651                                       0, smb_buflen(req->outbuf),
1652                                       (uint8_t *)smb_buf(req->outbuf))) {
1653                         goto error;
1654                 }
1655                 TALLOC_FREE(req->outbuf);
1656         }
1657
1658         /*
1659          * We use the old request's vwv field to grab the next chained command
1660          * and offset into the chained fields.
1661          */
1662
1663         chain_cmd = CVAL(req->vwv+0, 0);
1664         chain_offset = SVAL(req->vwv+1, 0);
1665
1666         if (chain_cmd == 0xff) {
1667                 /*
1668                  * End of chain, no more requests from the client. So ship the
1669                  * replies.
1670                  */
1671                 smb_setlen((char *)(req->chain_outbuf),
1672                            talloc_get_size(req->chain_outbuf) - 4);
1673                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1674                                   IS_CONN_ENCRYPTED(req->conn)
1675                                   ||req->encrypted)) {
1676                         exit_server_cleanly("chain_reply: srv_send_smb "
1677                                             "failed.");
1678                 }
1679                 return;
1680         }
1681
1682         /*
1683          * Check if the client tries to fool us. The request so far uses the
1684          * space to the end of the byte buffer in the request just
1685          * processed. The chain_offset can't point into that area. If that was
1686          * the case, we could end up with an endless processing of the chain,
1687          * we would always handle the same request.
1688          */
1689
1690         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1691         if (chain_offset < already_used) {
1692                 goto error;
1693         }
1694
1695         /*
1696          * Next check: Make sure the chain offset does not point beyond the
1697          * overall smb request length.
1698          */
1699
1700         length_needed = chain_offset+1; /* wct */
1701         if (length_needed > smblen) {
1702                 goto error;
1703         }
1704
1705         /*
1706          * Now comes the pointer magic. Goal here is to set up req->vwv and
1707          * req->buf correctly again to be able to call the subsequent
1708          * switch_message(). The chain offset (the former vwv[1]) points at
1709          * the new wct field.
1710          */
1711
1712         wct = CVAL(smb_base(req->inbuf), chain_offset);
1713
1714         /*
1715          * Next consistency check: Make the new vwv array fits in the overall
1716          * smb request.
1717          */
1718
1719         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1720         if (length_needed > smblen) {
1721                 goto error;
1722         }
1723         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1724
1725         /*
1726          * Now grab the new byte buffer....
1727          */
1728
1729         buflen = SVAL(vwv+wct, 0);
1730
1731         /*
1732          * .. and check that it fits.
1733          */
1734
1735         length_needed += buflen;
1736         if (length_needed > smblen) {
1737                 goto error;
1738         }
1739         buf = (uint8_t *)(vwv+wct+1);
1740
1741         req->cmd = chain_cmd;
1742         req->wct = wct;
1743         req->vwv = vwv;
1744         req->buflen = buflen;
1745         req->buf = buf;
1746
1747         switch_message(chain_cmd, req, smblen);
1748
1749         if (req->outbuf == NULL) {
1750                 /*
1751                  * This happens if the chained command has suspended itself or
1752                  * if it has called srv_send_smb() itself.
1753                  */
1754                 return;
1755         }
1756
1757         /*
1758          * We end up here if the chained command was not itself chained or
1759          * suspended, but for example a close() command. We now need to splice
1760          * the chained commands' outbuf into the already built up chain_outbuf
1761          * and ship the result.
1762          */
1763         goto done;
1764
1765  error:
1766         /*
1767          * We end up here if there's any error in the chain syntax. Report a
1768          * DOS error, just like Windows does.
1769          */
1770         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
1771         fixup_chain_error_packet(req);
1772
1773  done:
1774         if (!smb_splice_chain(&req->chain_outbuf,
1775                               CVAL(req->outbuf, smb_com),
1776                               CVAL(req->outbuf, smb_wct),
1777                               (uint16_t *)(req->outbuf + smb_vwv),
1778                               0, smb_buflen(req->outbuf),
1779                               (uint8_t *)smb_buf(req->outbuf))) {
1780                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
1781         }
1782         TALLOC_FREE(req->outbuf);
1783
1784         smb_setlen((char *)(req->chain_outbuf),
1785                    talloc_get_size(req->chain_outbuf) - 4);
1786
1787         show_msg((char *)(req->chain_outbuf));
1788
1789         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1790                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted)) {
1791                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1792         }
1793 }
1794
1795 /****************************************************************************
1796  Check if services need reloading.
1797 ****************************************************************************/
1798
1799 void check_reload(time_t t)
1800 {
1801         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1802
1803         if(last_smb_conf_reload_time == 0) {
1804                 last_smb_conf_reload_time = t;
1805                 /* Our printing subsystem might not be ready at smbd start up.
1806                    Then no printer is available till the first printers check
1807                    is performed.  A lower initial interval circumvents this. */
1808                 if ( printcap_cache_time > 60 )
1809                         last_printer_reload_time = t - printcap_cache_time + 60;
1810                 else
1811                         last_printer_reload_time = t;
1812         }
1813
1814         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1815                 /* randomize over 60 second the printcap reload to avoid all
1816                  * process hitting cupsd at the same time */
1817                 int time_range = 60;
1818
1819                 last_printer_reload_time += random() % time_range;
1820                 mypid = getpid();
1821         }
1822
1823         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1824                 reload_services(True);
1825                 reload_after_sighup = False;
1826                 last_smb_conf_reload_time = t;
1827         }
1828
1829         /* 'printcap cache time = 0' disable the feature */
1830
1831         if ( printcap_cache_time != 0 )
1832         {
1833                 /* see if it's time to reload or if the clock has been set back */
1834
1835                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1836                         || (t-last_printer_reload_time  < 0) )
1837                 {
1838                         DEBUG( 3,( "Printcap cache time expired.\n"));
1839                         reload_printers();
1840                         last_printer_reload_time = t;
1841                 }
1842         }
1843 }
1844
1845 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
1846 {
1847         /* TODO: make write nonblocking */
1848 }
1849
1850 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
1851 {
1852         uint8_t *inbuf = NULL;
1853         size_t inbuf_len = 0;
1854         size_t unread_bytes = 0;
1855         bool encrypted = false;
1856         TALLOC_CTX *mem_ctx = talloc_tos();
1857         NTSTATUS status;
1858
1859         /* TODO: make this completely nonblocking */
1860
1861         status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
1862                                     (char **)(void *)&inbuf,
1863                                     0, /* timeout */
1864                                     &unread_bytes,
1865                                     &encrypted,
1866                                     &inbuf_len);
1867         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1868                 goto process;
1869         }
1870         if (NT_STATUS_IS_ERR(status)) {
1871                 exit_server_cleanly("failed to receive smb request");
1872         }
1873         if (!NT_STATUS_IS_OK(status)) {
1874                 return;
1875         }
1876
1877 process:
1878         process_smb(conn, inbuf, inbuf_len, unread_bytes, encrypted);
1879 }
1880
1881 static void smbd_server_connection_handler(struct event_context *ev,
1882                                            struct fd_event *fde,
1883                                            uint16_t flags,
1884                                            void *private_data)
1885 {
1886         struct smbd_server_connection *conn = talloc_get_type(private_data,
1887                                               struct smbd_server_connection);
1888
1889         if (flags & EVENT_FD_WRITE) {
1890                 smbd_server_connection_write_handler(conn);
1891         } else if (flags & EVENT_FD_READ) {
1892                 smbd_server_connection_read_handler(conn);
1893         }
1894 }
1895
1896 /****************************************************************************
1897  Process commands from the client
1898 ****************************************************************************/
1899
1900 void smbd_process(void)
1901 {
1902         /*
1903          * Before the first packet, check the global hosts allow/ hosts deny
1904          * parameters before doing any parsing of packets passed to us by the
1905          * client. This prevents attacks on our parsing code from hosts not in
1906          * the hosts allow list.
1907          */
1908
1909         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1910                           lp_hostsdeny(-1))) {
1911                 char addr[INET6_ADDRSTRLEN];
1912
1913                 /*
1914                  * send a negative session response "not listening on calling
1915                  * name"
1916                  */
1917                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1918                 DEBUG( 1, ("Connection denied from %s\n",
1919                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1920                 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1921                 exit_server_cleanly("connection denied");
1922         }
1923
1924         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1925
1926         smbd_server_conn = talloc_zero(smbd_event_context(), struct smbd_server_connection);
1927         if (!smbd_server_conn) {
1928                 exit_server("failed to create smbd_server_connection");
1929         }
1930         smbd_server_conn->fde = event_add_fd(smbd_event_context(),
1931                                              smbd_server_conn,
1932                                              smbd_server_fd(),
1933                                              EVENT_FD_READ,
1934                                              smbd_server_connection_handler,
1935                                              smbd_server_conn);
1936         if (!smbd_server_conn->fde) {
1937                 exit_server("failed to create smbd_server_connection fde");
1938         }
1939
1940         while (True) {
1941                 NTSTATUS status;
1942                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1943
1944                 errno = 0;
1945
1946                 status = smbd_server_connection_loop_once(smbd_server_conn);
1947                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
1948                     !NT_STATUS_IS_OK(status)) {
1949                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
1950                                   " exiting\n", nt_errstr(status)));
1951                         return;
1952                 }
1953
1954                 TALLOC_FREE(frame);
1955         }
1956 }