source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern int smb_echo_count;
  24
  25 static enum smb_read_errors smb_read_error = SMB_READ_OK;
  26
  27 /*
  28  * Size of data we can send to client. Set
  29  *  by the client for all protocols above CORE.
  30  *  Set by us for CORE protocol.
  31  */
  32 int max_send = BUFFER_SIZE;
  33 /*
  34  * Size of the data we can receive. Set by us.
  35  * Can be modified by the max xmit parameter.
  36  */
  37 int max_recv = BUFFER_SIZE;
  38
  39 SIG_ATOMIC_T reload_after_sighup = 0;
  40 SIG_ATOMIC_T got_sig_term = 0;
  41 extern bool global_machine_password_needs_changing;
  42 extern int max_send;
  43
  44 /* Accessor function for smb_read_error for smbd functions. */
  45
  46 enum smb_read_errors *get_srv_read_error(void)
  47 {
  48         return &smb_read_error;
  49 }
  50
  51 /****************************************************************************
  52  Send an smb to a fd.
  53 ****************************************************************************/
  54
  55 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  56 {
  57         size_t len;
  58         size_t nwritten=0;
  59         ssize_t ret;
  60         char *buf_out = buffer;
  61
  62         /* Sign the outgoing packet if required. */
  63         srv_calculate_sign_mac(buf_out);
  64
  65         if (do_encrypt) {
  66                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  67                 if (!NT_STATUS_IS_OK(status)) {
  68                         DEBUG(0, ("send_smb: SMB encryption failed "
  69                                 "on outgoing packet! Error %s\n",
  70                                 nt_errstr(status) ));
  71                         return false;
  72                 }
  73         }
  74
  75         len = smb_len(buf_out) + 4;
  76
  77         while (nwritten < len) {
  78                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  79                 if (ret <= 0) {
  80                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  81                                 (int)len,(int)ret, strerror(errno) ));
  82                         srv_free_enc_buffer(buf_out);
  83                         return false;
  84                 }
  85                 nwritten += ret;
  86         }
  87
  88         srv_free_enc_buffer(buf_out);
  89         return true;
  90 }
  91
  92 /*******************************************************************
  93  Setup the word count and byte count for a smb message.
  94 ********************************************************************/
  95
  96 int srv_set_message(char *buf,
  97                         int num_words,
  98                         int num_bytes,
  99                         bool zero)
 100 {
 101         if (zero && (num_words || num_bytes)) {
 102                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 103         }
 104         SCVAL(buf,smb_wct,num_words);
 105         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 106         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 107         return (smb_size + num_words*2 + num_bytes);
 108 }
 109
 110 static bool valid_smb_header(const uint8_t *inbuf)
 111 {
 112         if (is_encrypted_packet(inbuf)) {
 113                 return true;
 114         }
 115         return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
 116 }
 117
 118 /* Socket functions for smbd packet processing. */
 119
 120 static bool valid_packet_size(size_t len)
 121 {
 122         /*
 123          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 124          * of header. Don't print the error if this fits.... JRA.
 125          */
 126
 127         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 128                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 129                                         (unsigned long)len));
 130                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
 131                         return false;
 132                 }
 133         }
 134         return true;
 135 }
 136
 137 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 138                                       unsigned int timeout, ssize_t len)
 139 {
 140         if (len <= 0) {
 141                 return NT_STATUS_OK;
 142         }
 143
 144         return read_socket_with_timeout_ntstatus(fd, buffer, len, len,
 145                                                  timeout, NULL);
 146 }
 147
 148 /****************************************************************************
 149  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 150 ****************************************************************************/
 151
 152 /*
 153  * Unfortunately, earlier versions of smbclient/libsmbclient
 154  * don't send this "standard" writeX header. I've fixed this
 155  * for 3.2 but we'll use the old method with earlier versions.
 156  * Windows and CIFSFS at least use this standard size. Not
 157  * sure about MacOSX.
 158  */
 159
 160 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 161                                 (2*14) + /* word count (including bcc) */ \
 162                                 1 /* pad byte */)
 163
 164 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 165                                                     const char lenbuf[4],
 166                                                     int fd, char **buffer,
 167                                                     unsigned int timeout,
 168                                                     size_t *p_unread,
 169                                                     size_t *len_ret)
 170 {
 171         /* Size of a WRITEX call (+4 byte len). */
 172         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 173         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 174         ssize_t toread;
 175         NTSTATUS status;
 176
 177         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 178
 179         status = read_socket_with_timeout_ntstatus(
 180                 fd, writeX_header + 4,
 181                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 182                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 183                 timeout, NULL);
 184
 185         if (!NT_STATUS_IS_OK(status)) {
 186                 return status;
 187         }
 188
 189         /*
 190          * Ok - now try and see if this is a possible
 191          * valid writeX call.
 192          */
 193
 194         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 195                 /*
 196                  * If the data offset is beyond what
 197                  * we've read, drain the extra bytes.
 198                  */
 199                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 200                 ssize_t newlen;
 201
 202                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 203                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 204                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 205                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 206                                         " failed to drain pending bytes");
 207                         }
 208                 } else {
 209                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 210                 }
 211
 212                 /* Spoof down the length and null out the bcc. */
 213                 set_message_bcc(writeX_header, 0);
 214                 newlen = smb_len(writeX_header);
 215
 216                 /* Copy the header we've written. */
 217
 218                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 219                                 writeX_header,
 220                                 sizeof(writeX_header));
 221
 222                 if (*buffer == NULL) {
 223                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 224                                   (int)sizeof(writeX_header)));
 225                         return NT_STATUS_NO_MEMORY;
 226                 }
 227
 228                 /* Work out the remaining bytes. */
 229                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 230                 *len_ret = newlen + 4;
 231                 return NT_STATUS_OK;
 232         }
 233
 234         if (!valid_packet_size(len)) {
 235                 return NT_STATUS_INVALID_PARAMETER;
 236         }
 237
 238         /*
 239          * Not a valid writeX call. Just do the standard
 240          * talloc and return.
 241          */
 242
 243         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 244
 245         if (*buffer == NULL) {
 246                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 247                           (int)len+4));
 248                 return NT_STATUS_NO_MEMORY;
 249         }
 250
 251         /* Copy in what we already read. */
 252         memcpy(*buffer,
 253                 writeX_header,
 254                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 255         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 256
 257         if(toread > 0) {
 258                 status = read_packet_remainder(
 259                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 260                         timeout, toread);
 261
 262                 if (!NT_STATUS_IS_OK(status)) {
 263                         return status;
 264                 }
 265         }
 266
 267         *len_ret = len + 4;
 268         return NT_STATUS_OK;
 269 }
 270
 271 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 272                                        char **buffer, unsigned int timeout,
 273                                        size_t *p_unread, size_t *plen)
 274 {
 275         char lenbuf[4];
 276         size_t len;
 277         int min_recv_size = lp_min_receive_file_size();
 278         NTSTATUS status;
 279
 280         *p_unread = 0;
 281
 282         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 283         if (!NT_STATUS_IS_OK(status)) {
 284                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 285                 return status;
 286         }
 287
 288         if (CVAL(lenbuf,0) == 0 &&
 289                         min_recv_size &&
 290                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 291                         !srv_is_signing_active()) {
 292
 293                 status = receive_smb_raw_talloc_partial_read(
 294                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, &len);
 295
 296                 if (!NT_STATUS_IS_OK(status)) {
 297                         DEBUG(10, ("receive_smb_raw: %s\n",
 298                                    nt_errstr(status)));
 299                         return status;
 300                 }
 301         }
 302
 303         if (!valid_packet_size(len)) {
 304                 return NT_STATUS_INVALID_PARAMETER;
 305         }
 306
 307         /*
 308          * The +4 here can't wrap, we've checked the length above already.
 309          */
 310
 311         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 312
 313         if (*buffer == NULL) {
 314                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 315                           (int)len+4));
 316                 return NT_STATUS_NO_MEMORY;
 317         }
 318
 319         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 320
 321         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 322         if (!NT_STATUS_IS_OK(status)) {
 323                 return status;
 324         }
 325
 326         *plen = len + 4;
 327         return NT_STATUS_OK;
 328 }
 329
 330 static ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx,
 331                                 int fd,
 332                                 char **buffer,
 333                                 unsigned int timeout,
 334                                 size_t *p_unread,
 335                                 bool *p_encrypted)
 336 {
 337         size_t len;
 338         NTSTATUS status;
 339
 340         *p_encrypted = false;
 341
 342         set_smb_read_error(get_srv_read_error(), SMB_READ_OK);
 343
 344         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 345                                         p_unread, &len);
 346         if (!NT_STATUS_IS_OK(status)) {
 347                 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 348                         set_smb_read_error(get_srv_read_error(), SMB_READ_EOF);
 349                         return -1;
 350                 }
 351
 352                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 353                         set_smb_read_error(get_srv_read_error(),
 354                                            SMB_READ_TIMEOUT);
 355                         return -1;
 356                 }
 357
 358                 set_smb_read_error(get_srv_read_error(), SMB_READ_ERROR);
 359                 return -1;
 360         }
 361
 362         if (is_encrypted_packet((uint8_t *)*buffer)) {
 363                 status = srv_decrypt_buffer(*buffer);
 364                 if (!NT_STATUS_IS_OK(status)) {
 365                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 366                                 "incoming packet! Error %s\n",
 367                                 nt_errstr(status) ));
 368                         cond_set_smb_read_error(get_srv_read_error(),
 369                                         SMB_READ_BAD_DECRYPT);
 370                         return -1;
 371                 }
 372                 *p_encrypted = true;
 373         }
 374
 375         /* Check the incoming SMB signature. */
 376         if (!srv_check_sign_mac(*buffer, true)) {
 377                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 378                           "incoming packet!\n"));
 379                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_BAD_SIG);
 380                 return -1;
 381         }
 382
 383         return len;
 384 }
 385
 386 /*
 387  * Initialize a struct smb_request from an inbuf
 388  */
 389
 390 void init_smb_request(struct smb_request *req,
 391                         const uint8 *inbuf,
 392                         size_t unread_bytes,
 393                         bool encrypted)
 394 {
 395         size_t req_size = smb_len(inbuf) + 4;
 396         /* Ensure we have at least smb_size bytes. */
 397         if (req_size < smb_size) {
 398                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 399                         (unsigned int)req_size ));
 400                 exit_server_cleanly("Invalid SMB request");
 401         }
 402         req->flags2 = SVAL(inbuf, smb_flg2);
 403         req->smbpid = SVAL(inbuf, smb_pid);
 404         req->mid    = SVAL(inbuf, smb_mid);
 405         req->vuid   = SVAL(inbuf, smb_uid);
 406         req->tid    = SVAL(inbuf, smb_tid);
 407         req->wct    = CVAL(inbuf, smb_wct);
 408         req->unread_bytes = unread_bytes;
 409         req->encrypted = encrypted;
 410         req->conn = conn_find(req->tid);
 411
 412         /* Ensure we have at least wct words and 2 bytes of bcc. */
 413         if (smb_size + req->wct*2 > req_size) {
 414                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 415                         (unsigned int)req->wct,
 416                         (unsigned int)req_size));
 417                 exit_server_cleanly("Invalid SMB request");
 418         }
 419         /* Ensure bcc is correct. */
 420         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 421                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 422                         "(wct = %u, size %u)\n",
 423                         (unsigned int)smb_buflen(inbuf),
 424                         (unsigned int)req->wct,
 425                         (unsigned int)req_size));
 426                 exit_server_cleanly("Invalid SMB request");
 427         }
 428         req->inbuf  = inbuf;
 429         req->outbuf = NULL;
 430 }
 431
 432 /****************************************************************************
 433  structure to hold a linked list of queued messages.
 434  for processing.
 435 ****************************************************************************/
 436
 437 static struct pending_message_list *deferred_open_queue;
 438
 439 /****************************************************************************
 440  Function to push a message onto the tail of a linked list of smb messages ready
 441  for processing.
 442 ****************************************************************************/
 443
 444 static bool push_queued_message(struct smb_request *req,
 445                                 struct timeval request_time,
 446                                 struct timeval end_time,
 447                                 char *private_data, size_t private_len)
 448 {
 449         int msg_len = smb_len(req->inbuf) + 4;
 450         struct pending_message_list *msg;
 451
 452         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 453
 454         if(msg == NULL) {
 455                 DEBUG(0,("push_message: malloc fail (1)\n"));
 456                 return False;
 457         }
 458
 459         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 460         if(msg->buf.data == NULL) {
 461                 DEBUG(0,("push_message: malloc fail (2)\n"));
 462                 TALLOC_FREE(msg);
 463                 return False;
 464         }
 465
 466         msg->request_time = request_time;
 467         msg->end_time = end_time;
 468         msg->encrypted = req->encrypted;
 469
 470         if (private_data) {
 471                 msg->private_data = data_blob_talloc(msg, private_data,
 472                                                      private_len);
 473                 if (msg->private_data.data == NULL) {
 474                         DEBUG(0,("push_message: malloc fail (3)\n"));
 475                         TALLOC_FREE(msg);
 476                         return False;
 477                 }
 478         }
 479
 480         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 481
 482         DEBUG(10,("push_message: pushed message length %u on "
 483                   "deferred_open_queue\n", (unsigned int)msg_len));
 484
 485         return True;
 486 }
 487
 488 /****************************************************************************
 489  Function to delete a sharing violation open message by mid.
 490 ****************************************************************************/
 491
 492 void remove_deferred_open_smb_message(uint16 mid)
 493 {
 494         struct pending_message_list *pml;
 495
 496         for (pml = deferred_open_queue; pml; pml = pml->next) {
 497                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 498                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 499                                   "deleting mid %u len %u\n",
 500                                   (unsigned int)mid,
 501                                   (unsigned int)pml->buf.length ));
 502                         DLIST_REMOVE(deferred_open_queue, pml);
 503                         TALLOC_FREE(pml);
 504                         return;
 505                 }
 506         }
 507 }
 508
 509 /****************************************************************************
 510  Move a sharing violation open retry message to the front of the list and
 511  schedule it for immediate processing.
 512 ****************************************************************************/
 513
 514 void schedule_deferred_open_smb_message(uint16 mid)
 515 {
 516         struct pending_message_list *pml;
 517         int i = 0;
 518
 519         for (pml = deferred_open_queue; pml; pml = pml->next) {
 520                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 521                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 522                         (unsigned int)msg_mid ));
 523                 if (mid == msg_mid) {
 524                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 525                                 mid ));
 526                         pml->end_time.tv_sec = 0;
 527                         pml->end_time.tv_usec = 0;
 528                         DLIST_PROMOTE(deferred_open_queue, pml);
 529                         return;
 530                 }
 531         }
 532
 533         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 534                 mid ));
 535 }
 536
 537 /****************************************************************************
 538  Return true if this mid is on the deferred queue.
 539 ****************************************************************************/
 540
 541 bool open_was_deferred(uint16 mid)
 542 {
 543         struct pending_message_list *pml;
 544
 545         for (pml = deferred_open_queue; pml; pml = pml->next) {
 546                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 547                         return True;
 548                 }
 549         }
 550         return False;
 551 }
 552
 553 /****************************************************************************
 554  Return the message queued by this mid.
 555 ****************************************************************************/
 556
 557 struct pending_message_list *get_open_deferred_message(uint16 mid)
 558 {
 559         struct pending_message_list *pml;
 560
 561         for (pml = deferred_open_queue; pml; pml = pml->next) {
 562                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 563                         return pml;
 564                 }
 565         }
 566         return NULL;
 567 }
 568
 569 /****************************************************************************
 570  Function to push a deferred open smb message onto a linked list of local smb
 571  messages ready for processing.
 572 ****************************************************************************/
 573
 574 bool push_deferred_smb_message(struct smb_request *req,
 575                                struct timeval request_time,
 576                                struct timeval timeout,
 577                                char *private_data, size_t priv_len)
 578 {
 579         struct timeval end_time;
 580
 581         if (req->unread_bytes) {
 582                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 583                         "unread_bytes = %u\n",
 584                         (unsigned int)req->unread_bytes ));
 585                 smb_panic("push_deferred_smb_message: "
 586                         "logic error unread_bytes != 0" );
 587         }
 588
 589         end_time = timeval_sum(&request_time, &timeout);
 590
 591         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 592                   "timeout time [%u.%06u]\n",
 593                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 594                   (unsigned int)end_time.tv_sec,
 595                   (unsigned int)end_time.tv_usec));
 596
 597         return push_queued_message(req, request_time, end_time,
 598                                    private_data, priv_len);
 599 }
 600
 601 struct idle_event {
 602         struct timed_event *te;
 603         struct timeval interval;
 604         char *name;
 605         bool (*handler)(const struct timeval *now, void *private_data);
 606         void *private_data;
 607 };
 608
 609 static void idle_event_handler(struct event_context *ctx,
 610                                struct timed_event *te,
 611                                const struct timeval *now,
 612                                void *private_data)
 613 {
 614         struct idle_event *event =
 615                 talloc_get_type_abort(private_data, struct idle_event);
 616
 617         TALLOC_FREE(event->te);
 618
 619         if (!event->handler(now, event->private_data)) {
 620                 /* Don't repeat, delete ourselves */
 621                 TALLOC_FREE(event);
 622                 return;
 623         }
 624
 625         event->te = event_add_timed(ctx, event,
 626                                     timeval_sum(now, &event->interval),
 627                                     event->name,
 628                                     idle_event_handler, event);
 629
 630         /* We can't do much but fail here. */
 631         SMB_ASSERT(event->te != NULL);
 632 }
 633
 634 struct idle_event *event_add_idle(struct event_context *event_ctx,
 635                                   TALLOC_CTX *mem_ctx,
 636                                   struct timeval interval,
 637                                   const char *name,
 638                                   bool (*handler)(const struct timeval *now,
 639                                                   void *private_data),
 640                                   void *private_data)
 641 {
 642         struct idle_event *result;
 643         struct timeval now = timeval_current();
 644
 645         result = TALLOC_P(mem_ctx, struct idle_event);
 646         if (result == NULL) {
 647                 DEBUG(0, ("talloc failed\n"));
 648                 return NULL;
 649         }
 650
 651         result->interval = interval;
 652         result->handler = handler;
 653         result->private_data = private_data;
 654
 655         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 656                 DEBUG(0, ("talloc failed\n"));
 657                 TALLOC_FREE(result);
 658                 return NULL;
 659         }
 660
 661         result->te = event_add_timed(event_ctx, result,
 662                                      timeval_sum(&now, &interval),
 663                                      result->name,
 664                                      idle_event_handler, result);
 665         if (result->te == NULL) {
 666                 DEBUG(0, ("event_add_timed failed\n"));
 667                 TALLOC_FREE(result);
 668                 return NULL;
 669         }
 670
 671         return result;
 672 }
 673
 674 /****************************************************************************
 675  Do all async processing in here. This includes kernel oplock messages, change
 676  notify events etc.
 677 ****************************************************************************/
 678
 679 static void async_processing(fd_set *pfds)
 680 {
 681         DEBUG(10,("async_processing: Doing async processing.\n"));
 682
 683         process_aio_queue();
 684
 685         process_kernel_oplocks(smbd_messaging_context(), pfds);
 686
 687         /* Do the aio check again after receive_local_message as it does a
 688            select and may have eaten our signal. */
 689         /* Is this till true? -- vl */
 690         process_aio_queue();
 691
 692         if (got_sig_term) {
 693                 exit_server_cleanly("termination signal");
 694         }
 695
 696         /* check for sighup processing */
 697         if (reload_after_sighup) {
 698                 change_to_root_user();
 699                 DEBUG(1,("Reloading services after SIGHUP\n"));
 700                 reload_services(False);
 701                 reload_after_sighup = 0;
 702         }
 703 }
 704
 705 /****************************************************************************
 706  Add a fd to the set we will be select(2)ing on.
 707 ****************************************************************************/
 708
 709 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 710 {
 711         if (fd != -1) {
 712                 FD_SET(fd, fds);
 713                 maxfd = MAX(maxfd, fd);
 714         }
 715
 716         return maxfd;
 717 }
 718
 719 /****************************************************************************
 720   Do a select on an two fd's - with timeout.
 721
 722   If a local udp message has been pushed onto the
 723   queue (this can only happen during oplock break
 724   processing) call async_processing()
 725
 726   If a pending smb message has been pushed onto the
 727   queue (this can only happen during oplock break
 728   processing) return this next.
 729
 730   If the first smbfd is ready then read an smb from it.
 731   if the second (loopback UDP) fd is ready then read a message
 732   from it and setup the buffer header to identify the length
 733   and from address.
 734   Returns False on timeout or error.
 735   Else returns True.
 736
 737 The timeout is in milliseconds
 738 ****************************************************************************/
 739
 740 static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 741                                 char **buffer,
 742                                 size_t *buffer_len,
 743                                 int timeout,
 744                                 size_t *p_unread,
 745                                 bool *p_encrypted)
 746 {
 747         fd_set r_fds, w_fds;
 748         int selrtn;
 749         struct timeval to;
 750         int maxfd = 0;
 751         ssize_t len;
 752
 753         *p_unread = 0;
 754         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 755
 756  again:
 757
 758         if (timeout >= 0) {
 759                 to.tv_sec = timeout / 1000;
 760                 to.tv_usec = (timeout % 1000) * 1000;
 761         } else {
 762                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 763                 to.tv_usec = 0;
 764         }
 765
 766         /*
 767          * Note that this call must be before processing any SMB
 768          * messages as we need to synchronously process any messages
 769          * we may have sent to ourselves from the previous SMB.
 770          */
 771         message_dispatch(smbd_messaging_context());
 772
 773         /*
 774          * Check to see if we already have a message on the deferred open queue
 775          * and it's time to schedule.
 776          */
 777         if(deferred_open_queue != NULL) {
 778                 bool pop_message = False;
 779                 struct pending_message_list *msg = deferred_open_queue;
 780
 781                 if (timeval_is_zero(&msg->end_time)) {
 782                         pop_message = True;
 783                 } else {
 784                         struct timeval tv;
 785                         SMB_BIG_INT tdif;
 786
 787                         GetTimeOfDay(&tv);
 788                         tdif = usec_time_diff(&msg->end_time, &tv);
 789                         if (tdif <= 0) {
 790                                 /* Timed out. Schedule...*/
 791                                 pop_message = True;
 792                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 793                         } else {
 794                                 /* Make a more accurate select timeout. */
 795                                 to.tv_sec = tdif / 1000000;
 796                                 to.tv_usec = tdif % 1000000;
 797                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 798                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 799                         }
 800                 }
 801
 802                 if (pop_message) {
 803
 804                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 805                                                         msg->buf.length);
 806                         if (*buffer == NULL) {
 807                                 DEBUG(0, ("talloc failed\n"));
 808                                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 809                                 return False;
 810                         }
 811                         *buffer_len = msg->buf.length;
 812                         *p_encrypted = msg->encrypted;
 813
 814                         /* We leave this message on the queue so the open code can
 815                            know this is a retry. */
 816                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 817                         return True;
 818                 }
 819         }
 820
 821         /*
 822          * Setup the select fd sets.
 823          */
 824
 825         FD_ZERO(&r_fds);
 826         FD_ZERO(&w_fds);
 827
 828         /*
 829          * Ensure we process oplock break messages by preference.
 830          * We have to do this before the select, after the select
 831          * and if the select returns EINTR. This is due to the fact
 832          * that the selects called from async_processing can eat an EINTR
 833          * caused by a signal (we can't take the break message there).
 834          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 835          */
 836
 837         if (oplock_message_waiting(&r_fds)) {
 838                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 839                 async_processing(&r_fds);
 840                 /*
 841                  * After async processing we must go and do the select again, as
 842                  * the state of the flag in fds for the server file descriptor is
 843                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 844                  */
 845                 goto again;
 846         }
 847
 848         /*
 849          * Are there any timed events waiting ? If so, ensure we don't
 850          * select for longer than it would take to wait for them.
 851          */
 852
 853         {
 854                 struct timeval now;
 855                 GetTimeOfDay(&now);
 856
 857                 event_add_to_select_args(smbd_event_context(), &now,
 858                                          &r_fds, &w_fds, &to, &maxfd);
 859         }
 860
 861         if (timeval_is_zero(&to)) {
 862                 /* Process a timed event now... */
 863                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 864                         goto again;
 865                 }
 866         }
 867
 868         {
 869                 int sav;
 870                 START_PROFILE(smbd_idle);
 871
 872                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 873                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 874
 875                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 876                 sav = errno;
 877
 878                 END_PROFILE(smbd_idle);
 879                 errno = sav;
 880         }
 881
 882         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 883                 goto again;
 884         }
 885
 886         /* if we get EINTR then maybe we have received an oplock
 887            signal - treat this as select returning 1. This is ugly, but
 888            is the best we can do until the oplock code knows more about
 889            signals */
 890         if (selrtn == -1 && errno == EINTR) {
 891                 async_processing(&r_fds);
 892                 /*
 893                  * After async processing we must go and do the select again, as
 894                  * the state of the flag in fds for the server file descriptor is
 895                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 896                  */
 897                 goto again;
 898         }
 899
 900         /* Check if error */
 901         if (selrtn == -1) {
 902                 /* something is wrong. Maybe the socket is dead? */
 903                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 904                 return False;
 905         }
 906
 907         /* Did we timeout ? */
 908         if (selrtn == 0) {
 909                 set_smb_read_error(get_srv_read_error(),SMB_READ_TIMEOUT);
 910                 return False;
 911         }
 912
 913         /*
 914          * Ensure we process oplock break messages by preference.
 915          * This is IMPORTANT ! Otherwise we can starve other processes
 916          * sending us an oplock break message. JRA.
 917          */
 918
 919         if (oplock_message_waiting(&r_fds)) {
 920                 async_processing(&r_fds);
 921                 /*
 922                  * After async processing we must go and do the select again, as
 923                  * the state of the flag in fds for the server file descriptor is
 924                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 925                  */
 926                 goto again;
 927         }
 928
 929         len = receive_smb_talloc(mem_ctx, smbd_server_fd(),
 930                                 buffer, 0, p_unread, p_encrypted);
 931
 932         if (len == -1) {
 933                 return False;
 934         }
 935
 936         *buffer_len = (size_t)len;
 937
 938         return True;
 939 }
 940
 941 /*
 942  * Only allow 5 outstanding trans requests. We're allocating memory, so
 943  * prevent a DoS.
 944  */
 945
 946 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 947 {
 948         int count = 0;
 949         for (; list != NULL; list = list->next) {
 950
 951                 if (list->mid == mid) {
 952                         return NT_STATUS_INVALID_PARAMETER;
 953                 }
 954
 955                 count += 1;
 956         }
 957         if (count > 5) {
 958                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 959         }
 960
 961         return NT_STATUS_OK;
 962 }
 963
 964 /****************************************************************************
 965  We're terminating and have closed all our files/connections etc.
 966  If there are any pending local messages we need to respond to them
 967  before termination so that other smbds don't think we just died whilst
 968  holding oplocks.
 969 ****************************************************************************/
 970
 971 void respond_to_all_remaining_local_messages(void)
 972 {
 973         /*
 974          * Assert we have no exclusive open oplocks.
 975          */
 976
 977         if(get_number_of_exclusive_open_oplocks()) {
 978                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 979                         get_number_of_exclusive_open_oplocks() ));
 980                 return;
 981         }
 982
 983         process_kernel_oplocks(smbd_messaging_context(), NULL);
 984
 985         return;
 986 }
 987
 988
 989 /*
 990 These flags determine some of the permissions required to do an operation
 991
 992 Note that I don't set NEED_WRITE on some write operations because they
 993 are used by some brain-dead clients when printing, and I don't want to
 994 force write permissions on print services.
 995 */
 996 #define AS_USER (1<<0)
 997 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 998 #define TIME_INIT (1<<2)
 999 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1000 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1001 #define DO_CHDIR (1<<6)
1002
1003 /*
1004    define a list of possible SMB messages and their corresponding
1005    functions. Any message that has a NULL function is unimplemented -
1006    please feel free to contribute implementations!
1007 */
1008 static const struct smb_message_struct {
1009         const char *name;
1010         void (*fn_new)(struct smb_request *req);
1011         int flags;
1012 } smb_messages[256] = {
1013
1014 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1015 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1016 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1017 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1018 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1019 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1020 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1021 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1022 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1023 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1024 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1025 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1026 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1027 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1028 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1029 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1030 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1031 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1032 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1033 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1034 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1035 /* 0x15 */ { NULL, NULL, 0 },
1036 /* 0x16 */ { NULL, NULL, 0 },
1037 /* 0x17 */ { NULL, NULL, 0 },
1038 /* 0x18 */ { NULL, NULL, 0 },
1039 /* 0x19 */ { NULL, NULL, 0 },
1040 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1041 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1042 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1043 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1044 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1045 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1046 /* 0x20 */ { "SMBwritec", NULL,0},
1047 /* 0x21 */ { NULL, NULL, 0 },
1048 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1049 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1050 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1051 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1052 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1053 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1054 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1055 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1056 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1057 /* 0x2b */ { "SMBecho",reply_echo,0},
1058 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1059 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1060 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1061 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1062 /* 0x30 */ { NULL, NULL, 0 },
1063 /* 0x31 */ { NULL, NULL, 0 },
1064 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1065 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1066 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1067 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1068 /* 0x36 */ { NULL, NULL, 0 },
1069 /* 0x37 */ { NULL, NULL, 0 },
1070 /* 0x38 */ { NULL, NULL, 0 },
1071 /* 0x39 */ { NULL, NULL, 0 },
1072 /* 0x3a */ { NULL, NULL, 0 },
1073 /* 0x3b */ { NULL, NULL, 0 },
1074 /* 0x3c */ { NULL, NULL, 0 },
1075 /* 0x3d */ { NULL, NULL, 0 },
1076 /* 0x3e */ { NULL, NULL, 0 },
1077 /* 0x3f */ { NULL, NULL, 0 },
1078 /* 0x40 */ { NULL, NULL, 0 },
1079 /* 0x41 */ { NULL, NULL, 0 },
1080 /* 0x42 */ { NULL, NULL, 0 },
1081 /* 0x43 */ { NULL, NULL, 0 },
1082 /* 0x44 */ { NULL, NULL, 0 },
1083 /* 0x45 */ { NULL, NULL, 0 },
1084 /* 0x46 */ { NULL, NULL, 0 },
1085 /* 0x47 */ { NULL, NULL, 0 },
1086 /* 0x48 */ { NULL, NULL, 0 },
1087 /* 0x49 */ { NULL, NULL, 0 },
1088 /* 0x4a */ { NULL, NULL, 0 },
1089 /* 0x4b */ { NULL, NULL, 0 },
1090 /* 0x4c */ { NULL, NULL, 0 },
1091 /* 0x4d */ { NULL, NULL, 0 },
1092 /* 0x4e */ { NULL, NULL, 0 },
1093 /* 0x4f */ { NULL, NULL, 0 },
1094 /* 0x50 */ { NULL, NULL, 0 },
1095 /* 0x51 */ { NULL, NULL, 0 },
1096 /* 0x52 */ { NULL, NULL, 0 },
1097 /* 0x53 */ { NULL, NULL, 0 },
1098 /* 0x54 */ { NULL, NULL, 0 },
1099 /* 0x55 */ { NULL, NULL, 0 },
1100 /* 0x56 */ { NULL, NULL, 0 },
1101 /* 0x57 */ { NULL, NULL, 0 },
1102 /* 0x58 */ { NULL, NULL, 0 },
1103 /* 0x59 */ { NULL, NULL, 0 },
1104 /* 0x5a */ { NULL, NULL, 0 },
1105 /* 0x5b */ { NULL, NULL, 0 },
1106 /* 0x5c */ { NULL, NULL, 0 },
1107 /* 0x5d */ { NULL, NULL, 0 },
1108 /* 0x5e */ { NULL, NULL, 0 },
1109 /* 0x5f */ { NULL, NULL, 0 },
1110 /* 0x60 */ { NULL, NULL, 0 },
1111 /* 0x61 */ { NULL, NULL, 0 },
1112 /* 0x62 */ { NULL, NULL, 0 },
1113 /* 0x63 */ { NULL, NULL, 0 },
1114 /* 0x64 */ { NULL, NULL, 0 },
1115 /* 0x65 */ { NULL, NULL, 0 },
1116 /* 0x66 */ { NULL, NULL, 0 },
1117 /* 0x67 */ { NULL, NULL, 0 },
1118 /* 0x68 */ { NULL, NULL, 0 },
1119 /* 0x69 */ { NULL, NULL, 0 },
1120 /* 0x6a */ { NULL, NULL, 0 },
1121 /* 0x6b */ { NULL, NULL, 0 },
1122 /* 0x6c */ { NULL, NULL, 0 },
1123 /* 0x6d */ { NULL, NULL, 0 },
1124 /* 0x6e */ { NULL, NULL, 0 },
1125 /* 0x6f */ { NULL, NULL, 0 },
1126 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1127 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1128 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1129 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1130 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1131 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1132 /* 0x76 */ { NULL, NULL, 0 },
1133 /* 0x77 */ { NULL, NULL, 0 },
1134 /* 0x78 */ { NULL, NULL, 0 },
1135 /* 0x79 */ { NULL, NULL, 0 },
1136 /* 0x7a */ { NULL, NULL, 0 },
1137 /* 0x7b */ { NULL, NULL, 0 },
1138 /* 0x7c */ { NULL, NULL, 0 },
1139 /* 0x7d */ { NULL, NULL, 0 },
1140 /* 0x7e */ { NULL, NULL, 0 },
1141 /* 0x7f */ { NULL, NULL, 0 },
1142 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1143 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1144 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1145 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1146 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1147 /* 0x85 */ { NULL, NULL, 0 },
1148 /* 0x86 */ { NULL, NULL, 0 },
1149 /* 0x87 */ { NULL, NULL, 0 },
1150 /* 0x88 */ { NULL, NULL, 0 },
1151 /* 0x89 */ { NULL, NULL, 0 },
1152 /* 0x8a */ { NULL, NULL, 0 },
1153 /* 0x8b */ { NULL, NULL, 0 },
1154 /* 0x8c */ { NULL, NULL, 0 },
1155 /* 0x8d */ { NULL, NULL, 0 },
1156 /* 0x8e */ { NULL, NULL, 0 },
1157 /* 0x8f */ { NULL, NULL, 0 },
1158 /* 0x90 */ { NULL, NULL, 0 },
1159 /* 0x91 */ { NULL, NULL, 0 },
1160 /* 0x92 */ { NULL, NULL, 0 },
1161 /* 0x93 */ { NULL, NULL, 0 },
1162 /* 0x94 */ { NULL, NULL, 0 },
1163 /* 0x95 */ { NULL, NULL, 0 },
1164 /* 0x96 */ { NULL, NULL, 0 },
1165 /* 0x97 */ { NULL, NULL, 0 },
1166 /* 0x98 */ { NULL, NULL, 0 },
1167 /* 0x99 */ { NULL, NULL, 0 },
1168 /* 0x9a */ { NULL, NULL, 0 },
1169 /* 0x9b */ { NULL, NULL, 0 },
1170 /* 0x9c */ { NULL, NULL, 0 },
1171 /* 0x9d */ { NULL, NULL, 0 },
1172 /* 0x9e */ { NULL, NULL, 0 },
1173 /* 0x9f */ { NULL, NULL, 0 },
1174 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1175 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1176 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1177 /* 0xa3 */ { NULL, NULL, 0 },
1178 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1179 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1180 /* 0xa6 */ { NULL, NULL, 0 },
1181 /* 0xa7 */ { NULL, NULL, 0 },
1182 /* 0xa8 */ { NULL, NULL, 0 },
1183 /* 0xa9 */ { NULL, NULL, 0 },
1184 /* 0xaa */ { NULL, NULL, 0 },
1185 /* 0xab */ { NULL, NULL, 0 },
1186 /* 0xac */ { NULL, NULL, 0 },
1187 /* 0xad */ { NULL, NULL, 0 },
1188 /* 0xae */ { NULL, NULL, 0 },
1189 /* 0xaf */ { NULL, NULL, 0 },
1190 /* 0xb0 */ { NULL, NULL, 0 },
1191 /* 0xb1 */ { NULL, NULL, 0 },
1192 /* 0xb2 */ { NULL, NULL, 0 },
1193 /* 0xb3 */ { NULL, NULL, 0 },
1194 /* 0xb4 */ { NULL, NULL, 0 },
1195 /* 0xb5 */ { NULL, NULL, 0 },
1196 /* 0xb6 */ { NULL, NULL, 0 },
1197 /* 0xb7 */ { NULL, NULL, 0 },
1198 /* 0xb8 */ { NULL, NULL, 0 },
1199 /* 0xb9 */ { NULL, NULL, 0 },
1200 /* 0xba */ { NULL, NULL, 0 },
1201 /* 0xbb */ { NULL, NULL, 0 },
1202 /* 0xbc */ { NULL, NULL, 0 },
1203 /* 0xbd */ { NULL, NULL, 0 },
1204 /* 0xbe */ { NULL, NULL, 0 },
1205 /* 0xbf */ { NULL, NULL, 0 },
1206 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1207 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1208 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1209 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1210 /* 0xc4 */ { NULL, NULL, 0 },
1211 /* 0xc5 */ { NULL, NULL, 0 },
1212 /* 0xc6 */ { NULL, NULL, 0 },
1213 /* 0xc7 */ { NULL, NULL, 0 },
1214 /* 0xc8 */ { NULL, NULL, 0 },
1215 /* 0xc9 */ { NULL, NULL, 0 },
1216 /* 0xca */ { NULL, NULL, 0 },
1217 /* 0xcb */ { NULL, NULL, 0 },
1218 /* 0xcc */ { NULL, NULL, 0 },
1219 /* 0xcd */ { NULL, NULL, 0 },
1220 /* 0xce */ { NULL, NULL, 0 },
1221 /* 0xcf */ { NULL, NULL, 0 },
1222 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1223 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1224 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1225 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1226 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1227 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1228 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1229 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1230 /* 0xd8 */ { NULL, NULL, 0 },
1231 /* 0xd9 */ { NULL, NULL, 0 },
1232 /* 0xda */ { NULL, NULL, 0 },
1233 /* 0xdb */ { NULL, NULL, 0 },
1234 /* 0xdc */ { NULL, NULL, 0 },
1235 /* 0xdd */ { NULL, NULL, 0 },
1236 /* 0xde */ { NULL, NULL, 0 },
1237 /* 0xdf */ { NULL, NULL, 0 },
1238 /* 0xe0 */ { NULL, NULL, 0 },
1239 /* 0xe1 */ { NULL, NULL, 0 },
1240 /* 0xe2 */ { NULL, NULL, 0 },
1241 /* 0xe3 */ { NULL, NULL, 0 },
1242 /* 0xe4 */ { NULL, NULL, 0 },
1243 /* 0xe5 */ { NULL, NULL, 0 },
1244 /* 0xe6 */ { NULL, NULL, 0 },
1245 /* 0xe7 */ { NULL, NULL, 0 },
1246 /* 0xe8 */ { NULL, NULL, 0 },
1247 /* 0xe9 */ { NULL, NULL, 0 },
1248 /* 0xea */ { NULL, NULL, 0 },
1249 /* 0xeb */ { NULL, NULL, 0 },
1250 /* 0xec */ { NULL, NULL, 0 },
1251 /* 0xed */ { NULL, NULL, 0 },
1252 /* 0xee */ { NULL, NULL, 0 },
1253 /* 0xef */ { NULL, NULL, 0 },
1254 /* 0xf0 */ { NULL, NULL, 0 },
1255 /* 0xf1 */ { NULL, NULL, 0 },
1256 /* 0xf2 */ { NULL, NULL, 0 },
1257 /* 0xf3 */ { NULL, NULL, 0 },
1258 /* 0xf4 */ { NULL, NULL, 0 },
1259 /* 0xf5 */ { NULL, NULL, 0 },
1260 /* 0xf6 */ { NULL, NULL, 0 },
1261 /* 0xf7 */ { NULL, NULL, 0 },
1262 /* 0xf8 */ { NULL, NULL, 0 },
1263 /* 0xf9 */ { NULL, NULL, 0 },
1264 /* 0xfa */ { NULL, NULL, 0 },
1265 /* 0xfb */ { NULL, NULL, 0 },
1266 /* 0xfc */ { NULL, NULL, 0 },
1267 /* 0xfd */ { NULL, NULL, 0 },
1268 /* 0xfe */ { NULL, NULL, 0 },
1269 /* 0xff */ { NULL, NULL, 0 }
1270
1271 };
1272
1273 /*******************************************************************
1274  allocate and initialize a reply packet
1275 ********************************************************************/
1276
1277 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1278 {
1279         /*
1280          * Protect against integer wrap
1281          */
1282         if ((num_bytes > 0xffffff)
1283             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1284                 char *msg;
1285                 asprintf(&msg, "num_bytes too large: %u",
1286                          (unsigned)num_bytes);
1287                 smb_panic(msg);
1288         }
1289
1290         if (!(req->outbuf = TALLOC_ARRAY(
1291                       req, uint8,
1292                       smb_size + num_words*2 + num_bytes))) {
1293                 smb_panic("could not allocate output buffer\n");
1294         }
1295
1296         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1297         srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1298         /*
1299          * Zero out the word area, the caller has to take care of the bcc area
1300          * himself
1301          */
1302         if (num_words != 0) {
1303                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1304         }
1305
1306         return;
1307 }
1308
1309
1310 /*******************************************************************
1311  Dump a packet to a file.
1312 ********************************************************************/
1313
1314 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1315 {
1316         int fd, i;
1317         char *fname = NULL;
1318         if (DEBUGLEVEL < 50) {
1319                 return;
1320         }
1321
1322         if (len < 4) len = smb_len(data)+4;
1323         for (i=1;i<100;i++) {
1324                 asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1325                                 type ? "req" : "resp");
1326                 if (!fname) {
1327                         return;
1328                 }
1329                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1330                 if (fd != -1 || errno != EEXIST) break;
1331         }
1332         if (fd != -1) {
1333                 ssize_t ret = write(fd, data, len);
1334                 if (ret != len)
1335                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1336                 close(fd);
1337                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1338         }
1339         SAFE_FREE(fname);
1340 }
1341
1342 /****************************************************************************
1343  Prepare everything for calling the actual request function, and potentially
1344  call the request function via the "new" interface.
1345
1346  Return False if the "legacy" function needs to be called, everything is
1347  prepared.
1348
1349  Return True if we're done.
1350
1351  I know this API sucks, but it is the one with the least code change I could
1352  find.
1353 ****************************************************************************/
1354
1355 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1356 {
1357         int flags;
1358         uint16 session_tag;
1359         connection_struct *conn = NULL;
1360
1361         static uint16 last_session_tag = UID_FIELD_INVALID;
1362
1363         errno = 0;
1364
1365         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1366          * so subtract 4 from it. */
1367         if (!valid_smb_header(req->inbuf)
1368             || (size < (smb_size - 4))) {
1369                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1370                          smb_len(req->inbuf)));
1371                 exit_server_cleanly("Non-SMB packet");
1372         }
1373
1374         if (smb_messages[type].fn_new == NULL) {
1375                 DEBUG(0,("Unknown message type %d!\n",type));
1376                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1377                 reply_unknown_new(req, type);
1378                 return NULL;
1379         }
1380
1381         flags = smb_messages[type].flags;
1382
1383         /* In share mode security we must ignore the vuid. */
1384         session_tag = (lp_security() == SEC_SHARE)
1385                 ? UID_FIELD_INVALID : req->vuid;
1386         conn = req->conn;
1387
1388         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1389                  (int)sys_getpid(), (unsigned long)conn));
1390
1391         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1392
1393         /* Ensure this value is replaced in the incoming packet. */
1394         SSVAL(req->inbuf,smb_uid,session_tag);
1395
1396         /*
1397          * Ensure the correct username is in current_user_info.  This is a
1398          * really ugly bugfix for problems with multiple session_setup_and_X's
1399          * being done and allowing %U and %G substitutions to work correctly.
1400          * There is a reason this code is done here, don't move it unless you
1401          * know what you're doing... :-).
1402          * JRA.
1403          */
1404
1405         if (session_tag != last_session_tag) {
1406                 user_struct *vuser = NULL;
1407
1408                 last_session_tag = session_tag;
1409                 if(session_tag != UID_FIELD_INVALID) {
1410                         vuser = get_valid_user_struct(session_tag);
1411                         if (vuser) {
1412                                 set_current_user_info(&vuser->user);
1413                         }
1414                 }
1415         }
1416
1417         /* Does this call need to be run as the connected user? */
1418         if (flags & AS_USER) {
1419
1420                 /* Does this call need a valid tree connection? */
1421                 if (!conn) {
1422                         /*
1423                          * Amazingly, the error code depends on the command
1424                          * (from Samba4).
1425                          */
1426                         if (type == SMBntcreateX) {
1427                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1428                         } else {
1429                                 reply_doserror(req, ERRSRV, ERRinvnid);
1430                         }
1431                         return NULL;
1432                 }
1433
1434                 if (!change_to_user(conn,session_tag)) {
1435                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1436                         return conn;
1437                 }
1438
1439                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1440
1441                 /* Does it need write permission? */
1442                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1443                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1444                         return conn;
1445                 }
1446
1447                 /* IPC services are limited */
1448                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1449                         reply_doserror(req, ERRSRV,ERRaccess);
1450                         return conn;
1451                 }
1452         } else {
1453                 /* This call needs to be run as root */
1454                 change_to_root_user();
1455         }
1456
1457         /* load service specific parameters */
1458         if (conn) {
1459                 if (req->encrypted) {
1460                         conn->encrypted_tid = true;
1461                         /* encrypted required from now on. */
1462                         conn->encrypt_level = Required;
1463                 } else if (ENCRYPTION_REQUIRED(conn)) {
1464                         uint8 com = CVAL(req->inbuf,smb_com);
1465                         if (com != SMBtrans2 && com != SMBtranss2) {
1466                                 exit_server_cleanly("encryption required "
1467                                         "on connection");
1468                                 return conn;
1469                         }
1470                 }
1471
1472                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1473                                          (flags & (AS_USER|DO_CHDIR)
1474                                           ?True:False))) {
1475                         reply_doserror(req, ERRSRV, ERRaccess);
1476                         return conn;
1477                 }
1478                 conn->num_smb_operations++;
1479         }
1480
1481         /* does this protocol need to be run as guest? */
1482         if ((flags & AS_GUEST)
1483             && (!change_to_guest() ||
1484                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1485                               lp_hostsdeny(-1)))) {
1486                 reply_doserror(req, ERRSRV, ERRaccess);
1487                 return conn;
1488         }
1489
1490         smb_messages[type].fn_new(req);
1491         return req->conn;
1492 }
1493
1494 /****************************************************************************
1495  Construct a reply to the incoming packet.
1496 ****************************************************************************/
1497
1498 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1499 {
1500         uint8 type = CVAL(inbuf,smb_com);
1501         connection_struct *conn;
1502         struct smb_request *req;
1503
1504         chain_size = 0;
1505         file_chain_reset();
1506         reset_chain_p();
1507
1508         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1509                 smb_panic("could not allocate smb_request");
1510         }
1511         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1512
1513         conn = switch_message(type, req, size);
1514
1515         if (req->unread_bytes) {
1516                 /* writeX failed. drain socket. */
1517                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1518                                 req->unread_bytes) {
1519                         smb_panic("failed to drain pending bytes");
1520                 }
1521                 req->unread_bytes = 0;
1522         }
1523
1524         if (req->outbuf == NULL) {
1525                 return;
1526         }
1527
1528         if (CVAL(req->outbuf,0) == 0) {
1529                 show_msg((char *)req->outbuf);
1530         }
1531
1532         if (!srv_send_smb(smbd_server_fd(),
1533                         (char *)req->outbuf,
1534                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1535                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1536         }
1537
1538         TALLOC_FREE(req);
1539
1540         return;
1541 }
1542
1543 /****************************************************************************
1544  Process an smb from the client
1545 ****************************************************************************/
1546
1547 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1548 {
1549         static int trans_num;
1550         int msg_type = CVAL(inbuf,0);
1551
1552         DO_PROFILE_INC(smb_count);
1553
1554         if (trans_num == 0) {
1555                 char addr[INET6_ADDRSTRLEN];
1556
1557                 /* on the first packet, check the global hosts allow/ hosts
1558                 deny parameters before doing any parsing of the packet
1559                 passed to us by the client.  This prevents attacks on our
1560                 parsing code from hosts not in the hosts allow list */
1561
1562                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1563                                   lp_hostsdeny(-1))) {
1564                         /* send a negative session response "not listening on calling name" */
1565                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1566                         DEBUG( 1, ( "Connection denied from %s\n",
1567                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1568                         (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1569                         exit_server_cleanly("connection denied");
1570                 }
1571         }
1572
1573         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1574                     smb_len(inbuf) ) );
1575         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1576                                 (int)nread,
1577                                 (unsigned int)unread_bytes ));
1578
1579         if (msg_type != 0) {
1580                 /*
1581                  * NetBIOS session request, keepalive, etc.
1582                  */
1583                 reply_special(inbuf);
1584                 return;
1585         }
1586
1587         show_msg(inbuf);
1588
1589         construct_reply(inbuf,nread,unread_bytes,encrypted);
1590
1591         trans_num++;
1592 }
1593
1594 /****************************************************************************
1595  Return a string containing the function name of a SMB command.
1596 ****************************************************************************/
1597
1598 const char *smb_fn_name(int type)
1599 {
1600         const char *unknown_name = "SMBunknown";
1601
1602         if (smb_messages[type].name == NULL)
1603                 return(unknown_name);
1604
1605         return(smb_messages[type].name);
1606 }
1607
1608 /****************************************************************************
1609  Helper functions for contruct_reply.
1610 ****************************************************************************/
1611
1612 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1613
1614 void add_to_common_flags2(uint32 v)
1615 {
1616         common_flags2 |= v;
1617 }
1618
1619 void remove_from_common_flags2(uint32 v)
1620 {
1621         common_flags2 &= ~v;
1622 }
1623
1624 void construct_reply_common(const char *inbuf, char *outbuf)
1625 {
1626         srv_set_message(outbuf,0,0,false);
1627
1628         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1629         SIVAL(outbuf,smb_rcls,0);
1630         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1631         SSVAL(outbuf,smb_flg2,
1632                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1633                 common_flags2);
1634         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1635
1636         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1637         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1638         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1639         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1640 }
1641
1642 /****************************************************************************
1643  Construct a chained reply and add it to the already made reply
1644 ****************************************************************************/
1645
1646 void chain_reply(struct smb_request *req)
1647 {
1648         static char *orig_inbuf;
1649
1650         /*
1651          * Dirty little const_discard: We mess with req->inbuf, which is
1652          * declared as const. If maybe at some point this routine gets
1653          * rewritten, this const_discard could go away.
1654          */
1655         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1656         int size = smb_len(req->inbuf)+4;
1657
1658         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1659         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1660         char *inbuf2;
1661         int outsize2;
1662         int new_size;
1663         char inbuf_saved[smb_wct];
1664         char *outbuf = (char *)req->outbuf;
1665         size_t outsize = smb_len(outbuf) + 4;
1666         size_t outsize_padded;
1667         size_t ofs, to_move;
1668
1669         struct smb_request *req2;
1670         size_t caller_outputlen;
1671         char *caller_output;
1672
1673         /* Maybe its not chained, or it's an error packet. */
1674         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1675                 SCVAL(outbuf,smb_vwv0,0xFF);
1676                 return;
1677         }
1678
1679         if (chain_size == 0) {
1680                 /* this is the first part of the chain */
1681                 orig_inbuf = inbuf;
1682         }
1683
1684         /*
1685          * We need to save the output the caller added to the chain so that we
1686          * can splice it into the final output buffer later.
1687          */
1688
1689         caller_outputlen = outsize - smb_wct;
1690
1691         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1692
1693         if (caller_output == NULL) {
1694                 /* TODO: NT_STATUS_NO_MEMORY */
1695                 smb_panic("could not dup outbuf");
1696         }
1697
1698         /*
1699          * The original Win95 redirector dies on a reply to
1700          * a lockingX and read chain unless the chain reply is
1701          * 4 byte aligned. JRA.
1702          */
1703
1704         outsize_padded = (outsize + 3) & ~3;
1705
1706         /*
1707          * remember how much the caller added to the chain, only counting
1708          * stuff after the parameter words
1709          */
1710         chain_size += outsize_padded - smb_wct;
1711
1712         /*
1713          * work out pointers into the original packets. The
1714          * headers on these need to be filled in
1715          */
1716         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1717
1718         /* remember the original command type */
1719         smb_com1 = CVAL(orig_inbuf,smb_com);
1720
1721         /* save the data which will be overwritten by the new headers */
1722         memcpy(inbuf_saved,inbuf2,smb_wct);
1723
1724         /* give the new packet the same header as the last part of the SMB */
1725         memmove(inbuf2,inbuf,smb_wct);
1726
1727         /* create the in buffer */
1728         SCVAL(inbuf2,smb_com,smb_com2);
1729
1730         /* work out the new size for the in buffer. */
1731         new_size = size - (inbuf2 - inbuf);
1732         if (new_size < 0) {
1733                 DEBUG(0,("chain_reply: chain packet size incorrect "
1734                          "(orig size = %d, offset = %d)\n",
1735                          size, (int)(inbuf2 - inbuf) ));
1736                 exit_server_cleanly("Bad chained packet");
1737                 return;
1738         }
1739
1740         /* And set it in the header. */
1741         smb_setlen(inbuf2, new_size - 4);
1742
1743         DEBUG(3,("Chained message\n"));
1744         show_msg(inbuf2);
1745
1746         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1747                 smb_panic("could not allocate smb_request");
1748         }
1749         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1750
1751         /* process the request */
1752         switch_message(smb_com2, req2, new_size);
1753
1754         /*
1755          * We don't accept deferred operations in chained requests.
1756          */
1757         SMB_ASSERT(req2->outbuf != NULL);
1758         outsize2 = smb_len(req2->outbuf)+4;
1759
1760         /*
1761          * Move away the new command output so that caller_output fits in,
1762          * copy in the caller_output saved above.
1763          */
1764
1765         SMB_ASSERT(outsize_padded >= smb_wct);
1766
1767         /*
1768          * "ofs" is the space we need for caller_output. Equal to
1769          * caller_outputlen plus the padding.
1770          */
1771
1772         ofs = outsize_padded - smb_wct;
1773
1774         /*
1775          * "to_move" is the amount of bytes the secondary routine gave us
1776          */
1777
1778         to_move = outsize2 - smb_wct;
1779
1780         if (to_move + ofs + smb_wct + chain_size > max_send) {
1781                 smb_panic("replies too large -- would have to cut");
1782         }
1783
1784         /*
1785          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1786          * the first request in the chain. So we have to re-allocate it. In
1787          * the "old" API the only outbuf ever used is the global OutBuffer
1788          * which is always large enough.
1789          */
1790
1791         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1792                                       to_move + ofs + smb_wct);
1793         if (outbuf == NULL) {
1794                 smb_panic("could not realloc outbuf");
1795         }
1796
1797         req->outbuf = (uint8 *)outbuf;
1798
1799         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1800         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1801
1802         /*
1803          * copy the new reply header over the old one but preserve the smb_com
1804          * field
1805          */
1806         memmove(outbuf, req2->outbuf, smb_wct);
1807         SCVAL(outbuf, smb_com, smb_com1);
1808
1809         /*
1810          * We've just copied in the whole "wct" area from the secondary
1811          * function. Fix up the chaining: com2 and the offset need to be
1812          * readjusted.
1813          */
1814
1815         SCVAL(outbuf, smb_vwv0, smb_com2);
1816         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1817
1818         if (outsize_padded > outsize) {
1819
1820                 /*
1821                  * Due to padding we have some uninitialized bytes after the
1822                  * caller's output
1823                  */
1824
1825                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1826         }
1827
1828         smb_setlen(outbuf, outsize2 + chain_size - 4);
1829
1830         /*
1831          * restore the saved data, being careful not to overwrite any data
1832          * from the reply header
1833          */
1834         memcpy(inbuf2,inbuf_saved,smb_wct);
1835
1836         SAFE_FREE(caller_output);
1837         TALLOC_FREE(req2);
1838
1839         return;
1840 }
1841
1842 /****************************************************************************
1843  Setup the needed select timeout in milliseconds.
1844 ****************************************************************************/
1845
1846 static int setup_select_timeout(void)
1847 {
1848         int select_timeout;
1849
1850         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1851
1852         if (print_notify_messages_pending()) {
1853                 select_timeout = MIN(select_timeout, 1000);
1854         }
1855
1856         return select_timeout;
1857 }
1858
1859 /****************************************************************************
1860  Check if services need reloading.
1861 ****************************************************************************/
1862
1863 void check_reload(time_t t)
1864 {
1865         static pid_t mypid = 0;
1866         static time_t last_smb_conf_reload_time = 0;
1867         static time_t last_printer_reload_time = 0;
1868         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1869
1870         if(last_smb_conf_reload_time == 0) {
1871                 last_smb_conf_reload_time = t;
1872                 /* Our printing subsystem might not be ready at smbd start up.
1873                    Then no printer is available till the first printers check
1874                    is performed.  A lower initial interval circumvents this. */
1875                 if ( printcap_cache_time > 60 )
1876                         last_printer_reload_time = t - printcap_cache_time + 60;
1877                 else
1878                         last_printer_reload_time = t;
1879         }
1880
1881         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1882                 /* randomize over 60 second the printcap reload to avoid all
1883                  * process hitting cupsd at the same time */
1884                 int time_range = 60;
1885
1886                 last_printer_reload_time += random() % time_range;
1887                 mypid = getpid();
1888         }
1889
1890         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1891                 reload_services(True);
1892                 reload_after_sighup = False;
1893                 last_smb_conf_reload_time = t;
1894         }
1895
1896         /* 'printcap cache time = 0' disable the feature */
1897
1898         if ( printcap_cache_time != 0 )
1899         {
1900                 /* see if it's time to reload or if the clock has been set back */
1901
1902                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1903                         || (t-last_printer_reload_time  < 0) )
1904                 {
1905                         DEBUG( 3,( "Printcap cache time expired.\n"));
1906                         reload_printers();
1907                         last_printer_reload_time = t;
1908                 }
1909         }
1910 }
1911
1912 /****************************************************************************
1913  Process any timeout housekeeping. Return False if the caller should exit.
1914 ****************************************************************************/
1915
1916 static bool timeout_processing(int *select_timeout,
1917                                time_t *last_timeout_processing_time)
1918 {
1919         time_t t;
1920
1921         if (*get_srv_read_error() == SMB_READ_EOF) {
1922                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1923                 return false;
1924         }
1925
1926         if (*get_srv_read_error() == SMB_READ_ERROR) {
1927                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1928                         strerror(errno)));
1929                 return false;
1930         }
1931
1932         if (*get_srv_read_error() == SMB_READ_BAD_SIG) {
1933                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1934                 return false;
1935         }
1936
1937         *last_timeout_processing_time = t = time(NULL);
1938
1939         /* become root again if waiting */
1940         change_to_root_user();
1941
1942         /* check if we need to reload services */
1943         check_reload(t);
1944
1945         if(global_machine_password_needs_changing &&
1946                         /* for ADS we need to do a regular ADS password change, not a domain
1947                                         password change */
1948                         lp_security() == SEC_DOMAIN) {
1949
1950                 unsigned char trust_passwd_hash[16];
1951                 time_t lct;
1952
1953                 /*
1954                  * We're in domain level security, and the code that
1955                  * read the machine password flagged that the machine
1956                  * password needs changing.
1957                  */
1958
1959                 /*
1960                  * First, open the machine password file with an exclusive lock.
1961                  */
1962
1963                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1964                         DEBUG(0,("process: unable to lock the machine account password for \
1965 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1966                         return True;
1967                 }
1968
1969                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1970                         DEBUG(0,("process: unable to read the machine account password for \
1971 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1972                         secrets_lock_trust_account_password(lp_workgroup(), False);
1973                         return True;
1974                 }
1975
1976                 /*
1977                  * Make sure someone else hasn't already done this.
1978                  */
1979
1980                 if(t < lct + lp_machine_password_timeout()) {
1981                         global_machine_password_needs_changing = False;
1982                         secrets_lock_trust_account_password(lp_workgroup(), False);
1983                         return True;
1984                 }
1985
1986                 /* always just contact the PDC here */
1987
1988                 change_trust_account_password( lp_workgroup(), NULL);
1989                 global_machine_password_needs_changing = False;
1990                 secrets_lock_trust_account_password(lp_workgroup(), False);
1991         }
1992
1993         /* update printer queue caches if necessary */
1994
1995         update_monitored_printq_cache();
1996
1997         /*
1998          * Now we are root, check if the log files need pruning.
1999          * Force a log file check.
2000          */
2001         force_check_log_size();
2002         check_log_size();
2003
2004         /* Send any queued printer notify message to interested smbd's. */
2005
2006         print_notify_send_messages(smbd_messaging_context(), 0);
2007
2008         /*
2009          * Modify the select timeout depending upon
2010          * what we have remaining in our queues.
2011          */
2012
2013         *select_timeout = setup_select_timeout();
2014
2015         return True;
2016 }
2017
2018 /****************************************************************************
2019  Process commands from the client
2020 ****************************************************************************/
2021
2022 void smbd_process(void)
2023 {
2024         time_t last_timeout_processing_time = time(NULL);
2025         unsigned int num_smbs = 0;
2026         size_t unread_bytes = 0;
2027
2028         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2029
2030         while (True) {
2031                 int select_timeout = setup_select_timeout();
2032                 int num_echos;
2033                 char *inbuf;
2034                 size_t inbuf_len;
2035                 bool encrypted = false;
2036                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2037
2038                 errno = 0;
2039
2040                 /* Did someone ask for immediate checks on things like blocking locks ? */
2041                 if (select_timeout == 0) {
2042                         if(!timeout_processing(&select_timeout,
2043                                                &last_timeout_processing_time))
2044                                 return;
2045                         num_smbs = 0; /* Reset smb counter. */
2046                 }
2047
2048                 run_events(smbd_event_context(), 0, NULL, NULL);
2049
2050                 while (!receive_message_or_smb(talloc_tos(), &inbuf, &inbuf_len,
2051                                                 select_timeout,
2052                                                 &unread_bytes,
2053                                                 &encrypted)) {
2054                         if(!timeout_processing(&select_timeout,
2055                                                &last_timeout_processing_time))
2056                                 return;
2057                         num_smbs = 0; /* Reset smb counter. */
2058                 }
2059
2060
2061                 /*
2062                  * Ensure we do timeout processing if the SMB we just got was
2063                  * only an echo request. This allows us to set the select
2064                  * timeout in 'receive_message_or_smb()' to any value we like
2065                  * without worrying that the client will send echo requests
2066                  * faster than the select timeout, thus starving out the
2067                  * essential processing (change notify, blocking locks) that
2068                  * the timeout code does. JRA.
2069                  */
2070                 num_echos = smb_echo_count;
2071
2072                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2073
2074                 TALLOC_FREE(inbuf);
2075
2076                 if (smb_echo_count != num_echos) {
2077                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
2078                                 return;
2079                         num_smbs = 0; /* Reset smb counter. */
2080                 }
2081
2082                 num_smbs++;
2083
2084                 /*
2085                  * If we are getting smb requests in a constant stream
2086                  * with no echos, make sure we attempt timeout processing
2087                  * every select_timeout milliseconds - but only check for this
2088                  * every 200 smb requests.
2089                  */
2090
2091                 if ((num_smbs % 200) == 0) {
2092                         time_t new_check_time = time(NULL);
2093                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2094                                 if(!timeout_processing(
2095                                            &select_timeout,
2096                                            &last_timeout_processing_time))
2097                                         return;
2098                                 num_smbs = 0; /* Reset smb counter. */
2099                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2100                         }
2101                 }
2102
2103                 /* The timeout_processing function isn't run nearly
2104                    often enough to implement 'max log size' without
2105                    overrunning the size of the file by many megabytes.
2106                    This is especially true if we are running at debug
2107                    level 10.  Checking every 50 SMBs is a nice
2108                    tradeoff of performance vs log file size overrun. */
2109
2110                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2111                         change_to_root_user();
2112                         check_log_size();
2113                 }
2114                 TALLOC_FREE(frame);
2115         }
2116 }