source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "lib/messages_ctdb.h"
  36 #include "smbprofile.h"
  37 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  38 #include "libsmb/libsmb.h"
  39 #include "../lib/util/tevent_ntstatus.h"
  40 #include "../libcli/security/dom_sid.h"
  41 #include "../libcli/security/security_token.h"
  42 #include "lib/id_cache.h"
  43 #include "lib/util/sys_rw_data.h"
  44 #include "serverid.h"
  45 #include "system/threads.h"
  46
  47 /* Internal message queue for deferred opens. */
  48 struct pending_message_list {
  49         struct pending_message_list *next, *prev;
  50         struct timeval request_time; /* When was this first issued? */
  51         struct smbd_server_connection *sconn;
  52         struct smbXsrv_connection *xconn;
  53         struct tevent_timer *te;
  54         struct smb_perfcount_data pcd;
  55         uint32_t seqnum;
  56         bool encrypted;
  57         bool processed;
  58         DATA_BLOB buf;
  59         struct deferred_open_record *open_rec;
  60 };
  61
  62 static void construct_reply_common(uint8_t cmd, const uint8_t *inbuf,
  63                                    char *outbuf);
  64 static struct pending_message_list *get_deferred_open_message_smb(
  65         struct smbd_server_connection *sconn, uint64_t mid);
  66 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  67
  68 static void smbd_echo_init(struct smbXsrv_connection *xconn)
  69 {
  70         xconn->smb1.echo_handler.trusted_fd = -1;
  71         xconn->smb1.echo_handler.socket_lock_fd = -1;
  72 #ifdef HAVE_ROBUST_MUTEXES
  73         xconn->smb1.echo_handler.socket_mutex = NULL;
  74 #endif
  75 }
  76
  77 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
  78 {
  79         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
  80                 return true;
  81         }
  82
  83 #ifdef HAVE_ROBUST_MUTEXES
  84         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
  85                 return true;
  86         }
  87 #endif
  88
  89         return false;
  90 }
  91
  92 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
  93 {
  94         if (!smbd_echo_active(xconn)) {
  95                 return true;
  96         }
  97
  98         xconn->smb1.echo_handler.ref_count++;
  99
 100         if (xconn->smb1.echo_handler.ref_count > 1) {
 101                 return true;
 102         }
 103
 104         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 105
 106 #ifdef HAVE_ROBUST_MUTEXES
 107         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 108                 int ret = EINTR;
 109
 110                 while (ret == EINTR) {
 111                         ret = pthread_mutex_lock(
 112                                 xconn->smb1.echo_handler.socket_mutex);
 113                         if (ret == 0) {
 114                                 break;
 115                         }
 116                 }
 117                 if (ret != 0) {
 118                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 119                                   strerror(ret)));
 120                         return false;
 121                 }
 122         }
 123 #endif
 124
 125         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 126                 bool ok;
 127
 128                 do {
 129                         ok = fcntl_lock(
 130                                 xconn->smb1.echo_handler.socket_lock_fd,
 131                                 F_SETLKW, 0, 0, F_WRLCK);
 132                 } while (!ok && (errno == EINTR));
 133
 134                 if (!ok) {
 135                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 136                         return false;
 137                 }
 138         }
 139
 140         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 141
 142         return true;
 143 }
 144
 145 void smbd_lock_socket(struct smbXsrv_connection *xconn)
 146 {
 147         if (!smbd_lock_socket_internal(xconn)) {
 148                 exit_server_cleanly("failed to lock socket");
 149         }
 150 }
 151
 152 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
 153 {
 154         if (!smbd_echo_active(xconn)) {
 155                 return true;
 156         }
 157
 158         xconn->smb1.echo_handler.ref_count--;
 159
 160         if (xconn->smb1.echo_handler.ref_count > 0) {
 161                 return true;
 162         }
 163
 164 #ifdef HAVE_ROBUST_MUTEXES
 165         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 166                 int ret = EINTR;
 167
 168                 while (ret == EINTR) {
 169                         ret = pthread_mutex_unlock(
 170                                 xconn->smb1.echo_handler.socket_mutex);
 171                         if (ret == 0) {
 172                                 break;
 173                         }
 174                 }
 175                 if (ret != 0) {
 176                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 177                                   strerror(ret)));
 178                         return false;
 179                 }
 180         }
 181 #endif
 182
 183         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 184                 bool ok;
 185
 186                 do {
 187                         ok = fcntl_lock(
 188                                 xconn->smb1.echo_handler.socket_lock_fd,
 189                                 F_SETLKW, 0, 0, F_UNLCK);
 190                 } while (!ok && (errno == EINTR));
 191
 192                 if (!ok) {
 193                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 194                         return false;
 195                 }
 196         }
 197
 198         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 199
 200         return true;
 201 }
 202
 203 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
 204 {
 205         if (!smbd_unlock_socket_internal(xconn)) {
 206                 exit_server_cleanly("failed to unlock socket");
 207         }
 208 }
 209
 210 /* Accessor function for smb_read_error for smbd functions. */
 211
 212 /****************************************************************************
 213  Send an smb to a fd.
 214 ****************************************************************************/
 215
 216 bool srv_send_smb(struct smbXsrv_connection *xconn, char *buffer,
 217                   bool do_signing, uint32_t seqnum,
 218                   bool do_encrypt,
 219                   struct smb_perfcount_data *pcd)
 220 {
 221         size_t len = 0;
 222         ssize_t ret;
 223         char *buf_out = buffer;
 224
 225         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 226                 /*
 227                  * we're not supposed to do any io
 228                  */
 229                 return true;
 230         }
 231
 232         smbd_lock_socket(xconn);
 233
 234         if (do_signing) {
 235                 /* Sign the outgoing packet if required. */
 236                 srv_calculate_sign_mac(xconn, buf_out, seqnum);
 237         }
 238
 239         if (do_encrypt) {
 240                 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
 241                 if (!NT_STATUS_IS_OK(status)) {
 242                         DEBUG(0, ("send_smb: SMB encryption failed "
 243                                 "on outgoing packet! Error %s\n",
 244                                 nt_errstr(status) ));
 245                         ret = -1;
 246                         goto out;
 247                 }
 248         }
 249
 250         len = smb_len_large(buf_out) + 4;
 251
 252         ret = write_data(xconn->transport.sock, buf_out, len);
 253         if (ret <= 0) {
 254                 int saved_errno = errno;
 255                 /*
 256                  * Try and give an error message saying what
 257                  * client failed.
 258                  */
 259                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 260                          (int)getpid(), (int)len,
 261                          smbXsrv_connection_dbg(xconn),
 262                          (int)ret, strerror(saved_errno)));
 263                 errno = saved_errno;
 264
 265                 srv_free_enc_buffer(xconn, buf_out);
 266                 goto out;
 267         }
 268
 269         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 270         srv_free_enc_buffer(xconn, buf_out);
 271 out:
 272         SMB_PERFCOUNT_END(pcd);
 273
 274         smbd_unlock_socket(xconn);
 275         return (ret > 0);
 276 }
 277
 278 /*******************************************************************
 279  Setup the word count and byte count for a smb message.
 280 ********************************************************************/
 281
 282 int srv_set_message(char *buf,
 283                         int num_words,
 284                         int num_bytes,
 285                         bool zero)
 286 {
 287         if (zero && (num_words || num_bytes)) {
 288                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 289         }
 290         SCVAL(buf,smb_wct,num_words);
 291         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 292         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 293         return (smb_size + num_words*2 + num_bytes);
 294 }
 295
 296 static bool valid_smb_header(const uint8_t *inbuf)
 297 {
 298         if (is_encrypted_packet(inbuf)) {
 299                 return true;
 300         }
 301         /*
 302          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 303          * but it just looks weird to call strncmp for this one.
 304          */
 305         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 306 }
 307
 308 /* Socket functions for smbd packet processing. */
 309
 310 static bool valid_packet_size(size_t len)
 311 {
 312         /*
 313          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 314          * of header. Don't print the error if this fits.... JRA.
 315          */
 316
 317         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 318                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 319                                         (unsigned long)len));
 320                 return false;
 321         }
 322         return true;
 323 }
 324
 325 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 326                                       unsigned int timeout, ssize_t len)
 327 {
 328         NTSTATUS status;
 329
 330         if (len <= 0) {
 331                 return NT_STATUS_OK;
 332         }
 333
 334         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 335         if (!NT_STATUS_IS_OK(status)) {
 336                 char addr[INET6_ADDRSTRLEN];
 337                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 338                           "error = %s.\n",
 339                           get_peer_addr(fd, addr, sizeof(addr)),
 340                           nt_errstr(status)));
 341         }
 342         return status;
 343 }
 344
 345 /****************************************************************************
 346  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 347 ****************************************************************************/
 348
 349 /*
 350  * Unfortunately, earlier versions of smbclient/libsmbclient
 351  * don't send this "standard" writeX header. I've fixed this
 352  * for 3.2 but we'll use the old method with earlier versions.
 353  * Windows and CIFSFS at least use this standard size. Not
 354  * sure about MacOSX.
 355  */
 356
 357 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 358                                 (2*14) + /* word count (including bcc) */ \
 359                                 1 /* pad byte */)
 360
 361 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 362                                                     const char lenbuf[4],
 363                                                     struct smbXsrv_connection *xconn,
 364                                                     int sock,
 365                                                     char **buffer,
 366                                                     unsigned int timeout,
 367                                                     size_t *p_unread,
 368                                                     size_t *len_ret)
 369 {
 370         /* Size of a WRITEX call (+4 byte len). */
 371         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 372         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 373         ssize_t toread;
 374         NTSTATUS status;
 375
 376         memcpy(writeX_header, lenbuf, 4);
 377
 378         status = read_fd_with_timeout(
 379                 sock, writeX_header + 4,
 380                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 381                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 382                 timeout, NULL);
 383
 384         if (!NT_STATUS_IS_OK(status)) {
 385                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 386                           "error = %s.\n",
 387                           smbXsrv_connection_dbg(xconn),
 388                           nt_errstr(status)));
 389                 return status;
 390         }
 391
 392         /*
 393          * Ok - now try and see if this is a possible
 394          * valid writeX call.
 395          */
 396
 397         if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
 398                 /*
 399                  * If the data offset is beyond what
 400                  * we've read, drain the extra bytes.
 401                  */
 402                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 403                 ssize_t newlen;
 404
 405                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 406                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 407                         if (drain_socket(sock, drain) != drain) {
 408                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 409                                         " failed to drain pending bytes");
 410                         }
 411                 } else {
 412                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 413                 }
 414
 415                 /* Spoof down the length and null out the bcc. */
 416                 set_message_bcc(writeX_header, 0);
 417                 newlen = smb_len(writeX_header);
 418
 419                 /* Copy the header we've written. */
 420
 421                 *buffer = (char *)talloc_memdup(mem_ctx,
 422                                 writeX_header,
 423                                 sizeof(writeX_header));
 424
 425                 if (*buffer == NULL) {
 426                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 427                                   (int)sizeof(writeX_header)));
 428                         return NT_STATUS_NO_MEMORY;
 429                 }
 430
 431                 /* Work out the remaining bytes. */
 432                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 433                 *len_ret = newlen + 4;
 434                 return NT_STATUS_OK;
 435         }
 436
 437         if (!valid_packet_size(len)) {
 438                 return NT_STATUS_INVALID_PARAMETER;
 439         }
 440
 441         /*
 442          * Not a valid writeX call. Just do the standard
 443          * talloc and return.
 444          */
 445
 446         *buffer = talloc_array(mem_ctx, char, len+4);
 447
 448         if (*buffer == NULL) {
 449                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 450                           (int)len+4));
 451                 return NT_STATUS_NO_MEMORY;
 452         }
 453
 454         /* Copy in what we already read. */
 455         memcpy(*buffer,
 456                 writeX_header,
 457                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 458         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 459
 460         if(toread > 0) {
 461                 status = read_packet_remainder(
 462                         sock,
 463                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 464                         timeout, toread);
 465
 466                 if (!NT_STATUS_IS_OK(status)) {
 467                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 468                                    nt_errstr(status)));
 469                         return status;
 470                 }
 471         }
 472
 473         *len_ret = len + 4;
 474         return NT_STATUS_OK;
 475 }
 476
 477 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 478                                        struct smbXsrv_connection *xconn,
 479                                        int sock,
 480                                        char **buffer, unsigned int timeout,
 481                                        size_t *p_unread, size_t *plen)
 482 {
 483         char lenbuf[4];
 484         size_t len;
 485         int min_recv_size = lp_min_receive_file_size();
 486         NTSTATUS status;
 487
 488         *p_unread = 0;
 489
 490         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 491                                                   &len);
 492         if (!NT_STATUS_IS_OK(status)) {
 493                 return status;
 494         }
 495
 496         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 497             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 498                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 499             !srv_is_signing_active(xconn) &&
 500             xconn->smb1.echo_handler.trusted_fde == NULL) {
 501
 502                 return receive_smb_raw_talloc_partial_read(
 503                         mem_ctx, lenbuf, xconn, sock, buffer, timeout,
 504                         p_unread, plen);
 505         }
 506
 507         if (!valid_packet_size(len)) {
 508                 return NT_STATUS_INVALID_PARAMETER;
 509         }
 510
 511         /*
 512          * The +4 here can't wrap, we've checked the length above already.
 513          */
 514
 515         *buffer = talloc_array(mem_ctx, char, len+4);
 516
 517         if (*buffer == NULL) {
 518                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 519                           (int)len+4));
 520                 return NT_STATUS_NO_MEMORY;
 521         }
 522
 523         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 524
 525         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 526         if (!NT_STATUS_IS_OK(status)) {
 527                 return status;
 528         }
 529
 530         *plen = len + 4;
 531         return NT_STATUS_OK;
 532 }
 533
 534 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 535                                    struct smbXsrv_connection *xconn,
 536                                    int sock,
 537                                    char **buffer, unsigned int timeout,
 538                                    size_t *p_unread, bool *p_encrypted,
 539                                    size_t *p_len,
 540                                    uint32_t *seqnum,
 541                                    bool trusted_channel)
 542 {
 543         size_t len = 0;
 544         NTSTATUS status;
 545
 546         *p_encrypted = false;
 547
 548         status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
 549                                         p_unread, &len);
 550         if (!NT_STATUS_IS_OK(status)) {
 551                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 552                       ("receive_smb_raw_talloc failed for client %s "
 553                        "read error = %s.\n",
 554                        smbXsrv_connection_dbg(xconn),
 555                        nt_errstr(status)) );
 556                 return status;
 557         }
 558
 559         if (is_encrypted_packet((uint8_t *)*buffer)) {
 560                 status = srv_decrypt_buffer(xconn, *buffer);
 561                 if (!NT_STATUS_IS_OK(status)) {
 562                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 563                                 "incoming packet! Error %s\n",
 564                                 nt_errstr(status) ));
 565                         return status;
 566                 }
 567                 *p_encrypted = true;
 568         }
 569
 570         /* Check the incoming SMB signature. */
 571         if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
 572                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 573                           "incoming packet!\n"));
 574                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 575         }
 576
 577         *p_len = len;
 578         return NT_STATUS_OK;
 579 }
 580
 581 /*
 582  * Initialize a struct smb_request from an inbuf
 583  */
 584
 585 static bool init_smb_request(struct smb_request *req,
 586                              struct smbd_server_connection *sconn,
 587                              struct smbXsrv_connection *xconn,
 588                              const uint8_t *inbuf,
 589                              size_t unread_bytes, bool encrypted,
 590                              uint32_t seqnum)
 591 {
 592         struct smbXsrv_tcon *tcon;
 593         NTSTATUS status;
 594         NTTIME now;
 595         size_t req_size = smb_len(inbuf) + 4;
 596
 597         /* Ensure we have at least smb_size bytes. */
 598         if (req_size < smb_size) {
 599                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 600                         (unsigned int)req_size ));
 601                 return false;
 602         }
 603
 604         req->request_time = timeval_current();
 605         now = timeval_to_nttime(&req->request_time);
 606
 607         req->cmd    = CVAL(inbuf, smb_com);
 608         req->flags2 = SVAL(inbuf, smb_flg2);
 609         req->smbpid = SVAL(inbuf, smb_pid);
 610         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 611         req->seqnum = seqnum;
 612         req->vuid   = SVAL(inbuf, smb_uid);
 613         req->tid    = SVAL(inbuf, smb_tid);
 614         req->wct    = CVAL(inbuf, smb_wct);
 615         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 616         req->buflen = smb_buflen(inbuf);
 617         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 618         req->unread_bytes = unread_bytes;
 619         req->encrypted = encrypted;
 620         req->sconn = sconn;
 621         req->xconn = xconn;
 622         req->conn = NULL;
 623         if (xconn != NULL) {
 624                 status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
 625                 if (NT_STATUS_IS_OK(status)) {
 626                         req->conn = tcon->compat;
 627                 }
 628         }
 629         req->chain_fsp = NULL;
 630         req->smb2req = NULL;
 631         req->priv_paths = NULL;
 632         req->chain = NULL;
 633         req->posix_pathnames = lp_posix_pathnames();
 634         smb_init_perfcount_data(&req->pcd);
 635
 636         /* Ensure we have at least wct words and 2 bytes of bcc. */
 637         if (smb_size + req->wct*2 > req_size) {
 638                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 639                         (unsigned int)req->wct,
 640                         (unsigned int)req_size));
 641                 return false;
 642         }
 643         /* Ensure bcc is correct. */
 644         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 645                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 646                         "(wct = %u, size %u)\n",
 647                         (unsigned int)req->buflen,
 648                         (unsigned int)req->wct,
 649                         (unsigned int)req_size));
 650                 return false;
 651         }
 652
 653         req->outbuf = NULL;
 654         return true;
 655 }
 656
 657 static void process_smb(struct smbXsrv_connection *xconn,
 658                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 659                         uint32_t seqnum, bool encrypted,
 660                         struct smb_perfcount_data *deferred_pcd);
 661
 662 static void smbd_deferred_open_timer(struct tevent_context *ev,
 663                                      struct tevent_timer *te,
 664                                      struct timeval _tval,
 665                                      void *private_data)
 666 {
 667         struct pending_message_list *msg = talloc_get_type(private_data,
 668                                            struct pending_message_list);
 669         struct smbd_server_connection *sconn = msg->sconn;
 670         struct smbXsrv_connection *xconn = msg->xconn;
 671         TALLOC_CTX *mem_ctx = talloc_tos();
 672         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 673         uint8_t *inbuf;
 674
 675         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 676                                          msg->buf.length);
 677         if (inbuf == NULL) {
 678                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 679                 return;
 680         }
 681
 682         /* We leave this message on the queue so the open code can
 683            know this is a retry. */
 684         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 685                 (unsigned long long)mid ));
 686
 687         /* Mark the message as processed so this is not
 688          * re-processed in error. */
 689         msg->processed = true;
 690
 691         process_smb(xconn, inbuf,
 692                     msg->buf.length, 0,
 693                     msg->seqnum, msg->encrypted, &msg->pcd);
 694
 695         /* If it's still there and was processed, remove it. */
 696         msg = get_deferred_open_message_smb(sconn, mid);
 697         if (msg && msg->processed) {
 698                 remove_deferred_open_message_smb(xconn, mid);
 699         }
 700 }
 701
 702 /****************************************************************************
 703  Function to push a message onto the tail of a linked list of smb messages ready
 704  for processing.
 705 ****************************************************************************/
 706
 707 static bool push_queued_message(struct smb_request *req,
 708                                 struct timeval request_time,
 709                                 struct timeval end_time,
 710                                 struct deferred_open_record *open_rec)
 711 {
 712         int msg_len = smb_len(req->inbuf) + 4;
 713         struct pending_message_list *msg;
 714
 715         msg = talloc_zero(NULL, struct pending_message_list);
 716
 717         if(msg == NULL) {
 718                 DEBUG(0,("push_message: malloc fail (1)\n"));
 719                 return False;
 720         }
 721         msg->sconn = req->sconn;
 722         msg->xconn = req->xconn;
 723
 724         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 725         if(msg->buf.data == NULL) {
 726                 DEBUG(0,("push_message: malloc fail (2)\n"));
 727                 TALLOC_FREE(msg);
 728                 return False;
 729         }
 730
 731         msg->request_time = request_time;
 732         msg->seqnum = req->seqnum;
 733         msg->encrypted = req->encrypted;
 734         msg->processed = false;
 735         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 736
 737         if (open_rec) {
 738                 msg->open_rec = talloc_move(msg, &open_rec);
 739         }
 740
 741 #if 0
 742         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 743                                    msg,
 744                                    end_time,
 745                                    smbd_deferred_open_timer,
 746                                    msg);
 747         if (!msg->te) {
 748                 DEBUG(0,("push_message: event_add_timed failed\n"));
 749                 TALLOC_FREE(msg);
 750                 return false;
 751         }
 752 #endif
 753
 754         DLIST_ADD_END(req->sconn->deferred_open_queue, msg);
 755
 756         DEBUG(10,("push_message: pushed message length %u on "
 757                   "deferred_open_queue\n", (unsigned int)msg_len));
 758
 759         return True;
 760 }
 761
 762 /****************************************************************************
 763  Function to delete a sharing violation open message by mid.
 764 ****************************************************************************/
 765
 766 void remove_deferred_open_message_smb(struct smbXsrv_connection *xconn,
 767                                       uint64_t mid)
 768 {
 769         struct smbd_server_connection *sconn = xconn->client->sconn;
 770         struct pending_message_list *pml;
 771
 772         if (sconn->using_smb2) {
 773                 remove_deferred_open_message_smb2(xconn, mid);
 774                 return;
 775         }
 776
 777         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 778                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 779                         DEBUG(10,("remove_deferred_open_message_smb: "
 780                                   "deleting mid %llu len %u\n",
 781                                   (unsigned long long)mid,
 782                                   (unsigned int)pml->buf.length ));
 783                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 784                         TALLOC_FREE(pml);
 785                         return;
 786                 }
 787         }
 788 }
 789
 790 /****************************************************************************
 791  Move a sharing violation open retry message to the front of the list and
 792  schedule it for immediate processing.
 793 ****************************************************************************/
 794
 795 bool schedule_deferred_open_message_smb(struct smbXsrv_connection *xconn,
 796                                         uint64_t mid)
 797 {
 798         struct smbd_server_connection *sconn = xconn->client->sconn;
 799         struct pending_message_list *pml;
 800         int i = 0;
 801
 802         if (sconn->using_smb2) {
 803                 return schedule_deferred_open_message_smb2(xconn, mid);
 804         }
 805
 806         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 807                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 808
 809                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 810                         "msg_mid = %llu\n",
 811                         i++,
 812                         (unsigned long long)msg_mid ));
 813
 814                 if (mid == msg_mid) {
 815                         struct tevent_timer *te;
 816
 817                         if (pml->processed) {
 818                                 /* A processed message should not be
 819                                  * rescheduled. */
 820                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 821                                         "message mid %llu was already processed\n",
 822                                         (unsigned long long)msg_mid ));
 823                                 continue;
 824                         }
 825
 826                         DEBUG(10,("schedule_deferred_open_message_smb: "
 827                                 "scheduling mid %llu\n",
 828                                 (unsigned long long)mid ));
 829
 830                         te = tevent_add_timer(pml->sconn->ev_ctx,
 831                                               pml,
 832                                               timeval_zero(),
 833                                               smbd_deferred_open_timer,
 834                                               pml);
 835                         if (!te) {
 836                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 837                                         "event_add_timed() failed, "
 838                                         "skipping mid %llu\n",
 839                                         (unsigned long long)msg_mid ));
 840                         }
 841
 842                         TALLOC_FREE(pml->te);
 843                         pml->te = te;
 844                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 845                         return true;
 846                 }
 847         }
 848
 849         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 850                 "find message mid %llu\n",
 851                 (unsigned long long)mid ));
 852
 853         return false;
 854 }
 855
 856 /****************************************************************************
 857  Return true if this mid is on the deferred queue and was not yet processed.
 858 ****************************************************************************/
 859
 860 bool open_was_deferred(struct smbXsrv_connection *xconn, uint64_t mid)
 861 {
 862         struct smbd_server_connection *sconn = xconn->client->sconn;
 863         struct pending_message_list *pml;
 864
 865         if (sconn->using_smb2) {
 866                 return open_was_deferred_smb2(xconn, mid);
 867         }
 868
 869         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 870                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 871                         return True;
 872                 }
 873         }
 874         return False;
 875 }
 876
 877 /****************************************************************************
 878  Return the message queued by this mid.
 879 ****************************************************************************/
 880
 881 static struct pending_message_list *get_deferred_open_message_smb(
 882         struct smbd_server_connection *sconn, uint64_t mid)
 883 {
 884         struct pending_message_list *pml;
 885
 886         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 887                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 888                         return pml;
 889                 }
 890         }
 891         return NULL;
 892 }
 893
 894 /****************************************************************************
 895  Get the state data queued by this mid.
 896 ****************************************************************************/
 897
 898 bool get_deferred_open_message_state(struct smb_request *smbreq,
 899                                 struct timeval *p_request_time,
 900                                 struct deferred_open_record **open_rec)
 901 {
 902         struct pending_message_list *pml;
 903
 904         if (smbreq->sconn->using_smb2) {
 905                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 906                                         p_request_time,
 907                                         open_rec);
 908         }
 909
 910         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 911         if (!pml) {
 912                 return false;
 913         }
 914         if (p_request_time) {
 915                 *p_request_time = pml->request_time;
 916         }
 917         if (open_rec != NULL) {
 918                 *open_rec = pml->open_rec;
 919         }
 920         return true;
 921 }
 922
 923 /****************************************************************************
 924  Function to push a deferred open smb message onto a linked list of local smb
 925  messages ready for processing.
 926 ****************************************************************************/
 927
 928 bool push_deferred_open_message_smb(struct smb_request *req,
 929                                struct timeval request_time,
 930                                struct timeval timeout,
 931                                struct file_id id,
 932                                struct deferred_open_record *open_rec)
 933 {
 934         struct timeval end_time;
 935
 936         if (req->smb2req) {
 937                 return push_deferred_open_message_smb2(req->smb2req,
 938                                                 request_time,
 939                                                 timeout,
 940                                                 id,
 941                                                 open_rec);
 942         }
 943
 944         if (req->unread_bytes) {
 945                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 946                         "unread_bytes = %u\n",
 947                         (unsigned int)req->unread_bytes ));
 948                 smb_panic("push_deferred_open_message_smb: "
 949                         "logic error unread_bytes != 0" );
 950         }
 951
 952         end_time = timeval_sum(&request_time, &timeout);
 953
 954         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 955                 "len %u mid %llu timeout time [%u.%06u]\n",
 956                 (unsigned int) smb_len(req->inbuf)+4,
 957                 (unsigned long long)req->mid,
 958                 (unsigned int)end_time.tv_sec,
 959                 (unsigned int)end_time.tv_usec));
 960
 961         return push_queued_message(req, request_time, end_time, open_rec);
 962 }
 963
 964 static void smbd_sig_term_handler(struct tevent_context *ev,
 965                                   struct tevent_signal *se,
 966                                   int signum,
 967                                   int count,
 968                                   void *siginfo,
 969                                   void *private_data)
 970 {
 971         exit_server_cleanly("termination signal");
 972 }
 973
 974 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 975 {
 976         struct tevent_signal *se;
 977
 978         se = tevent_add_signal(sconn->ev_ctx,
 979                                sconn,
 980                                SIGTERM, 0,
 981                                smbd_sig_term_handler,
 982                                sconn);
 983         if (!se) {
 984                 exit_server("failed to setup SIGTERM handler");
 985         }
 986 }
 987
 988 static void smbd_sig_hup_handler(struct tevent_context *ev,
 989                                   struct tevent_signal *se,
 990                                   int signum,
 991                                   int count,
 992                                   void *siginfo,
 993                                   void *private_data)
 994 {
 995         struct smbd_server_connection *sconn =
 996                 talloc_get_type_abort(private_data,
 997                 struct smbd_server_connection);
 998
 999         change_to_root_user();
1000         DEBUG(1,("Reloading services after SIGHUP\n"));
1001         reload_services(sconn, conn_snum_used, false);
1002 }
1003
1004 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1005 {
1006         struct tevent_signal *se;
1007
1008         se = tevent_add_signal(sconn->ev_ctx,
1009                                sconn,
1010                                SIGHUP, 0,
1011                                smbd_sig_hup_handler,
1012                                sconn);
1013         if (!se) {
1014                 exit_server("failed to setup SIGHUP handler");
1015         }
1016 }
1017
1018 static void smbd_conf_updated(struct messaging_context *msg,
1019                               void *private_data,
1020                               uint32_t msg_type,
1021                               struct server_id server_id,
1022                               DATA_BLOB *data)
1023 {
1024         struct smbd_server_connection *sconn =
1025                 talloc_get_type_abort(private_data,
1026                 struct smbd_server_connection);
1027
1028         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1029                   "updated. Reloading.\n"));
1030         change_to_root_user();
1031         reload_services(sconn, conn_snum_used, false);
1032 }
1033
1034 /*
1035  * Only allow 5 outstanding trans requests. We're allocating memory, so
1036  * prevent a DoS.
1037  */
1038
1039 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1040 {
1041         int count = 0;
1042         for (; list != NULL; list = list->next) {
1043
1044                 if (list->mid == mid) {
1045                         return NT_STATUS_INVALID_PARAMETER;
1046                 }
1047
1048                 count += 1;
1049         }
1050         if (count > 5) {
1051                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1052         }
1053
1054         return NT_STATUS_OK;
1055 }
1056
1057 /*
1058 These flags determine some of the permissions required to do an operation
1059
1060 Note that I don't set NEED_WRITE on some write operations because they
1061 are used by some brain-dead clients when printing, and I don't want to
1062 force write permissions on print services.
1063 */
1064 #define AS_USER (1<<0)
1065 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1066 #define TIME_INIT (1<<2)
1067 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1068 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1069 #define DO_CHDIR (1<<6)
1070
1071 /*
1072    define a list of possible SMB messages and their corresponding
1073    functions. Any message that has a NULL function is unimplemented -
1074    please feel free to contribute implementations!
1075 */
1076 static const struct smb_message_struct {
1077         const char *name;
1078         void (*fn)(struct smb_request *req);
1079         int flags;
1080 } smb_messages[256] = {
1081
1082 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1083 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1084 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1085 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1086 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1087 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1088 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1089 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1090 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1091 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1092 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1093 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1094 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1095 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1096 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1097 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1098 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1099 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1100 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1101 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1102 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1103 /* 0x15 */ { NULL, NULL, 0 },
1104 /* 0x16 */ { NULL, NULL, 0 },
1105 /* 0x17 */ { NULL, NULL, 0 },
1106 /* 0x18 */ { NULL, NULL, 0 },
1107 /* 0x19 */ { NULL, NULL, 0 },
1108 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1109 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1110 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1111 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1112 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1113 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1114 /* 0x20 */ { "SMBwritec", NULL,0},
1115 /* 0x21 */ { NULL, NULL, 0 },
1116 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1117 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1118 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1119 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1120 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1121 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1122 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1123 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1124 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1125 /* 0x2b */ { "SMBecho",reply_echo,0},
1126 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1127 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1128 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1129 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1130 /* 0x30 */ { NULL, NULL, 0 },
1131 /* 0x31 */ { NULL, NULL, 0 },
1132 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1133 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1134 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1135 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1136 /* 0x36 */ { NULL, NULL, 0 },
1137 /* 0x37 */ { NULL, NULL, 0 },
1138 /* 0x38 */ { NULL, NULL, 0 },
1139 /* 0x39 */ { NULL, NULL, 0 },
1140 /* 0x3a */ { NULL, NULL, 0 },
1141 /* 0x3b */ { NULL, NULL, 0 },
1142 /* 0x3c */ { NULL, NULL, 0 },
1143 /* 0x3d */ { NULL, NULL, 0 },
1144 /* 0x3e */ { NULL, NULL, 0 },
1145 /* 0x3f */ { NULL, NULL, 0 },
1146 /* 0x40 */ { NULL, NULL, 0 },
1147 /* 0x41 */ { NULL, NULL, 0 },
1148 /* 0x42 */ { NULL, NULL, 0 },
1149 /* 0x43 */ { NULL, NULL, 0 },
1150 /* 0x44 */ { NULL, NULL, 0 },
1151 /* 0x45 */ { NULL, NULL, 0 },
1152 /* 0x46 */ { NULL, NULL, 0 },
1153 /* 0x47 */ { NULL, NULL, 0 },
1154 /* 0x48 */ { NULL, NULL, 0 },
1155 /* 0x49 */ { NULL, NULL, 0 },
1156 /* 0x4a */ { NULL, NULL, 0 },
1157 /* 0x4b */ { NULL, NULL, 0 },
1158 /* 0x4c */ { NULL, NULL, 0 },
1159 /* 0x4d */ { NULL, NULL, 0 },
1160 /* 0x4e */ { NULL, NULL, 0 },
1161 /* 0x4f */ { NULL, NULL, 0 },
1162 /* 0x50 */ { NULL, NULL, 0 },
1163 /* 0x51 */ { NULL, NULL, 0 },
1164 /* 0x52 */ { NULL, NULL, 0 },
1165 /* 0x53 */ { NULL, NULL, 0 },
1166 /* 0x54 */ { NULL, NULL, 0 },
1167 /* 0x55 */ { NULL, NULL, 0 },
1168 /* 0x56 */ { NULL, NULL, 0 },
1169 /* 0x57 */ { NULL, NULL, 0 },
1170 /* 0x58 */ { NULL, NULL, 0 },
1171 /* 0x59 */ { NULL, NULL, 0 },
1172 /* 0x5a */ { NULL, NULL, 0 },
1173 /* 0x5b */ { NULL, NULL, 0 },
1174 /* 0x5c */ { NULL, NULL, 0 },
1175 /* 0x5d */ { NULL, NULL, 0 },
1176 /* 0x5e */ { NULL, NULL, 0 },
1177 /* 0x5f */ { NULL, NULL, 0 },
1178 /* 0x60 */ { NULL, NULL, 0 },
1179 /* 0x61 */ { NULL, NULL, 0 },
1180 /* 0x62 */ { NULL, NULL, 0 },
1181 /* 0x63 */ { NULL, NULL, 0 },
1182 /* 0x64 */ { NULL, NULL, 0 },
1183 /* 0x65 */ { NULL, NULL, 0 },
1184 /* 0x66 */ { NULL, NULL, 0 },
1185 /* 0x67 */ { NULL, NULL, 0 },
1186 /* 0x68 */ { NULL, NULL, 0 },
1187 /* 0x69 */ { NULL, NULL, 0 },
1188 /* 0x6a */ { NULL, NULL, 0 },
1189 /* 0x6b */ { NULL, NULL, 0 },
1190 /* 0x6c */ { NULL, NULL, 0 },
1191 /* 0x6d */ { NULL, NULL, 0 },
1192 /* 0x6e */ { NULL, NULL, 0 },
1193 /* 0x6f */ { NULL, NULL, 0 },
1194 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1195 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1196 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1197 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1198 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1199 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1200 /* 0x76 */ { NULL, NULL, 0 },
1201 /* 0x77 */ { NULL, NULL, 0 },
1202 /* 0x78 */ { NULL, NULL, 0 },
1203 /* 0x79 */ { NULL, NULL, 0 },
1204 /* 0x7a */ { NULL, NULL, 0 },
1205 /* 0x7b */ { NULL, NULL, 0 },
1206 /* 0x7c */ { NULL, NULL, 0 },
1207 /* 0x7d */ { NULL, NULL, 0 },
1208 /* 0x7e */ { NULL, NULL, 0 },
1209 /* 0x7f */ { NULL, NULL, 0 },
1210 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1211 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1212 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1213 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1214 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1215 /* 0x85 */ { NULL, NULL, 0 },
1216 /* 0x86 */ { NULL, NULL, 0 },
1217 /* 0x87 */ { NULL, NULL, 0 },
1218 /* 0x88 */ { NULL, NULL, 0 },
1219 /* 0x89 */ { NULL, NULL, 0 },
1220 /* 0x8a */ { NULL, NULL, 0 },
1221 /* 0x8b */ { NULL, NULL, 0 },
1222 /* 0x8c */ { NULL, NULL, 0 },
1223 /* 0x8d */ { NULL, NULL, 0 },
1224 /* 0x8e */ { NULL, NULL, 0 },
1225 /* 0x8f */ { NULL, NULL, 0 },
1226 /* 0x90 */ { NULL, NULL, 0 },
1227 /* 0x91 */ { NULL, NULL, 0 },
1228 /* 0x92 */ { NULL, NULL, 0 },
1229 /* 0x93 */ { NULL, NULL, 0 },
1230 /* 0x94 */ { NULL, NULL, 0 },
1231 /* 0x95 */ { NULL, NULL, 0 },
1232 /* 0x96 */ { NULL, NULL, 0 },
1233 /* 0x97 */ { NULL, NULL, 0 },
1234 /* 0x98 */ { NULL, NULL, 0 },
1235 /* 0x99 */ { NULL, NULL, 0 },
1236 /* 0x9a */ { NULL, NULL, 0 },
1237 /* 0x9b */ { NULL, NULL, 0 },
1238 /* 0x9c */ { NULL, NULL, 0 },
1239 /* 0x9d */ { NULL, NULL, 0 },
1240 /* 0x9e */ { NULL, NULL, 0 },
1241 /* 0x9f */ { NULL, NULL, 0 },
1242 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1243 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1244 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1245 /* 0xa3 */ { NULL, NULL, 0 },
1246 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1247 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1248 /* 0xa6 */ { NULL, NULL, 0 },
1249 /* 0xa7 */ { NULL, NULL, 0 },
1250 /* 0xa8 */ { NULL, NULL, 0 },
1251 /* 0xa9 */ { NULL, NULL, 0 },
1252 /* 0xaa */ { NULL, NULL, 0 },
1253 /* 0xab */ { NULL, NULL, 0 },
1254 /* 0xac */ { NULL, NULL, 0 },
1255 /* 0xad */ { NULL, NULL, 0 },
1256 /* 0xae */ { NULL, NULL, 0 },
1257 /* 0xaf */ { NULL, NULL, 0 },
1258 /* 0xb0 */ { NULL, NULL, 0 },
1259 /* 0xb1 */ { NULL, NULL, 0 },
1260 /* 0xb2 */ { NULL, NULL, 0 },
1261 /* 0xb3 */ { NULL, NULL, 0 },
1262 /* 0xb4 */ { NULL, NULL, 0 },
1263 /* 0xb5 */ { NULL, NULL, 0 },
1264 /* 0xb6 */ { NULL, NULL, 0 },
1265 /* 0xb7 */ { NULL, NULL, 0 },
1266 /* 0xb8 */ { NULL, NULL, 0 },
1267 /* 0xb9 */ { NULL, NULL, 0 },
1268 /* 0xba */ { NULL, NULL, 0 },
1269 /* 0xbb */ { NULL, NULL, 0 },
1270 /* 0xbc */ { NULL, NULL, 0 },
1271 /* 0xbd */ { NULL, NULL, 0 },
1272 /* 0xbe */ { NULL, NULL, 0 },
1273 /* 0xbf */ { NULL, NULL, 0 },
1274 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1275 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1276 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1277 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1278 /* 0xc4 */ { NULL, NULL, 0 },
1279 /* 0xc5 */ { NULL, NULL, 0 },
1280 /* 0xc6 */ { NULL, NULL, 0 },
1281 /* 0xc7 */ { NULL, NULL, 0 },
1282 /* 0xc8 */ { NULL, NULL, 0 },
1283 /* 0xc9 */ { NULL, NULL, 0 },
1284 /* 0xca */ { NULL, NULL, 0 },
1285 /* 0xcb */ { NULL, NULL, 0 },
1286 /* 0xcc */ { NULL, NULL, 0 },
1287 /* 0xcd */ { NULL, NULL, 0 },
1288 /* 0xce */ { NULL, NULL, 0 },
1289 /* 0xcf */ { NULL, NULL, 0 },
1290 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1291 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1292 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1293 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1294 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1295 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1296 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1297 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1298 /* 0xd8 */ { NULL, NULL, 0 },
1299 /* 0xd9 */ { NULL, NULL, 0 },
1300 /* 0xda */ { NULL, NULL, 0 },
1301 /* 0xdb */ { NULL, NULL, 0 },
1302 /* 0xdc */ { NULL, NULL, 0 },
1303 /* 0xdd */ { NULL, NULL, 0 },
1304 /* 0xde */ { NULL, NULL, 0 },
1305 /* 0xdf */ { NULL, NULL, 0 },
1306 /* 0xe0 */ { NULL, NULL, 0 },
1307 /* 0xe1 */ { NULL, NULL, 0 },
1308 /* 0xe2 */ { NULL, NULL, 0 },
1309 /* 0xe3 */ { NULL, NULL, 0 },
1310 /* 0xe4 */ { NULL, NULL, 0 },
1311 /* 0xe5 */ { NULL, NULL, 0 },
1312 /* 0xe6 */ { NULL, NULL, 0 },
1313 /* 0xe7 */ { NULL, NULL, 0 },
1314 /* 0xe8 */ { NULL, NULL, 0 },
1315 /* 0xe9 */ { NULL, NULL, 0 },
1316 /* 0xea */ { NULL, NULL, 0 },
1317 /* 0xeb */ { NULL, NULL, 0 },
1318 /* 0xec */ { NULL, NULL, 0 },
1319 /* 0xed */ { NULL, NULL, 0 },
1320 /* 0xee */ { NULL, NULL, 0 },
1321 /* 0xef */ { NULL, NULL, 0 },
1322 /* 0xf0 */ { NULL, NULL, 0 },
1323 /* 0xf1 */ { NULL, NULL, 0 },
1324 /* 0xf2 */ { NULL, NULL, 0 },
1325 /* 0xf3 */ { NULL, NULL, 0 },
1326 /* 0xf4 */ { NULL, NULL, 0 },
1327 /* 0xf5 */ { NULL, NULL, 0 },
1328 /* 0xf6 */ { NULL, NULL, 0 },
1329 /* 0xf7 */ { NULL, NULL, 0 },
1330 /* 0xf8 */ { NULL, NULL, 0 },
1331 /* 0xf9 */ { NULL, NULL, 0 },
1332 /* 0xfa */ { NULL, NULL, 0 },
1333 /* 0xfb */ { NULL, NULL, 0 },
1334 /* 0xfc */ { NULL, NULL, 0 },
1335 /* 0xfd */ { NULL, NULL, 0 },
1336 /* 0xfe */ { NULL, NULL, 0 },
1337 /* 0xff */ { NULL, NULL, 0 }
1338
1339 };
1340
1341 /*******************************************************************
1342  allocate and initialize a reply packet
1343 ********************************************************************/
1344
1345 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1346                           const uint8_t *inbuf, char **outbuf,
1347                           uint8_t num_words, uint32_t num_bytes)
1348 {
1349         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1350
1351         /*
1352          * Protect against integer wrap.
1353          * The SMB layer reply can be up to 0xFFFFFF bytes.
1354          */
1355         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1356                 char *msg;
1357                 if (asprintf(&msg, "num_bytes too large: %u",
1358                              (unsigned)num_bytes) == -1) {
1359                         msg = discard_const_p(char, "num_bytes too large");
1360                 }
1361                 smb_panic(msg);
1362         }
1363
1364         /*
1365          * Here we include the NBT header for now.
1366          */
1367         *outbuf = talloc_array(mem_ctx, char,
1368                                NBT_HDR_SIZE + smb_len);
1369         if (*outbuf == NULL) {
1370                 return false;
1371         }
1372
1373         construct_reply_common(req->cmd, inbuf, *outbuf);
1374         srv_set_message(*outbuf, num_words, num_bytes, false);
1375         /*
1376          * Zero out the word area, the caller has to take care of the bcc area
1377          * himself
1378          */
1379         if (num_words != 0) {
1380                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1381         }
1382
1383         return true;
1384 }
1385
1386 void reply_outbuf(struct smb_request *req, uint8_t num_words, uint32_t num_bytes)
1387 {
1388         char *outbuf;
1389         if (!create_outbuf(req, req, req->inbuf, &outbuf, num_words,
1390                            num_bytes)) {
1391                 smb_panic("could not allocate output buffer\n");
1392         }
1393         req->outbuf = (uint8_t *)outbuf;
1394 }
1395
1396
1397 /*******************************************************************
1398  Dump a packet to a file.
1399 ********************************************************************/
1400
1401 static void smb_dump(const char *name, int type, const char *data)
1402 {
1403         size_t len;
1404         int fd, i;
1405         char *fname = NULL;
1406         if (DEBUGLEVEL < 50) {
1407                 return;
1408         }
1409
1410         len = smb_len_tcp(data)+4;
1411         for (i=1;i<100;i++) {
1412                 fname = talloc_asprintf(talloc_tos(),
1413                                 "/tmp/%s.%d.%s",
1414                                 name,
1415                                 i,
1416                                 type ? "req" : "resp");
1417                 if (fname == NULL) {
1418                         return;
1419                 }
1420                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1421                 if (fd != -1 || errno != EEXIST) break;
1422                 TALLOC_FREE(fname);
1423         }
1424         if (fd != -1) {
1425                 ssize_t ret = write(fd, data, len);
1426                 if (ret != len)
1427                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1428                 close(fd);
1429                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1430         }
1431         TALLOC_FREE(fname);
1432 }
1433
1434 static void smb1srv_update_crypto_flags(struct smbXsrv_session *session,
1435                                         struct smb_request *req,
1436                                         uint8_t type,
1437                                         bool *update_session_globalp,
1438                                         bool *update_tcon_globalp)
1439 {
1440         connection_struct *conn = req->conn;
1441         struct smbXsrv_tcon *tcon = conn ? conn->tcon : NULL;
1442         uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
1443         uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
1444         bool update_session = false;
1445         bool update_tcon = false;
1446
1447         if (req->encrypted) {
1448                 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
1449         }
1450
1451         if (srv_is_signing_active(req->xconn)) {
1452                 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
1453         } else if ((type == SMBecho) || (type == SMBsesssetupX)) {
1454                 /*
1455                  * echo can be unsigned. Sesssion setup except final
1456                  * session setup response too
1457                  */
1458                 sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
1459         }
1460
1461         update_session |= smbXsrv_set_crypto_flag(
1462                 &session->global->encryption_flags, encrypt_flag);
1463         update_session |= smbXsrv_set_crypto_flag(
1464                 &session->global->signing_flags, sign_flag);
1465
1466         if (tcon) {
1467                 update_tcon |= smbXsrv_set_crypto_flag(
1468                         &tcon->global->encryption_flags, encrypt_flag);
1469                 update_tcon |= smbXsrv_set_crypto_flag(
1470                         &tcon->global->signing_flags, sign_flag);
1471         }
1472
1473         if (update_session) {
1474                 session->global->channels[0].encryption_cipher = SMB_ENCRYPTION_GSSAPI;
1475         }
1476
1477         *update_session_globalp = update_session;
1478         *update_tcon_globalp = update_tcon;
1479         return;
1480 }
1481
1482 /****************************************************************************
1483  Prepare everything for calling the actual request function, and potentially
1484  call the request function via the "new" interface.
1485
1486  Return False if the "legacy" function needs to be called, everything is
1487  prepared.
1488
1489  Return True if we're done.
1490
1491  I know this API sucks, but it is the one with the least code change I could
1492  find.
1493 ****************************************************************************/
1494
1495 static connection_struct *switch_message(uint8_t type, struct smb_request *req)
1496 {
1497         int flags;
1498         uint64_t session_tag;
1499         connection_struct *conn = NULL;
1500         struct smbXsrv_connection *xconn = req->xconn;
1501         NTTIME now = timeval_to_nttime(&req->request_time);
1502         struct smbXsrv_session *session = NULL;
1503         NTSTATUS status;
1504
1505         errno = 0;
1506
1507         if (!xconn->smb1.negprot.done) {
1508                 switch (type) {
1509                         /*
1510                          * Without a negprot the request must
1511                          * either be a negprot, or one of the
1512                          * evil old SMB mailslot messaging types.
1513                          */
1514                         case SMBnegprot:
1515                         case SMBsendstrt:
1516                         case SMBsendend:
1517                         case SMBsendtxt:
1518                                 break;
1519                         default:
1520                                 exit_server_cleanly("The first request "
1521                                         "should be a negprot");
1522                 }
1523         }
1524
1525         if (smb_messages[type].fn == NULL) {
1526                 DEBUG(0,("Unknown message type %d!\n",type));
1527                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1528                 reply_unknown_new(req, type);
1529                 return NULL;
1530         }
1531
1532         flags = smb_messages[type].flags;
1533
1534         /* In share mode security we must ignore the vuid. */
1535         session_tag = req->vuid;
1536         conn = req->conn;
1537
1538         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1539                  (int)getpid(), (unsigned long)conn));
1540
1541         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1542
1543         /* Ensure this value is replaced in the incoming packet. */
1544         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1545
1546         /*
1547          * Ensure the correct username is in current_user_info.  This is a
1548          * really ugly bugfix for problems with multiple session_setup_and_X's
1549          * being done and allowing %U and %G substitutions to work correctly.
1550          * There is a reason this code is done here, don't move it unless you
1551          * know what you're doing... :-).
1552          * JRA.
1553          */
1554
1555         /*
1556          * lookup an existing session
1557          *
1558          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1559          * here, the main check is still in change_to_user()
1560          */
1561         status = smb1srv_session_lookup(xconn,
1562                                         session_tag,
1563                                         now,
1564                                         &session);
1565         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1566                 switch (type) {
1567                 case SMBsesssetupX:
1568                         status = NT_STATUS_OK;
1569                         break;
1570                 default:
1571                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1572                                  (unsigned long long)session_tag,
1573                                  (unsigned long long)req->mid));
1574                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1575                         return conn;
1576                 }
1577         }
1578
1579         if (session_tag != xconn->client->last_session_id) {
1580                 struct user_struct *vuser = NULL;
1581
1582                 xconn->client->last_session_id = session_tag;
1583                 if (session) {
1584                         vuser = session->compat;
1585                 }
1586                 if (vuser) {
1587                         set_current_user_info(
1588                                 vuser->session_info->unix_info->sanitized_username,
1589                                 vuser->session_info->unix_info->unix_name,
1590                                 vuser->session_info->info->domain_name);
1591                 }
1592         }
1593
1594         /* Does this call need to be run as the connected user? */
1595         if (flags & AS_USER) {
1596
1597                 /* Does this call need a valid tree connection? */
1598                 if (!conn) {
1599                         /*
1600                          * Amazingly, the error code depends on the command
1601                          * (from Samba4).
1602                          */
1603                         if (type == SMBntcreateX) {
1604                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1605                         } else {
1606                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1607                         }
1608                         return NULL;
1609                 }
1610
1611                 if (!change_to_user(conn,session_tag)) {
1612                         DEBUG(0, ("Error: Could not change to user. Removing "
1613                                 "deferred open, mid=%llu.\n",
1614                                 (unsigned long long)req->mid));
1615                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1616                         return conn;
1617                 }
1618
1619                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1620
1621                 /* Does it need write permission? */
1622                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1623                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1624                         return conn;
1625                 }
1626
1627                 /* IPC services are limited */
1628                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1629                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1630                         return conn;
1631                 }
1632         } else {
1633                 /* This call needs to be run as root */
1634                 change_to_root_user();
1635         }
1636
1637         /* load service specific parameters */
1638         if (conn) {
1639                 if (req->encrypted) {
1640                         conn->encrypted_tid = true;
1641                         /* encrypted required from now on. */
1642                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1643                 } else if (ENCRYPTION_REQUIRED(conn)) {
1644                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1645                                 DEBUG(1,("service[%s] requires encryption"
1646                                         "%s ACCESS_DENIED. mid=%llu\n",
1647                                         lp_servicename(talloc_tos(), SNUM(conn)),
1648                                         smb_fn_name(type),
1649                                         (unsigned long long)req->mid));
1650                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1651                                 return conn;
1652                         }
1653                 }
1654
1655                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1656                                          (flags & (AS_USER|DO_CHDIR)
1657                                           ?True:False))) {
1658                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1659                         return conn;
1660                 }
1661                 conn->num_smb_operations++;
1662         }
1663
1664         /*
1665          * Does this protocol need to be run as guest? (Only archane
1666          * messenger service requests have this...)
1667          */
1668         if (flags & AS_GUEST) {
1669                 char *raddr;
1670                 bool ok;
1671
1672                 if (!change_to_guest()) {
1673                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1674                         return conn;
1675                 }
1676
1677                 raddr = tsocket_address_inet_addr_string(xconn->remote_address,
1678                                                          talloc_tos());
1679                 if (raddr == NULL) {
1680                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1681                         return conn;
1682                 }
1683
1684                 /*
1685                  * Haven't we checked this in smbd_process already???
1686                  */
1687
1688                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1689                                   xconn->remote_hostname, raddr);
1690                 TALLOC_FREE(raddr);
1691
1692                 if (!ok) {
1693                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1694                         return conn;
1695                 }
1696         }
1697
1698         /*
1699          * Update encryption and signing state tracking flags that are
1700          * used by smbstatus to display signing and encryption status.
1701          */
1702         if (session != NULL) {
1703                 bool update_session_global = false;
1704                 bool update_tcon_global = false;
1705
1706                 smb1srv_update_crypto_flags(session, req, type,
1707                                             &update_session_global,
1708                                             &update_tcon_global);
1709
1710                 if (update_session_global) {
1711                         status = smbXsrv_session_update(session);
1712                         if (!NT_STATUS_IS_OK(status)) {
1713                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1714                                 return conn;
1715                         }
1716                 }
1717
1718                 if (update_tcon_global) {
1719                         status = smbXsrv_tcon_update(req->conn->tcon);
1720                         if (!NT_STATUS_IS_OK(status)) {
1721                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1722                                 return conn;
1723                         }
1724                 }
1725         }
1726
1727         smb_messages[type].fn(req);
1728         return req->conn;
1729 }
1730
1731 /****************************************************************************
1732  Construct a reply to the incoming packet.
1733 ****************************************************************************/
1734
1735 static void construct_reply(struct smbXsrv_connection *xconn,
1736                             char *inbuf, int size, size_t unread_bytes,
1737                             uint32_t seqnum, bool encrypted,
1738                             struct smb_perfcount_data *deferred_pcd)
1739 {
1740         struct smbd_server_connection *sconn = xconn->client->sconn;
1741         struct smb_request *req;
1742
1743         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1744                 smb_panic("could not allocate smb_request");
1745         }
1746
1747         if (!init_smb_request(req, sconn, xconn, (uint8_t *)inbuf, unread_bytes,
1748                               encrypted, seqnum)) {
1749                 exit_server_cleanly("Invalid SMB request");
1750         }
1751
1752         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1753
1754         /* we popped this message off the queue - keep original perf data */
1755         if (deferred_pcd)
1756                 req->pcd = *deferred_pcd;
1757         else {
1758                 SMB_PERFCOUNT_START(&req->pcd);
1759                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1760                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1761         }
1762
1763         req->conn = switch_message(req->cmd, req);
1764
1765         if (req->outbuf == NULL) {
1766                 /*
1767                  * Request has suspended itself, will come
1768                  * back here.
1769                  */
1770                 return;
1771         }
1772         if (CVAL(req->outbuf,0) == 0) {
1773                 show_msg((char *)req->outbuf);
1774         }
1775         smb_request_done(req);
1776 }
1777
1778 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1779                                   char *inbuf, int size, uint32_t seqnum,
1780                                   bool encrypted,
1781                                   struct smb_perfcount_data *deferred_pcd)
1782 {
1783         struct smb_request **reqs = NULL;
1784         struct smb_request *req;
1785         unsigned num_reqs;
1786         bool ok;
1787
1788         ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted,
1789                               seqnum, &reqs, &num_reqs);
1790         if (!ok) {
1791                 char errbuf[smb_size];
1792                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1793                              __LINE__, __FILE__);
1794                 if (!srv_send_smb(xconn, errbuf, true, seqnum, encrypted,
1795                                   NULL)) {
1796                         exit_server_cleanly("construct_reply_chain: "
1797                                             "srv_send_smb failed.");
1798                 }
1799                 return;
1800         }
1801
1802         req = reqs[0];
1803         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1804
1805         req->conn = switch_message(req->cmd, req);
1806
1807         if (req->outbuf == NULL) {
1808                 /*
1809                  * Request has suspended itself, will come
1810                  * back here.
1811                  */
1812                 return;
1813         }
1814         smb_request_done(req);
1815 }
1816
1817 /*
1818  * To be called from an async SMB handler that is potentially chained
1819  * when it is finished for shipping.
1820  */
1821
1822 void smb_request_done(struct smb_request *req)
1823 {
1824         struct smb_request **reqs = NULL;
1825         struct smb_request *first_req;
1826         size_t i, num_reqs, next_index;
1827         NTSTATUS status;
1828
1829         if (req->chain == NULL) {
1830                 first_req = req;
1831                 goto shipit;
1832         }
1833
1834         reqs = req->chain;
1835         num_reqs = talloc_array_length(reqs);
1836
1837         for (i=0; i<num_reqs; i++) {
1838                 if (reqs[i] == req) {
1839                         break;
1840                 }
1841         }
1842         if (i == num_reqs) {
1843                 /*
1844                  * Invalid chain, should not happen
1845                  */
1846                 status = NT_STATUS_INTERNAL_ERROR;
1847                 goto error;
1848         }
1849         next_index = i+1;
1850
1851         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1852                 struct smb_request *next = reqs[next_index];
1853                 struct smbXsrv_tcon *tcon;
1854                 NTTIME now = timeval_to_nttime(&req->request_time);
1855
1856                 next->vuid = SVAL(req->outbuf, smb_uid);
1857                 next->tid  = SVAL(req->outbuf, smb_tid);
1858                 status = smb1srv_tcon_lookup(req->xconn, req->tid,
1859                                              now, &tcon);
1860                 if (NT_STATUS_IS_OK(status)) {
1861                         req->conn = tcon->compat;
1862                 } else {
1863                         req->conn = NULL;
1864                 }
1865                 next->chain_fsp = req->chain_fsp;
1866                 next->inbuf = req->inbuf;
1867
1868                 req = next;
1869                 req->conn = switch_message(req->cmd, req);
1870
1871                 if (req->outbuf == NULL) {
1872                         /*
1873                          * Request has suspended itself, will come
1874                          * back here.
1875                          */
1876                         return;
1877                 }
1878                 next_index += 1;
1879         }
1880
1881         first_req = reqs[0];
1882
1883         for (i=1; i<next_index; i++) {
1884                 bool ok;
1885
1886                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1887                 if (!ok) {
1888                         status = NT_STATUS_INTERNAL_ERROR;
1889                         goto error;
1890                 }
1891         }
1892
1893         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1894         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1895
1896         /*
1897          * This scary statement intends to set the
1898          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1899          * to the value last_req->outbuf carries
1900          */
1901         SSVAL(first_req->outbuf, smb_flg2,
1902               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1903               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1904
1905         /*
1906          * Transfer the error codes from the subrequest to the main one
1907          */
1908         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1909         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1910
1911         _smb_setlen_large(
1912                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1913
1914 shipit:
1915         if (!srv_send_smb(first_req->xconn,
1916                           (char *)first_req->outbuf,
1917                           true, first_req->seqnum+1,
1918                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1919                           &first_req->pcd)) {
1920                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1921                                     "failed.");
1922         }
1923         TALLOC_FREE(req);       /* non-chained case */
1924         TALLOC_FREE(reqs);      /* chained case */
1925         return;
1926
1927 error:
1928         {
1929                 char errbuf[smb_size];
1930                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1931                 if (!srv_send_smb(req->xconn, errbuf, true,
1932                                   req->seqnum+1, req->encrypted,
1933                                   NULL)) {
1934                         exit_server_cleanly("construct_reply_chain: "
1935                                             "srv_send_smb failed.");
1936                 }
1937         }
1938         TALLOC_FREE(req);       /* non-chained case */
1939         TALLOC_FREE(reqs);      /* chained case */
1940 }
1941
1942 /****************************************************************************
1943  Process an smb from the client
1944 ****************************************************************************/
1945 static void process_smb(struct smbXsrv_connection *xconn,
1946                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1947                         uint32_t seqnum, bool encrypted,
1948                         struct smb_perfcount_data *deferred_pcd)
1949 {
1950         struct smbd_server_connection *sconn = xconn->client->sconn;
1951         int msg_type = CVAL(inbuf,0);
1952
1953         DO_PROFILE_INC(request);
1954
1955         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1956                     smb_len(inbuf) ) );
1957         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1958                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1959
1960         if (msg_type != NBSSmessage) {
1961                 /*
1962                  * NetBIOS session request, keepalive, etc.
1963                  */
1964                 reply_special(xconn, (char *)inbuf, nread);
1965                 goto done;
1966         }
1967
1968         if (sconn->using_smb2) {
1969                 /* At this point we're not really using smb2,
1970                  * we make the decision here.. */
1971                 if (smbd_is_smb2_header(inbuf, nread)) {
1972                         const uint8_t *inpdu = inbuf + NBT_HDR_SIZE;
1973                         size_t pdulen = nread - NBT_HDR_SIZE;
1974                         smbd_smb2_process_negprot(xconn, 0, inpdu, pdulen);
1975                         return;
1976                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1977                                 && CVAL(inbuf, smb_com) != 0x72) {
1978                         /* This is a non-negprot SMB1 packet.
1979                            Disable SMB2 from now on. */
1980                         sconn->using_smb2 = false;
1981                 }
1982         }
1983
1984         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1985          * so subtract 4 from it. */
1986         if ((nread < (smb_size - 4)) || !valid_smb_header(inbuf)) {
1987                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1988                          smb_len(inbuf)));
1989
1990                 /* special magic for immediate exit */
1991                 if ((nread == 9) &&
1992                     (IVAL(inbuf, 4) == 0x74697865) &&
1993                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1994                         uint8_t exitcode = CVAL(inbuf, 8);
1995                         DEBUG(1, ("Exiting immediately with code %d\n",
1996                                   (int)exitcode));
1997                         exit(exitcode);
1998                 }
1999
2000                 exit_server_cleanly("Non-SMB packet");
2001         }
2002
2003         show_msg((char *)inbuf);
2004
2005         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
2006                 construct_reply_chain(xconn, (char *)inbuf, nread,
2007                                       seqnum, encrypted, deferred_pcd);
2008         } else {
2009                 construct_reply(xconn, (char *)inbuf, nread, unread_bytes,
2010                                 seqnum, encrypted, deferred_pcd);
2011         }
2012
2013         sconn->trans_num++;
2014
2015 done:
2016         sconn->num_requests++;
2017
2018         /* The timeout_processing function isn't run nearly
2019            often enough to implement 'max log size' without
2020            overrunning the size of the file by many megabytes.
2021            This is especially true if we are running at debug
2022            level 10.  Checking every 50 SMBs is a nice
2023            tradeoff of performance vs log file size overrun. */
2024
2025         if ((sconn->num_requests % 50) == 0 &&
2026             need_to_check_log_size()) {
2027                 change_to_root_user();
2028                 check_log_size();
2029         }
2030 }
2031
2032 /****************************************************************************
2033  Return a string containing the function name of a SMB command.
2034 ****************************************************************************/
2035
2036 const char *smb_fn_name(int type)
2037 {
2038         const char *unknown_name = "SMBunknown";
2039
2040         if (smb_messages[type].name == NULL)
2041                 return(unknown_name);
2042
2043         return(smb_messages[type].name);
2044 }
2045
2046 /****************************************************************************
2047  Helper functions for contruct_reply.
2048 ****************************************************************************/
2049
2050 void add_to_common_flags2(uint32_t v)
2051 {
2052         common_flags2 |= v;
2053 }
2054
2055 void remove_from_common_flags2(uint32_t v)
2056 {
2057         common_flags2 &= ~v;
2058 }
2059
2060 static void construct_reply_common(uint8_t cmd, const uint8_t *inbuf,
2061                                    char *outbuf)
2062 {
2063         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
2064         uint16_t out_flags2 = common_flags2;
2065
2066         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
2067         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
2068         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
2069
2070         srv_set_message(outbuf,0,0,false);
2071
2072         SCVAL(outbuf, smb_com, cmd);
2073         SIVAL(outbuf,smb_rcls,0);
2074         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
2075         SSVAL(outbuf,smb_flg2, out_flags2);
2076         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
2077         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
2078
2079         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
2080         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
2081         SSVAL(outbuf,smb_pidhigh,SVAL(inbuf,smb_pidhigh));
2082         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
2083         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
2084 }
2085
2086 void construct_reply_common_req(struct smb_request *req, char *outbuf)
2087 {
2088         construct_reply_common(req->cmd, req->inbuf, outbuf);
2089 }
2090
2091 /**
2092  * @brief Find the smb_cmd offset of the last command pushed
2093  * @param[in] buf       The buffer we're building up
2094  * @retval              Where can we put our next andx cmd?
2095  *
2096  * While chaining requests, the "next" request we're looking at needs to put
2097  * its SMB_Command before the data the previous request already built up added
2098  * to the chain. Find the offset to the place where we have to put our cmd.
2099  */
2100
2101 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2102 {
2103         uint8_t cmd;
2104         size_t ofs;
2105
2106         cmd = CVAL(buf, smb_com);
2107
2108         if (!is_andx_req(cmd)) {
2109                 return false;
2110         }
2111
2112         ofs = smb_vwv0;
2113
2114         while (CVAL(buf, ofs) != 0xff) {
2115
2116                 if (!is_andx_req(CVAL(buf, ofs))) {
2117                         return false;
2118                 }
2119
2120                 /*
2121                  * ofs is from start of smb header, so add the 4 length
2122                  * bytes. The next cmd is right after the wct field.
2123                  */
2124                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2125
2126                 if (ofs+4 >= talloc_get_size(buf)) {
2127                         return false;
2128                 }
2129         }
2130
2131         *pofs = ofs;
2132         return true;
2133 }
2134
2135 /**
2136  * @brief Do the smb chaining at a buffer level
2137  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2138  * @param[in] andx_buf          Buffer to be appended
2139  */
2140
2141 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2142 {
2143         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2144         uint8_t wct             = CVAL(andx_buf, smb_wct);
2145         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2146         uint32_t num_bytes      = smb_buflen(andx_buf);
2147         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2148
2149         uint8_t *outbuf;
2150         size_t old_size, new_size;
2151         size_t ofs;
2152         size_t chain_padding = 0;
2153         size_t andx_cmd_ofs;
2154
2155
2156         old_size = talloc_get_size(*poutbuf);
2157
2158         if ((old_size % 4) != 0) {
2159                 /*
2160                  * Align the wct field of subsequent requests to a 4-byte
2161                  * boundary
2162                  */
2163                 chain_padding = 4 - (old_size % 4);
2164         }
2165
2166         /*
2167          * After the old request comes the new wct field (1 byte), the vwv's
2168          * and the num_bytes field.
2169          */
2170
2171         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2172         new_size += num_bytes;
2173
2174         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2175                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2176                           (unsigned)new_size));
2177                 return false;
2178         }
2179
2180         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2181         if (outbuf == NULL) {
2182                 DEBUG(0, ("talloc failed\n"));
2183                 return false;
2184         }
2185         *poutbuf = outbuf;
2186
2187         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2188                 DEBUG(1, ("invalid command chain\n"));
2189                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2190                 return false;
2191         }
2192
2193         if (chain_padding != 0) {
2194                 memset(outbuf + old_size, 0, chain_padding);
2195                 old_size += chain_padding;
2196         }
2197
2198         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2199         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2200
2201         ofs = old_size;
2202
2203         /*
2204          * Push the chained request:
2205          *
2206          * wct field
2207          */
2208
2209         SCVAL(outbuf, ofs, wct);
2210         ofs += 1;
2211
2212         /*
2213          * vwv array
2214          */
2215
2216         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2217
2218         /*
2219          * HACK ALERT
2220          *
2221          * Read&X has an offset into its data buffer at
2222          * vwv[6]. reply_read_andx has no idea anymore that it's
2223          * running from within a chain, so we have to fix up the
2224          * offset here.
2225          *
2226          * Although it looks disgusting at this place, I want to keep
2227          * it here. The alternative would be to push knowledge about
2228          * the andx chain down into read&x again.
2229          */
2230
2231         if (smb_command == SMBreadX) {
2232                 uint8_t *bytes_addr;
2233
2234                 if (wct < 7) {
2235                         /*
2236                          * Invalid read&x response
2237                          */
2238                         return false;
2239                 }
2240
2241                 bytes_addr = outbuf + ofs        /* vwv start */
2242                         + sizeof(uint16_t) * wct /* vwv array */
2243                         + sizeof(uint16_t)       /* bcc */
2244                         + 1;                     /* padding byte */
2245
2246                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2247                       bytes_addr - outbuf - 4);
2248         }
2249
2250         ofs += sizeof(uint16_t) * wct;
2251
2252         /*
2253          * bcc (byte count)
2254          */
2255
2256         SSVAL(outbuf, ofs, num_bytes);
2257         ofs += sizeof(uint16_t);
2258
2259         /*
2260          * The bytes field
2261          */
2262
2263         memcpy(outbuf + ofs, bytes, num_bytes);
2264
2265         return true;
2266 }
2267
2268 bool smb1_is_chain(const uint8_t *buf)
2269 {
2270         uint8_t cmd, wct, andx_cmd;
2271
2272         cmd = CVAL(buf, smb_com);
2273         if (!is_andx_req(cmd)) {
2274                 return false;
2275         }
2276         wct = CVAL(buf, smb_wct);
2277         if (wct < 2) {
2278                 return false;
2279         }
2280         andx_cmd = CVAL(buf, smb_vwv);
2281         return (andx_cmd != 0xFF);
2282 }
2283
2284 bool smb1_walk_chain(const uint8_t *buf,
2285                      bool (*fn)(uint8_t cmd,
2286                                 uint8_t wct, const uint16_t *vwv,
2287                                 uint16_t num_bytes, const uint8_t *bytes,
2288                                 void *private_data),
2289                      void *private_data)
2290 {
2291         size_t smblen = smb_len(buf);
2292         const char *smb_buf = smb_base(buf);
2293         uint8_t cmd, chain_cmd;
2294         uint8_t wct;
2295         const uint16_t *vwv;
2296         uint16_t num_bytes;
2297         const uint8_t *bytes;
2298
2299         cmd = CVAL(buf, smb_com);
2300         wct = CVAL(buf, smb_wct);
2301         vwv = (const uint16_t *)(buf + smb_vwv);
2302         num_bytes = smb_buflen(buf);
2303         bytes = (const uint8_t *)smb_buf_const(buf);
2304
2305         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2306                 return false;
2307         }
2308
2309         if (!is_andx_req(cmd)) {
2310                 return true;
2311         }
2312         if (wct < 2) {
2313                 return false;
2314         }
2315
2316         chain_cmd = CVAL(vwv, 0);
2317
2318         while (chain_cmd != 0xff) {
2319                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2320                 size_t length_needed;
2321                 ptrdiff_t vwv_offset;
2322
2323                 chain_offset = SVAL(vwv+1, 0);
2324
2325                 /*
2326                  * Check if the client tries to fool us. The chain
2327                  * offset needs to point beyond the current request in
2328                  * the chain, it needs to strictly grow. Otherwise we
2329                  * might be tricked into an endless loop always
2330                  * processing the same request over and over again. We
2331                  * used to assume that vwv and the byte buffer array
2332                  * in a chain are always attached, but OS/2 the
2333                  * Write&X/Read&X chain puts the Read&X vwv array
2334                  * right behind the Write&X vwv chain. The Write&X bcc
2335                  * array is put behind the Read&X vwv array. So now we
2336                  * check whether the chain offset points strictly
2337                  * behind the previous vwv array. req->buf points
2338                  * right after the vwv array of the previous
2339                  * request. See
2340                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2341                  * more information.
2342                  */
2343
2344                 vwv_offset = ((const char *)vwv - smb_buf);
2345                 if (chain_offset <= vwv_offset) {
2346                         return false;
2347                 }
2348
2349                 /*
2350                  * Next check: Make sure the chain offset does not
2351                  * point beyond the overall smb request length.
2352                  */
2353
2354                 length_needed = chain_offset+1; /* wct */
2355                 if (length_needed > smblen) {
2356                         return false;
2357                 }
2358
2359                 /*
2360                  * Now comes the pointer magic. Goal here is to set up
2361                  * vwv and buf correctly again. The chain offset (the
2362                  * former vwv[1]) points at the new wct field.
2363                  */
2364
2365                 wct = CVAL(smb_buf, chain_offset);
2366
2367                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2368                         return false;
2369                 }
2370
2371                 /*
2372                  * Next consistency check: Make the new vwv array fits
2373                  * in the overall smb request.
2374                  */
2375
2376                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2377                 if (length_needed > smblen) {
2378                         return false;
2379                 }
2380                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2381
2382                 /*
2383                  * Now grab the new byte buffer....
2384                  */
2385
2386                 num_bytes = SVAL(vwv+wct, 0);
2387
2388                 /*
2389                  * .. and check that it fits.
2390                  */
2391
2392                 length_needed += num_bytes;
2393                 if (length_needed > smblen) {
2394                         return false;
2395                 }
2396                 bytes = (const uint8_t *)(vwv+wct+1);
2397
2398                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2399                         return false;
2400                 }
2401
2402                 if (!is_andx_req(chain_cmd)) {
2403                         return true;
2404                 }
2405                 chain_cmd = CVAL(vwv, 0);
2406         }
2407         return true;
2408 }
2409
2410 static bool smb1_chain_length_cb(uint8_t cmd,
2411                                  uint8_t wct, const uint16_t *vwv,
2412                                  uint16_t num_bytes, const uint8_t *bytes,
2413                                  void *private_data)
2414 {
2415         unsigned *count = (unsigned *)private_data;
2416         *count += 1;
2417         return true;
2418 }
2419
2420 unsigned smb1_chain_length(const uint8_t *buf)
2421 {
2422         unsigned count = 0;
2423
2424         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2425                 return 0;
2426         }
2427         return count;
2428 }
2429
2430 struct smb1_parse_chain_state {
2431         TALLOC_CTX *mem_ctx;
2432         const uint8_t *buf;
2433         struct smbd_server_connection *sconn;
2434         struct smbXsrv_connection *xconn;
2435         bool encrypted;
2436         uint32_t seqnum;
2437
2438         struct smb_request **reqs;
2439         unsigned num_reqs;
2440 };
2441
2442 static bool smb1_parse_chain_cb(uint8_t cmd,
2443                                 uint8_t wct, const uint16_t *vwv,
2444                                 uint16_t num_bytes, const uint8_t *bytes,
2445                                 void *private_data)
2446 {
2447         struct smb1_parse_chain_state *state =
2448                 (struct smb1_parse_chain_state *)private_data;
2449         struct smb_request **reqs;
2450         struct smb_request *req;
2451         bool ok;
2452
2453         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2454                               struct smb_request *, state->num_reqs+1);
2455         if (reqs == NULL) {
2456                 return false;
2457         }
2458         state->reqs = reqs;
2459
2460         req = talloc(reqs, struct smb_request);
2461         if (req == NULL) {
2462                 return false;
2463         }
2464
2465         ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2466                               state->encrypted, state->seqnum);
2467         if (!ok) {
2468                 return false;
2469         }
2470         req->cmd = cmd;
2471         req->wct = wct;
2472         req->vwv = vwv;
2473         req->buflen = num_bytes;
2474         req->buf = bytes;
2475
2476         reqs[state->num_reqs] = req;
2477         state->num_reqs += 1;
2478         return true;
2479 }
2480
2481 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2482                       struct smbXsrv_connection *xconn,
2483                       bool encrypted, uint32_t seqnum,
2484                       struct smb_request ***reqs, unsigned *num_reqs)
2485 {
2486         struct smbd_server_connection *sconn = NULL;
2487         struct smb1_parse_chain_state state;
2488         unsigned i;
2489
2490         if (xconn != NULL) {
2491                 sconn = xconn->client->sconn;
2492         }
2493
2494         state.mem_ctx = mem_ctx;
2495         state.buf = buf;
2496         state.sconn = sconn;
2497         state.xconn = xconn;
2498         state.encrypted = encrypted;
2499         state.seqnum = seqnum;
2500         state.reqs = NULL;
2501         state.num_reqs = 0;
2502
2503         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2504                 TALLOC_FREE(state.reqs);
2505                 return false;
2506         }
2507         for (i=0; i<state.num_reqs; i++) {
2508                 state.reqs[i]->chain = state.reqs;
2509         }
2510         *reqs = state.reqs;
2511         *num_reqs = state.num_reqs;
2512         return true;
2513 }
2514
2515 /****************************************************************************
2516  Check if services need reloading.
2517 ****************************************************************************/
2518
2519 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2520 {
2521
2522         if (last_smb_conf_reload_time == 0) {
2523                 last_smb_conf_reload_time = t;
2524         }
2525
2526         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2527                 reload_services(sconn, conn_snum_used, true);
2528                 last_smb_conf_reload_time = t;
2529         }
2530 }
2531
2532 static bool fd_is_readable(int fd)
2533 {
2534         int ret, revents;
2535
2536         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2537
2538         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2539
2540 }
2541
2542 static void smbd_server_connection_write_handler(
2543         struct smbXsrv_connection *xconn)
2544 {
2545         /* TODO: make write nonblocking */
2546 }
2547
2548 static void smbd_server_connection_read_handler(
2549         struct smbXsrv_connection *xconn, int fd)
2550 {
2551         uint8_t *inbuf = NULL;
2552         size_t inbuf_len = 0;
2553         size_t unread_bytes = 0;
2554         bool encrypted = false;
2555         TALLOC_CTX *mem_ctx = talloc_tos();
2556         NTSTATUS status;
2557         uint32_t seqnum;
2558
2559         bool async_echo = lp_async_smb_echo_handler();
2560         bool from_client = false;
2561
2562         if (async_echo) {
2563                 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2564                         /*
2565                          * This is the super-ugly hack to prefer the packets
2566                          * forwarded by the echo handler over the ones by the
2567                          * client directly
2568                          */
2569                         fd = xconn->smb1.echo_handler.trusted_fd;
2570                 }
2571         }
2572
2573         from_client = (xconn->transport.sock == fd);
2574
2575         if (async_echo && from_client) {
2576                 smbd_lock_socket(xconn);
2577
2578                 if (!fd_is_readable(fd)) {
2579                         DEBUG(10,("the echo listener was faster\n"));
2580                         smbd_unlock_socket(xconn);
2581                         return;
2582                 }
2583         }
2584
2585         /* TODO: make this completely nonblocking */
2586         status = receive_smb_talloc(mem_ctx, xconn, fd,
2587                                     (char **)(void *)&inbuf,
2588                                     0, /* timeout */
2589                                     &unread_bytes,
2590                                     &encrypted,
2591                                     &inbuf_len, &seqnum,
2592                                     !from_client /* trusted channel */);
2593
2594         if (async_echo && from_client) {
2595                 smbd_unlock_socket(xconn);
2596         }
2597
2598         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2599                 goto process;
2600         }
2601         if (NT_STATUS_IS_ERR(status)) {
2602                 exit_server_cleanly("failed to receive smb request");
2603         }
2604         if (!NT_STATUS_IS_OK(status)) {
2605                 return;
2606         }
2607
2608 process:
2609         process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2610                     seqnum, encrypted, NULL);
2611 }
2612
2613 static void smbd_server_connection_handler(struct tevent_context *ev,
2614                                            struct tevent_fd *fde,
2615                                            uint16_t flags,
2616                                            void *private_data)
2617 {
2618         struct smbXsrv_connection *xconn =
2619                 talloc_get_type_abort(private_data,
2620                 struct smbXsrv_connection);
2621
2622         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2623                 /*
2624                  * we're not supposed to do any io
2625                  */
2626                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2627                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2628                 return;
2629         }
2630
2631         if (flags & TEVENT_FD_WRITE) {
2632                 smbd_server_connection_write_handler(xconn);
2633                 return;
2634         }
2635         if (flags & TEVENT_FD_READ) {
2636                 smbd_server_connection_read_handler(xconn, xconn->transport.sock);
2637                 return;
2638         }
2639 }
2640
2641 static void smbd_server_echo_handler(struct tevent_context *ev,
2642                                      struct tevent_fd *fde,
2643                                      uint16_t flags,
2644                                      void *private_data)
2645 {
2646         struct smbXsrv_connection *xconn =
2647                 talloc_get_type_abort(private_data,
2648                 struct smbXsrv_connection);
2649
2650         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2651                 /*
2652                  * we're not supposed to do any io
2653                  */
2654                 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2655                 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2656                 return;
2657         }
2658
2659         if (flags & TEVENT_FD_WRITE) {
2660                 smbd_server_connection_write_handler(xconn);
2661                 return;
2662         }
2663         if (flags & TEVENT_FD_READ) {
2664                 smbd_server_connection_read_handler(
2665                         xconn, xconn->smb1.echo_handler.trusted_fd);
2666                 return;
2667         }
2668 }
2669
2670 struct smbd_release_ip_state {
2671         struct smbXsrv_connection *xconn;
2672         struct tevent_immediate *im;
2673         char addr[INET6_ADDRSTRLEN];
2674 };
2675
2676 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2677                                       struct tevent_immediate *im,
2678                                       void *private_data)
2679 {
2680         struct smbd_release_ip_state *state =
2681                 talloc_get_type_abort(private_data,
2682                 struct smbd_release_ip_state);
2683         struct smbXsrv_connection *xconn = state->xconn;
2684
2685         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2686                 /*
2687                  * smbd_server_connection_terminate() already triggered ?
2688                  */
2689                 return;
2690         }
2691
2692         smbd_server_connection_terminate(xconn, "CTDB_SRVID_RELEASE_IP");
2693 }
2694
2695 /****************************************************************************
2696 received when we should release a specific IP
2697 ****************************************************************************/
2698 static int release_ip(struct tevent_context *ev,
2699                       uint32_t src_vnn, uint32_t dst_vnn,
2700                       uint64_t dst_srvid,
2701                       const uint8_t *msg, size_t msglen,
2702                       void *private_data)
2703 {
2704         struct smbd_release_ip_state *state =
2705                 talloc_get_type_abort(private_data,
2706                 struct smbd_release_ip_state);
2707         struct smbXsrv_connection *xconn = state->xconn;
2708         const char *ip;
2709         const char *addr = state->addr;
2710         const char *p = addr;
2711
2712         if (msglen == 0) {
2713                 return 0;
2714         }
2715         if (msg[msglen-1] != '\0') {
2716                 return 0;
2717         }
2718
2719         ip = (const char *)msg;
2720
2721         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2722                 /* avoid recursion */
2723                 return 0;
2724         }
2725
2726         if (strncmp("::ffff:", addr, 7) == 0) {
2727                 p = addr + 7;
2728         }
2729
2730         DEBUG(10, ("Got release IP message for %s, "
2731                    "our address is %s\n", ip, p));
2732
2733         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2734                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2735                         ip));
2736                 /*
2737                  * With SMB2 we should do a clean disconnect,
2738                  * the previous_session_id in the session setup
2739                  * will cleanup the old session, tcons and opens.
2740                  *
2741                  * A clean disconnect is needed in order to support
2742                  * durable handles.
2743                  *
2744                  * Note: typically this is never triggered
2745                  *       as we got a TCP RST (triggered by ctdb event scripts)
2746                  *       before we get CTDB_SRVID_RELEASE_IP.
2747                  *
2748                  * We used to call _exit(1) here, but as this was mostly never
2749                  * triggered and has implication on our process model,
2750                  * we can just use smbd_server_connection_terminate()
2751                  * (also for SMB1).
2752                  *
2753                  * We don't call smbd_server_connection_terminate() directly
2754                  * as we might be called from within ctdbd_migrate(),
2755                  * we need to defer our action to the next event loop
2756                  */
2757                 tevent_schedule_immediate(state->im, xconn->ev_ctx,
2758                                           smbd_release_ip_immediate, state);
2759
2760                 /*
2761                  * Make sure we don't get any io on the connection.
2762                  */
2763                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2764                 return EADDRNOTAVAIL;
2765         }
2766
2767         return 0;
2768 }
2769
2770 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2771                                   struct sockaddr_storage *srv,
2772                                   struct sockaddr_storage *clnt)
2773 {
2774         struct smbd_release_ip_state *state;
2775         struct ctdbd_connection *cconn;
2776         int ret;
2777
2778         cconn = messaging_ctdb_connection();
2779         if (cconn == NULL) {
2780                 return NT_STATUS_NO_MEMORY;
2781         }
2782
2783         state = talloc_zero(xconn, struct smbd_release_ip_state);
2784         if (state == NULL) {
2785                 return NT_STATUS_NO_MEMORY;
2786         }
2787         state->xconn = xconn;
2788         state->im = tevent_create_immediate(state);
2789         if (state->im == NULL) {
2790                 return NT_STATUS_NO_MEMORY;
2791         }
2792         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2793                 return NT_STATUS_NO_MEMORY;
2794         }
2795
2796         ret = ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2797         if (ret != 0) {
2798                 return map_nt_error_from_unix(ret);
2799         }
2800         return NT_STATUS_OK;
2801 }
2802
2803 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2804                                   void *private_data, uint32_t msg_type,
2805                                   struct server_id server_id, DATA_BLOB *data)
2806 {
2807         struct smbd_server_connection *sconn = talloc_get_type_abort(
2808                 private_data, struct smbd_server_connection);
2809         const char *ip = (char *) data->data;
2810         char *client_ip;
2811
2812         DBG_DEBUG("Got kill request for client IP %s\n", ip);
2813
2814         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2815                                                      talloc_tos());
2816         if (client_ip == NULL) {
2817                 return;
2818         }
2819
2820         if (strequal(ip, client_ip)) {
2821                 DBG_WARNING("Got kill client message for %s - "
2822                             "exiting immediately\n", ip);
2823                 exit_server_cleanly("Forced disconnect for client");
2824         }
2825
2826         TALLOC_FREE(client_ip);
2827 }
2828
2829 /*
2830  * Send keepalive packets to our client
2831  */
2832 static bool keepalive_fn(const struct timeval *now, void *private_data)
2833 {
2834         struct smbd_server_connection *sconn = talloc_get_type_abort(
2835                 private_data, struct smbd_server_connection);
2836         struct smbXsrv_connection *xconn = NULL;
2837         bool ret;
2838
2839         if (sconn->using_smb2) {
2840                 /* Don't do keepalives on an SMB2 connection. */
2841                 return false;
2842         }
2843
2844         /*
2845          * With SMB1 we only have 1 connection
2846          */
2847         xconn = sconn->client->connections;
2848         smbd_lock_socket(xconn);
2849         ret = send_keepalive(xconn->transport.sock);
2850         smbd_unlock_socket(xconn);
2851
2852         if (!ret) {
2853                 int saved_errno = errno;
2854                 /*
2855                  * Try and give an error message saying what
2856                  * client failed.
2857                  */
2858                 DEBUG(0, ("send_keepalive failed for client %s. "
2859                           "Error %s - exiting\n",
2860                           smbXsrv_connection_dbg(xconn),
2861                           strerror(saved_errno)));
2862                 errno = saved_errno;
2863                 return False;
2864         }
2865         return True;
2866 }
2867
2868 /*
2869  * Do the recurring check if we're idle
2870  */
2871 static bool deadtime_fn(const struct timeval *now, void *private_data)
2872 {
2873         struct smbd_server_connection *sconn =
2874                 (struct smbd_server_connection *)private_data;
2875
2876         if ((conn_num_open(sconn) == 0)
2877             || (conn_idle_all(sconn, now->tv_sec))) {
2878                 DEBUG( 2, ( "Closing idle connection\n" ) );
2879                 messaging_send(sconn->msg_ctx,
2880                                messaging_server_id(sconn->msg_ctx),
2881                                MSG_SHUTDOWN, &data_blob_null);
2882                 return False;
2883         }
2884
2885         return True;
2886 }
2887
2888 /*
2889  * Do the recurring log file and smb.conf reload checks.
2890  */
2891
2892 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2893 {
2894         struct smbd_server_connection *sconn = talloc_get_type_abort(
2895                 private_data, struct smbd_server_connection);
2896
2897         DEBUG(5, ("housekeeping\n"));
2898
2899         change_to_root_user();
2900
2901         /* update printer queue caches if necessary */
2902         update_monitored_printq_cache(sconn->msg_ctx);
2903
2904         /* check if we need to reload services */
2905         check_reload(sconn, time_mono(NULL));
2906
2907         /*
2908          * Force a log file check.
2909          */
2910         force_check_log_size();
2911         check_log_size();
2912         return true;
2913 }
2914
2915 /*
2916  * Read an smb packet in the echo handler child, giving the parent
2917  * smbd one second to react once the socket becomes readable.
2918  */
2919
2920 struct smbd_echo_read_state {
2921         struct tevent_context *ev;
2922         struct smbXsrv_connection *xconn;
2923
2924         char *buf;
2925         size_t buflen;
2926         uint32_t seqnum;
2927 };
2928
2929 static void smbd_echo_read_readable(struct tevent_req *subreq);
2930 static void smbd_echo_read_waited(struct tevent_req *subreq);
2931
2932 static struct tevent_req *smbd_echo_read_send(
2933         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2934         struct smbXsrv_connection *xconn)
2935 {
2936         struct tevent_req *req, *subreq;
2937         struct smbd_echo_read_state *state;
2938
2939         req = tevent_req_create(mem_ctx, &state,
2940                                 struct smbd_echo_read_state);
2941         if (req == NULL) {
2942                 return NULL;
2943         }
2944         state->ev = ev;
2945         state->xconn = xconn;
2946
2947         subreq = wait_for_read_send(state, ev, xconn->transport.sock, false);
2948         if (tevent_req_nomem(subreq, req)) {
2949                 return tevent_req_post(req, ev);
2950         }
2951         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2952         return req;
2953 }
2954
2955 static void smbd_echo_read_readable(struct tevent_req *subreq)
2956 {
2957         struct tevent_req *req = tevent_req_callback_data(
2958                 subreq, struct tevent_req);
2959         struct smbd_echo_read_state *state = tevent_req_data(
2960                 req, struct smbd_echo_read_state);
2961         bool ok;
2962         int err;
2963
2964         ok = wait_for_read_recv(subreq, &err);
2965         TALLOC_FREE(subreq);
2966         if (!ok) {
2967                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2968                 return;
2969         }
2970
2971         /*
2972          * Give the parent smbd one second to step in
2973          */
2974
2975         subreq = tevent_wakeup_send(
2976                 state, state->ev, timeval_current_ofs(1, 0));
2977         if (tevent_req_nomem(subreq, req)) {
2978                 return;
2979         }
2980         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2981 }
2982
2983 static void smbd_echo_read_waited(struct tevent_req *subreq)
2984 {
2985         struct tevent_req *req = tevent_req_callback_data(
2986                 subreq, struct tevent_req);
2987         struct smbd_echo_read_state *state = tevent_req_data(
2988                 req, struct smbd_echo_read_state);
2989         struct smbXsrv_connection *xconn = state->xconn;
2990         bool ok;
2991         NTSTATUS status;
2992         size_t unread = 0;
2993         bool encrypted;
2994
2995         ok = tevent_wakeup_recv(subreq);
2996         TALLOC_FREE(subreq);
2997         if (!ok) {
2998                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2999                 return;
3000         }
3001
3002         ok = smbd_lock_socket_internal(xconn);
3003         if (!ok) {
3004                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
3005                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
3006                 return;
3007         }
3008
3009         if (!fd_is_readable(xconn->transport.sock)) {
3010                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
3011                           (int)getpid()));
3012
3013                 ok = smbd_unlock_socket_internal(xconn);
3014                 if (!ok) {
3015                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
3016                         DEBUG(1, ("%s: failed to unlock socket\n",
3017                                 __location__));
3018                         return;
3019                 }
3020
3021                 subreq = wait_for_read_send(state, state->ev,
3022                                             xconn->transport.sock, false);
3023                 if (tevent_req_nomem(subreq, req)) {
3024                         return;
3025                 }
3026                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
3027                 return;
3028         }
3029
3030         status = receive_smb_talloc(state, xconn,
3031                                     xconn->transport.sock,
3032                                     &state->buf,
3033                                     0 /* timeout */,
3034                                     &unread,
3035                                     &encrypted,
3036                                     &state->buflen,
3037                                     &state->seqnum,
3038                                     false /* trusted_channel*/);
3039
3040         if (tevent_req_nterror(req, status)) {
3041                 tevent_req_nterror(req, status);
3042                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
3043                           (int)getpid(), nt_errstr(status)));
3044                 return;
3045         }
3046
3047         ok = smbd_unlock_socket_internal(xconn);
3048         if (!ok) {
3049                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
3050                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
3051                 return;
3052         }
3053         tevent_req_done(req);
3054 }
3055
3056 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3057                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
3058 {
3059         struct smbd_echo_read_state *state = tevent_req_data(
3060                 req, struct smbd_echo_read_state);
3061         NTSTATUS status;
3062
3063         if (tevent_req_is_nterror(req, &status)) {
3064                 return status;
3065         }
3066         *pbuf = talloc_move(mem_ctx, &state->buf);
3067         *pbuflen = state->buflen;
3068         *pseqnum = state->seqnum;
3069         return NT_STATUS_OK;
3070 }
3071
3072 struct smbd_echo_state {
3073         struct tevent_context *ev;
3074         struct iovec *pending;
3075         struct smbd_server_connection *sconn;
3076         struct smbXsrv_connection *xconn;
3077         int parent_pipe;
3078
3079         struct tevent_fd *parent_fde;
3080
3081         struct tevent_req *write_req;
3082 };
3083
3084 static void smbd_echo_writer_done(struct tevent_req *req);
3085
3086 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
3087 {
3088         int num_pending;
3089
3090         if (state->write_req != NULL) {
3091                 return;
3092         }
3093
3094         num_pending = talloc_array_length(state->pending);
3095         if (num_pending == 0) {
3096                 return;
3097         }
3098
3099         state->write_req = writev_send(state, state->ev, NULL,
3100                                        state->parent_pipe, false,
3101                                        state->pending, num_pending);
3102         if (state->write_req == NULL) {
3103                 DEBUG(1, ("writev_send failed\n"));
3104                 exit(1);
3105         }
3106
3107         talloc_steal(state->write_req, state->pending);
3108         state->pending = NULL;
3109
3110         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
3111                                 state);
3112 }
3113
3114 static void smbd_echo_writer_done(struct tevent_req *req)
3115 {
3116         struct smbd_echo_state *state = tevent_req_callback_data(
3117                 req, struct smbd_echo_state);
3118         ssize_t written;
3119         int err;
3120
3121         written = writev_recv(req, &err);
3122         TALLOC_FREE(req);
3123         state->write_req = NULL;
3124         if (written == -1) {
3125                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3126                 exit(1);
3127         }
3128         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3129         smbd_echo_activate_writer(state);
3130 }
3131
3132 static bool smbd_echo_reply(struct smbd_echo_state *state,
3133                             uint8_t *inbuf, size_t inbuf_len,
3134                             uint32_t seqnum)
3135 {
3136         struct smb_request req;
3137         uint16_t num_replies;
3138         char *outbuf;
3139         bool ok;
3140
3141         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3142                 DEBUG(10, ("Got netbios keepalive\n"));
3143                 /*
3144                  * Just swallow it
3145                  */
3146                 return true;
3147         }
3148
3149         if (inbuf_len < smb_size) {
3150                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3151                 return false;
3152         }
3153         if (!valid_smb_header(inbuf)) {
3154                 DEBUG(10, ("Got invalid SMB header\n"));
3155                 return false;
3156         }
3157
3158         if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3159                               seqnum)) {
3160                 return false;
3161         }
3162         req.inbuf = inbuf;
3163
3164         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3165                    smb_messages[req.cmd].name
3166                    ? smb_messages[req.cmd].name : "unknown"));
3167
3168         if (req.cmd != SMBecho) {
3169                 return false;
3170         }
3171         if (req.wct < 1) {
3172                 return false;
3173         }
3174
3175         num_replies = SVAL(req.vwv+0, 0);
3176         if (num_replies != 1) {
3177                 /* Not a Windows "Hey, you're still there?" request */
3178                 return false;
3179         }
3180
3181         if (!create_outbuf(talloc_tos(), &req, req.inbuf, &outbuf,
3182                            1, req.buflen)) {
3183                 DEBUG(10, ("create_outbuf failed\n"));
3184                 return false;
3185         }
3186         req.outbuf = (uint8_t *)outbuf;
3187
3188         SSVAL(req.outbuf, smb_vwv0, num_replies);
3189
3190         if (req.buflen > 0) {
3191                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3192         }
3193
3194         ok = srv_send_smb(req.xconn,
3195                           (char *)outbuf,
3196                           true, seqnum+1,
3197                           false, &req.pcd);
3198         TALLOC_FREE(outbuf);
3199         if (!ok) {
3200                 exit(1);
3201         }
3202
3203         return true;
3204 }
3205
3206 static void smbd_echo_exit(struct tevent_context *ev,
3207                            struct tevent_fd *fde, uint16_t flags,
3208                            void *private_data)
3209 {
3210         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3211         exit(0);
3212 }
3213
3214 static void smbd_echo_got_packet(struct tevent_req *req);
3215
3216 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
3217                            int parent_pipe)
3218 {
3219         struct smbd_echo_state *state;
3220         struct tevent_req *read_req;
3221
3222         state = talloc_zero(xconn, struct smbd_echo_state);
3223         if (state == NULL) {
3224                 DEBUG(1, ("talloc failed\n"));
3225                 return;
3226         }
3227         state->xconn = xconn;
3228         state->parent_pipe = parent_pipe;
3229         state->ev = samba_tevent_context_init(state);
3230         if (state->ev == NULL) {
3231                 DEBUG(1, ("samba_tevent_context_init failed\n"));
3232                 TALLOC_FREE(state);
3233                 return;
3234         }
3235         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3236                                         TEVENT_FD_READ, smbd_echo_exit,
3237                                         state);
3238         if (state->parent_fde == NULL) {
3239                 DEBUG(1, ("tevent_add_fd failed\n"));
3240                 TALLOC_FREE(state);
3241                 return;
3242         }
3243
3244         read_req = smbd_echo_read_send(state, state->ev, xconn);
3245         if (read_req == NULL) {
3246                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3247                 TALLOC_FREE(state);
3248                 return;
3249         }
3250         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3251
3252         while (true) {
3253                 if (tevent_loop_once(state->ev) == -1) {
3254                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3255                                   strerror(errno)));
3256                         break;
3257                 }
3258         }
3259         TALLOC_FREE(state);
3260 }
3261
3262 static void smbd_echo_got_packet(struct tevent_req *req)
3263 {
3264         struct smbd_echo_state *state = tevent_req_callback_data(
3265                 req, struct smbd_echo_state);
3266         NTSTATUS status;
3267         char *buf = NULL;
3268         size_t buflen = 0;
3269         uint32_t seqnum = 0;
3270         bool reply;
3271
3272         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3273         TALLOC_FREE(req);
3274         if (!NT_STATUS_IS_OK(status)) {
3275                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3276                           nt_errstr(status)));
3277                 exit(1);
3278         }
3279
3280         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3281         if (!reply) {
3282                 size_t num_pending;
3283                 struct iovec *tmp;
3284                 struct iovec *iov;
3285
3286                 num_pending = talloc_array_length(state->pending);
3287                 tmp = talloc_realloc(state, state->pending, struct iovec,
3288                                      num_pending+1);
3289                 if (tmp == NULL) {
3290                         DEBUG(1, ("talloc_realloc failed\n"));
3291                         exit(1);
3292                 }
3293                 state->pending = tmp;
3294
3295                 if (buflen >= smb_size) {
3296                         /*
3297                          * place the seqnum in the packet so that the main process
3298                          * can reply with signing
3299                          */
3300                         SIVAL(buf, smb_ss_field, seqnum);
3301                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3302                 }
3303
3304                 iov = &state->pending[num_pending];
3305                 iov->iov_base = talloc_move(state->pending, &buf);
3306                 iov->iov_len = buflen;
3307
3308                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3309                           (int)getpid()));
3310                 smbd_echo_activate_writer(state);
3311         }
3312
3313         req = smbd_echo_read_send(state, state->ev, state->xconn);
3314         if (req == NULL) {
3315                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3316                 exit(1);
3317         }
3318         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3319 }
3320
3321
3322 /*
3323  * Handle SMBecho requests in a forked child process
3324  */
3325 bool fork_echo_handler(struct smbXsrv_connection *xconn)
3326 {
3327         int listener_pipe[2];
3328         int res;
3329         pid_t child;
3330         bool use_mutex = false;
3331
3332         res = pipe(listener_pipe);
3333         if (res == -1) {
3334                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3335                 return false;
3336         }
3337
3338 #ifdef HAVE_ROBUST_MUTEXES
3339         use_mutex = tdb_runtime_check_for_robust_mutexes();
3340
3341         if (use_mutex) {
3342                 pthread_mutexattr_t a;
3343
3344                 xconn->smb1.echo_handler.socket_mutex =
3345                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3346                 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3347                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3348                                   strerror(errno)));
3349                         goto fail;
3350                 }
3351
3352                 res = pthread_mutexattr_init(&a);
3353                 if (res != 0) {
3354                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3355                                   strerror(res)));
3356                         goto fail;
3357                 }
3358                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3359                 if (res != 0) {
3360                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3361                                   strerror(res)));
3362                         pthread_mutexattr_destroy(&a);
3363                         goto fail;
3364                 }
3365                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3366                 if (res != 0) {
3367                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3368                                   strerror(res)));
3369                         pthread_mutexattr_destroy(&a);
3370                         goto fail;
3371                 }
3372                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3373                 if (res != 0) {
3374                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3375                                   "%s\n", strerror(res)));
3376                         pthread_mutexattr_destroy(&a);
3377                         goto fail;
3378                 }
3379                 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3380                                          &a);
3381                 pthread_mutexattr_destroy(&a);
3382                 if (res != 0) {
3383                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3384                                   strerror(res)));
3385                         goto fail;
3386                 }
3387         }
3388 #endif
3389
3390         if (!use_mutex) {
3391                 xconn->smb1.echo_handler.socket_lock_fd =
3392                         create_unlink_tmp(lp_lock_directory());
3393                 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3394                         DEBUG(1, ("Could not create lock fd: %s\n",
3395                                   strerror(errno)));
3396                         goto fail;
3397                 }
3398         }
3399
3400         child = fork();
3401         if (child == 0) {
3402                 NTSTATUS status;
3403
3404                 close(listener_pipe[0]);
3405                 set_blocking(listener_pipe[1], false);
3406
3407                 status = smbd_reinit_after_fork(xconn->msg_ctx, xconn->ev_ctx,
3408                                                 true, "smbd-echo");
3409                 if (!NT_STATUS_IS_OK(status)) {
3410                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3411                                   nt_errstr(status)));
3412                         exit(1);
3413                 }
3414                 smbd_echo_loop(xconn, listener_pipe[1]);
3415                 exit(0);
3416         }
3417         close(listener_pipe[1]);
3418         listener_pipe[1] = -1;
3419         xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3420
3421         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3422
3423         /*
3424          * Without smb signing this is the same as the normal smbd
3425          * listener. This needs to change once signing comes in.
3426          */
3427         xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(xconn->ev_ctx,
3428                                         xconn,
3429                                         xconn->smb1.echo_handler.trusted_fd,
3430                                         TEVENT_FD_READ,
3431                                         smbd_server_echo_handler,
3432                                         xconn);
3433         if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3434                 DEBUG(1, ("event_add_fd failed\n"));
3435                 goto fail;
3436         }
3437
3438         return true;
3439
3440 fail:
3441         if (listener_pipe[0] != -1) {
3442                 close(listener_pipe[0]);
3443         }
3444         if (listener_pipe[1] != -1) {
3445                 close(listener_pipe[1]);
3446         }
3447         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3448                 close(xconn->smb1.echo_handler.socket_lock_fd);
3449         }
3450 #ifdef HAVE_ROBUST_MUTEXES
3451         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3452                 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3453                 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3454         }
3455 #endif
3456         smbd_echo_init(xconn);
3457
3458         return false;
3459 }
3460
3461 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3462 {
3463         while (user) {
3464                 if (user->session_info &&
3465                     (user->session_info->unix_token->uid == uid)) {
3466                         return true;
3467                 }
3468                 user = user->next;
3469         }
3470         return false;
3471 }
3472
3473 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3474 {
3475         while (user) {
3476                 if (user->session_info != NULL) {
3477                         int i;
3478                         struct security_unix_token *utok;
3479
3480                         utok = user->session_info->unix_token;
3481                         if (utok->gid == gid) {
3482                                 return true;
3483                         }
3484                         for(i=0; i<utok->ngroups; i++) {
3485                                 if (utok->groups[i] == gid) {
3486                                         return true;
3487                                 }
3488                         }
3489                 }
3490                 user = user->next;
3491         }
3492         return false;
3493 }
3494
3495 static bool sid_in_use(const struct user_struct *user,
3496                        const struct dom_sid *psid)
3497 {
3498         while (user) {
3499                 struct security_token *tok;
3500
3501                 if (user->session_info == NULL) {
3502                         continue;
3503                 }
3504                 tok = user->session_info->security_token;
3505                 if (tok == NULL) {
3506                         /*
3507                          * Not sure session_info->security_token can
3508                          * ever be NULL. This check might be not
3509                          * necessary.
3510                          */
3511                         continue;
3512                 }
3513                 if (security_token_has_sid(tok, psid)) {
3514                         return true;
3515                 }
3516                 user = user->next;
3517         }
3518         return false;
3519 }
3520
3521 static bool id_in_use(const struct user_struct *user,
3522                       const struct id_cache_ref *id)
3523 {
3524         switch(id->type) {
3525         case UID:
3526                 return uid_in_use(user, id->id.uid);
3527         case GID:
3528                 return gid_in_use(user, id->id.gid);
3529         case SID:
3530                 return sid_in_use(user, &id->id.sid);
3531         default:
3532                 break;
3533         }
3534         return false;
3535 }
3536
3537 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3538                                void *private_data,
3539                                uint32_t msg_type,
3540                                struct server_id server_id,
3541                                DATA_BLOB* data)
3542 {
3543         const char *msg = (data && data->data)
3544                 ? (const char *)data->data : "<NULL>";
3545         struct id_cache_ref id;
3546         struct smbd_server_connection *sconn =
3547                 talloc_get_type_abort(private_data,
3548                 struct smbd_server_connection);
3549
3550         if (!id_cache_ref_parse(msg, &id)) {
3551                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3552                 return;
3553         }
3554
3555         if (id_in_use(sconn->users, &id)) {
3556                 exit_server_cleanly(msg);
3557         }
3558         id_cache_delete_from_cache(&id);
3559 }
3560
3561 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3562                                         enum protocol_types protocol)
3563 {
3564         NTSTATUS status;
3565
3566         conn->protocol = protocol;
3567
3568         if (conn->client->session_table != NULL) {
3569                 return NT_STATUS_OK;
3570         }
3571
3572         if (protocol >= PROTOCOL_SMB2_02) {
3573                 status = smb2srv_session_table_init(conn);
3574                 if (!NT_STATUS_IS_OK(status)) {
3575                         conn->protocol = PROTOCOL_NONE;
3576                         return status;
3577                 }
3578
3579                 status = smb2srv_open_table_init(conn);
3580                 if (!NT_STATUS_IS_OK(status)) {
3581                         conn->protocol = PROTOCOL_NONE;
3582                         return status;
3583                 }
3584         } else {
3585                 status = smb1srv_session_table_init(conn);
3586                 if (!NT_STATUS_IS_OK(status)) {
3587                         conn->protocol = PROTOCOL_NONE;
3588                         return status;
3589                 }
3590
3591                 status = smb1srv_tcon_table_init(conn);
3592                 if (!NT_STATUS_IS_OK(status)) {
3593                         conn->protocol = PROTOCOL_NONE;
3594                         return status;
3595                 }
3596
3597                 status = smb1srv_open_table_init(conn);
3598                 if (!NT_STATUS_IS_OK(status)) {
3599                         conn->protocol = PROTOCOL_NONE;
3600                         return status;
3601                 }
3602         }
3603
3604         set_Protocol(protocol);
3605         return NT_STATUS_OK;
3606 }
3607
3608 struct smbd_tevent_trace_state {
3609         struct tevent_context *ev;
3610         TALLOC_CTX *frame;
3611         SMBPROFILE_BASIC_ASYNC_STATE(profile_idle);
3612 };
3613
3614 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3615                                        void *private_data)
3616 {
3617         struct smbd_tevent_trace_state *state =
3618                 (struct smbd_tevent_trace_state *)private_data;
3619
3620         switch (point) {
3621         case TEVENT_TRACE_BEFORE_WAIT:
3622                 if (!smbprofile_dump_pending()) {
3623                         /*
3624                          * If there's no dump pending
3625                          * we don't want to schedule a new 1 sec timer.
3626                          *
3627                          * Instead we want to sleep as long as nothing happens.
3628                          */
3629                         smbprofile_dump_setup(NULL);
3630                 }
3631                 SMBPROFILE_BASIC_ASYNC_START(idle, profile_p, state->profile_idle);
3632                 break;
3633         case TEVENT_TRACE_AFTER_WAIT:
3634                 SMBPROFILE_BASIC_ASYNC_END(state->profile_idle);
3635                 if (!smbprofile_dump_pending()) {
3636                         /*
3637                          * We need to flush our state after sleeping
3638                          * (hopefully a long time).
3639                          */
3640                         smbprofile_dump();
3641                         /*
3642                          * future profiling events should trigger timers
3643                          * on our main event context.
3644                          */
3645                         smbprofile_dump_setup(state->ev);
3646                 }
3647                 break;
3648         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3649                 TALLOC_FREE(state->frame);
3650                 state->frame = talloc_stackframe_pool(8192);
3651                 break;
3652         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3653                 TALLOC_FREE(state->frame);
3654                 break;
3655         }
3656
3657         errno = 0;
3658 }
3659
3660 /**
3661  * Create a debug string for the connection
3662  *
3663  * This is allocated to talloc_tos() or a string constant
3664  * in certain corner cases. The returned string should
3665  * hence not be free'd directly but only via the talloc stack.
3666  */
3667 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3668 {
3669         const char *ret;
3670
3671         /*
3672          * TODO: this can be improved later
3673          * maybe including the client guid or more
3674          */
3675         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3676         if (ret == NULL) {
3677                 return "<tsocket_address_string() failed>";
3678         }
3679
3680         return ret;
3681 }
3682
3683 NTSTATUS smbd_add_connection(struct smbXsrv_client *client, int sock_fd,
3684                              struct smbXsrv_connection **_xconn)
3685 {
3686         TALLOC_CTX *frame = talloc_stackframe();
3687         struct smbXsrv_connection *xconn;
3688         struct sockaddr_storage ss_srv;
3689         void *sp_srv = (void *)&ss_srv;
3690         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3691         struct sockaddr_storage ss_clnt;
3692         void *sp_clnt = (void *)&ss_clnt;
3693         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3694         socklen_t sa_socklen;
3695         struct tsocket_address *local_address = NULL;
3696         struct tsocket_address *remote_address = NULL;
3697         const char *remaddr = NULL;
3698         char *p;
3699         const char *rhost = NULL;
3700         int ret;
3701         int tmp;
3702
3703         *_xconn = NULL;
3704
3705         DO_PROFILE_INC(connect);
3706
3707         xconn = talloc_zero(client, struct smbXsrv_connection);
3708         if (xconn == NULL) {
3709                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3710                 TALLOC_FREE(frame);
3711                 return NT_STATUS_NO_MEMORY;
3712         }
3713         talloc_steal(frame, xconn);
3714
3715         xconn->ev_ctx = client->ev_ctx;
3716         xconn->msg_ctx = client->msg_ctx;
3717         xconn->transport.sock = sock_fd;
3718         smbd_echo_init(xconn);
3719         xconn->protocol = PROTOCOL_NONE;
3720
3721         /* Ensure child is set to blocking mode */
3722         set_blocking(sock_fd,True);
3723
3724         set_socket_options(sock_fd, "SO_KEEPALIVE");
3725         set_socket_options(sock_fd, lp_socket_options());
3726
3727         sa_socklen = sizeof(ss_clnt);
3728         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3729         if (ret != 0) {
3730                 int saved_errno = errno;
3731                 int level = (errno == ENOTCONN)?2:0;
3732                 DEBUG(level,("getpeername() failed - %s\n",
3733                       strerror(saved_errno)));
3734                 TALLOC_FREE(frame);
3735                 return map_nt_error_from_unix_common(saved_errno);
3736         }
3737         ret = tsocket_address_bsd_from_sockaddr(xconn,
3738                                                 sa_clnt, sa_socklen,
3739                                                 &remote_address);
3740         if (ret != 0) {
3741                 int saved_errno = errno;
3742                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3743                         __location__, strerror(saved_errno)));
3744                 TALLOC_FREE(frame);
3745                 return map_nt_error_from_unix_common(saved_errno);
3746         }
3747
3748         sa_socklen = sizeof(ss_srv);
3749         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3750         if (ret != 0) {
3751                 int saved_errno = errno;
3752                 int level = (errno == ENOTCONN)?2:0;
3753                 DEBUG(level,("getsockname() failed - %s\n",
3754                       strerror(saved_errno)));
3755                 TALLOC_FREE(frame);
3756                 return map_nt_error_from_unix_common(saved_errno);
3757         }
3758         ret = tsocket_address_bsd_from_sockaddr(xconn,
3759                                                 sa_srv, sa_socklen,
3760                                                 &local_address);
3761         if (ret != 0) {
3762                 int saved_errno = errno;
3763                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3764                         __location__, strerror(saved_errno)));
3765                 TALLOC_FREE(frame);
3766                 return map_nt_error_from_unix_common(saved_errno);
3767         }
3768
3769         if (tsocket_address_is_inet(remote_address, "ip")) {
3770                 remaddr = tsocket_address_inet_addr_string(remote_address,
3771                                                            talloc_tos());
3772                 if (remaddr == NULL) {
3773                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3774                                  __location__, strerror(errno)));
3775                         TALLOC_FREE(frame);
3776                         return NT_STATUS_NO_MEMORY;
3777                 }
3778         } else {
3779                 remaddr = "0.0.0.0";
3780         }
3781
3782         /*
3783          * Before the first packet, check the global hosts allow/ hosts deny
3784          * parameters before doing any parsing of packets passed to us by the
3785          * client. This prevents attacks on our parsing code from hosts not in
3786          * the hosts allow list.
3787          */
3788
3789         ret = get_remote_hostname(remote_address,
3790                                   &p, talloc_tos());
3791         if (ret < 0) {
3792                 int saved_errno = errno;
3793                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3794                         __location__, strerror(saved_errno)));
3795                 TALLOC_FREE(frame);
3796                 return map_nt_error_from_unix_common(saved_errno);
3797         }
3798         rhost = p;
3799         if (strequal(rhost, "UNKNOWN")) {
3800                 rhost = remaddr;
3801         }
3802
3803         xconn->local_address = local_address;
3804         xconn->remote_address = remote_address;
3805         xconn->remote_hostname = talloc_strdup(xconn, rhost);
3806         if (xconn->remote_hostname == NULL) {
3807                 return NT_STATUS_NO_MEMORY;
3808         }
3809
3810         if (!srv_init_signing(xconn)) {
3811                 DEBUG(0, ("Failed to init smb_signing\n"));
3812                 TALLOC_FREE(frame);
3813                 return NT_STATUS_INTERNAL_ERROR;
3814         }
3815
3816         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3817                           xconn->remote_hostname,
3818                           remaddr)) {
3819                 DEBUG( 1, ("Connection denied from %s to %s\n",
3820                            tsocket_address_string(remote_address, talloc_tos()),
3821                            tsocket_address_string(local_address, talloc_tos())));
3822
3823                 /*
3824                  * We return a valid xconn
3825                  * so that the caller can return an error message
3826                  * to the client
3827                  */
3828                 client->connections = xconn;
3829                 xconn->client = client;
3830                 talloc_steal(client, xconn);
3831
3832                 *_xconn = xconn;
3833                 TALLOC_FREE(frame);
3834                 return NT_STATUS_NETWORK_ACCESS_DENIED;
3835         }
3836
3837         DEBUG(10, ("Connection allowed from %s to %s\n",
3838                    tsocket_address_string(remote_address, talloc_tos()),
3839                    tsocket_address_string(local_address, talloc_tos())));
3840
3841         if (lp_clustering()) {
3842                 /*
3843                  * We need to tell ctdb about our client's TCP
3844                  * connection, so that for failover ctdbd can send
3845                  * tickle acks, triggering a reconnection by the
3846                  * client.
3847                  */
3848                 NTSTATUS status;
3849
3850                 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3851                 if (!NT_STATUS_IS_OK(status)) {
3852                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3853                                   nt_errstr(status)));
3854                 }
3855         }
3856
3857         tmp = lp_max_xmit();
3858         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3859         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3860
3861         xconn->smb1.negprot.max_recv = tmp;
3862
3863         xconn->smb1.sessions.done_sesssetup = false;
3864         xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3865
3866         xconn->transport.fde = tevent_add_fd(client->ev_ctx,
3867                                              xconn,
3868                                              sock_fd,
3869                                              TEVENT_FD_READ,
3870                                              smbd_server_connection_handler,
3871                                              xconn);
3872         if (!xconn->transport.fde) {
3873                 TALLOC_FREE(frame);
3874                 return NT_STATUS_NO_MEMORY;
3875         }
3876
3877         /* for now we only have one connection */
3878         DLIST_ADD_END(client->connections, xconn);
3879         xconn->client = client;
3880         talloc_steal(client, xconn);
3881
3882         *_xconn = xconn;
3883         TALLOC_FREE(frame);
3884         return NT_STATUS_OK;
3885 }
3886
3887 /****************************************************************************
3888  Process commands from the client
3889 ****************************************************************************/
3890
3891 void smbd_process(struct tevent_context *ev_ctx,
3892                   struct messaging_context *msg_ctx,
3893                   int sock_fd,
3894                   bool interactive)
3895 {
3896         struct smbd_tevent_trace_state trace_state = {
3897                 .ev = ev_ctx,
3898                 .frame = talloc_stackframe(),
3899         };
3900         struct smbXsrv_client *client = NULL;
3901         struct smbd_server_connection *sconn = NULL;
3902         struct smbXsrv_connection *xconn = NULL;
3903         const char *locaddr = NULL;
3904         const char *remaddr = NULL;
3905         int ret;
3906         NTSTATUS status;
3907         struct timeval tv = timeval_current();
3908         NTTIME now = timeval_to_nttime(&tv);
3909         char *chroot_dir = NULL;
3910         int rc;
3911
3912         status = smbXsrv_client_create(ev_ctx, ev_ctx, msg_ctx, now, &client);
3913         if (!NT_STATUS_IS_OK(status)) {
3914                 DBG_ERR("smbXsrv_client_create(): %s\n", nt_errstr(status));
3915                 exit_server_cleanly("talloc_zero(struct smbXsrv_client).\n");
3916         }
3917
3918         /*
3919          * TODO: remove this...:-)
3920          */
3921         global_smbXsrv_client = client;
3922
3923         sconn = talloc_zero(client, struct smbd_server_connection);
3924         if (sconn == NULL) {
3925                 exit_server("failed to create smbd_server_connection");
3926         }
3927
3928         client->sconn = sconn;
3929         sconn->client = client;
3930
3931         sconn->ev_ctx = ev_ctx;
3932         sconn->msg_ctx = msg_ctx;
3933
3934         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3935                 /*
3936                  * We're not making the decision here,
3937                  * we're just allowing the client
3938                  * to decide between SMB1 and SMB2
3939                  * with the first negprot
3940                  * packet.
3941                  */
3942                 sconn->using_smb2 = true;
3943         }
3944
3945         if (!interactive) {
3946                 smbd_setup_sig_term_handler(sconn);
3947                 smbd_setup_sig_hup_handler(sconn);
3948
3949                 if (!serverid_register(messaging_server_id(msg_ctx),
3950                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3951                                        |FLAG_MSG_DBWRAP
3952                                        |FLAG_MSG_PRINT_GENERAL)) {
3953                         exit_server_cleanly("Could not register myself in "
3954                                             "serverid.tdb");
3955                 }
3956         }
3957
3958         status = smbd_add_connection(client, sock_fd, &xconn);
3959         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3960                 /*
3961                  * send a negative session response "not listening on calling
3962                  * name"
3963                  */
3964                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3965                 (void)srv_send_smb(xconn,(char *)buf, false,
3966                                    0, false, NULL);
3967                 exit_server_cleanly("connection denied");
3968         } else if (!NT_STATUS_IS_OK(status)) {
3969                 exit_server_cleanly(nt_errstr(status));
3970         }
3971
3972         sconn->local_address =
3973                 tsocket_address_copy(xconn->local_address, sconn);
3974         if (sconn->local_address == NULL) {
3975                 exit_server_cleanly("tsocket_address_copy() failed");
3976         }
3977         sconn->remote_address =
3978                 tsocket_address_copy(xconn->remote_address, sconn);
3979         if (sconn->remote_address == NULL) {
3980                 exit_server_cleanly("tsocket_address_copy() failed");
3981         }
3982         sconn->remote_hostname =
3983                 talloc_strdup(sconn, xconn->remote_hostname);
3984         if (sconn->remote_hostname == NULL) {
3985                 exit_server_cleanly("tsocket_strdup() failed");
3986         }
3987
3988         if (tsocket_address_is_inet(sconn->local_address, "ip")) {
3989                 locaddr = tsocket_address_inet_addr_string(
3990                                 sconn->local_address,
3991                                 talloc_tos());
3992                 if (locaddr == NULL) {
3993                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3994                                  __location__, strerror(errno)));
3995                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3996                 }
3997         } else {
3998                 locaddr = "0.0.0.0";
3999         }
4000
4001         if (tsocket_address_is_inet(sconn->remote_address, "ip")) {
4002                 remaddr = tsocket_address_inet_addr_string(
4003                                 sconn->remote_address,
4004                                 talloc_tos());
4005                 if (remaddr == NULL) {
4006                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
4007                                  __location__, strerror(errno)));
4008                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
4009                 }
4010         } else {
4011                 remaddr = "0.0.0.0";
4012         }
4013
4014         /* this is needed so that we get decent entries
4015            in smbstatus for port 445 connects */
4016         set_remote_machine_name(remaddr, false);
4017         reload_services(sconn, conn_snum_used, true);
4018         sub_set_socket_ids(remaddr,
4019                            sconn->remote_hostname,
4020                            locaddr);
4021
4022         if (lp_preload_modules()) {
4023                 smb_load_all_modules_absoute_path(lp_preload_modules());
4024         }
4025
4026         smb_perfcount_init();
4027
4028         if (!init_account_policy()) {
4029                 exit_server("Could not open account policy tdb.\n");
4030         }
4031
4032         chroot_dir = lp_root_directory(talloc_tos());
4033         if (chroot_dir[0] != '\0') {
4034                 rc = chdir(chroot_dir);
4035                 if (rc != 0) {
4036                         DBG_ERR("Failed to chdir to %s\n", chroot_dir);
4037                         exit_server("Failed to chdir()");
4038                 }
4039
4040                 rc = chroot(chroot_dir);
4041                 if (rc != 0) {
4042                         DBG_ERR("Failed to change root to %s\n", chroot_dir);
4043                         exit_server("Failed to chroot()");
4044                 }
4045                 DBG_WARNING("Changed root to %s\n", chroot_dir);
4046
4047                 TALLOC_FREE(chroot_dir);
4048         }
4049
4050         if (!file_init(sconn)) {
4051                 exit_server("file_init() failed");
4052         }
4053
4054         /* Setup oplocks */
4055         if (!init_oplocks(sconn))
4056                 exit_server("Failed to init oplocks");
4057
4058         /* register our message handlers */
4059         messaging_register(sconn->msg_ctx, sconn,
4060                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
4061         messaging_register(sconn->msg_ctx, sconn,
4062                            MSG_SMB_CLOSE_FILE, msg_close_file);
4063         messaging_register(sconn->msg_ctx, sconn,
4064                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
4065
4066         id_cache_register_msgs(sconn->msg_ctx);
4067         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
4068         messaging_register(sconn->msg_ctx, sconn,
4069                            ID_CACHE_KILL, smbd_id_cache_kill);
4070
4071         messaging_deregister(sconn->msg_ctx,
4072                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
4073         messaging_register(sconn->msg_ctx, sconn,
4074                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
4075
4076         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
4077                              NULL);
4078         messaging_register(sconn->msg_ctx, sconn,
4079                            MSG_SMB_KILL_CLIENT_IP,
4080                            msg_kill_client_ip);
4081
4082         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
4083
4084         /*
4085          * Use the default MSG_DEBUG handler to avoid rebroadcasting
4086          * MSGs to all child processes
4087          */
4088         messaging_deregister(sconn->msg_ctx,
4089                              MSG_DEBUG, NULL);
4090         messaging_register(sconn->msg_ctx, NULL,
4091                            MSG_DEBUG, debug_message);
4092
4093         if ((lp_keepalive() != 0)
4094             && !(event_add_idle(ev_ctx, NULL,
4095                                 timeval_set(lp_keepalive(), 0),
4096                                 "keepalive", keepalive_fn,
4097                                 sconn))) {
4098                 DEBUG(0, ("Could not add keepalive event\n"));
4099                 exit(1);
4100         }
4101
4102         if (!(event_add_idle(ev_ctx, NULL,
4103                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
4104                              "deadtime", deadtime_fn, sconn))) {
4105                 DEBUG(0, ("Could not add deadtime event\n"));
4106                 exit(1);
4107         }
4108
4109         if (!(event_add_idle(ev_ctx, NULL,
4110                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
4111                              "housekeeping", housekeeping_fn, sconn))) {
4112                 DEBUG(0, ("Could not add housekeeping event\n"));
4113                 exit(1);
4114         }
4115
4116         smbprofile_dump_setup(ev_ctx);
4117
4118         if (!init_dptrs(sconn)) {
4119                 exit_server("init_dptrs() failed");
4120         }
4121
4122         TALLOC_FREE(trace_state.frame);
4123
4124         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback,
4125                                   &trace_state);
4126
4127         ret = tevent_loop_wait(ev_ctx);
4128         if (ret != 0) {
4129                 DEBUG(1, ("tevent_loop_wait failed: %d, %s,"
4130                           " exiting\n", ret, strerror(errno)));
4131         }
4132
4133         TALLOC_FREE(trace_state.frame);
4134
4135         exit_server_cleanly(NULL);
4136 }
4137
4138 bool req_is_in_chain(const struct smb_request *req)
4139 {
4140         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
4141                 /*
4142                  * We're right now handling a subsequent request, so we must
4143                  * be in a chain
4144                  */
4145                 return true;
4146         }
4147
4148         if (!is_andx_req(req->cmd)) {
4149                 return false;
4150         }
4151
4152         if (req->wct < 2) {
4153                 /*
4154                  * Okay, an illegal request, but definitely not chained :-)
4155                  */
4156                 return false;
4157         }
4158
4159         return (CVAL(req->vwv+0, 0) != 0xFF);
4160 }