source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43 #include "system/threads.h"
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct smbXsrv_connection *xconn;
  51         struct tevent_timer *te;
  52         struct smb_perfcount_data pcd;
  53         uint32_t seqnum;
  54         bool encrypted;
  55         bool processed;
  56         DATA_BLOB buf;
  57         struct deferred_open_record *open_rec;
  58 };
  59
  60 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  61                                    char *outbuf);
  62 static struct pending_message_list *get_deferred_open_message_smb(
  63         struct smbd_server_connection *sconn, uint64_t mid);
  64 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  65
  66 static void smbd_echo_init(struct smbXsrv_connection *xconn)
  67 {
  68         xconn->smb1.echo_handler.trusted_fd = -1;
  69         xconn->smb1.echo_handler.socket_lock_fd = -1;
  70 #ifdef HAVE_ROBUST_MUTEXES
  71         xconn->smb1.echo_handler.socket_mutex = NULL;
  72 #endif
  73 }
  74
  75 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
  76 {
  77         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
  78                 return true;
  79         }
  80
  81 #ifdef HAVE_ROBUST_MUTEXES
  82         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
  83                 return true;
  84         }
  85 #endif
  86
  87         return false;
  88 }
  89
  90 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
  91 {
  92         if (!smbd_echo_active(xconn)) {
  93                 return true;
  94         }
  95
  96         xconn->smb1.echo_handler.ref_count++;
  97
  98         if (xconn->smb1.echo_handler.ref_count > 1) {
  99                 return true;
 100         }
 101
 102         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 103
 104 #ifdef HAVE_ROBUST_MUTEXES
 105         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 106                 int ret = EINTR;
 107
 108                 while (ret == EINTR) {
 109                         ret = pthread_mutex_lock(
 110                                 xconn->smb1.echo_handler.socket_mutex);
 111                         if (ret == 0) {
 112                                 break;
 113                         }
 114                 }
 115                 if (ret != 0) {
 116                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 117                                   strerror(ret)));
 118                         return false;
 119                 }
 120         }
 121 #endif
 122
 123         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 124                 bool ok;
 125
 126                 do {
 127                         ok = fcntl_lock(
 128                                 xconn->smb1.echo_handler.socket_lock_fd,
 129                                 F_SETLKW, 0, 0, F_WRLCK);
 130                 } while (!ok && (errno == EINTR));
 131
 132                 if (!ok) {
 133                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 134                         return false;
 135                 }
 136         }
 137
 138         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 139
 140         return true;
 141 }
 142
 143 void smbd_lock_socket(struct smbXsrv_connection *xconn)
 144 {
 145         if (!smbd_lock_socket_internal(xconn)) {
 146                 exit_server_cleanly("failed to lock socket");
 147         }
 148 }
 149
 150 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
 151 {
 152         if (!smbd_echo_active(xconn)) {
 153                 return true;
 154         }
 155
 156         xconn->smb1.echo_handler.ref_count--;
 157
 158         if (xconn->smb1.echo_handler.ref_count > 0) {
 159                 return true;
 160         }
 161
 162 #ifdef HAVE_ROBUST_MUTEXES
 163         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 164                 int ret = EINTR;
 165
 166                 while (ret == EINTR) {
 167                         ret = pthread_mutex_unlock(
 168                                 xconn->smb1.echo_handler.socket_mutex);
 169                         if (ret == 0) {
 170                                 break;
 171                         }
 172                 }
 173                 if (ret != 0) {
 174                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 175                                   strerror(ret)));
 176                         return false;
 177                 }
 178         }
 179 #endif
 180
 181         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 182                 bool ok;
 183
 184                 do {
 185                         ok = fcntl_lock(
 186                                 xconn->smb1.echo_handler.socket_lock_fd,
 187                                 F_SETLKW, 0, 0, F_UNLCK);
 188                 } while (!ok && (errno == EINTR));
 189
 190                 if (!ok) {
 191                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 192                         return false;
 193                 }
 194         }
 195
 196         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 197
 198         return true;
 199 }
 200
 201 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
 202 {
 203         if (!smbd_unlock_socket_internal(xconn)) {
 204                 exit_server_cleanly("failed to unlock socket");
 205         }
 206 }
 207
 208 /* Accessor function for smb_read_error for smbd functions. */
 209
 210 /****************************************************************************
 211  Send an smb to a fd.
 212 ****************************************************************************/
 213
 214 bool srv_send_smb(struct smbXsrv_connection *xconn, char *buffer,
 215                   bool do_signing, uint32_t seqnum,
 216                   bool do_encrypt,
 217                   struct smb_perfcount_data *pcd)
 218 {
 219         size_t len = 0;
 220         ssize_t ret;
 221         char *buf_out = buffer;
 222
 223         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 224                 /*
 225                  * we're not supposed to do any io
 226                  */
 227                 return true;
 228         }
 229
 230         smbd_lock_socket(xconn);
 231
 232         if (do_signing) {
 233                 /* Sign the outgoing packet if required. */
 234                 srv_calculate_sign_mac(xconn, buf_out, seqnum);
 235         }
 236
 237         if (do_encrypt) {
 238                 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
 239                 if (!NT_STATUS_IS_OK(status)) {
 240                         DEBUG(0, ("send_smb: SMB encryption failed "
 241                                 "on outgoing packet! Error %s\n",
 242                                 nt_errstr(status) ));
 243                         ret = -1;
 244                         goto out;
 245                 }
 246         }
 247
 248         len = smb_len_large(buf_out) + 4;
 249
 250         ret = write_data(xconn->transport.sock, buf_out, len);
 251         if (ret <= 0) {
 252                 int saved_errno = errno;
 253                 /*
 254                  * Try and give an error message saying what
 255                  * client failed.
 256                  */
 257                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 258                          (int)getpid(), (int)len,
 259                          smbXsrv_connection_dbg(xconn),
 260                          (int)ret, strerror(saved_errno)));
 261                 errno = saved_errno;
 262
 263                 srv_free_enc_buffer(xconn, buf_out);
 264                 goto out;
 265         }
 266
 267         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 268         srv_free_enc_buffer(xconn, buf_out);
 269 out:
 270         SMB_PERFCOUNT_END(pcd);
 271
 272         smbd_unlock_socket(xconn);
 273         return (ret > 0);
 274 }
 275
 276 /*******************************************************************
 277  Setup the word count and byte count for a smb message.
 278 ********************************************************************/
 279
 280 int srv_set_message(char *buf,
 281                         int num_words,
 282                         int num_bytes,
 283                         bool zero)
 284 {
 285         if (zero && (num_words || num_bytes)) {
 286                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 287         }
 288         SCVAL(buf,smb_wct,num_words);
 289         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 290         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 291         return (smb_size + num_words*2 + num_bytes);
 292 }
 293
 294 static bool valid_smb_header(const uint8_t *inbuf)
 295 {
 296         if (is_encrypted_packet(inbuf)) {
 297                 return true;
 298         }
 299         /*
 300          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 301          * but it just looks weird to call strncmp for this one.
 302          */
 303         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 304 }
 305
 306 /* Socket functions for smbd packet processing. */
 307
 308 static bool valid_packet_size(size_t len)
 309 {
 310         /*
 311          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 312          * of header. Don't print the error if this fits.... JRA.
 313          */
 314
 315         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 316                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 317                                         (unsigned long)len));
 318                 return false;
 319         }
 320         return true;
 321 }
 322
 323 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 324                                       unsigned int timeout, ssize_t len)
 325 {
 326         NTSTATUS status;
 327
 328         if (len <= 0) {
 329                 return NT_STATUS_OK;
 330         }
 331
 332         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 333         if (!NT_STATUS_IS_OK(status)) {
 334                 char addr[INET6_ADDRSTRLEN];
 335                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 336                           "error = %s.\n",
 337                           get_peer_addr(fd, addr, sizeof(addr)),
 338                           nt_errstr(status)));
 339         }
 340         return status;
 341 }
 342
 343 /****************************************************************************
 344  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 345 ****************************************************************************/
 346
 347 /*
 348  * Unfortunately, earlier versions of smbclient/libsmbclient
 349  * don't send this "standard" writeX header. I've fixed this
 350  * for 3.2 but we'll use the old method with earlier versions.
 351  * Windows and CIFSFS at least use this standard size. Not
 352  * sure about MacOSX.
 353  */
 354
 355 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 356                                 (2*14) + /* word count (including bcc) */ \
 357                                 1 /* pad byte */)
 358
 359 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 360                                                     const char lenbuf[4],
 361                                                     struct smbXsrv_connection *xconn,
 362                                                     int sock,
 363                                                     char **buffer,
 364                                                     unsigned int timeout,
 365                                                     size_t *p_unread,
 366                                                     size_t *len_ret)
 367 {
 368         /* Size of a WRITEX call (+4 byte len). */
 369         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 370         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 371         ssize_t toread;
 372         NTSTATUS status;
 373
 374         memcpy(writeX_header, lenbuf, 4);
 375
 376         status = read_fd_with_timeout(
 377                 sock, writeX_header + 4,
 378                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 379                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 380                 timeout, NULL);
 381
 382         if (!NT_STATUS_IS_OK(status)) {
 383                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 384                           "error = %s.\n",
 385                           smbXsrv_connection_dbg(xconn),
 386                           nt_errstr(status)));
 387                 return status;
 388         }
 389
 390         /*
 391          * Ok - now try and see if this is a possible
 392          * valid writeX call.
 393          */
 394
 395         if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
 396                 /*
 397                  * If the data offset is beyond what
 398                  * we've read, drain the extra bytes.
 399                  */
 400                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 401                 ssize_t newlen;
 402
 403                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 404                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 405                         if (drain_socket(sock, drain) != drain) {
 406                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 407                                         " failed to drain pending bytes");
 408                         }
 409                 } else {
 410                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 411                 }
 412
 413                 /* Spoof down the length and null out the bcc. */
 414                 set_message_bcc(writeX_header, 0);
 415                 newlen = smb_len(writeX_header);
 416
 417                 /* Copy the header we've written. */
 418
 419                 *buffer = (char *)talloc_memdup(mem_ctx,
 420                                 writeX_header,
 421                                 sizeof(writeX_header));
 422
 423                 if (*buffer == NULL) {
 424                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 425                                   (int)sizeof(writeX_header)));
 426                         return NT_STATUS_NO_MEMORY;
 427                 }
 428
 429                 /* Work out the remaining bytes. */
 430                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 431                 *len_ret = newlen + 4;
 432                 return NT_STATUS_OK;
 433         }
 434
 435         if (!valid_packet_size(len)) {
 436                 return NT_STATUS_INVALID_PARAMETER;
 437         }
 438
 439         /*
 440          * Not a valid writeX call. Just do the standard
 441          * talloc and return.
 442          */
 443
 444         *buffer = talloc_array(mem_ctx, char, len+4);
 445
 446         if (*buffer == NULL) {
 447                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 448                           (int)len+4));
 449                 return NT_STATUS_NO_MEMORY;
 450         }
 451
 452         /* Copy in what we already read. */
 453         memcpy(*buffer,
 454                 writeX_header,
 455                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 456         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 457
 458         if(toread > 0) {
 459                 status = read_packet_remainder(
 460                         sock,
 461                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 462                         timeout, toread);
 463
 464                 if (!NT_STATUS_IS_OK(status)) {
 465                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 466                                    nt_errstr(status)));
 467                         return status;
 468                 }
 469         }
 470
 471         *len_ret = len + 4;
 472         return NT_STATUS_OK;
 473 }
 474
 475 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 476                                        struct smbXsrv_connection *xconn,
 477                                        int sock,
 478                                        char **buffer, unsigned int timeout,
 479                                        size_t *p_unread, size_t *plen)
 480 {
 481         char lenbuf[4];
 482         size_t len;
 483         int min_recv_size = lp_min_receive_file_size();
 484         NTSTATUS status;
 485
 486         *p_unread = 0;
 487
 488         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 489                                                   &len);
 490         if (!NT_STATUS_IS_OK(status)) {
 491                 return status;
 492         }
 493
 494         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 495             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 496                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 497             !srv_is_signing_active(xconn) &&
 498             xconn->smb1.echo_handler.trusted_fde == NULL) {
 499
 500                 return receive_smb_raw_talloc_partial_read(
 501                         mem_ctx, lenbuf, xconn, sock, buffer, timeout,
 502                         p_unread, plen);
 503         }
 504
 505         if (!valid_packet_size(len)) {
 506                 return NT_STATUS_INVALID_PARAMETER;
 507         }
 508
 509         /*
 510          * The +4 here can't wrap, we've checked the length above already.
 511          */
 512
 513         *buffer = talloc_array(mem_ctx, char, len+4);
 514
 515         if (*buffer == NULL) {
 516                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 517                           (int)len+4));
 518                 return NT_STATUS_NO_MEMORY;
 519         }
 520
 521         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 522
 523         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 524         if (!NT_STATUS_IS_OK(status)) {
 525                 return status;
 526         }
 527
 528         *plen = len + 4;
 529         return NT_STATUS_OK;
 530 }
 531
 532 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 533                                    struct smbXsrv_connection *xconn,
 534                                    int sock,
 535                                    char **buffer, unsigned int timeout,
 536                                    size_t *p_unread, bool *p_encrypted,
 537                                    size_t *p_len,
 538                                    uint32_t *seqnum,
 539                                    bool trusted_channel)
 540 {
 541         size_t len = 0;
 542         NTSTATUS status;
 543
 544         *p_encrypted = false;
 545
 546         status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
 547                                         p_unread, &len);
 548         if (!NT_STATUS_IS_OK(status)) {
 549                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 550                       ("receive_smb_raw_talloc failed for client %s "
 551                        "read error = %s.\n",
 552                        smbXsrv_connection_dbg(xconn),
 553                        nt_errstr(status)) );
 554                 return status;
 555         }
 556
 557         if (is_encrypted_packet((uint8_t *)*buffer)) {
 558                 status = srv_decrypt_buffer(xconn, *buffer);
 559                 if (!NT_STATUS_IS_OK(status)) {
 560                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 561                                 "incoming packet! Error %s\n",
 562                                 nt_errstr(status) ));
 563                         return status;
 564                 }
 565                 *p_encrypted = true;
 566         }
 567
 568         /* Check the incoming SMB signature. */
 569         if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
 570                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 571                           "incoming packet!\n"));
 572                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 573         }
 574
 575         *p_len = len;
 576         return NT_STATUS_OK;
 577 }
 578
 579 /*
 580  * Initialize a struct smb_request from an inbuf
 581  */
 582
 583 static bool init_smb_request(struct smb_request *req,
 584                              struct smbd_server_connection *sconn,
 585                              struct smbXsrv_connection *xconn,
 586                              const uint8 *inbuf,
 587                              size_t unread_bytes, bool encrypted,
 588                              uint32_t seqnum)
 589 {
 590         struct smbXsrv_tcon *tcon;
 591         NTSTATUS status;
 592         NTTIME now;
 593         size_t req_size = smb_len(inbuf) + 4;
 594
 595         /* Ensure we have at least smb_size bytes. */
 596         if (req_size < smb_size) {
 597                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 598                         (unsigned int)req_size ));
 599                 return false;
 600         }
 601
 602         req->request_time = timeval_current();
 603         now = timeval_to_nttime(&req->request_time);
 604
 605         req->cmd    = CVAL(inbuf, smb_com);
 606         req->flags2 = SVAL(inbuf, smb_flg2);
 607         req->smbpid = SVAL(inbuf, smb_pid);
 608         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 609         req->seqnum = seqnum;
 610         req->vuid   = SVAL(inbuf, smb_uid);
 611         req->tid    = SVAL(inbuf, smb_tid);
 612         req->wct    = CVAL(inbuf, smb_wct);
 613         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 614         req->buflen = smb_buflen(inbuf);
 615         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 616         req->unread_bytes = unread_bytes;
 617         req->encrypted = encrypted;
 618         req->sconn = sconn;
 619         req->xconn = xconn;
 620         req->conn = NULL;
 621         if (xconn != NULL) {
 622                 status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
 623                 if (NT_STATUS_IS_OK(status)) {
 624                         req->conn = tcon->compat;
 625                 }
 626         }
 627         req->chain_fsp = NULL;
 628         req->smb2req = NULL;
 629         req->priv_paths = NULL;
 630         req->chain = NULL;
 631         smb_init_perfcount_data(&req->pcd);
 632
 633         /* Ensure we have at least wct words and 2 bytes of bcc. */
 634         if (smb_size + req->wct*2 > req_size) {
 635                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 636                         (unsigned int)req->wct,
 637                         (unsigned int)req_size));
 638                 return false;
 639         }
 640         /* Ensure bcc is correct. */
 641         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 642                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 643                         "(wct = %u, size %u)\n",
 644                         (unsigned int)req->buflen,
 645                         (unsigned int)req->wct,
 646                         (unsigned int)req_size));
 647                 return false;
 648         }
 649
 650         req->outbuf = NULL;
 651         return true;
 652 }
 653
 654 static void process_smb(struct smbXsrv_connection *xconn,
 655                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 656                         uint32_t seqnum, bool encrypted,
 657                         struct smb_perfcount_data *deferred_pcd);
 658
 659 static void smbd_deferred_open_timer(struct tevent_context *ev,
 660                                      struct tevent_timer *te,
 661                                      struct timeval _tval,
 662                                      void *private_data)
 663 {
 664         struct pending_message_list *msg = talloc_get_type(private_data,
 665                                            struct pending_message_list);
 666         struct smbd_server_connection *sconn = msg->sconn;
 667         struct smbXsrv_connection *xconn = msg->xconn;
 668         TALLOC_CTX *mem_ctx = talloc_tos();
 669         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 670         uint8_t *inbuf;
 671
 672         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 673                                          msg->buf.length);
 674         if (inbuf == NULL) {
 675                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 676                 return;
 677         }
 678
 679         /* We leave this message on the queue so the open code can
 680            know this is a retry. */
 681         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 682                 (unsigned long long)mid ));
 683
 684         /* Mark the message as processed so this is not
 685          * re-processed in error. */
 686         msg->processed = true;
 687
 688         process_smb(xconn, inbuf,
 689                     msg->buf.length, 0,
 690                     msg->seqnum, msg->encrypted, &msg->pcd);
 691
 692         /* If it's still there and was processed, remove it. */
 693         msg = get_deferred_open_message_smb(sconn, mid);
 694         if (msg && msg->processed) {
 695                 remove_deferred_open_message_smb(sconn, mid);
 696         }
 697 }
 698
 699 /****************************************************************************
 700  Function to push a message onto the tail of a linked list of smb messages ready
 701  for processing.
 702 ****************************************************************************/
 703
 704 static bool push_queued_message(struct smb_request *req,
 705                                 struct timeval request_time,
 706                                 struct timeval end_time,
 707                                 struct deferred_open_record *open_rec)
 708 {
 709         int msg_len = smb_len(req->inbuf) + 4;
 710         struct pending_message_list *msg;
 711
 712         msg = talloc_zero(NULL, struct pending_message_list);
 713
 714         if(msg == NULL) {
 715                 DEBUG(0,("push_message: malloc fail (1)\n"));
 716                 return False;
 717         }
 718         msg->sconn = req->sconn;
 719         msg->xconn = req->xconn;
 720
 721         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 722         if(msg->buf.data == NULL) {
 723                 DEBUG(0,("push_message: malloc fail (2)\n"));
 724                 TALLOC_FREE(msg);
 725                 return False;
 726         }
 727
 728         msg->request_time = request_time;
 729         msg->seqnum = req->seqnum;
 730         msg->encrypted = req->encrypted;
 731         msg->processed = false;
 732         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 733
 734         if (open_rec) {
 735                 msg->open_rec = talloc_move(msg, &open_rec);
 736         }
 737
 738 #if 0
 739         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 740                                    msg,
 741                                    end_time,
 742                                    smbd_deferred_open_timer,
 743                                    msg);
 744         if (!msg->te) {
 745                 DEBUG(0,("push_message: event_add_timed failed\n"));
 746                 TALLOC_FREE(msg);
 747                 return false;
 748         }
 749 #endif
 750
 751         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 752                       struct pending_message_list *);
 753
 754         DEBUG(10,("push_message: pushed message length %u on "
 755                   "deferred_open_queue\n", (unsigned int)msg_len));
 756
 757         return True;
 758 }
 759
 760 /****************************************************************************
 761  Function to delete a sharing violation open message by mid.
 762 ****************************************************************************/
 763
 764 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 765                                       uint64_t mid)
 766 {
 767         struct pending_message_list *pml;
 768
 769         if (sconn->using_smb2) {
 770                 remove_deferred_open_message_smb2(sconn, mid);
 771                 return;
 772         }
 773
 774         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 775                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 776                         DEBUG(10,("remove_deferred_open_message_smb: "
 777                                   "deleting mid %llu len %u\n",
 778                                   (unsigned long long)mid,
 779                                   (unsigned int)pml->buf.length ));
 780                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 781                         TALLOC_FREE(pml);
 782                         return;
 783                 }
 784         }
 785 }
 786
 787 /****************************************************************************
 788  Move a sharing violation open retry message to the front of the list and
 789  schedule it for immediate processing.
 790 ****************************************************************************/
 791
 792 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 793                                         uint64_t mid)
 794 {
 795         struct pending_message_list *pml;
 796         int i = 0;
 797
 798         if (sconn->using_smb2) {
 799                 return schedule_deferred_open_message_smb2(sconn, mid);
 800         }
 801
 802         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 803                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 804
 805                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 806                         "msg_mid = %llu\n",
 807                         i++,
 808                         (unsigned long long)msg_mid ));
 809
 810                 if (mid == msg_mid) {
 811                         struct tevent_timer *te;
 812
 813                         if (pml->processed) {
 814                                 /* A processed message should not be
 815                                  * rescheduled. */
 816                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 817                                         "message mid %llu was already processed\n",
 818                                         (unsigned long long)msg_mid ));
 819                                 continue;
 820                         }
 821
 822                         DEBUG(10,("schedule_deferred_open_message_smb: "
 823                                 "scheduling mid %llu\n",
 824                                 (unsigned long long)mid ));
 825
 826                         te = tevent_add_timer(pml->sconn->ev_ctx,
 827                                               pml,
 828                                               timeval_zero(),
 829                                               smbd_deferred_open_timer,
 830                                               pml);
 831                         if (!te) {
 832                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 833                                         "event_add_timed() failed, "
 834                                         "skipping mid %llu\n",
 835                                         (unsigned long long)msg_mid ));
 836                         }
 837
 838                         TALLOC_FREE(pml->te);
 839                         pml->te = te;
 840                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 841                         return true;
 842                 }
 843         }
 844
 845         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 846                 "find message mid %llu\n",
 847                 (unsigned long long)mid ));
 848
 849         return false;
 850 }
 851
 852 /****************************************************************************
 853  Return true if this mid is on the deferred queue and was not yet processed.
 854 ****************************************************************************/
 855
 856 bool open_was_deferred(struct smbXsrv_connection *xconn, uint64_t mid)
 857 {
 858         struct smbd_server_connection *sconn = xconn->client->sconn;
 859         struct pending_message_list *pml;
 860
 861         if (sconn->using_smb2) {
 862                 return open_was_deferred_smb2(sconn, mid);
 863         }
 864
 865         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 866                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 867                         return True;
 868                 }
 869         }
 870         return False;
 871 }
 872
 873 /****************************************************************************
 874  Return the message queued by this mid.
 875 ****************************************************************************/
 876
 877 static struct pending_message_list *get_deferred_open_message_smb(
 878         struct smbd_server_connection *sconn, uint64_t mid)
 879 {
 880         struct pending_message_list *pml;
 881
 882         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 883                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 884                         return pml;
 885                 }
 886         }
 887         return NULL;
 888 }
 889
 890 /****************************************************************************
 891  Get the state data queued by this mid.
 892 ****************************************************************************/
 893
 894 bool get_deferred_open_message_state(struct smb_request *smbreq,
 895                                 struct timeval *p_request_time,
 896                                 struct deferred_open_record **open_rec)
 897 {
 898         struct pending_message_list *pml;
 899
 900         if (smbreq->sconn->using_smb2) {
 901                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 902                                         p_request_time,
 903                                         open_rec);
 904         }
 905
 906         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 907         if (!pml) {
 908                 return false;
 909         }
 910         if (p_request_time) {
 911                 *p_request_time = pml->request_time;
 912         }
 913         if (open_rec != NULL) {
 914                 *open_rec = pml->open_rec;
 915         }
 916         return true;
 917 }
 918
 919 /****************************************************************************
 920  Function to push a deferred open smb message onto a linked list of local smb
 921  messages ready for processing.
 922 ****************************************************************************/
 923
 924 bool push_deferred_open_message_smb(struct smb_request *req,
 925                                struct timeval request_time,
 926                                struct timeval timeout,
 927                                struct file_id id,
 928                                struct deferred_open_record *open_rec)
 929 {
 930         struct timeval end_time;
 931
 932         if (req->smb2req) {
 933                 return push_deferred_open_message_smb2(req->smb2req,
 934                                                 request_time,
 935                                                 timeout,
 936                                                 id,
 937                                                 open_rec);
 938         }
 939
 940         if (req->unread_bytes) {
 941                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 942                         "unread_bytes = %u\n",
 943                         (unsigned int)req->unread_bytes ));
 944                 smb_panic("push_deferred_open_message_smb: "
 945                         "logic error unread_bytes != 0" );
 946         }
 947
 948         end_time = timeval_sum(&request_time, &timeout);
 949
 950         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 951                 "len %u mid %llu timeout time [%u.%06u]\n",
 952                 (unsigned int) smb_len(req->inbuf)+4,
 953                 (unsigned long long)req->mid,
 954                 (unsigned int)end_time.tv_sec,
 955                 (unsigned int)end_time.tv_usec));
 956
 957         return push_queued_message(req, request_time, end_time, open_rec);
 958 }
 959
 960 static void smbd_sig_term_handler(struct tevent_context *ev,
 961                                   struct tevent_signal *se,
 962                                   int signum,
 963                                   int count,
 964                                   void *siginfo,
 965                                   void *private_data)
 966 {
 967         exit_server_cleanly("termination signal");
 968 }
 969
 970 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 971 {
 972         struct tevent_signal *se;
 973
 974         se = tevent_add_signal(sconn->ev_ctx,
 975                                sconn,
 976                                SIGTERM, 0,
 977                                smbd_sig_term_handler,
 978                                sconn);
 979         if (!se) {
 980                 exit_server("failed to setup SIGTERM handler");
 981         }
 982 }
 983
 984 static void smbd_sig_hup_handler(struct tevent_context *ev,
 985                                   struct tevent_signal *se,
 986                                   int signum,
 987                                   int count,
 988                                   void *siginfo,
 989                                   void *private_data)
 990 {
 991         struct smbd_server_connection *sconn =
 992                 talloc_get_type_abort(private_data,
 993                 struct smbd_server_connection);
 994
 995         change_to_root_user();
 996         DEBUG(1,("Reloading services after SIGHUP\n"));
 997         reload_services(sconn, conn_snum_used, false);
 998 }
 999
1000 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1001 {
1002         struct tevent_signal *se;
1003
1004         se = tevent_add_signal(sconn->ev_ctx,
1005                                sconn,
1006                                SIGHUP, 0,
1007                                smbd_sig_hup_handler,
1008                                sconn);
1009         if (!se) {
1010                 exit_server("failed to setup SIGHUP handler");
1011         }
1012 }
1013
1014 static void smbd_conf_updated(struct messaging_context *msg,
1015                               void *private_data,
1016                               uint32_t msg_type,
1017                               struct server_id server_id,
1018                               DATA_BLOB *data)
1019 {
1020         struct smbd_server_connection *sconn =
1021                 talloc_get_type_abort(private_data,
1022                 struct smbd_server_connection);
1023
1024         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1025                   "updated. Reloading.\n"));
1026         change_to_root_user();
1027         reload_services(sconn, conn_snum_used, false);
1028 }
1029
1030 /*
1031  * Only allow 5 outstanding trans requests. We're allocating memory, so
1032  * prevent a DoS.
1033  */
1034
1035 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1036 {
1037         int count = 0;
1038         for (; list != NULL; list = list->next) {
1039
1040                 if (list->mid == mid) {
1041                         return NT_STATUS_INVALID_PARAMETER;
1042                 }
1043
1044                 count += 1;
1045         }
1046         if (count > 5) {
1047                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1048         }
1049
1050         return NT_STATUS_OK;
1051 }
1052
1053 /*
1054 These flags determine some of the permissions required to do an operation
1055
1056 Note that I don't set NEED_WRITE on some write operations because they
1057 are used by some brain-dead clients when printing, and I don't want to
1058 force write permissions on print services.
1059 */
1060 #define AS_USER (1<<0)
1061 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1062 #define TIME_INIT (1<<2)
1063 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1064 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1065 #define DO_CHDIR (1<<6)
1066
1067 /*
1068    define a list of possible SMB messages and their corresponding
1069    functions. Any message that has a NULL function is unimplemented -
1070    please feel free to contribute implementations!
1071 */
1072 static const struct smb_message_struct {
1073         const char *name;
1074         void (*fn)(struct smb_request *req);
1075         int flags;
1076 } smb_messages[256] = {
1077
1078 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1079 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1080 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1081 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1082 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1083 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1084 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1085 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1086 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1087 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1088 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1089 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1090 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1091 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1092 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1093 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1094 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1095 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1096 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1097 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1098 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1099 /* 0x15 */ { NULL, NULL, 0 },
1100 /* 0x16 */ { NULL, NULL, 0 },
1101 /* 0x17 */ { NULL, NULL, 0 },
1102 /* 0x18 */ { NULL, NULL, 0 },
1103 /* 0x19 */ { NULL, NULL, 0 },
1104 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1105 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1106 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1107 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1108 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1109 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1110 /* 0x20 */ { "SMBwritec", NULL,0},
1111 /* 0x21 */ { NULL, NULL, 0 },
1112 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1113 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1114 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1115 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1116 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1117 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1118 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1119 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1120 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1121 /* 0x2b */ { "SMBecho",reply_echo,0},
1122 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1123 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1124 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1125 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1126 /* 0x30 */ { NULL, NULL, 0 },
1127 /* 0x31 */ { NULL, NULL, 0 },
1128 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1129 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1130 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1131 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1132 /* 0x36 */ { NULL, NULL, 0 },
1133 /* 0x37 */ { NULL, NULL, 0 },
1134 /* 0x38 */ { NULL, NULL, 0 },
1135 /* 0x39 */ { NULL, NULL, 0 },
1136 /* 0x3a */ { NULL, NULL, 0 },
1137 /* 0x3b */ { NULL, NULL, 0 },
1138 /* 0x3c */ { NULL, NULL, 0 },
1139 /* 0x3d */ { NULL, NULL, 0 },
1140 /* 0x3e */ { NULL, NULL, 0 },
1141 /* 0x3f */ { NULL, NULL, 0 },
1142 /* 0x40 */ { NULL, NULL, 0 },
1143 /* 0x41 */ { NULL, NULL, 0 },
1144 /* 0x42 */ { NULL, NULL, 0 },
1145 /* 0x43 */ { NULL, NULL, 0 },
1146 /* 0x44 */ { NULL, NULL, 0 },
1147 /* 0x45 */ { NULL, NULL, 0 },
1148 /* 0x46 */ { NULL, NULL, 0 },
1149 /* 0x47 */ { NULL, NULL, 0 },
1150 /* 0x48 */ { NULL, NULL, 0 },
1151 /* 0x49 */ { NULL, NULL, 0 },
1152 /* 0x4a */ { NULL, NULL, 0 },
1153 /* 0x4b */ { NULL, NULL, 0 },
1154 /* 0x4c */ { NULL, NULL, 0 },
1155 /* 0x4d */ { NULL, NULL, 0 },
1156 /* 0x4e */ { NULL, NULL, 0 },
1157 /* 0x4f */ { NULL, NULL, 0 },
1158 /* 0x50 */ { NULL, NULL, 0 },
1159 /* 0x51 */ { NULL, NULL, 0 },
1160 /* 0x52 */ { NULL, NULL, 0 },
1161 /* 0x53 */ { NULL, NULL, 0 },
1162 /* 0x54 */ { NULL, NULL, 0 },
1163 /* 0x55 */ { NULL, NULL, 0 },
1164 /* 0x56 */ { NULL, NULL, 0 },
1165 /* 0x57 */ { NULL, NULL, 0 },
1166 /* 0x58 */ { NULL, NULL, 0 },
1167 /* 0x59 */ { NULL, NULL, 0 },
1168 /* 0x5a */ { NULL, NULL, 0 },
1169 /* 0x5b */ { NULL, NULL, 0 },
1170 /* 0x5c */ { NULL, NULL, 0 },
1171 /* 0x5d */ { NULL, NULL, 0 },
1172 /* 0x5e */ { NULL, NULL, 0 },
1173 /* 0x5f */ { NULL, NULL, 0 },
1174 /* 0x60 */ { NULL, NULL, 0 },
1175 /* 0x61 */ { NULL, NULL, 0 },
1176 /* 0x62 */ { NULL, NULL, 0 },
1177 /* 0x63 */ { NULL, NULL, 0 },
1178 /* 0x64 */ { NULL, NULL, 0 },
1179 /* 0x65 */ { NULL, NULL, 0 },
1180 /* 0x66 */ { NULL, NULL, 0 },
1181 /* 0x67 */ { NULL, NULL, 0 },
1182 /* 0x68 */ { NULL, NULL, 0 },
1183 /* 0x69 */ { NULL, NULL, 0 },
1184 /* 0x6a */ { NULL, NULL, 0 },
1185 /* 0x6b */ { NULL, NULL, 0 },
1186 /* 0x6c */ { NULL, NULL, 0 },
1187 /* 0x6d */ { NULL, NULL, 0 },
1188 /* 0x6e */ { NULL, NULL, 0 },
1189 /* 0x6f */ { NULL, NULL, 0 },
1190 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1191 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1192 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1193 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1194 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1195 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1196 /* 0x76 */ { NULL, NULL, 0 },
1197 /* 0x77 */ { NULL, NULL, 0 },
1198 /* 0x78 */ { NULL, NULL, 0 },
1199 /* 0x79 */ { NULL, NULL, 0 },
1200 /* 0x7a */ { NULL, NULL, 0 },
1201 /* 0x7b */ { NULL, NULL, 0 },
1202 /* 0x7c */ { NULL, NULL, 0 },
1203 /* 0x7d */ { NULL, NULL, 0 },
1204 /* 0x7e */ { NULL, NULL, 0 },
1205 /* 0x7f */ { NULL, NULL, 0 },
1206 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1207 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1208 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1209 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1210 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1211 /* 0x85 */ { NULL, NULL, 0 },
1212 /* 0x86 */ { NULL, NULL, 0 },
1213 /* 0x87 */ { NULL, NULL, 0 },
1214 /* 0x88 */ { NULL, NULL, 0 },
1215 /* 0x89 */ { NULL, NULL, 0 },
1216 /* 0x8a */ { NULL, NULL, 0 },
1217 /* 0x8b */ { NULL, NULL, 0 },
1218 /* 0x8c */ { NULL, NULL, 0 },
1219 /* 0x8d */ { NULL, NULL, 0 },
1220 /* 0x8e */ { NULL, NULL, 0 },
1221 /* 0x8f */ { NULL, NULL, 0 },
1222 /* 0x90 */ { NULL, NULL, 0 },
1223 /* 0x91 */ { NULL, NULL, 0 },
1224 /* 0x92 */ { NULL, NULL, 0 },
1225 /* 0x93 */ { NULL, NULL, 0 },
1226 /* 0x94 */ { NULL, NULL, 0 },
1227 /* 0x95 */ { NULL, NULL, 0 },
1228 /* 0x96 */ { NULL, NULL, 0 },
1229 /* 0x97 */ { NULL, NULL, 0 },
1230 /* 0x98 */ { NULL, NULL, 0 },
1231 /* 0x99 */ { NULL, NULL, 0 },
1232 /* 0x9a */ { NULL, NULL, 0 },
1233 /* 0x9b */ { NULL, NULL, 0 },
1234 /* 0x9c */ { NULL, NULL, 0 },
1235 /* 0x9d */ { NULL, NULL, 0 },
1236 /* 0x9e */ { NULL, NULL, 0 },
1237 /* 0x9f */ { NULL, NULL, 0 },
1238 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1239 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1240 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1241 /* 0xa3 */ { NULL, NULL, 0 },
1242 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1243 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1244 /* 0xa6 */ { NULL, NULL, 0 },
1245 /* 0xa7 */ { NULL, NULL, 0 },
1246 /* 0xa8 */ { NULL, NULL, 0 },
1247 /* 0xa9 */ { NULL, NULL, 0 },
1248 /* 0xaa */ { NULL, NULL, 0 },
1249 /* 0xab */ { NULL, NULL, 0 },
1250 /* 0xac */ { NULL, NULL, 0 },
1251 /* 0xad */ { NULL, NULL, 0 },
1252 /* 0xae */ { NULL, NULL, 0 },
1253 /* 0xaf */ { NULL, NULL, 0 },
1254 /* 0xb0 */ { NULL, NULL, 0 },
1255 /* 0xb1 */ { NULL, NULL, 0 },
1256 /* 0xb2 */ { NULL, NULL, 0 },
1257 /* 0xb3 */ { NULL, NULL, 0 },
1258 /* 0xb4 */ { NULL, NULL, 0 },
1259 /* 0xb5 */ { NULL, NULL, 0 },
1260 /* 0xb6 */ { NULL, NULL, 0 },
1261 /* 0xb7 */ { NULL, NULL, 0 },
1262 /* 0xb8 */ { NULL, NULL, 0 },
1263 /* 0xb9 */ { NULL, NULL, 0 },
1264 /* 0xba */ { NULL, NULL, 0 },
1265 /* 0xbb */ { NULL, NULL, 0 },
1266 /* 0xbc */ { NULL, NULL, 0 },
1267 /* 0xbd */ { NULL, NULL, 0 },
1268 /* 0xbe */ { NULL, NULL, 0 },
1269 /* 0xbf */ { NULL, NULL, 0 },
1270 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1271 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1272 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1273 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1274 /* 0xc4 */ { NULL, NULL, 0 },
1275 /* 0xc5 */ { NULL, NULL, 0 },
1276 /* 0xc6 */ { NULL, NULL, 0 },
1277 /* 0xc7 */ { NULL, NULL, 0 },
1278 /* 0xc8 */ { NULL, NULL, 0 },
1279 /* 0xc9 */ { NULL, NULL, 0 },
1280 /* 0xca */ { NULL, NULL, 0 },
1281 /* 0xcb */ { NULL, NULL, 0 },
1282 /* 0xcc */ { NULL, NULL, 0 },
1283 /* 0xcd */ { NULL, NULL, 0 },
1284 /* 0xce */ { NULL, NULL, 0 },
1285 /* 0xcf */ { NULL, NULL, 0 },
1286 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1287 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1288 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1289 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1290 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1291 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1292 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1293 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1294 /* 0xd8 */ { NULL, NULL, 0 },
1295 /* 0xd9 */ { NULL, NULL, 0 },
1296 /* 0xda */ { NULL, NULL, 0 },
1297 /* 0xdb */ { NULL, NULL, 0 },
1298 /* 0xdc */ { NULL, NULL, 0 },
1299 /* 0xdd */ { NULL, NULL, 0 },
1300 /* 0xde */ { NULL, NULL, 0 },
1301 /* 0xdf */ { NULL, NULL, 0 },
1302 /* 0xe0 */ { NULL, NULL, 0 },
1303 /* 0xe1 */ { NULL, NULL, 0 },
1304 /* 0xe2 */ { NULL, NULL, 0 },
1305 /* 0xe3 */ { NULL, NULL, 0 },
1306 /* 0xe4 */ { NULL, NULL, 0 },
1307 /* 0xe5 */ { NULL, NULL, 0 },
1308 /* 0xe6 */ { NULL, NULL, 0 },
1309 /* 0xe7 */ { NULL, NULL, 0 },
1310 /* 0xe8 */ { NULL, NULL, 0 },
1311 /* 0xe9 */ { NULL, NULL, 0 },
1312 /* 0xea */ { NULL, NULL, 0 },
1313 /* 0xeb */ { NULL, NULL, 0 },
1314 /* 0xec */ { NULL, NULL, 0 },
1315 /* 0xed */ { NULL, NULL, 0 },
1316 /* 0xee */ { NULL, NULL, 0 },
1317 /* 0xef */ { NULL, NULL, 0 },
1318 /* 0xf0 */ { NULL, NULL, 0 },
1319 /* 0xf1 */ { NULL, NULL, 0 },
1320 /* 0xf2 */ { NULL, NULL, 0 },
1321 /* 0xf3 */ { NULL, NULL, 0 },
1322 /* 0xf4 */ { NULL, NULL, 0 },
1323 /* 0xf5 */ { NULL, NULL, 0 },
1324 /* 0xf6 */ { NULL, NULL, 0 },
1325 /* 0xf7 */ { NULL, NULL, 0 },
1326 /* 0xf8 */ { NULL, NULL, 0 },
1327 /* 0xf9 */ { NULL, NULL, 0 },
1328 /* 0xfa */ { NULL, NULL, 0 },
1329 /* 0xfb */ { NULL, NULL, 0 },
1330 /* 0xfc */ { NULL, NULL, 0 },
1331 /* 0xfd */ { NULL, NULL, 0 },
1332 /* 0xfe */ { NULL, NULL, 0 },
1333 /* 0xff */ { NULL, NULL, 0 }
1334
1335 };
1336
1337 /*******************************************************************
1338  allocate and initialize a reply packet
1339 ********************************************************************/
1340
1341 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1342                           const char *inbuf, char **outbuf, uint8_t num_words,
1343                           uint32_t num_bytes)
1344 {
1345         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1346
1347         /*
1348          * Protect against integer wrap.
1349          * The SMB layer reply can be up to 0xFFFFFF bytes.
1350          */
1351         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1352                 char *msg;
1353                 if (asprintf(&msg, "num_bytes too large: %u",
1354                              (unsigned)num_bytes) == -1) {
1355                         msg = discard_const_p(char, "num_bytes too large");
1356                 }
1357                 smb_panic(msg);
1358         }
1359
1360         /*
1361          * Here we include the NBT header for now.
1362          */
1363         *outbuf = talloc_array(mem_ctx, char,
1364                                NBT_HDR_SIZE + smb_len);
1365         if (*outbuf == NULL) {
1366                 return false;
1367         }
1368
1369         construct_reply_common(req, inbuf, *outbuf);
1370         srv_set_message(*outbuf, num_words, num_bytes, false);
1371         /*
1372          * Zero out the word area, the caller has to take care of the bcc area
1373          * himself
1374          */
1375         if (num_words != 0) {
1376                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1377         }
1378
1379         return true;
1380 }
1381
1382 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1383 {
1384         char *outbuf;
1385         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1386                            num_bytes)) {
1387                 smb_panic("could not allocate output buffer\n");
1388         }
1389         req->outbuf = (uint8_t *)outbuf;
1390 }
1391
1392
1393 /*******************************************************************
1394  Dump a packet to a file.
1395 ********************************************************************/
1396
1397 static void smb_dump(const char *name, int type, const char *data)
1398 {
1399         size_t len;
1400         int fd, i;
1401         char *fname = NULL;
1402         if (DEBUGLEVEL < 50) {
1403                 return;
1404         }
1405
1406         len = smb_len_tcp(data)+4;
1407         for (i=1;i<100;i++) {
1408                 fname = talloc_asprintf(talloc_tos(),
1409                                 "/tmp/%s.%d.%s",
1410                                 name,
1411                                 i,
1412                                 type ? "req" : "resp");
1413                 if (fname == NULL) {
1414                         return;
1415                 }
1416                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1417                 if (fd != -1 || errno != EEXIST) break;
1418                 TALLOC_FREE(fname);
1419         }
1420         if (fd != -1) {
1421                 ssize_t ret = write(fd, data, len);
1422                 if (ret != len)
1423                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1424                 close(fd);
1425                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1426         }
1427         TALLOC_FREE(fname);
1428 }
1429
1430 /****************************************************************************
1431  Prepare everything for calling the actual request function, and potentially
1432  call the request function via the "new" interface.
1433
1434  Return False if the "legacy" function needs to be called, everything is
1435  prepared.
1436
1437  Return True if we're done.
1438
1439  I know this API sucks, but it is the one with the least code change I could
1440  find.
1441 ****************************************************************************/
1442
1443 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1444 {
1445         int flags;
1446         uint64_t session_tag;
1447         connection_struct *conn = NULL;
1448         struct smbXsrv_connection *xconn = req->xconn;
1449         NTTIME now = timeval_to_nttime(&req->request_time);
1450         struct smbXsrv_session *session = NULL;
1451         NTSTATUS status;
1452
1453         errno = 0;
1454
1455         if (!xconn->smb1.negprot.done) {
1456                 switch (type) {
1457                         /*
1458                          * Without a negprot the request must
1459                          * either be a negprot, or one of the
1460                          * evil old SMB mailslot messaging types.
1461                          */
1462                         case SMBnegprot:
1463                         case SMBsendstrt:
1464                         case SMBsendend:
1465                         case SMBsendtxt:
1466                                 break;
1467                         default:
1468                                 exit_server_cleanly("The first request "
1469                                         "should be a negprot");
1470                 }
1471         }
1472
1473         if (smb_messages[type].fn == NULL) {
1474                 DEBUG(0,("Unknown message type %d!\n",type));
1475                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1476                 reply_unknown_new(req, type);
1477                 return NULL;
1478         }
1479
1480         flags = smb_messages[type].flags;
1481
1482         /* In share mode security we must ignore the vuid. */
1483         session_tag = req->vuid;
1484         conn = req->conn;
1485
1486         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1487                  (int)getpid(), (unsigned long)conn));
1488
1489         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1490
1491         /* Ensure this value is replaced in the incoming packet. */
1492         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1493
1494         /*
1495          * Ensure the correct username is in current_user_info.  This is a
1496          * really ugly bugfix for problems with multiple session_setup_and_X's
1497          * being done and allowing %U and %G substitutions to work correctly.
1498          * There is a reason this code is done here, don't move it unless you
1499          * know what you're doing... :-).
1500          * JRA.
1501          */
1502
1503         /*
1504          * lookup an existing session
1505          *
1506          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1507          * here, the main check is still in change_to_user()
1508          */
1509         status = smb1srv_session_lookup(xconn,
1510                                         session_tag,
1511                                         now,
1512                                         &session);
1513         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1514                 switch (type) {
1515                 case SMBsesssetupX:
1516                         status = NT_STATUS_OK;
1517                         break;
1518                 default:
1519                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1520                                  (unsigned long long)session_tag,
1521                                  (unsigned long long)req->mid));
1522                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1523                         return conn;
1524                 }
1525         }
1526
1527         if (session_tag != xconn->client->last_session_id) {
1528                 struct user_struct *vuser = NULL;
1529
1530                 xconn->client->last_session_id = session_tag;
1531                 if (session) {
1532                         vuser = session->compat;
1533                 }
1534                 if (vuser) {
1535                         set_current_user_info(
1536                                 vuser->session_info->unix_info->sanitized_username,
1537                                 vuser->session_info->unix_info->unix_name,
1538                                 vuser->session_info->info->domain_name);
1539                 }
1540         }
1541
1542         /* Does this call need to be run as the connected user? */
1543         if (flags & AS_USER) {
1544
1545                 /* Does this call need a valid tree connection? */
1546                 if (!conn) {
1547                         /*
1548                          * Amazingly, the error code depends on the command
1549                          * (from Samba4).
1550                          */
1551                         if (type == SMBntcreateX) {
1552                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1553                         } else {
1554                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1555                         }
1556                         return NULL;
1557                 }
1558
1559                 if (!change_to_user(conn,session_tag)) {
1560                         DEBUG(0, ("Error: Could not change to user. Removing "
1561                                 "deferred open, mid=%llu.\n",
1562                                 (unsigned long long)req->mid));
1563                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1564                         return conn;
1565                 }
1566
1567                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1568
1569                 /* Does it need write permission? */
1570                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1571                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1572                         return conn;
1573                 }
1574
1575                 /* IPC services are limited */
1576                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1577                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1578                         return conn;
1579                 }
1580         } else {
1581                 /* This call needs to be run as root */
1582                 change_to_root_user();
1583         }
1584
1585         /* load service specific parameters */
1586         if (conn) {
1587                 if (req->encrypted) {
1588                         conn->encrypted_tid = true;
1589                         /* encrypted required from now on. */
1590                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1591                 } else if (ENCRYPTION_REQUIRED(conn)) {
1592                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1593                                 DEBUG(1,("service[%s] requires encryption"
1594                                         "%s ACCESS_DENIED. mid=%llu\n",
1595                                         lp_servicename(talloc_tos(), SNUM(conn)),
1596                                         smb_fn_name(type),
1597                                         (unsigned long long)req->mid));
1598                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1599                                 return conn;
1600                         }
1601                 }
1602
1603                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1604                                          (flags & (AS_USER|DO_CHDIR)
1605                                           ?True:False))) {
1606                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1607                         return conn;
1608                 }
1609                 conn->num_smb_operations++;
1610         }
1611
1612         /*
1613          * Does this protocol need to be run as guest? (Only archane
1614          * messenger service requests have this...)
1615          */
1616         if (flags & AS_GUEST) {
1617                 char *raddr;
1618                 bool ok;
1619
1620                 if (!change_to_guest()) {
1621                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1622                         return conn;
1623                 }
1624
1625                 raddr = tsocket_address_inet_addr_string(xconn->remote_address,
1626                                                          talloc_tos());
1627                 if (raddr == NULL) {
1628                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1629                         return conn;
1630                 }
1631
1632                 /*
1633                  * Haven't we checked this in smbd_process already???
1634                  */
1635
1636                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1637                                   xconn->remote_hostname, raddr);
1638                 TALLOC_FREE(raddr);
1639
1640                 if (!ok) {
1641                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1642                         return conn;
1643                 }
1644         }
1645
1646         smb_messages[type].fn(req);
1647         return req->conn;
1648 }
1649
1650 /****************************************************************************
1651  Construct a reply to the incoming packet.
1652 ****************************************************************************/
1653
1654 static void construct_reply(struct smbXsrv_connection *xconn,
1655                             char *inbuf, int size, size_t unread_bytes,
1656                             uint32_t seqnum, bool encrypted,
1657                             struct smb_perfcount_data *deferred_pcd)
1658 {
1659         struct smbd_server_connection *sconn = xconn->client->sconn;
1660         struct smb_request *req;
1661
1662         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1663                 smb_panic("could not allocate smb_request");
1664         }
1665
1666         if (!init_smb_request(req, sconn, xconn, (uint8 *)inbuf, unread_bytes,
1667                               encrypted, seqnum)) {
1668                 exit_server_cleanly("Invalid SMB request");
1669         }
1670
1671         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1672
1673         /* we popped this message off the queue - keep original perf data */
1674         if (deferred_pcd)
1675                 req->pcd = *deferred_pcd;
1676         else {
1677                 SMB_PERFCOUNT_START(&req->pcd);
1678                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1679                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1680         }
1681
1682         req->conn = switch_message(req->cmd, req);
1683
1684         if (req->outbuf == NULL) {
1685                 /*
1686                  * Request has suspended itself, will come
1687                  * back here.
1688                  */
1689                 return;
1690         }
1691         if (CVAL(req->outbuf,0) == 0) {
1692                 show_msg((char *)req->outbuf);
1693         }
1694         smb_request_done(req);
1695 }
1696
1697 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1698                                   char *inbuf, int size, uint32_t seqnum,
1699                                   bool encrypted,
1700                                   struct smb_perfcount_data *deferred_pcd)
1701 {
1702         struct smb_request **reqs = NULL;
1703         struct smb_request *req;
1704         unsigned num_reqs;
1705         bool ok;
1706
1707         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, xconn, encrypted,
1708                               seqnum, &reqs, &num_reqs);
1709         if (!ok) {
1710                 char errbuf[smb_size];
1711                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1712                              __LINE__, __FILE__);
1713                 if (!srv_send_smb(xconn, errbuf, true, seqnum, encrypted,
1714                                   NULL)) {
1715                         exit_server_cleanly("construct_reply_chain: "
1716                                             "srv_send_smb failed.");
1717                 }
1718                 return;
1719         }
1720
1721         req = reqs[0];
1722         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1723
1724         req->conn = switch_message(req->cmd, req);
1725
1726         if (req->outbuf == NULL) {
1727                 /*
1728                  * Request has suspended itself, will come
1729                  * back here.
1730                  */
1731                 return;
1732         }
1733         smb_request_done(req);
1734 }
1735
1736 /*
1737  * To be called from an async SMB handler that is potentially chained
1738  * when it is finished for shipping.
1739  */
1740
1741 void smb_request_done(struct smb_request *req)
1742 {
1743         struct smb_request **reqs = NULL;
1744         struct smb_request *first_req;
1745         size_t i, num_reqs, next_index;
1746         NTSTATUS status;
1747
1748         if (req->chain == NULL) {
1749                 first_req = req;
1750                 goto shipit;
1751         }
1752
1753         reqs = req->chain;
1754         num_reqs = talloc_array_length(reqs);
1755
1756         for (i=0; i<num_reqs; i++) {
1757                 if (reqs[i] == req) {
1758                         break;
1759                 }
1760         }
1761         if (i == num_reqs) {
1762                 /*
1763                  * Invalid chain, should not happen
1764                  */
1765                 status = NT_STATUS_INTERNAL_ERROR;
1766                 goto error;
1767         }
1768         next_index = i+1;
1769
1770         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1771                 struct smb_request *next = reqs[next_index];
1772                 struct smbXsrv_tcon *tcon;
1773                 NTTIME now = timeval_to_nttime(&req->request_time);
1774
1775                 next->vuid = SVAL(req->outbuf, smb_uid);
1776                 next->tid  = SVAL(req->outbuf, smb_tid);
1777                 status = smb1srv_tcon_lookup(req->xconn, req->tid,
1778                                              now, &tcon);
1779                 if (NT_STATUS_IS_OK(status)) {
1780                         req->conn = tcon->compat;
1781                 } else {
1782                         req->conn = NULL;
1783                 }
1784                 next->chain_fsp = req->chain_fsp;
1785                 next->inbuf = req->inbuf;
1786
1787                 req = next;
1788                 req->conn = switch_message(req->cmd, req);
1789
1790                 if (req->outbuf == NULL) {
1791                         /*
1792                          * Request has suspended itself, will come
1793                          * back here.
1794                          */
1795                         return;
1796                 }
1797                 next_index += 1;
1798         }
1799
1800         first_req = reqs[0];
1801
1802         for (i=1; i<next_index; i++) {
1803                 bool ok;
1804
1805                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1806                 if (!ok) {
1807                         status = NT_STATUS_INTERNAL_ERROR;
1808                         goto error;
1809                 }
1810         }
1811
1812         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1813         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1814
1815         /*
1816          * This scary statement intends to set the
1817          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1818          * to the value last_req->outbuf carries
1819          */
1820         SSVAL(first_req->outbuf, smb_flg2,
1821               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1822               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1823
1824         /*
1825          * Transfer the error codes from the subrequest to the main one
1826          */
1827         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1828         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1829
1830         _smb_setlen_large(
1831                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1832
1833 shipit:
1834         if (!srv_send_smb(first_req->xconn,
1835                           (char *)first_req->outbuf,
1836                           true, first_req->seqnum+1,
1837                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1838                           &first_req->pcd)) {
1839                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1840                                     "failed.");
1841         }
1842         TALLOC_FREE(req);       /* non-chained case */
1843         TALLOC_FREE(reqs);      /* chained case */
1844         return;
1845
1846 error:
1847         {
1848                 char errbuf[smb_size];
1849                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1850                 if (!srv_send_smb(req->xconn, errbuf, true,
1851                                   req->seqnum+1, req->encrypted,
1852                                   NULL)) {
1853                         exit_server_cleanly("construct_reply_chain: "
1854                                             "srv_send_smb failed.");
1855                 }
1856         }
1857         TALLOC_FREE(req);       /* non-chained case */
1858         TALLOC_FREE(reqs);      /* chained case */
1859 }
1860
1861 /****************************************************************************
1862  Process an smb from the client
1863 ****************************************************************************/
1864 static void process_smb(struct smbXsrv_connection *xconn,
1865                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1866                         uint32_t seqnum, bool encrypted,
1867                         struct smb_perfcount_data *deferred_pcd)
1868 {
1869         struct smbd_server_connection *sconn = xconn->client->sconn;
1870         int msg_type = CVAL(inbuf,0);
1871
1872         DO_PROFILE_INC(smb_count);
1873
1874         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1875                     smb_len(inbuf) ) );
1876         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1877                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1878
1879         if (msg_type != NBSSmessage) {
1880                 /*
1881                  * NetBIOS session request, keepalive, etc.
1882                  */
1883                 reply_special(xconn, (char *)inbuf, nread);
1884                 goto done;
1885         }
1886
1887         if (sconn->using_smb2) {
1888                 /* At this point we're not really using smb2,
1889                  * we make the decision here.. */
1890                 if (smbd_is_smb2_header(inbuf, nread)) {
1891                         const uint8_t *inpdu = inbuf + NBT_HDR_SIZE;
1892                         size_t pdulen = nread - NBT_HDR_SIZE;
1893                         smbd_smb2_first_negprot(xconn, inpdu, pdulen);
1894                         return;
1895                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1896                                 && CVAL(inbuf, smb_com) != 0x72) {
1897                         /* This is a non-negprot SMB1 packet.
1898                            Disable SMB2 from now on. */
1899                         sconn->using_smb2 = false;
1900                 }
1901         }
1902
1903         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1904          * so subtract 4 from it. */
1905         if ((nread < (smb_size - 4)) || !valid_smb_header(inbuf)) {
1906                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1907                          smb_len(inbuf)));
1908
1909                 /* special magic for immediate exit */
1910                 if ((nread == 9) &&
1911                     (IVAL(inbuf, 4) == 0x74697865) &&
1912                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1913                         uint8_t exitcode = CVAL(inbuf, 8);
1914                         DEBUG(1, ("Exiting immediately with code %d\n",
1915                                   (int)exitcode));
1916                         exit(exitcode);
1917                 }
1918
1919                 exit_server_cleanly("Non-SMB packet");
1920         }
1921
1922         show_msg((char *)inbuf);
1923
1924         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1925                 construct_reply_chain(xconn, (char *)inbuf, nread,
1926                                       seqnum, encrypted, deferred_pcd);
1927         } else {
1928                 construct_reply(xconn, (char *)inbuf, nread, unread_bytes,
1929                                 seqnum, encrypted, deferred_pcd);
1930         }
1931
1932         sconn->trans_num++;
1933
1934 done:
1935         sconn->num_requests++;
1936
1937         /* The timeout_processing function isn't run nearly
1938            often enough to implement 'max log size' without
1939            overrunning the size of the file by many megabytes.
1940            This is especially true if we are running at debug
1941            level 10.  Checking every 50 SMBs is a nice
1942            tradeoff of performance vs log file size overrun. */
1943
1944         if ((sconn->num_requests % 50) == 0 &&
1945             need_to_check_log_size()) {
1946                 change_to_root_user();
1947                 check_log_size();
1948         }
1949 }
1950
1951 /****************************************************************************
1952  Return a string containing the function name of a SMB command.
1953 ****************************************************************************/
1954
1955 const char *smb_fn_name(int type)
1956 {
1957         const char *unknown_name = "SMBunknown";
1958
1959         if (smb_messages[type].name == NULL)
1960                 return(unknown_name);
1961
1962         return(smb_messages[type].name);
1963 }
1964
1965 /****************************************************************************
1966  Helper functions for contruct_reply.
1967 ****************************************************************************/
1968
1969 void add_to_common_flags2(uint32 v)
1970 {
1971         common_flags2 |= v;
1972 }
1973
1974 void remove_from_common_flags2(uint32 v)
1975 {
1976         common_flags2 &= ~v;
1977 }
1978
1979 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1980                                    char *outbuf)
1981 {
1982         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1983         uint16_t out_flags2 = common_flags2;
1984
1985         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1986         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1987         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1988
1989         srv_set_message(outbuf,0,0,false);
1990
1991         SCVAL(outbuf, smb_com, req->cmd);
1992         SIVAL(outbuf,smb_rcls,0);
1993         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1994         SSVAL(outbuf,smb_flg2, out_flags2);
1995         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1996         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1997
1998         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1999         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
2000         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
2001         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
2002 }
2003
2004 void construct_reply_common_req(struct smb_request *req, char *outbuf)
2005 {
2006         construct_reply_common(req, (const char *)req->inbuf, outbuf);
2007 }
2008
2009 /**
2010  * @brief Find the smb_cmd offset of the last command pushed
2011  * @param[in] buf       The buffer we're building up
2012  * @retval              Where can we put our next andx cmd?
2013  *
2014  * While chaining requests, the "next" request we're looking at needs to put
2015  * its SMB_Command before the data the previous request already built up added
2016  * to the chain. Find the offset to the place where we have to put our cmd.
2017  */
2018
2019 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2020 {
2021         uint8_t cmd;
2022         size_t ofs;
2023
2024         cmd = CVAL(buf, smb_com);
2025
2026         if (!is_andx_req(cmd)) {
2027                 return false;
2028         }
2029
2030         ofs = smb_vwv0;
2031
2032         while (CVAL(buf, ofs) != 0xff) {
2033
2034                 if (!is_andx_req(CVAL(buf, ofs))) {
2035                         return false;
2036                 }
2037
2038                 /*
2039                  * ofs is from start of smb header, so add the 4 length
2040                  * bytes. The next cmd is right after the wct field.
2041                  */
2042                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2043
2044                 if (ofs+4 >= talloc_get_size(buf)) {
2045                         return false;
2046                 }
2047         }
2048
2049         *pofs = ofs;
2050         return true;
2051 }
2052
2053 /**
2054  * @brief Do the smb chaining at a buffer level
2055  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2056  * @param[in] andx_buf          Buffer to be appended
2057  */
2058
2059 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2060 {
2061         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2062         uint8_t wct             = CVAL(andx_buf, smb_wct);
2063         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2064         uint32_t num_bytes      = smb_buflen(andx_buf);
2065         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2066
2067         uint8_t *outbuf;
2068         size_t old_size, new_size;
2069         size_t ofs;
2070         size_t chain_padding = 0;
2071         size_t andx_cmd_ofs;
2072
2073
2074         old_size = talloc_get_size(*poutbuf);
2075
2076         if ((old_size % 4) != 0) {
2077                 /*
2078                  * Align the wct field of subsequent requests to a 4-byte
2079                  * boundary
2080                  */
2081                 chain_padding = 4 - (old_size % 4);
2082         }
2083
2084         /*
2085          * After the old request comes the new wct field (1 byte), the vwv's
2086          * and the num_bytes field.
2087          */
2088
2089         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2090         new_size += num_bytes;
2091
2092         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2093                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2094                           (unsigned)new_size));
2095                 return false;
2096         }
2097
2098         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2099         if (outbuf == NULL) {
2100                 DEBUG(0, ("talloc failed\n"));
2101                 return false;
2102         }
2103         *poutbuf = outbuf;
2104
2105         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2106                 DEBUG(1, ("invalid command chain\n"));
2107                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2108                 return false;
2109         }
2110
2111         if (chain_padding != 0) {
2112                 memset(outbuf + old_size, 0, chain_padding);
2113                 old_size += chain_padding;
2114         }
2115
2116         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2117         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2118
2119         ofs = old_size;
2120
2121         /*
2122          * Push the chained request:
2123          *
2124          * wct field
2125          */
2126
2127         SCVAL(outbuf, ofs, wct);
2128         ofs += 1;
2129
2130         /*
2131          * vwv array
2132          */
2133
2134         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2135
2136         /*
2137          * HACK ALERT
2138          *
2139          * Read&X has an offset into its data buffer at
2140          * vwv[6]. reply_read_andx has no idea anymore that it's
2141          * running from within a chain, so we have to fix up the
2142          * offset here.
2143          *
2144          * Although it looks disgusting at this place, I want to keep
2145          * it here. The alternative would be to push knowledge about
2146          * the andx chain down into read&x again.
2147          */
2148
2149         if (smb_command == SMBreadX) {
2150                 uint8_t *bytes_addr;
2151
2152                 if (wct < 7) {
2153                         /*
2154                          * Invalid read&x response
2155                          */
2156                         return false;
2157                 }
2158
2159                 bytes_addr = outbuf + ofs        /* vwv start */
2160                         + sizeof(uint16_t) * wct /* vwv array */
2161                         + sizeof(uint16_t)       /* bcc */
2162                         + 1;                     /* padding byte */
2163
2164                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2165                       bytes_addr - outbuf - 4);
2166         }
2167
2168         ofs += sizeof(uint16_t) * wct;
2169
2170         /*
2171          * bcc (byte count)
2172          */
2173
2174         SSVAL(outbuf, ofs, num_bytes);
2175         ofs += sizeof(uint16_t);
2176
2177         /*
2178          * The bytes field
2179          */
2180
2181         memcpy(outbuf + ofs, bytes, num_bytes);
2182
2183         return true;
2184 }
2185
2186 bool smb1_is_chain(const uint8_t *buf)
2187 {
2188         uint8_t cmd, wct, andx_cmd;
2189
2190         cmd = CVAL(buf, smb_com);
2191         if (!is_andx_req(cmd)) {
2192                 return false;
2193         }
2194         wct = CVAL(buf, smb_wct);
2195         if (wct < 2) {
2196                 return false;
2197         }
2198         andx_cmd = CVAL(buf, smb_vwv);
2199         return (andx_cmd != 0xFF);
2200 }
2201
2202 bool smb1_walk_chain(const uint8_t *buf,
2203                      bool (*fn)(uint8_t cmd,
2204                                 uint8_t wct, const uint16_t *vwv,
2205                                 uint16_t num_bytes, const uint8_t *bytes,
2206                                 void *private_data),
2207                      void *private_data)
2208 {
2209         size_t smblen = smb_len(buf);
2210         const char *smb_buf = smb_base(buf);
2211         uint8_t cmd, chain_cmd;
2212         uint8_t wct;
2213         const uint16_t *vwv;
2214         uint16_t num_bytes;
2215         const uint8_t *bytes;
2216
2217         cmd = CVAL(buf, smb_com);
2218         wct = CVAL(buf, smb_wct);
2219         vwv = (const uint16_t *)(buf + smb_vwv);
2220         num_bytes = smb_buflen(buf);
2221         bytes = (const uint8_t *)smb_buf_const(buf);
2222
2223         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2224                 return false;
2225         }
2226
2227         if (!is_andx_req(cmd)) {
2228                 return true;
2229         }
2230         if (wct < 2) {
2231                 return false;
2232         }
2233
2234         chain_cmd = CVAL(vwv, 0);
2235
2236         while (chain_cmd != 0xff) {
2237                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2238                 size_t length_needed;
2239                 ptrdiff_t vwv_offset;
2240
2241                 chain_offset = SVAL(vwv+1, 0);
2242
2243                 /*
2244                  * Check if the client tries to fool us. The chain
2245                  * offset needs to point beyond the current request in
2246                  * the chain, it needs to strictly grow. Otherwise we
2247                  * might be tricked into an endless loop always
2248                  * processing the same request over and over again. We
2249                  * used to assume that vwv and the byte buffer array
2250                  * in a chain are always attached, but OS/2 the
2251                  * Write&X/Read&X chain puts the Read&X vwv array
2252                  * right behind the Write&X vwv chain. The Write&X bcc
2253                  * array is put behind the Read&X vwv array. So now we
2254                  * check whether the chain offset points strictly
2255                  * behind the previous vwv array. req->buf points
2256                  * right after the vwv array of the previous
2257                  * request. See
2258                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2259                  * more information.
2260                  */
2261
2262                 vwv_offset = ((const char *)vwv - smb_buf);
2263                 if (chain_offset <= vwv_offset) {
2264                         return false;
2265                 }
2266
2267                 /*
2268                  * Next check: Make sure the chain offset does not
2269                  * point beyond the overall smb request length.
2270                  */
2271
2272                 length_needed = chain_offset+1; /* wct */
2273                 if (length_needed > smblen) {
2274                         return false;
2275                 }
2276
2277                 /*
2278                  * Now comes the pointer magic. Goal here is to set up
2279                  * vwv and buf correctly again. The chain offset (the
2280                  * former vwv[1]) points at the new wct field.
2281                  */
2282
2283                 wct = CVAL(smb_buf, chain_offset);
2284
2285                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2286                         return false;
2287                 }
2288
2289                 /*
2290                  * Next consistency check: Make the new vwv array fits
2291                  * in the overall smb request.
2292                  */
2293
2294                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2295                 if (length_needed > smblen) {
2296                         return false;
2297                 }
2298                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2299
2300                 /*
2301                  * Now grab the new byte buffer....
2302                  */
2303
2304                 num_bytes = SVAL(vwv+wct, 0);
2305
2306                 /*
2307                  * .. and check that it fits.
2308                  */
2309
2310                 length_needed += num_bytes;
2311                 if (length_needed > smblen) {
2312                         return false;
2313                 }
2314                 bytes = (const uint8_t *)(vwv+wct+1);
2315
2316                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2317                         return false;
2318                 }
2319
2320                 if (!is_andx_req(chain_cmd)) {
2321                         return true;
2322                 }
2323                 chain_cmd = CVAL(vwv, 0);
2324         }
2325         return true;
2326 }
2327
2328 static bool smb1_chain_length_cb(uint8_t cmd,
2329                                  uint8_t wct, const uint16_t *vwv,
2330                                  uint16_t num_bytes, const uint8_t *bytes,
2331                                  void *private_data)
2332 {
2333         unsigned *count = (unsigned *)private_data;
2334         *count += 1;
2335         return true;
2336 }
2337
2338 unsigned smb1_chain_length(const uint8_t *buf)
2339 {
2340         unsigned count = 0;
2341
2342         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2343                 return 0;
2344         }
2345         return count;
2346 }
2347
2348 struct smb1_parse_chain_state {
2349         TALLOC_CTX *mem_ctx;
2350         const uint8_t *buf;
2351         struct smbd_server_connection *sconn;
2352         struct smbXsrv_connection *xconn;
2353         bool encrypted;
2354         uint32_t seqnum;
2355
2356         struct smb_request **reqs;
2357         unsigned num_reqs;
2358 };
2359
2360 static bool smb1_parse_chain_cb(uint8_t cmd,
2361                                 uint8_t wct, const uint16_t *vwv,
2362                                 uint16_t num_bytes, const uint8_t *bytes,
2363                                 void *private_data)
2364 {
2365         struct smb1_parse_chain_state *state =
2366                 (struct smb1_parse_chain_state *)private_data;
2367         struct smb_request **reqs;
2368         struct smb_request *req;
2369         bool ok;
2370
2371         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2372                               struct smb_request *, state->num_reqs+1);
2373         if (reqs == NULL) {
2374                 return false;
2375         }
2376         state->reqs = reqs;
2377
2378         req = talloc(reqs, struct smb_request);
2379         if (req == NULL) {
2380                 return false;
2381         }
2382
2383         ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2384                               state->encrypted, state->seqnum);
2385         if (!ok) {
2386                 return false;
2387         }
2388         req->cmd = cmd;
2389         req->wct = wct;
2390         req->vwv = vwv;
2391         req->buflen = num_bytes;
2392         req->buf = bytes;
2393
2394         reqs[state->num_reqs] = req;
2395         state->num_reqs += 1;
2396         return true;
2397 }
2398
2399 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2400                       struct smbXsrv_connection *xconn,
2401                       bool encrypted, uint32_t seqnum,
2402                       struct smb_request ***reqs, unsigned *num_reqs)
2403 {
2404         struct smbd_server_connection *sconn = NULL;
2405         struct smb1_parse_chain_state state;
2406         unsigned i;
2407
2408         if (xconn != NULL) {
2409                 sconn = xconn->client->sconn;
2410         }
2411
2412         state.mem_ctx = mem_ctx;
2413         state.buf = buf;
2414         state.sconn = sconn;
2415         state.xconn = xconn;
2416         state.encrypted = encrypted;
2417         state.seqnum = seqnum;
2418         state.reqs = NULL;
2419         state.num_reqs = 0;
2420
2421         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2422                 TALLOC_FREE(state.reqs);
2423                 return false;
2424         }
2425         for (i=0; i<state.num_reqs; i++) {
2426                 state.reqs[i]->chain = state.reqs;
2427         }
2428         *reqs = state.reqs;
2429         *num_reqs = state.num_reqs;
2430         return true;
2431 }
2432
2433 /****************************************************************************
2434  Check if services need reloading.
2435 ****************************************************************************/
2436
2437 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2438 {
2439
2440         if (last_smb_conf_reload_time == 0) {
2441                 last_smb_conf_reload_time = t;
2442         }
2443
2444         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2445                 reload_services(sconn, conn_snum_used, true);
2446                 last_smb_conf_reload_time = t;
2447         }
2448 }
2449
2450 static bool fd_is_readable(int fd)
2451 {
2452         int ret, revents;
2453
2454         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2455
2456         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2457
2458 }
2459
2460 static void smbd_server_connection_write_handler(
2461         struct smbXsrv_connection *xconn)
2462 {
2463         /* TODO: make write nonblocking */
2464 }
2465
2466 static void smbd_server_connection_read_handler(
2467         struct smbXsrv_connection *xconn, int fd)
2468 {
2469         uint8_t *inbuf = NULL;
2470         size_t inbuf_len = 0;
2471         size_t unread_bytes = 0;
2472         bool encrypted = false;
2473         TALLOC_CTX *mem_ctx = talloc_tos();
2474         NTSTATUS status;
2475         uint32_t seqnum;
2476
2477         bool async_echo = lp_async_smb_echo_handler();
2478         bool from_client = false;
2479
2480         if (async_echo) {
2481                 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2482                         /*
2483                          * This is the super-ugly hack to prefer the packets
2484                          * forwarded by the echo handler over the ones by the
2485                          * client directly
2486                          */
2487                         fd = xconn->smb1.echo_handler.trusted_fd;
2488                 }
2489         }
2490
2491         from_client = (xconn->transport.sock == fd);
2492
2493         if (async_echo && from_client) {
2494                 smbd_lock_socket(xconn);
2495
2496                 if (!fd_is_readable(fd)) {
2497                         DEBUG(10,("the echo listener was faster\n"));
2498                         smbd_unlock_socket(xconn);
2499                         return;
2500                 }
2501         }
2502
2503         /* TODO: make this completely nonblocking */
2504         status = receive_smb_talloc(mem_ctx, xconn, fd,
2505                                     (char **)(void *)&inbuf,
2506                                     0, /* timeout */
2507                                     &unread_bytes,
2508                                     &encrypted,
2509                                     &inbuf_len, &seqnum,
2510                                     !from_client /* trusted channel */);
2511
2512         if (async_echo && from_client) {
2513                 smbd_unlock_socket(xconn);
2514         }
2515
2516         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2517                 goto process;
2518         }
2519         if (NT_STATUS_IS_ERR(status)) {
2520                 exit_server_cleanly("failed to receive smb request");
2521         }
2522         if (!NT_STATUS_IS_OK(status)) {
2523                 return;
2524         }
2525
2526 process:
2527         process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2528                     seqnum, encrypted, NULL);
2529 }
2530
2531 static void smbd_server_connection_handler(struct tevent_context *ev,
2532                                            struct tevent_fd *fde,
2533                                            uint16_t flags,
2534                                            void *private_data)
2535 {
2536         struct smbXsrv_connection *xconn =
2537                 talloc_get_type_abort(private_data,
2538                 struct smbXsrv_connection);
2539
2540         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2541                 /*
2542                  * we're not supposed to do any io
2543                  */
2544                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2545                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2546                 return;
2547         }
2548
2549         if (flags & TEVENT_FD_WRITE) {
2550                 smbd_server_connection_write_handler(xconn);
2551                 return;
2552         }
2553         if (flags & TEVENT_FD_READ) {
2554                 smbd_server_connection_read_handler(xconn, xconn->transport.sock);
2555                 return;
2556         }
2557 }
2558
2559 static void smbd_server_echo_handler(struct tevent_context *ev,
2560                                      struct tevent_fd *fde,
2561                                      uint16_t flags,
2562                                      void *private_data)
2563 {
2564         struct smbXsrv_connection *xconn =
2565                 talloc_get_type_abort(private_data,
2566                 struct smbXsrv_connection);
2567
2568         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2569                 /*
2570                  * we're not supposed to do any io
2571                  */
2572                 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2573                 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2574                 return;
2575         }
2576
2577         if (flags & TEVENT_FD_WRITE) {
2578                 smbd_server_connection_write_handler(xconn);
2579                 return;
2580         }
2581         if (flags & TEVENT_FD_READ) {
2582                 smbd_server_connection_read_handler(
2583                         xconn, xconn->smb1.echo_handler.trusted_fd);
2584                 return;
2585         }
2586 }
2587
2588 struct smbd_release_ip_state {
2589         struct smbXsrv_connection *xconn;
2590         struct tevent_immediate *im;
2591         char addr[INET6_ADDRSTRLEN];
2592 };
2593
2594 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2595                                       struct tevent_immediate *im,
2596                                       void *private_data)
2597 {
2598         struct smbd_release_ip_state *state =
2599                 talloc_get_type_abort(private_data,
2600                 struct smbd_release_ip_state);
2601         struct smbXsrv_connection *xconn = state->xconn;
2602
2603         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2604                 /*
2605                  * smbd_server_connection_terminate() already triggered ?
2606                  */
2607                 return;
2608         }
2609
2610         smbd_server_connection_terminate(xconn, "CTDB_SRVID_RELEASE_IP");
2611 }
2612
2613 /****************************************************************************
2614 received when we should release a specific IP
2615 ****************************************************************************/
2616 static bool release_ip(const char *ip, void *priv)
2617 {
2618         struct smbd_release_ip_state *state =
2619                 talloc_get_type_abort(priv,
2620                 struct smbd_release_ip_state);
2621         struct smbXsrv_connection *xconn = state->xconn;
2622         const char *addr = state->addr;
2623         const char *p = addr;
2624
2625         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2626                 /* avoid recursion */
2627                 return false;
2628         }
2629
2630         if (strncmp("::ffff:", addr, 7) == 0) {
2631                 p = addr + 7;
2632         }
2633
2634         DEBUG(10, ("Got release IP message for %s, "
2635                    "our address is %s\n", ip, p));
2636
2637         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2638                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2639                         ip));
2640                 /*
2641                  * With SMB2 we should do a clean disconnect,
2642                  * the previous_session_id in the session setup
2643                  * will cleanup the old session, tcons and opens.
2644                  *
2645                  * A clean disconnect is needed in order to support
2646                  * durable handles.
2647                  *
2648                  * Note: typically this is never triggered
2649                  *       as we got a TCP RST (triggered by ctdb event scripts)
2650                  *       before we get CTDB_SRVID_RELEASE_IP.
2651                  *
2652                  * We used to call _exit(1) here, but as this was mostly never
2653                  * triggered and has implication on our process model,
2654                  * we can just use smbd_server_connection_terminate()
2655                  * (also for SMB1).
2656                  *
2657                  * We don't call smbd_server_connection_terminate() directly
2658                  * as we might be called from within ctdbd_migrate(),
2659                  * we need to defer our action to the next event loop
2660                  */
2661                 tevent_schedule_immediate(state->im, xconn->ev_ctx,
2662                                           smbd_release_ip_immediate, state);
2663
2664                 /*
2665                  * Make sure we don't get any io on the connection.
2666                  */
2667                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2668                 return true;
2669         }
2670
2671         return false;
2672 }
2673
2674 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2675                                   struct sockaddr_storage *srv,
2676                                   struct sockaddr_storage *clnt)
2677 {
2678         struct smbd_release_ip_state *state;
2679         struct ctdbd_connection *cconn;
2680
2681         cconn = messaging_ctdbd_connection();
2682         if (cconn == NULL) {
2683                 return NT_STATUS_NO_MEMORY;
2684         }
2685
2686         state = talloc_zero(xconn, struct smbd_release_ip_state);
2687         if (state == NULL) {
2688                 return NT_STATUS_NO_MEMORY;
2689         }
2690         state->xconn = xconn;
2691         state->im = tevent_create_immediate(state);
2692         if (state->im == NULL) {
2693                 return NT_STATUS_NO_MEMORY;
2694         }
2695         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2696                 return NT_STATUS_NO_MEMORY;
2697         }
2698
2699         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2700 }
2701
2702 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2703                                   void *private_data, uint32_t msg_type,
2704                                   struct server_id server_id, DATA_BLOB *data)
2705 {
2706         struct smbd_server_connection *sconn = talloc_get_type_abort(
2707                 private_data, struct smbd_server_connection);
2708         const char *ip = (char *) data->data;
2709         char *client_ip;
2710
2711         DEBUG(10, ("Got kill request for client IP %s\n", ip));
2712
2713         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2714                                                      talloc_tos());
2715         if (client_ip == NULL) {
2716                 return;
2717         }
2718
2719         if (strequal(ip, client_ip)) {
2720                 DEBUG(1, ("Got kill client message for %s - "
2721                           "exiting immediately\n", ip));
2722                 exit_server_cleanly("Forced disconnect for client");
2723         }
2724
2725         TALLOC_FREE(client_ip);
2726 }
2727
2728 /*
2729  * Send keepalive packets to our client
2730  */
2731 static bool keepalive_fn(const struct timeval *now, void *private_data)
2732 {
2733         struct smbd_server_connection *sconn = talloc_get_type_abort(
2734                 private_data, struct smbd_server_connection);
2735         struct smbXsrv_connection *xconn = NULL;
2736         bool ret;
2737
2738         if (sconn->using_smb2) {
2739                 /* Don't do keepalives on an SMB2 connection. */
2740                 return false;
2741         }
2742
2743         /*
2744          * With SMB1 we only have 1 connection
2745          */
2746         xconn = sconn->client->connections;
2747         smbd_lock_socket(xconn);
2748         ret = send_keepalive(xconn->transport.sock);
2749         smbd_unlock_socket(xconn);
2750
2751         if (!ret) {
2752                 int saved_errno = errno;
2753                 /*
2754                  * Try and give an error message saying what
2755                  * client failed.
2756                  */
2757                 DEBUG(0, ("send_keepalive failed for client %s. "
2758                           "Error %s - exiting\n",
2759                           smbXsrv_connection_dbg(xconn),
2760                           strerror(saved_errno)));
2761                 errno = saved_errno;
2762                 return False;
2763         }
2764         return True;
2765 }
2766
2767 /*
2768  * Do the recurring check if we're idle
2769  */
2770 static bool deadtime_fn(const struct timeval *now, void *private_data)
2771 {
2772         struct smbd_server_connection *sconn =
2773                 (struct smbd_server_connection *)private_data;
2774
2775         if ((conn_num_open(sconn) == 0)
2776             || (conn_idle_all(sconn, now->tv_sec))) {
2777                 DEBUG( 2, ( "Closing idle connection\n" ) );
2778                 messaging_send(sconn->msg_ctx,
2779                                messaging_server_id(sconn->msg_ctx),
2780                                MSG_SHUTDOWN, &data_blob_null);
2781                 return False;
2782         }
2783
2784         return True;
2785 }
2786
2787 /*
2788  * Do the recurring log file and smb.conf reload checks.
2789  */
2790
2791 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2792 {
2793         struct smbd_server_connection *sconn = talloc_get_type_abort(
2794                 private_data, struct smbd_server_connection);
2795
2796         DEBUG(5, ("housekeeping\n"));
2797
2798         change_to_root_user();
2799
2800         /* update printer queue caches if necessary */
2801         update_monitored_printq_cache(sconn->msg_ctx);
2802
2803         /* check if we need to reload services */
2804         check_reload(sconn, time_mono(NULL));
2805
2806         /*
2807          * Force a log file check.
2808          */
2809         force_check_log_size();
2810         check_log_size();
2811         return true;
2812 }
2813
2814 /*
2815  * Read an smb packet in the echo handler child, giving the parent
2816  * smbd one second to react once the socket becomes readable.
2817  */
2818
2819 struct smbd_echo_read_state {
2820         struct tevent_context *ev;
2821         struct smbXsrv_connection *xconn;
2822
2823         char *buf;
2824         size_t buflen;
2825         uint32_t seqnum;
2826 };
2827
2828 static void smbd_echo_read_readable(struct tevent_req *subreq);
2829 static void smbd_echo_read_waited(struct tevent_req *subreq);
2830
2831 static struct tevent_req *smbd_echo_read_send(
2832         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2833         struct smbXsrv_connection *xconn)
2834 {
2835         struct tevent_req *req, *subreq;
2836         struct smbd_echo_read_state *state;
2837
2838         req = tevent_req_create(mem_ctx, &state,
2839                                 struct smbd_echo_read_state);
2840         if (req == NULL) {
2841                 return NULL;
2842         }
2843         state->ev = ev;
2844         state->xconn = xconn;
2845
2846         subreq = wait_for_read_send(state, ev, xconn->transport.sock);
2847         if (tevent_req_nomem(subreq, req)) {
2848                 return tevent_req_post(req, ev);
2849         }
2850         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2851         return req;
2852 }
2853
2854 static void smbd_echo_read_readable(struct tevent_req *subreq)
2855 {
2856         struct tevent_req *req = tevent_req_callback_data(
2857                 subreq, struct tevent_req);
2858         struct smbd_echo_read_state *state = tevent_req_data(
2859                 req, struct smbd_echo_read_state);
2860         bool ok;
2861         int err;
2862
2863         ok = wait_for_read_recv(subreq, &err);
2864         TALLOC_FREE(subreq);
2865         if (!ok) {
2866                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2867                 return;
2868         }
2869
2870         /*
2871          * Give the parent smbd one second to step in
2872          */
2873
2874         subreq = tevent_wakeup_send(
2875                 state, state->ev, timeval_current_ofs(1, 0));
2876         if (tevent_req_nomem(subreq, req)) {
2877                 return;
2878         }
2879         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2880 }
2881
2882 static void smbd_echo_read_waited(struct tevent_req *subreq)
2883 {
2884         struct tevent_req *req = tevent_req_callback_data(
2885                 subreq, struct tevent_req);
2886         struct smbd_echo_read_state *state = tevent_req_data(
2887                 req, struct smbd_echo_read_state);
2888         struct smbXsrv_connection *xconn = state->xconn;
2889         bool ok;
2890         NTSTATUS status;
2891         size_t unread = 0;
2892         bool encrypted;
2893
2894         ok = tevent_wakeup_recv(subreq);
2895         TALLOC_FREE(subreq);
2896         if (!ok) {
2897                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2898                 return;
2899         }
2900
2901         ok = smbd_lock_socket_internal(xconn);
2902         if (!ok) {
2903                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2904                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2905                 return;
2906         }
2907
2908         if (!fd_is_readable(xconn->transport.sock)) {
2909                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2910                           (int)getpid()));
2911
2912                 ok = smbd_unlock_socket_internal(xconn);
2913                 if (!ok) {
2914                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2915                         DEBUG(1, ("%s: failed to unlock socket\n",
2916                                 __location__));
2917                         return;
2918                 }
2919
2920                 subreq = wait_for_read_send(state, state->ev,
2921                                             xconn->transport.sock);
2922                 if (tevent_req_nomem(subreq, req)) {
2923                         return;
2924                 }
2925                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2926                 return;
2927         }
2928
2929         status = receive_smb_talloc(state, xconn,
2930                                     xconn->transport.sock,
2931                                     &state->buf,
2932                                     0 /* timeout */,
2933                                     &unread,
2934                                     &encrypted,
2935                                     &state->buflen,
2936                                     &state->seqnum,
2937                                     false /* trusted_channel*/);
2938
2939         if (tevent_req_nterror(req, status)) {
2940                 tevent_req_nterror(req, status);
2941                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2942                           (int)getpid(), nt_errstr(status)));
2943                 return;
2944         }
2945
2946         ok = smbd_unlock_socket_internal(xconn);
2947         if (!ok) {
2948                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2949                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2950                 return;
2951         }
2952         tevent_req_done(req);
2953 }
2954
2955 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2956                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2957 {
2958         struct smbd_echo_read_state *state = tevent_req_data(
2959                 req, struct smbd_echo_read_state);
2960         NTSTATUS status;
2961
2962         if (tevent_req_is_nterror(req, &status)) {
2963                 return status;
2964         }
2965         *pbuf = talloc_move(mem_ctx, &state->buf);
2966         *pbuflen = state->buflen;
2967         *pseqnum = state->seqnum;
2968         return NT_STATUS_OK;
2969 }
2970
2971 struct smbd_echo_state {
2972         struct tevent_context *ev;
2973         struct iovec *pending;
2974         struct smbd_server_connection *sconn;
2975         struct smbXsrv_connection *xconn;
2976         int parent_pipe;
2977
2978         struct tevent_fd *parent_fde;
2979
2980         struct tevent_req *write_req;
2981 };
2982
2983 static void smbd_echo_writer_done(struct tevent_req *req);
2984
2985 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2986 {
2987         int num_pending;
2988
2989         if (state->write_req != NULL) {
2990                 return;
2991         }
2992
2993         num_pending = talloc_array_length(state->pending);
2994         if (num_pending == 0) {
2995                 return;
2996         }
2997
2998         state->write_req = writev_send(state, state->ev, NULL,
2999                                        state->parent_pipe, false,
3000                                        state->pending, num_pending);
3001         if (state->write_req == NULL) {
3002                 DEBUG(1, ("writev_send failed\n"));
3003                 exit(1);
3004         }
3005
3006         talloc_steal(state->write_req, state->pending);
3007         state->pending = NULL;
3008
3009         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
3010                                 state);
3011 }
3012
3013 static void smbd_echo_writer_done(struct tevent_req *req)
3014 {
3015         struct smbd_echo_state *state = tevent_req_callback_data(
3016                 req, struct smbd_echo_state);
3017         ssize_t written;
3018         int err;
3019
3020         written = writev_recv(req, &err);
3021         TALLOC_FREE(req);
3022         state->write_req = NULL;
3023         if (written == -1) {
3024                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3025                 exit(1);
3026         }
3027         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3028         smbd_echo_activate_writer(state);
3029 }
3030
3031 static bool smbd_echo_reply(struct smbd_echo_state *state,
3032                             uint8_t *inbuf, size_t inbuf_len,
3033                             uint32_t seqnum)
3034 {
3035         struct smb_request req;
3036         uint16_t num_replies;
3037         char *outbuf;
3038         bool ok;
3039
3040         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3041                 DEBUG(10, ("Got netbios keepalive\n"));
3042                 /*
3043                  * Just swallow it
3044                  */
3045                 return true;
3046         }
3047
3048         if (inbuf_len < smb_size) {
3049                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3050                 return false;
3051         }
3052         if (!valid_smb_header(inbuf)) {
3053                 DEBUG(10, ("Got invalid SMB header\n"));
3054                 return false;
3055         }
3056
3057         if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3058                               seqnum)) {
3059                 return false;
3060         }
3061         req.inbuf = inbuf;
3062
3063         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3064                    smb_messages[req.cmd].name
3065                    ? smb_messages[req.cmd].name : "unknown"));
3066
3067         if (req.cmd != SMBecho) {
3068                 return false;
3069         }
3070         if (req.wct < 1) {
3071                 return false;
3072         }
3073
3074         num_replies = SVAL(req.vwv+0, 0);
3075         if (num_replies != 1) {
3076                 /* Not a Windows "Hey, you're still there?" request */
3077                 return false;
3078         }
3079
3080         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
3081                            1, req.buflen)) {
3082                 DEBUG(10, ("create_outbuf failed\n"));
3083                 return false;
3084         }
3085         req.outbuf = (uint8_t *)outbuf;
3086
3087         SSVAL(req.outbuf, smb_vwv0, num_replies);
3088
3089         if (req.buflen > 0) {
3090                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3091         }
3092
3093         ok = srv_send_smb(req.xconn,
3094                           (char *)outbuf,
3095                           true, seqnum+1,
3096                           false, &req.pcd);
3097         TALLOC_FREE(outbuf);
3098         if (!ok) {
3099                 exit(1);
3100         }
3101
3102         return true;
3103 }
3104
3105 static void smbd_echo_exit(struct tevent_context *ev,
3106                            struct tevent_fd *fde, uint16_t flags,
3107                            void *private_data)
3108 {
3109         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3110         exit(0);
3111 }
3112
3113 static void smbd_echo_got_packet(struct tevent_req *req);
3114
3115 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
3116                            int parent_pipe)
3117 {
3118         struct smbd_echo_state *state;
3119         struct tevent_req *read_req;
3120
3121         state = talloc_zero(xconn, struct smbd_echo_state);
3122         if (state == NULL) {
3123                 DEBUG(1, ("talloc failed\n"));
3124                 return;
3125         }
3126         state->xconn = xconn;
3127         state->parent_pipe = parent_pipe;
3128         state->ev = s3_tevent_context_init(state);
3129         if (state->ev == NULL) {
3130                 DEBUG(1, ("tevent_context_init failed\n"));
3131                 TALLOC_FREE(state);
3132                 return;
3133         }
3134         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3135                                         TEVENT_FD_READ, smbd_echo_exit,
3136                                         state);
3137         if (state->parent_fde == NULL) {
3138                 DEBUG(1, ("tevent_add_fd failed\n"));
3139                 TALLOC_FREE(state);
3140                 return;
3141         }
3142
3143         read_req = smbd_echo_read_send(state, state->ev, xconn);
3144         if (read_req == NULL) {
3145                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3146                 TALLOC_FREE(state);
3147                 return;
3148         }
3149         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3150
3151         while (true) {
3152                 if (tevent_loop_once(state->ev) == -1) {
3153                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3154                                   strerror(errno)));
3155                         break;
3156                 }
3157         }
3158         TALLOC_FREE(state);
3159 }
3160
3161 static void smbd_echo_got_packet(struct tevent_req *req)
3162 {
3163         struct smbd_echo_state *state = tevent_req_callback_data(
3164                 req, struct smbd_echo_state);
3165         NTSTATUS status;
3166         char *buf = NULL;
3167         size_t buflen = 0;
3168         uint32_t seqnum = 0;
3169         bool reply;
3170
3171         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3172         TALLOC_FREE(req);
3173         if (!NT_STATUS_IS_OK(status)) {
3174                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3175                           nt_errstr(status)));
3176                 exit(1);
3177         }
3178
3179         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3180         if (!reply) {
3181                 size_t num_pending;
3182                 struct iovec *tmp;
3183                 struct iovec *iov;
3184
3185                 num_pending = talloc_array_length(state->pending);
3186                 tmp = talloc_realloc(state, state->pending, struct iovec,
3187                                      num_pending+1);
3188                 if (tmp == NULL) {
3189                         DEBUG(1, ("talloc_realloc failed\n"));
3190                         exit(1);
3191                 }
3192                 state->pending = tmp;
3193
3194                 if (buflen >= smb_size) {
3195                         /*
3196                          * place the seqnum in the packet so that the main process
3197                          * can reply with signing
3198                          */
3199                         SIVAL(buf, smb_ss_field, seqnum);
3200                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3201                 }
3202
3203                 iov = &state->pending[num_pending];
3204                 iov->iov_base = talloc_move(state->pending, &buf);
3205                 iov->iov_len = buflen;
3206
3207                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3208                           (int)getpid()));
3209                 smbd_echo_activate_writer(state);
3210         }
3211
3212         req = smbd_echo_read_send(state, state->ev, state->xconn);
3213         if (req == NULL) {
3214                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3215                 exit(1);
3216         }
3217         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3218 }
3219
3220
3221 /*
3222  * Handle SMBecho requests in a forked child process
3223  */
3224 bool fork_echo_handler(struct smbXsrv_connection *xconn)
3225 {
3226         int listener_pipe[2];
3227         int res;
3228         pid_t child;
3229         bool use_mutex = false;
3230
3231         res = pipe(listener_pipe);
3232         if (res == -1) {
3233                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3234                 return false;
3235         }
3236
3237 #ifdef HAVE_ROBUST_MUTEXES
3238         use_mutex = tdb_runtime_check_for_robust_mutexes();
3239
3240         if (use_mutex) {
3241                 pthread_mutexattr_t a;
3242
3243                 xconn->smb1.echo_handler.socket_mutex =
3244                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3245                 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3246                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3247                                   strerror(errno)));
3248                         goto fail;
3249                 }
3250
3251                 res = pthread_mutexattr_init(&a);
3252                 if (res != 0) {
3253                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3254                                   strerror(res)));
3255                         goto fail;
3256                 }
3257                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3258                 if (res != 0) {
3259                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3260                                   strerror(res)));
3261                         pthread_mutexattr_destroy(&a);
3262                         goto fail;
3263                 }
3264                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3265                 if (res != 0) {
3266                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3267                                   strerror(res)));
3268                         pthread_mutexattr_destroy(&a);
3269                         goto fail;
3270                 }
3271                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3272                 if (res != 0) {
3273                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3274                                   "%s\n", strerror(res)));
3275                         pthread_mutexattr_destroy(&a);
3276                         goto fail;
3277                 }
3278                 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3279                                          &a);
3280                 pthread_mutexattr_destroy(&a);
3281                 if (res != 0) {
3282                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3283                                   strerror(res)));
3284                         goto fail;
3285                 }
3286         }
3287 #endif
3288
3289         if (!use_mutex) {
3290                 xconn->smb1.echo_handler.socket_lock_fd =
3291                         create_unlink_tmp(lp_lock_directory());
3292                 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3293                         DEBUG(1, ("Could not create lock fd: %s\n",
3294                                   strerror(errno)));
3295                         goto fail;
3296                 }
3297         }
3298
3299         child = fork();
3300         if (child == 0) {
3301                 NTSTATUS status;
3302
3303                 close(listener_pipe[0]);
3304                 set_blocking(listener_pipe[1], false);
3305
3306                 status = reinit_after_fork(xconn->msg_ctx,
3307                                            xconn->ev_ctx,
3308                                            true);
3309                 if (!NT_STATUS_IS_OK(status)) {
3310                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3311                                   nt_errstr(status)));
3312                         exit(1);
3313                 }
3314                 smbd_echo_loop(xconn, listener_pipe[1]);
3315                 exit(0);
3316         }
3317         close(listener_pipe[1]);
3318         listener_pipe[1] = -1;
3319         xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3320
3321         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3322
3323         /*
3324          * Without smb signing this is the same as the normal smbd
3325          * listener. This needs to change once signing comes in.
3326          */
3327         xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(xconn->ev_ctx,
3328                                         xconn,
3329                                         xconn->smb1.echo_handler.trusted_fd,
3330                                         TEVENT_FD_READ,
3331                                         smbd_server_echo_handler,
3332                                         xconn);
3333         if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3334                 DEBUG(1, ("event_add_fd failed\n"));
3335                 goto fail;
3336         }
3337
3338         return true;
3339
3340 fail:
3341         if (listener_pipe[0] != -1) {
3342                 close(listener_pipe[0]);
3343         }
3344         if (listener_pipe[1] != -1) {
3345                 close(listener_pipe[1]);
3346         }
3347         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3348                 close(xconn->smb1.echo_handler.socket_lock_fd);
3349         }
3350 #ifdef HAVE_ROBUST_MUTEXES
3351         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3352                 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3353                 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3354         }
3355 #endif
3356         smbd_echo_init(xconn);
3357
3358         return false;
3359 }
3360
3361 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3362 {
3363         while (user) {
3364                 if (user->session_info &&
3365                     (user->session_info->unix_token->uid == uid)) {
3366                         return true;
3367                 }
3368                 user = user->next;
3369         }
3370         return false;
3371 }
3372
3373 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3374 {
3375         while (user) {
3376                 if (user->session_info != NULL) {
3377                         int i;
3378                         struct security_unix_token *utok;
3379
3380                         utok = user->session_info->unix_token;
3381                         if (utok->gid == gid) {
3382                                 return true;
3383                         }
3384                         for(i=0; i<utok->ngroups; i++) {
3385                                 if (utok->groups[i] == gid) {
3386                                         return true;
3387                                 }
3388                         }
3389                 }
3390                 user = user->next;
3391         }
3392         return false;
3393 }
3394
3395 static bool sid_in_use(const struct user_struct *user,
3396                        const struct dom_sid *psid)
3397 {
3398         while (user) {
3399                 struct security_token *tok;
3400
3401                 if (user->session_info == NULL) {
3402                         continue;
3403                 }
3404                 tok = user->session_info->security_token;
3405                 if (tok == NULL) {
3406                         /*
3407                          * Not sure session_info->security_token can
3408                          * ever be NULL. This check might be not
3409                          * necessary.
3410                          */
3411                         continue;
3412                 }
3413                 if (security_token_has_sid(tok, psid)) {
3414                         return true;
3415                 }
3416                 user = user->next;
3417         }
3418         return false;
3419 }
3420
3421 static bool id_in_use(const struct user_struct *user,
3422                       const struct id_cache_ref *id)
3423 {
3424         switch(id->type) {
3425         case UID:
3426                 return uid_in_use(user, id->id.uid);
3427         case GID:
3428                 return gid_in_use(user, id->id.gid);
3429         case SID:
3430                 return sid_in_use(user, &id->id.sid);
3431         default:
3432                 break;
3433         }
3434         return false;
3435 }
3436
3437 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3438                                void *private_data,
3439                                uint32_t msg_type,
3440                                struct server_id server_id,
3441                                DATA_BLOB* data)
3442 {
3443         const char *msg = (data && data->data)
3444                 ? (const char *)data->data : "<NULL>";
3445         struct id_cache_ref id;
3446         struct smbd_server_connection *sconn =
3447                 talloc_get_type_abort(private_data,
3448                 struct smbd_server_connection);
3449
3450         if (!id_cache_ref_parse(msg, &id)) {
3451                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3452                 return;
3453         }
3454
3455         if (id_in_use(sconn->users, &id)) {
3456                 exit_server_cleanly(msg);
3457         }
3458         id_cache_delete_from_cache(&id);
3459 }
3460
3461 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3462                                         enum protocol_types protocol)
3463 {
3464         NTSTATUS status;
3465
3466         set_Protocol(protocol);
3467         conn->protocol = protocol;
3468
3469         if (protocol >= PROTOCOL_SMB2_02) {
3470                 status = smb2srv_session_table_init(conn);
3471                 if (!NT_STATUS_IS_OK(status)) {
3472                         return status;
3473                 }
3474
3475                 status = smb2srv_open_table_init(conn);
3476                 if (!NT_STATUS_IS_OK(status)) {
3477                         return status;
3478                 }
3479         } else {
3480                 status = smb1srv_session_table_init(conn);
3481                 if (!NT_STATUS_IS_OK(status)) {
3482                         return status;
3483                 }
3484
3485                 status = smb1srv_tcon_table_init(conn);
3486                 if (!NT_STATUS_IS_OK(status)) {
3487                         return status;
3488                 }
3489
3490                 status = smb1srv_open_table_init(conn);
3491                 if (!NT_STATUS_IS_OK(status)) {
3492                         return status;
3493                 }
3494         }
3495
3496         return NT_STATUS_OK;
3497 }
3498
3499 struct smbd_tevent_trace_state {
3500         TALLOC_CTX *frame;
3501         uint64_t smbd_idle_profstamp;
3502 };
3503
3504 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3505                                        void *private_data)
3506 {
3507         struct smbd_tevent_trace_state *state =
3508                 (struct smbd_tevent_trace_state *)private_data;
3509
3510         switch (point) {
3511         case TEVENT_TRACE_BEFORE_WAIT:
3512                 /*
3513                  * This just removes compiler warning
3514                  * without profile support
3515                  */
3516                 state->smbd_idle_profstamp = 0;
3517                 START_PROFILE_STAMP(smbd_idle, state->smbd_idle_profstamp);
3518                 break;
3519         case TEVENT_TRACE_AFTER_WAIT:
3520                 END_PROFILE_STAMP(smbd_idle, state->smbd_idle_profstamp);
3521                 break;
3522         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3523                 TALLOC_FREE(state->frame);
3524                 state->frame = talloc_stackframe_pool(8192);
3525                 break;
3526         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3527                 TALLOC_FREE(state->frame);
3528                 break;
3529         }
3530
3531         errno = 0;
3532 }
3533
3534 /**
3535  * Create a debug string for the connection
3536  *
3537  * This is allocated to talloc_tos() or a string constant
3538  * in certain corner cases. The returned string should
3539  * hence not be free'd directly but only via the talloc stack.
3540  */
3541 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3542 {
3543         const char *ret;
3544
3545         /*
3546          * TODO: this can be improved later
3547          * maybe including the client guid or more
3548          */
3549         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3550         if (ret == NULL) {
3551                 return "<tsocket_address_string() failed>";
3552         }
3553
3554         return ret;
3555 }
3556
3557 /****************************************************************************
3558  Process commands from the client
3559 ****************************************************************************/
3560
3561 void smbd_process(struct tevent_context *ev_ctx,
3562                   struct messaging_context *msg_ctx,
3563                   int sock_fd,
3564                   bool interactive)
3565 {
3566         struct smbd_tevent_trace_state trace_state = {
3567                 .frame = talloc_stackframe(),
3568         };
3569         struct smbXsrv_client *client;
3570         struct smbXsrv_connection *xconn;
3571         struct smbd_server_connection *sconn;
3572         struct sockaddr_storage ss_srv;
3573         void *sp_srv = (void *)&ss_srv;
3574         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3575         struct sockaddr_storage ss_clnt;
3576         void *sp_clnt = (void *)&ss_clnt;
3577         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3578         socklen_t sa_socklen;
3579         struct tsocket_address *local_address = NULL;
3580         struct tsocket_address *remote_address = NULL;
3581         const char *locaddr = NULL;
3582         const char *remaddr = NULL;
3583         char *rhost;
3584         int ret;
3585         int tmp;
3586
3587         client = talloc_zero(ev_ctx, struct smbXsrv_client);
3588         if (client == NULL) {
3589                 DEBUG(0,("talloc_zero(struct smbXsrv_client)\n"));
3590                 exit_server_cleanly("talloc_zero(struct smbXsrv_client).\n");
3591         }
3592
3593         /*
3594          * TODO: remove this...:-)
3595          */
3596         global_smbXsrv_client = client;
3597
3598         client->ev_ctx = ev_ctx;
3599         client->msg_ctx = msg_ctx;
3600
3601         sconn = talloc_zero(client, struct smbd_server_connection);
3602         if (sconn == NULL) {
3603                 exit_server("failed to create smbd_server_connection");
3604         }
3605
3606         client->sconn = sconn;
3607         sconn->client = client;
3608
3609         sconn->ev_ctx = ev_ctx;
3610         sconn->msg_ctx = msg_ctx;
3611
3612         xconn = talloc_zero(client, struct smbXsrv_connection);
3613         if (xconn == NULL) {
3614                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3615                 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3616         }
3617         /* for now we only have one connection */
3618         DLIST_ADD_END(client->connections, xconn, NULL);
3619         xconn->client = client;
3620
3621         xconn->ev_ctx = ev_ctx;
3622         xconn->msg_ctx = msg_ctx;
3623         xconn->transport.sock = sock_fd;
3624         smbd_echo_init(xconn);
3625
3626         /*
3627          * TODO: remove this...:-)
3628          */
3629         sconn->conn = xconn;
3630
3631         if (!interactive) {
3632                 smbd_setup_sig_term_handler(sconn);
3633                 smbd_setup_sig_hup_handler(sconn);
3634
3635                 if (!serverid_register(messaging_server_id(msg_ctx),
3636                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3637                                        |FLAG_MSG_DBWRAP
3638                                        |FLAG_MSG_PRINT_GENERAL)) {
3639                         exit_server_cleanly("Could not register myself in "
3640                                             "serverid.tdb");
3641                 }
3642         }
3643
3644         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3645                 /*
3646                  * We're not making the decision here,
3647                  * we're just allowing the client
3648                  * to decide between SMB1 and SMB2
3649                  * with the first negprot
3650                  * packet.
3651                  */
3652                 sconn->using_smb2 = true;
3653         }
3654
3655         /* Ensure child is set to blocking mode */
3656         set_blocking(sock_fd,True);
3657
3658         set_socket_options(sock_fd, "SO_KEEPALIVE");
3659         set_socket_options(sock_fd, lp_socket_options());
3660
3661         sa_socklen = sizeof(ss_clnt);
3662         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3663         if (ret != 0) {
3664                 int level = (errno == ENOTCONN)?2:0;
3665                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3666                 exit_server_cleanly("getpeername() failed.\n");
3667         }
3668         ret = tsocket_address_bsd_from_sockaddr(sconn,
3669                                                 sa_clnt, sa_socklen,
3670                                                 &remote_address);
3671         if (ret != 0) {
3672                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3673                         __location__, strerror(errno)));
3674                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3675         }
3676
3677         sa_socklen = sizeof(ss_srv);
3678         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3679         if (ret != 0) {
3680                 int level = (errno == ENOTCONN)?2:0;
3681                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3682                 exit_server_cleanly("getsockname() failed.\n");
3683         }
3684         ret = tsocket_address_bsd_from_sockaddr(sconn,
3685                                                 sa_srv, sa_socklen,
3686                                                 &local_address);
3687         if (ret != 0) {
3688                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3689                         __location__, strerror(errno)));
3690                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3691         }
3692
3693         sconn->local_address = local_address;
3694         sconn->remote_address = remote_address;
3695
3696         if (tsocket_address_is_inet(local_address, "ip")) {
3697                 locaddr = tsocket_address_inet_addr_string(
3698                                 sconn->local_address,
3699                                 talloc_tos());
3700                 if (locaddr == NULL) {
3701                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3702                                  __location__, strerror(errno)));
3703                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3704                 }
3705         } else {
3706                 locaddr = "0.0.0.0";
3707         }
3708
3709         if (tsocket_address_is_inet(remote_address, "ip")) {
3710                 remaddr = tsocket_address_inet_addr_string(
3711                                 sconn->remote_address,
3712                                 talloc_tos());
3713                 if (remaddr == NULL) {
3714                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3715                                  __location__, strerror(errno)));
3716                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3717                 }
3718         } else {
3719                 remaddr = "0.0.0.0";
3720         }
3721
3722         /* this is needed so that we get decent entries
3723            in smbstatus for port 445 connects */
3724         set_remote_machine_name(remaddr, false);
3725         reload_services(sconn, conn_snum_used, true);
3726
3727         /*
3728          * Before the first packet, check the global hosts allow/ hosts deny
3729          * parameters before doing any parsing of packets passed to us by the
3730          * client. This prevents attacks on our parsing code from hosts not in
3731          * the hosts allow list.
3732          */
3733
3734         ret = get_remote_hostname(remote_address,
3735                                   &rhost,
3736                                   talloc_tos());
3737         if (ret < 0) {
3738                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3739                         __location__, strerror(errno)));
3740                 exit_server_cleanly("get_remote_hostname failed.\n");
3741         }
3742         if (strequal(rhost, "UNKNOWN")) {
3743                 rhost = talloc_strdup(talloc_tos(), remaddr);
3744         }
3745         sconn->remote_hostname = talloc_move(sconn, &rhost);
3746
3747         sub_set_socket_ids(remaddr,
3748                            sconn->remote_hostname,
3749                            locaddr);
3750
3751         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3752                           sconn->remote_hostname,
3753                           remaddr)) {
3754                 /*
3755                  * send a negative session response "not listening on calling
3756                  * name"
3757                  */
3758                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3759                 DEBUG( 1, ("Connection denied from %s to %s\n",
3760                            tsocket_address_string(remote_address, talloc_tos()),
3761                            tsocket_address_string(local_address, talloc_tos())));
3762                 (void)srv_send_smb(xconn,(char *)buf, false,
3763                                    0, false, NULL);
3764                 exit_server_cleanly("connection denied");
3765         }
3766
3767         DEBUG(10, ("Connection allowed from %s to %s\n",
3768                    tsocket_address_string(remote_address, talloc_tos()),
3769                    tsocket_address_string(local_address, talloc_tos())));
3770
3771         if (lp_preload_modules()) {
3772                 smb_load_modules(lp_preload_modules());
3773         }
3774
3775         smb_perfcount_init();
3776
3777         if (!init_account_policy()) {
3778                 exit_server("Could not open account policy tdb.\n");
3779         }
3780
3781         if (*lp_root_directory(talloc_tos())) {
3782                 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3783                         DEBUG(0,("Failed to change root to %s\n",
3784                                  lp_root_directory(talloc_tos())));
3785                         exit_server("Failed to chroot()");
3786                 }
3787                 if (chdir("/") == -1) {
3788                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3789                         exit_server("Failed to chroot()");
3790                 }
3791                 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3792         }
3793
3794         if (!srv_init_signing(xconn)) {
3795                 exit_server("Failed to init smb_signing");
3796         }
3797
3798         if (!file_init(sconn)) {
3799                 exit_server("file_init() failed");
3800         }
3801
3802         /* Setup oplocks */
3803         if (!init_oplocks(sconn))
3804                 exit_server("Failed to init oplocks");
3805
3806         /* register our message handlers */
3807         messaging_register(sconn->msg_ctx, sconn,
3808                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3809         messaging_register(sconn->msg_ctx, sconn,
3810                            MSG_SMB_CLOSE_FILE, msg_close_file);
3811         messaging_register(sconn->msg_ctx, sconn,
3812                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3813
3814         id_cache_register_msgs(sconn->msg_ctx);
3815         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3816         messaging_register(sconn->msg_ctx, sconn,
3817                            ID_CACHE_KILL, smbd_id_cache_kill);
3818
3819         messaging_deregister(sconn->msg_ctx,
3820                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3821         messaging_register(sconn->msg_ctx, sconn,
3822                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3823
3824         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3825                              NULL);
3826         messaging_register(sconn->msg_ctx, sconn,
3827                            MSG_SMB_KILL_CLIENT_IP,
3828                            msg_kill_client_ip);
3829
3830         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3831
3832         /*
3833          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3834          * MSGs to all child processes
3835          */
3836         messaging_deregister(sconn->msg_ctx,
3837                              MSG_DEBUG, NULL);
3838         messaging_register(sconn->msg_ctx, NULL,
3839                            MSG_DEBUG, debug_message);
3840
3841         if ((lp_keepalive() != 0)
3842             && !(event_add_idle(ev_ctx, NULL,
3843                                 timeval_set(lp_keepalive(), 0),
3844                                 "keepalive", keepalive_fn,
3845                                 sconn))) {
3846                 DEBUG(0, ("Could not add keepalive event\n"));
3847                 exit(1);
3848         }
3849
3850         if (!(event_add_idle(ev_ctx, NULL,
3851                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3852                              "deadtime", deadtime_fn, sconn))) {
3853                 DEBUG(0, ("Could not add deadtime event\n"));
3854                 exit(1);
3855         }
3856
3857         if (!(event_add_idle(ev_ctx, NULL,
3858                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3859                              "housekeeping", housekeeping_fn, sconn))) {
3860                 DEBUG(0, ("Could not add housekeeping event\n"));
3861                 exit(1);
3862         }
3863
3864         if (lp_clustering()) {
3865                 /*
3866                  * We need to tell ctdb about our client's TCP
3867                  * connection, so that for failover ctdbd can send
3868                  * tickle acks, triggering a reconnection by the
3869                  * client.
3870                  */
3871                 NTSTATUS status;
3872
3873                 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3874                 if (!NT_STATUS_IS_OK(status)) {
3875                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3876                                   nt_errstr(status)));
3877                 }
3878         }
3879
3880         tmp = lp_max_xmit();
3881         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3882         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3883
3884         xconn->smb1.negprot.max_recv = tmp;
3885
3886         xconn->smb1.sessions.done_sesssetup = false;
3887         xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3888
3889         if (!init_dptrs(sconn)) {
3890                 exit_server("init_dptrs() failed");
3891         }
3892
3893         xconn->transport.fde = tevent_add_fd(ev_ctx,
3894                                              xconn,
3895                                              sock_fd,
3896                                              TEVENT_FD_READ,
3897                                              smbd_server_connection_handler,
3898                                              xconn);
3899         if (!xconn->transport.fde) {
3900                 exit_server("failed to create smbd_server_connection fde");
3901         }
3902
3903         xconn->local_address = sconn->local_address;
3904         xconn->remote_address = sconn->remote_address;
3905         xconn->remote_hostname = sconn->remote_hostname;
3906         xconn->protocol = PROTOCOL_NONE;
3907
3908         TALLOC_FREE(trace_state.frame);
3909
3910         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback,
3911                                   &trace_state);
3912
3913         ret = tevent_loop_wait(ev_ctx);
3914         if (ret != 0) {
3915                 DEBUG(1, ("tevent_loop_wait failed: %d, %s,"
3916                           " exiting\n", ret, strerror(errno)));
3917         }
3918
3919         TALLOC_FREE(trace_state.frame);
3920
3921         exit_server_cleanly(NULL);
3922 }
3923
3924 bool req_is_in_chain(const struct smb_request *req)
3925 {
3926         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3927                 /*
3928                  * We're right now handling a subsequent request, so we must
3929                  * be in a chain
3930                  */
3931                 return true;
3932         }
3933
3934         if (!is_andx_req(req->cmd)) {
3935                 return false;
3936         }
3937
3938         if (req->wct < 2) {
3939                 /*
3940                  * Okay, an illegal request, but definitely not chained :-)
3941                  */
3942                 return false;
3943         }
3944
3945         return (CVAL(req->vwv+0, 0) != 0xFF);
3946 }