source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern int smb_echo_count;
  24
  25 static enum smb_read_errors smb_read_error = SMB_READ_OK;
  26
  27 /*
  28  * Size of data we can send to client. Set
  29  *  by the client for all protocols above CORE.
  30  *  Set by us for CORE protocol.
  31  */
  32 int max_send = BUFFER_SIZE;
  33 /*
  34  * Size of the data we can receive. Set by us.
  35  * Can be modified by the max xmit parameter.
  36  */
  37 int max_recv = BUFFER_SIZE;
  38
  39 SIG_ATOMIC_T reload_after_sighup = 0;
  40 SIG_ATOMIC_T got_sig_term = 0;
  41 extern bool global_machine_password_needs_changing;
  42 extern int max_send;
  43
  44 /* Accessor function for smb_read_error for smbd functions. */
  45
  46 enum smb_read_errors *get_srv_read_error(void)
  47 {
  48         return &smb_read_error;
  49 }
  50
  51 /****************************************************************************
  52  Send an smb to a fd.
  53 ****************************************************************************/
  54
  55 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  56 {
  57         size_t len;
  58         size_t nwritten=0;
  59         ssize_t ret;
  60         char *buf_out = buffer;
  61
  62         /* Sign the outgoing packet if required. */
  63         srv_calculate_sign_mac(buf_out);
  64
  65         if (do_encrypt) {
  66                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  67                 if (!NT_STATUS_IS_OK(status)) {
  68                         DEBUG(0, ("send_smb: SMB encryption failed "
  69                                 "on outgoing packet! Error %s\n",
  70                                 nt_errstr(status) ));
  71                         return false;
  72                 }
  73         }
  74
  75         len = smb_len(buf_out) + 4;
  76
  77         while (nwritten < len) {
  78                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  79                 if (ret <= 0) {
  80                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  81                                 (int)len,(int)ret, strerror(errno) ));
  82                         srv_free_enc_buffer(buf_out);
  83                         return false;
  84                 }
  85                 nwritten += ret;
  86         }
  87
  88         srv_free_enc_buffer(buf_out);
  89         return true;
  90 }
  91
  92 /*******************************************************************
  93  Setup the word count and byte count for a smb message.
  94 ********************************************************************/
  95
  96 int srv_set_message(char *buf,
  97                         int num_words,
  98                         int num_bytes,
  99                         bool zero)
 100 {
 101         if (zero && (num_words || num_bytes)) {
 102                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 103         }
 104         SCVAL(buf,smb_wct,num_words);
 105         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 106         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 107         return (smb_size + num_words*2 + num_bytes);
 108 }
 109
 110 static bool valid_smb_header(const uint8_t *inbuf)
 111 {
 112         if (is_encrypted_packet(inbuf)) {
 113                 return true;
 114         }
 115         return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
 116 }
 117
 118 /* Socket functions for smbd packet processing. */
 119
 120 static bool valid_packet_size(size_t len)
 121 {
 122         /*
 123          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 124          * of header. Don't print the error if this fits.... JRA.
 125          */
 126
 127         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 128                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 129                                         (unsigned long)len));
 130                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
 131                         return false;
 132                 }
 133         }
 134         return true;
 135 }
 136
 137 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 138                                       unsigned int timeout, ssize_t len)
 139 {
 140         if (len <= 0) {
 141                 return NT_STATUS_OK;
 142         }
 143
 144         return read_socket_with_timeout_ntstatus(fd, buffer, len, len,
 145                                                  timeout, NULL);
 146 }
 147
 148 /****************************************************************************
 149  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 150 ****************************************************************************/
 151
 152 /*
 153  * Unfortunately, earlier versions of smbclient/libsmbclient
 154  * don't send this "standard" writeX header. I've fixed this
 155  * for 3.2 but we'll use the old method with earlier versions.
 156  * Windows and CIFSFS at least use this standard size. Not
 157  * sure about MacOSX.
 158  */
 159
 160 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 161                                 (2*14) + /* word count (including bcc) */ \
 162                                 1 /* pad byte */)
 163
 164 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 165                                                     const char lenbuf[4],
 166                                                     int fd, char **buffer,
 167                                                     unsigned int timeout,
 168                                                     size_t *p_unread,
 169                                                     size_t *len_ret)
 170 {
 171         /* Size of a WRITEX call (+4 byte len). */
 172         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 173         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 174         ssize_t toread;
 175         NTSTATUS status;
 176
 177         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 178
 179         status = read_socket_with_timeout_ntstatus(
 180                 fd, writeX_header + 4,
 181                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 182                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 183                 timeout, NULL);
 184
 185         if (!NT_STATUS_IS_OK(status)) {
 186                 return status;
 187         }
 188
 189         /*
 190          * Ok - now try and see if this is a possible
 191          * valid writeX call.
 192          */
 193
 194         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 195                 /*
 196                  * If the data offset is beyond what
 197                  * we've read, drain the extra bytes.
 198                  */
 199                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 200                 ssize_t newlen;
 201
 202                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 203                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 204                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 205                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 206                                         " failed to drain pending bytes");
 207                         }
 208                 } else {
 209                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 210                 }
 211
 212                 /* Spoof down the length and null out the bcc. */
 213                 set_message_bcc(writeX_header, 0);
 214                 newlen = smb_len(writeX_header);
 215
 216                 /* Copy the header we've written. */
 217
 218                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 219                                 writeX_header,
 220                                 sizeof(writeX_header));
 221
 222                 if (*buffer == NULL) {
 223                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 224                                   (int)sizeof(writeX_header)));
 225                         return NT_STATUS_NO_MEMORY;
 226                 }
 227
 228                 /* Work out the remaining bytes. */
 229                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 230                 *len_ret = newlen + 4;
 231                 return NT_STATUS_OK;
 232         }
 233
 234         if (!valid_packet_size(len)) {
 235                 return NT_STATUS_INVALID_PARAMETER;
 236         }
 237
 238         /*
 239          * Not a valid writeX call. Just do the standard
 240          * talloc and return.
 241          */
 242
 243         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 244
 245         if (*buffer == NULL) {
 246                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 247                           (int)len+4));
 248                 return NT_STATUS_NO_MEMORY;
 249         }
 250
 251         /* Copy in what we already read. */
 252         memcpy(*buffer,
 253                 writeX_header,
 254                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 255         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 256
 257         if(toread > 0) {
 258                 status = read_packet_remainder(
 259                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 260                         timeout, toread);
 261
 262                 if (!NT_STATUS_IS_OK(status)) {
 263                         return status;
 264                 }
 265         }
 266
 267         *len_ret = len + 4;
 268         return NT_STATUS_OK;
 269 }
 270
 271 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 272                                        char **buffer, unsigned int timeout,
 273                                        size_t *p_unread, size_t *plen)
 274 {
 275         char lenbuf[4];
 276         size_t len;
 277         int min_recv_size = lp_min_receive_file_size();
 278         NTSTATUS status;
 279
 280         *p_unread = 0;
 281
 282         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 283         if (!NT_STATUS_IS_OK(status)) {
 284                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 285                 return status;
 286         }
 287
 288         if (CVAL(lenbuf,0) == 0 &&
 289                         min_recv_size &&
 290                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 291                         !srv_is_signing_active()) {
 292
 293                 status = receive_smb_raw_talloc_partial_read(
 294                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, &len);
 295
 296                 if (!NT_STATUS_IS_OK(status)) {
 297                         DEBUG(10, ("receive_smb_raw: %s\n",
 298                                    nt_errstr(status)));
 299                         return status;
 300                 }
 301         }
 302
 303         if (!valid_packet_size(len)) {
 304                 return NT_STATUS_INVALID_PARAMETER;
 305         }
 306
 307         /*
 308          * The +4 here can't wrap, we've checked the length above already.
 309          */
 310
 311         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 312
 313         if (*buffer == NULL) {
 314                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 315                           (int)len+4));
 316                 return NT_STATUS_NO_MEMORY;
 317         }
 318
 319         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 320
 321         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 322         if (!NT_STATUS_IS_OK(status)) {
 323                 return status;
 324         }
 325
 326         *plen = len + 4;
 327         return NT_STATUS_OK;
 328 }
 329
 330 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 331                                    char **buffer, unsigned int timeout,
 332                                    size_t *p_unread, bool *p_encrypted,
 333                                    size_t *p_len)
 334 {
 335         size_t len;
 336         NTSTATUS status;
 337
 338         *p_encrypted = false;
 339
 340         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 341                                         p_unread, &len);
 342         if (!NT_STATUS_IS_OK(status)) {
 343                 return status;
 344         }
 345
 346         if (is_encrypted_packet((uint8_t *)*buffer)) {
 347                 status = srv_decrypt_buffer(*buffer);
 348                 if (!NT_STATUS_IS_OK(status)) {
 349                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 350                                 "incoming packet! Error %s\n",
 351                                 nt_errstr(status) ));
 352                         return status;
 353                 }
 354                 *p_encrypted = true;
 355         }
 356
 357         /* Check the incoming SMB signature. */
 358         if (!srv_check_sign_mac(*buffer, true)) {
 359                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 360                           "incoming packet!\n"));
 361                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 362         }
 363
 364         *p_len = len;
 365         return NT_STATUS_OK;
 366 }
 367
 368 /*
 369  * Initialize a struct smb_request from an inbuf
 370  */
 371
 372 void init_smb_request(struct smb_request *req,
 373                         const uint8 *inbuf,
 374                         size_t unread_bytes,
 375                         bool encrypted)
 376 {
 377         size_t req_size = smb_len(inbuf) + 4;
 378         /* Ensure we have at least smb_size bytes. */
 379         if (req_size < smb_size) {
 380                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 381                         (unsigned int)req_size ));
 382                 exit_server_cleanly("Invalid SMB request");
 383         }
 384         req->flags2 = SVAL(inbuf, smb_flg2);
 385         req->smbpid = SVAL(inbuf, smb_pid);
 386         req->mid    = SVAL(inbuf, smb_mid);
 387         req->vuid   = SVAL(inbuf, smb_uid);
 388         req->tid    = SVAL(inbuf, smb_tid);
 389         req->wct    = CVAL(inbuf, smb_wct);
 390         req->unread_bytes = unread_bytes;
 391         req->encrypted = encrypted;
 392         req->conn = conn_find(req->tid);
 393
 394         /* Ensure we have at least wct words and 2 bytes of bcc. */
 395         if (smb_size + req->wct*2 > req_size) {
 396                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 397                         (unsigned int)req->wct,
 398                         (unsigned int)req_size));
 399                 exit_server_cleanly("Invalid SMB request");
 400         }
 401         /* Ensure bcc is correct. */
 402         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 403                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 404                         "(wct = %u, size %u)\n",
 405                         (unsigned int)smb_buflen(inbuf),
 406                         (unsigned int)req->wct,
 407                         (unsigned int)req_size));
 408                 exit_server_cleanly("Invalid SMB request");
 409         }
 410         req->inbuf  = inbuf;
 411         req->outbuf = NULL;
 412 }
 413
 414 /****************************************************************************
 415  structure to hold a linked list of queued messages.
 416  for processing.
 417 ****************************************************************************/
 418
 419 static struct pending_message_list *deferred_open_queue;
 420
 421 /****************************************************************************
 422  Function to push a message onto the tail of a linked list of smb messages ready
 423  for processing.
 424 ****************************************************************************/
 425
 426 static bool push_queued_message(struct smb_request *req,
 427                                 struct timeval request_time,
 428                                 struct timeval end_time,
 429                                 char *private_data, size_t private_len)
 430 {
 431         int msg_len = smb_len(req->inbuf) + 4;
 432         struct pending_message_list *msg;
 433
 434         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 435
 436         if(msg == NULL) {
 437                 DEBUG(0,("push_message: malloc fail (1)\n"));
 438                 return False;
 439         }
 440
 441         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 442         if(msg->buf.data == NULL) {
 443                 DEBUG(0,("push_message: malloc fail (2)\n"));
 444                 TALLOC_FREE(msg);
 445                 return False;
 446         }
 447
 448         msg->request_time = request_time;
 449         msg->end_time = end_time;
 450         msg->encrypted = req->encrypted;
 451
 452         if (private_data) {
 453                 msg->private_data = data_blob_talloc(msg, private_data,
 454                                                      private_len);
 455                 if (msg->private_data.data == NULL) {
 456                         DEBUG(0,("push_message: malloc fail (3)\n"));
 457                         TALLOC_FREE(msg);
 458                         return False;
 459                 }
 460         }
 461
 462         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 463
 464         DEBUG(10,("push_message: pushed message length %u on "
 465                   "deferred_open_queue\n", (unsigned int)msg_len));
 466
 467         return True;
 468 }
 469
 470 /****************************************************************************
 471  Function to delete a sharing violation open message by mid.
 472 ****************************************************************************/
 473
 474 void remove_deferred_open_smb_message(uint16 mid)
 475 {
 476         struct pending_message_list *pml;
 477
 478         for (pml = deferred_open_queue; pml; pml = pml->next) {
 479                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 480                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 481                                   "deleting mid %u len %u\n",
 482                                   (unsigned int)mid,
 483                                   (unsigned int)pml->buf.length ));
 484                         DLIST_REMOVE(deferred_open_queue, pml);
 485                         TALLOC_FREE(pml);
 486                         return;
 487                 }
 488         }
 489 }
 490
 491 /****************************************************************************
 492  Move a sharing violation open retry message to the front of the list and
 493  schedule it for immediate processing.
 494 ****************************************************************************/
 495
 496 void schedule_deferred_open_smb_message(uint16 mid)
 497 {
 498         struct pending_message_list *pml;
 499         int i = 0;
 500
 501         for (pml = deferred_open_queue; pml; pml = pml->next) {
 502                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 503                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 504                         (unsigned int)msg_mid ));
 505                 if (mid == msg_mid) {
 506                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 507                                 mid ));
 508                         pml->end_time.tv_sec = 0;
 509                         pml->end_time.tv_usec = 0;
 510                         DLIST_PROMOTE(deferred_open_queue, pml);
 511                         return;
 512                 }
 513         }
 514
 515         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 516                 mid ));
 517 }
 518
 519 /****************************************************************************
 520  Return true if this mid is on the deferred queue.
 521 ****************************************************************************/
 522
 523 bool open_was_deferred(uint16 mid)
 524 {
 525         struct pending_message_list *pml;
 526
 527         for (pml = deferred_open_queue; pml; pml = pml->next) {
 528                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 529                         return True;
 530                 }
 531         }
 532         return False;
 533 }
 534
 535 /****************************************************************************
 536  Return the message queued by this mid.
 537 ****************************************************************************/
 538
 539 struct pending_message_list *get_open_deferred_message(uint16 mid)
 540 {
 541         struct pending_message_list *pml;
 542
 543         for (pml = deferred_open_queue; pml; pml = pml->next) {
 544                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 545                         return pml;
 546                 }
 547         }
 548         return NULL;
 549 }
 550
 551 /****************************************************************************
 552  Function to push a deferred open smb message onto a linked list of local smb
 553  messages ready for processing.
 554 ****************************************************************************/
 555
 556 bool push_deferred_smb_message(struct smb_request *req,
 557                                struct timeval request_time,
 558                                struct timeval timeout,
 559                                char *private_data, size_t priv_len)
 560 {
 561         struct timeval end_time;
 562
 563         if (req->unread_bytes) {
 564                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 565                         "unread_bytes = %u\n",
 566                         (unsigned int)req->unread_bytes ));
 567                 smb_panic("push_deferred_smb_message: "
 568                         "logic error unread_bytes != 0" );
 569         }
 570
 571         end_time = timeval_sum(&request_time, &timeout);
 572
 573         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 574                   "timeout time [%u.%06u]\n",
 575                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 576                   (unsigned int)end_time.tv_sec,
 577                   (unsigned int)end_time.tv_usec));
 578
 579         return push_queued_message(req, request_time, end_time,
 580                                    private_data, priv_len);
 581 }
 582
 583 struct idle_event {
 584         struct timed_event *te;
 585         struct timeval interval;
 586         char *name;
 587         bool (*handler)(const struct timeval *now, void *private_data);
 588         void *private_data;
 589 };
 590
 591 static void idle_event_handler(struct event_context *ctx,
 592                                struct timed_event *te,
 593                                const struct timeval *now,
 594                                void *private_data)
 595 {
 596         struct idle_event *event =
 597                 talloc_get_type_abort(private_data, struct idle_event);
 598
 599         TALLOC_FREE(event->te);
 600
 601         if (!event->handler(now, event->private_data)) {
 602                 /* Don't repeat, delete ourselves */
 603                 TALLOC_FREE(event);
 604                 return;
 605         }
 606
 607         event->te = event_add_timed(ctx, event,
 608                                     timeval_sum(now, &event->interval),
 609                                     event->name,
 610                                     idle_event_handler, event);
 611
 612         /* We can't do much but fail here. */
 613         SMB_ASSERT(event->te != NULL);
 614 }
 615
 616 struct idle_event *event_add_idle(struct event_context *event_ctx,
 617                                   TALLOC_CTX *mem_ctx,
 618                                   struct timeval interval,
 619                                   const char *name,
 620                                   bool (*handler)(const struct timeval *now,
 621                                                   void *private_data),
 622                                   void *private_data)
 623 {
 624         struct idle_event *result;
 625         struct timeval now = timeval_current();
 626
 627         result = TALLOC_P(mem_ctx, struct idle_event);
 628         if (result == NULL) {
 629                 DEBUG(0, ("talloc failed\n"));
 630                 return NULL;
 631         }
 632
 633         result->interval = interval;
 634         result->handler = handler;
 635         result->private_data = private_data;
 636
 637         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 638                 DEBUG(0, ("talloc failed\n"));
 639                 TALLOC_FREE(result);
 640                 return NULL;
 641         }
 642
 643         result->te = event_add_timed(event_ctx, result,
 644                                      timeval_sum(&now, &interval),
 645                                      result->name,
 646                                      idle_event_handler, result);
 647         if (result->te == NULL) {
 648                 DEBUG(0, ("event_add_timed failed\n"));
 649                 TALLOC_FREE(result);
 650                 return NULL;
 651         }
 652
 653         return result;
 654 }
 655
 656 /****************************************************************************
 657  Do all async processing in here. This includes kernel oplock messages, change
 658  notify events etc.
 659 ****************************************************************************/
 660
 661 static void async_processing(fd_set *pfds)
 662 {
 663         DEBUG(10,("async_processing: Doing async processing.\n"));
 664
 665         process_aio_queue();
 666
 667         process_kernel_oplocks(smbd_messaging_context(), pfds);
 668
 669         /* Do the aio check again after receive_local_message as it does a
 670            select and may have eaten our signal. */
 671         /* Is this till true? -- vl */
 672         process_aio_queue();
 673
 674         if (got_sig_term) {
 675                 exit_server_cleanly("termination signal");
 676         }
 677
 678         /* check for sighup processing */
 679         if (reload_after_sighup) {
 680                 change_to_root_user();
 681                 DEBUG(1,("Reloading services after SIGHUP\n"));
 682                 reload_services(False);
 683                 reload_after_sighup = 0;
 684         }
 685 }
 686
 687 /****************************************************************************
 688  Add a fd to the set we will be select(2)ing on.
 689 ****************************************************************************/
 690
 691 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 692 {
 693         if (fd != -1) {
 694                 FD_SET(fd, fds);
 695                 maxfd = MAX(maxfd, fd);
 696         }
 697
 698         return maxfd;
 699 }
 700
 701 /****************************************************************************
 702   Do a select on an two fd's - with timeout.
 703
 704   If a local udp message has been pushed onto the
 705   queue (this can only happen during oplock break
 706   processing) call async_processing()
 707
 708   If a pending smb message has been pushed onto the
 709   queue (this can only happen during oplock break
 710   processing) return this next.
 711
 712   If the first smbfd is ready then read an smb from it.
 713   if the second (loopback UDP) fd is ready then read a message
 714   from it and setup the buffer header to identify the length
 715   and from address.
 716   Returns False on timeout or error.
 717   Else returns True.
 718
 719 The timeout is in milliseconds
 720 ****************************************************************************/
 721
 722 static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 723                                 char **buffer,
 724                                 size_t *buffer_len,
 725                                 int timeout,
 726                                 size_t *p_unread,
 727                                 bool *p_encrypted)
 728 {
 729         fd_set r_fds, w_fds;
 730         int selrtn;
 731         struct timeval to;
 732         int maxfd = 0;
 733         size_t len;
 734         NTSTATUS status;
 735
 736         *p_unread = 0;
 737         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 738
 739  again:
 740
 741         if (timeout >= 0) {
 742                 to.tv_sec = timeout / 1000;
 743                 to.tv_usec = (timeout % 1000) * 1000;
 744         } else {
 745                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 746                 to.tv_usec = 0;
 747         }
 748
 749         /*
 750          * Note that this call must be before processing any SMB
 751          * messages as we need to synchronously process any messages
 752          * we may have sent to ourselves from the previous SMB.
 753          */
 754         message_dispatch(smbd_messaging_context());
 755
 756         /*
 757          * Check to see if we already have a message on the deferred open queue
 758          * and it's time to schedule.
 759          */
 760         if(deferred_open_queue != NULL) {
 761                 bool pop_message = False;
 762                 struct pending_message_list *msg = deferred_open_queue;
 763
 764                 if (timeval_is_zero(&msg->end_time)) {
 765                         pop_message = True;
 766                 } else {
 767                         struct timeval tv;
 768                         SMB_BIG_INT tdif;
 769
 770                         GetTimeOfDay(&tv);
 771                         tdif = usec_time_diff(&msg->end_time, &tv);
 772                         if (tdif <= 0) {
 773                                 /* Timed out. Schedule...*/
 774                                 pop_message = True;
 775                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 776                         } else {
 777                                 /* Make a more accurate select timeout. */
 778                                 to.tv_sec = tdif / 1000000;
 779                                 to.tv_usec = tdif % 1000000;
 780                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 781                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 782                         }
 783                 }
 784
 785                 if (pop_message) {
 786
 787                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 788                                                         msg->buf.length);
 789                         if (*buffer == NULL) {
 790                                 DEBUG(0, ("talloc failed\n"));
 791                                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 792                                 return False;
 793                         }
 794                         *buffer_len = msg->buf.length;
 795                         *p_encrypted = msg->encrypted;
 796
 797                         /* We leave this message on the queue so the open code can
 798                            know this is a retry. */
 799                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 800                         return True;
 801                 }
 802         }
 803
 804         /*
 805          * Setup the select fd sets.
 806          */
 807
 808         FD_ZERO(&r_fds);
 809         FD_ZERO(&w_fds);
 810
 811         /*
 812          * Ensure we process oplock break messages by preference.
 813          * We have to do this before the select, after the select
 814          * and if the select returns EINTR. This is due to the fact
 815          * that the selects called from async_processing can eat an EINTR
 816          * caused by a signal (we can't take the break message there).
 817          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 818          */
 819
 820         if (oplock_message_waiting(&r_fds)) {
 821                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 822                 async_processing(&r_fds);
 823                 /*
 824                  * After async processing we must go and do the select again, as
 825                  * the state of the flag in fds for the server file descriptor is
 826                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 827                  */
 828                 goto again;
 829         }
 830
 831         /*
 832          * Are there any timed events waiting ? If so, ensure we don't
 833          * select for longer than it would take to wait for them.
 834          */
 835
 836         {
 837                 struct timeval now;
 838                 GetTimeOfDay(&now);
 839
 840                 event_add_to_select_args(smbd_event_context(), &now,
 841                                          &r_fds, &w_fds, &to, &maxfd);
 842         }
 843
 844         if (timeval_is_zero(&to)) {
 845                 /* Process a timed event now... */
 846                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 847                         goto again;
 848                 }
 849         }
 850
 851         {
 852                 int sav;
 853                 START_PROFILE(smbd_idle);
 854
 855                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 856                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 857
 858                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 859                 sav = errno;
 860
 861                 END_PROFILE(smbd_idle);
 862                 errno = sav;
 863         }
 864
 865         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 866                 goto again;
 867         }
 868
 869         /* if we get EINTR then maybe we have received an oplock
 870            signal - treat this as select returning 1. This is ugly, but
 871            is the best we can do until the oplock code knows more about
 872            signals */
 873         if (selrtn == -1 && errno == EINTR) {
 874                 async_processing(&r_fds);
 875                 /*
 876                  * After async processing we must go and do the select again, as
 877                  * the state of the flag in fds for the server file descriptor is
 878                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 879                  */
 880                 goto again;
 881         }
 882
 883         /* Check if error */
 884         if (selrtn == -1) {
 885                 /* something is wrong. Maybe the socket is dead? */
 886                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 887                 return False;
 888         }
 889
 890         /* Did we timeout ? */
 891         if (selrtn == 0) {
 892                 set_smb_read_error(get_srv_read_error(),SMB_READ_TIMEOUT);
 893                 return False;
 894         }
 895
 896         /*
 897          * Ensure we process oplock break messages by preference.
 898          * This is IMPORTANT ! Otherwise we can starve other processes
 899          * sending us an oplock break message. JRA.
 900          */
 901
 902         if (oplock_message_waiting(&r_fds)) {
 903                 async_processing(&r_fds);
 904                 /*
 905                  * After async processing we must go and do the select again, as
 906                  * the state of the flag in fds for the server file descriptor is
 907                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 908                  */
 909                 goto again;
 910         }
 911
 912         status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
 913                                     p_unread, p_encrypted, &len);
 914
 915         if (!NT_STATUS_IS_OK(status)) {
 916                 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 917                         set_smb_read_error(get_srv_read_error(), SMB_READ_EOF);
 918                         return false;
 919                 }
 920
 921                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 922                         set_smb_read_error(get_srv_read_error(),
 923                                            SMB_READ_TIMEOUT);
 924                         return false;
 925                 }
 926
 927                 set_smb_read_error(get_srv_read_error(), SMB_READ_ERROR);
 928                 return false;
 929         }
 930
 931         *buffer_len = len;
 932
 933         return True;
 934 }
 935
 936 /*
 937  * Only allow 5 outstanding trans requests. We're allocating memory, so
 938  * prevent a DoS.
 939  */
 940
 941 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 942 {
 943         int count = 0;
 944         for (; list != NULL; list = list->next) {
 945
 946                 if (list->mid == mid) {
 947                         return NT_STATUS_INVALID_PARAMETER;
 948                 }
 949
 950                 count += 1;
 951         }
 952         if (count > 5) {
 953                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 954         }
 955
 956         return NT_STATUS_OK;
 957 }
 958
 959 /****************************************************************************
 960  We're terminating and have closed all our files/connections etc.
 961  If there are any pending local messages we need to respond to them
 962  before termination so that other smbds don't think we just died whilst
 963  holding oplocks.
 964 ****************************************************************************/
 965
 966 void respond_to_all_remaining_local_messages(void)
 967 {
 968         /*
 969          * Assert we have no exclusive open oplocks.
 970          */
 971
 972         if(get_number_of_exclusive_open_oplocks()) {
 973                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 974                         get_number_of_exclusive_open_oplocks() ));
 975                 return;
 976         }
 977
 978         process_kernel_oplocks(smbd_messaging_context(), NULL);
 979
 980         return;
 981 }
 982
 983
 984 /*
 985 These flags determine some of the permissions required to do an operation
 986
 987 Note that I don't set NEED_WRITE on some write operations because they
 988 are used by some brain-dead clients when printing, and I don't want to
 989 force write permissions on print services.
 990 */
 991 #define AS_USER (1<<0)
 992 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 993 #define TIME_INIT (1<<2)
 994 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 995 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 996 #define DO_CHDIR (1<<6)
 997
 998 /*
 999    define a list of possible SMB messages and their corresponding
1000    functions. Any message that has a NULL function is unimplemented -
1001    please feel free to contribute implementations!
1002 */
1003 static const struct smb_message_struct {
1004         const char *name;
1005         void (*fn_new)(struct smb_request *req);
1006         int flags;
1007 } smb_messages[256] = {
1008
1009 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1010 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1011 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1012 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1013 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1014 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1015 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1016 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1017 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1018 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1019 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1020 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1021 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1022 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1023 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1024 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1025 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1026 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1027 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1028 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1029 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1030 /* 0x15 */ { NULL, NULL, 0 },
1031 /* 0x16 */ { NULL, NULL, 0 },
1032 /* 0x17 */ { NULL, NULL, 0 },
1033 /* 0x18 */ { NULL, NULL, 0 },
1034 /* 0x19 */ { NULL, NULL, 0 },
1035 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1036 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1037 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1038 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1039 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1040 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1041 /* 0x20 */ { "SMBwritec", NULL,0},
1042 /* 0x21 */ { NULL, NULL, 0 },
1043 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1044 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1045 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1046 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1047 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1048 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1049 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1050 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1051 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1052 /* 0x2b */ { "SMBecho",reply_echo,0},
1053 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1054 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1055 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1056 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1057 /* 0x30 */ { NULL, NULL, 0 },
1058 /* 0x31 */ { NULL, NULL, 0 },
1059 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1060 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1061 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1062 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1063 /* 0x36 */ { NULL, NULL, 0 },
1064 /* 0x37 */ { NULL, NULL, 0 },
1065 /* 0x38 */ { NULL, NULL, 0 },
1066 /* 0x39 */ { NULL, NULL, 0 },
1067 /* 0x3a */ { NULL, NULL, 0 },
1068 /* 0x3b */ { NULL, NULL, 0 },
1069 /* 0x3c */ { NULL, NULL, 0 },
1070 /* 0x3d */ { NULL, NULL, 0 },
1071 /* 0x3e */ { NULL, NULL, 0 },
1072 /* 0x3f */ { NULL, NULL, 0 },
1073 /* 0x40 */ { NULL, NULL, 0 },
1074 /* 0x41 */ { NULL, NULL, 0 },
1075 /* 0x42 */ { NULL, NULL, 0 },
1076 /* 0x43 */ { NULL, NULL, 0 },
1077 /* 0x44 */ { NULL, NULL, 0 },
1078 /* 0x45 */ { NULL, NULL, 0 },
1079 /* 0x46 */ { NULL, NULL, 0 },
1080 /* 0x47 */ { NULL, NULL, 0 },
1081 /* 0x48 */ { NULL, NULL, 0 },
1082 /* 0x49 */ { NULL, NULL, 0 },
1083 /* 0x4a */ { NULL, NULL, 0 },
1084 /* 0x4b */ { NULL, NULL, 0 },
1085 /* 0x4c */ { NULL, NULL, 0 },
1086 /* 0x4d */ { NULL, NULL, 0 },
1087 /* 0x4e */ { NULL, NULL, 0 },
1088 /* 0x4f */ { NULL, NULL, 0 },
1089 /* 0x50 */ { NULL, NULL, 0 },
1090 /* 0x51 */ { NULL, NULL, 0 },
1091 /* 0x52 */ { NULL, NULL, 0 },
1092 /* 0x53 */ { NULL, NULL, 0 },
1093 /* 0x54 */ { NULL, NULL, 0 },
1094 /* 0x55 */ { NULL, NULL, 0 },
1095 /* 0x56 */ { NULL, NULL, 0 },
1096 /* 0x57 */ { NULL, NULL, 0 },
1097 /* 0x58 */ { NULL, NULL, 0 },
1098 /* 0x59 */ { NULL, NULL, 0 },
1099 /* 0x5a */ { NULL, NULL, 0 },
1100 /* 0x5b */ { NULL, NULL, 0 },
1101 /* 0x5c */ { NULL, NULL, 0 },
1102 /* 0x5d */ { NULL, NULL, 0 },
1103 /* 0x5e */ { NULL, NULL, 0 },
1104 /* 0x5f */ { NULL, NULL, 0 },
1105 /* 0x60 */ { NULL, NULL, 0 },
1106 /* 0x61 */ { NULL, NULL, 0 },
1107 /* 0x62 */ { NULL, NULL, 0 },
1108 /* 0x63 */ { NULL, NULL, 0 },
1109 /* 0x64 */ { NULL, NULL, 0 },
1110 /* 0x65 */ { NULL, NULL, 0 },
1111 /* 0x66 */ { NULL, NULL, 0 },
1112 /* 0x67 */ { NULL, NULL, 0 },
1113 /* 0x68 */ { NULL, NULL, 0 },
1114 /* 0x69 */ { NULL, NULL, 0 },
1115 /* 0x6a */ { NULL, NULL, 0 },
1116 /* 0x6b */ { NULL, NULL, 0 },
1117 /* 0x6c */ { NULL, NULL, 0 },
1118 /* 0x6d */ { NULL, NULL, 0 },
1119 /* 0x6e */ { NULL, NULL, 0 },
1120 /* 0x6f */ { NULL, NULL, 0 },
1121 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1122 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1123 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1124 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1125 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1126 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1127 /* 0x76 */ { NULL, NULL, 0 },
1128 /* 0x77 */ { NULL, NULL, 0 },
1129 /* 0x78 */ { NULL, NULL, 0 },
1130 /* 0x79 */ { NULL, NULL, 0 },
1131 /* 0x7a */ { NULL, NULL, 0 },
1132 /* 0x7b */ { NULL, NULL, 0 },
1133 /* 0x7c */ { NULL, NULL, 0 },
1134 /* 0x7d */ { NULL, NULL, 0 },
1135 /* 0x7e */ { NULL, NULL, 0 },
1136 /* 0x7f */ { NULL, NULL, 0 },
1137 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1138 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1139 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1140 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1141 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1142 /* 0x85 */ { NULL, NULL, 0 },
1143 /* 0x86 */ { NULL, NULL, 0 },
1144 /* 0x87 */ { NULL, NULL, 0 },
1145 /* 0x88 */ { NULL, NULL, 0 },
1146 /* 0x89 */ { NULL, NULL, 0 },
1147 /* 0x8a */ { NULL, NULL, 0 },
1148 /* 0x8b */ { NULL, NULL, 0 },
1149 /* 0x8c */ { NULL, NULL, 0 },
1150 /* 0x8d */ { NULL, NULL, 0 },
1151 /* 0x8e */ { NULL, NULL, 0 },
1152 /* 0x8f */ { NULL, NULL, 0 },
1153 /* 0x90 */ { NULL, NULL, 0 },
1154 /* 0x91 */ { NULL, NULL, 0 },
1155 /* 0x92 */ { NULL, NULL, 0 },
1156 /* 0x93 */ { NULL, NULL, 0 },
1157 /* 0x94 */ { NULL, NULL, 0 },
1158 /* 0x95 */ { NULL, NULL, 0 },
1159 /* 0x96 */ { NULL, NULL, 0 },
1160 /* 0x97 */ { NULL, NULL, 0 },
1161 /* 0x98 */ { NULL, NULL, 0 },
1162 /* 0x99 */ { NULL, NULL, 0 },
1163 /* 0x9a */ { NULL, NULL, 0 },
1164 /* 0x9b */ { NULL, NULL, 0 },
1165 /* 0x9c */ { NULL, NULL, 0 },
1166 /* 0x9d */ { NULL, NULL, 0 },
1167 /* 0x9e */ { NULL, NULL, 0 },
1168 /* 0x9f */ { NULL, NULL, 0 },
1169 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1170 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1171 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1172 /* 0xa3 */ { NULL, NULL, 0 },
1173 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1174 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1175 /* 0xa6 */ { NULL, NULL, 0 },
1176 /* 0xa7 */ { NULL, NULL, 0 },
1177 /* 0xa8 */ { NULL, NULL, 0 },
1178 /* 0xa9 */ { NULL, NULL, 0 },
1179 /* 0xaa */ { NULL, NULL, 0 },
1180 /* 0xab */ { NULL, NULL, 0 },
1181 /* 0xac */ { NULL, NULL, 0 },
1182 /* 0xad */ { NULL, NULL, 0 },
1183 /* 0xae */ { NULL, NULL, 0 },
1184 /* 0xaf */ { NULL, NULL, 0 },
1185 /* 0xb0 */ { NULL, NULL, 0 },
1186 /* 0xb1 */ { NULL, NULL, 0 },
1187 /* 0xb2 */ { NULL, NULL, 0 },
1188 /* 0xb3 */ { NULL, NULL, 0 },
1189 /* 0xb4 */ { NULL, NULL, 0 },
1190 /* 0xb5 */ { NULL, NULL, 0 },
1191 /* 0xb6 */ { NULL, NULL, 0 },
1192 /* 0xb7 */ { NULL, NULL, 0 },
1193 /* 0xb8 */ { NULL, NULL, 0 },
1194 /* 0xb9 */ { NULL, NULL, 0 },
1195 /* 0xba */ { NULL, NULL, 0 },
1196 /* 0xbb */ { NULL, NULL, 0 },
1197 /* 0xbc */ { NULL, NULL, 0 },
1198 /* 0xbd */ { NULL, NULL, 0 },
1199 /* 0xbe */ { NULL, NULL, 0 },
1200 /* 0xbf */ { NULL, NULL, 0 },
1201 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1202 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1203 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1204 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1205 /* 0xc4 */ { NULL, NULL, 0 },
1206 /* 0xc5 */ { NULL, NULL, 0 },
1207 /* 0xc6 */ { NULL, NULL, 0 },
1208 /* 0xc7 */ { NULL, NULL, 0 },
1209 /* 0xc8 */ { NULL, NULL, 0 },
1210 /* 0xc9 */ { NULL, NULL, 0 },
1211 /* 0xca */ { NULL, NULL, 0 },
1212 /* 0xcb */ { NULL, NULL, 0 },
1213 /* 0xcc */ { NULL, NULL, 0 },
1214 /* 0xcd */ { NULL, NULL, 0 },
1215 /* 0xce */ { NULL, NULL, 0 },
1216 /* 0xcf */ { NULL, NULL, 0 },
1217 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1218 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1219 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1220 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1221 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1222 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1223 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1224 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1225 /* 0xd8 */ { NULL, NULL, 0 },
1226 /* 0xd9 */ { NULL, NULL, 0 },
1227 /* 0xda */ { NULL, NULL, 0 },
1228 /* 0xdb */ { NULL, NULL, 0 },
1229 /* 0xdc */ { NULL, NULL, 0 },
1230 /* 0xdd */ { NULL, NULL, 0 },
1231 /* 0xde */ { NULL, NULL, 0 },
1232 /* 0xdf */ { NULL, NULL, 0 },
1233 /* 0xe0 */ { NULL, NULL, 0 },
1234 /* 0xe1 */ { NULL, NULL, 0 },
1235 /* 0xe2 */ { NULL, NULL, 0 },
1236 /* 0xe3 */ { NULL, NULL, 0 },
1237 /* 0xe4 */ { NULL, NULL, 0 },
1238 /* 0xe5 */ { NULL, NULL, 0 },
1239 /* 0xe6 */ { NULL, NULL, 0 },
1240 /* 0xe7 */ { NULL, NULL, 0 },
1241 /* 0xe8 */ { NULL, NULL, 0 },
1242 /* 0xe9 */ { NULL, NULL, 0 },
1243 /* 0xea */ { NULL, NULL, 0 },
1244 /* 0xeb */ { NULL, NULL, 0 },
1245 /* 0xec */ { NULL, NULL, 0 },
1246 /* 0xed */ { NULL, NULL, 0 },
1247 /* 0xee */ { NULL, NULL, 0 },
1248 /* 0xef */ { NULL, NULL, 0 },
1249 /* 0xf0 */ { NULL, NULL, 0 },
1250 /* 0xf1 */ { NULL, NULL, 0 },
1251 /* 0xf2 */ { NULL, NULL, 0 },
1252 /* 0xf3 */ { NULL, NULL, 0 },
1253 /* 0xf4 */ { NULL, NULL, 0 },
1254 /* 0xf5 */ { NULL, NULL, 0 },
1255 /* 0xf6 */ { NULL, NULL, 0 },
1256 /* 0xf7 */ { NULL, NULL, 0 },
1257 /* 0xf8 */ { NULL, NULL, 0 },
1258 /* 0xf9 */ { NULL, NULL, 0 },
1259 /* 0xfa */ { NULL, NULL, 0 },
1260 /* 0xfb */ { NULL, NULL, 0 },
1261 /* 0xfc */ { NULL, NULL, 0 },
1262 /* 0xfd */ { NULL, NULL, 0 },
1263 /* 0xfe */ { NULL, NULL, 0 },
1264 /* 0xff */ { NULL, NULL, 0 }
1265
1266 };
1267
1268 /*******************************************************************
1269  allocate and initialize a reply packet
1270 ********************************************************************/
1271
1272 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1273 {
1274         /*
1275          * Protect against integer wrap
1276          */
1277         if ((num_bytes > 0xffffff)
1278             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1279                 char *msg;
1280                 asprintf(&msg, "num_bytes too large: %u",
1281                          (unsigned)num_bytes);
1282                 smb_panic(msg);
1283         }
1284
1285         if (!(req->outbuf = TALLOC_ARRAY(
1286                       req, uint8,
1287                       smb_size + num_words*2 + num_bytes))) {
1288                 smb_panic("could not allocate output buffer\n");
1289         }
1290
1291         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1292         srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1293         /*
1294          * Zero out the word area, the caller has to take care of the bcc area
1295          * himself
1296          */
1297         if (num_words != 0) {
1298                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1299         }
1300
1301         return;
1302 }
1303
1304
1305 /*******************************************************************
1306  Dump a packet to a file.
1307 ********************************************************************/
1308
1309 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1310 {
1311         int fd, i;
1312         char *fname = NULL;
1313         if (DEBUGLEVEL < 50) {
1314                 return;
1315         }
1316
1317         if (len < 4) len = smb_len(data)+4;
1318         for (i=1;i<100;i++) {
1319                 asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1320                                 type ? "req" : "resp");
1321                 if (!fname) {
1322                         return;
1323                 }
1324                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1325                 if (fd != -1 || errno != EEXIST) break;
1326         }
1327         if (fd != -1) {
1328                 ssize_t ret = write(fd, data, len);
1329                 if (ret != len)
1330                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1331                 close(fd);
1332                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1333         }
1334         SAFE_FREE(fname);
1335 }
1336
1337 /****************************************************************************
1338  Prepare everything for calling the actual request function, and potentially
1339  call the request function via the "new" interface.
1340
1341  Return False if the "legacy" function needs to be called, everything is
1342  prepared.
1343
1344  Return True if we're done.
1345
1346  I know this API sucks, but it is the one with the least code change I could
1347  find.
1348 ****************************************************************************/
1349
1350 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1351 {
1352         int flags;
1353         uint16 session_tag;
1354         connection_struct *conn = NULL;
1355
1356         static uint16 last_session_tag = UID_FIELD_INVALID;
1357
1358         errno = 0;
1359
1360         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1361          * so subtract 4 from it. */
1362         if (!valid_smb_header(req->inbuf)
1363             || (size < (smb_size - 4))) {
1364                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1365                          smb_len(req->inbuf)));
1366                 exit_server_cleanly("Non-SMB packet");
1367         }
1368
1369         if (smb_messages[type].fn_new == NULL) {
1370                 DEBUG(0,("Unknown message type %d!\n",type));
1371                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1372                 reply_unknown_new(req, type);
1373                 return NULL;
1374         }
1375
1376         flags = smb_messages[type].flags;
1377
1378         /* In share mode security we must ignore the vuid. */
1379         session_tag = (lp_security() == SEC_SHARE)
1380                 ? UID_FIELD_INVALID : req->vuid;
1381         conn = req->conn;
1382
1383         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1384                  (int)sys_getpid(), (unsigned long)conn));
1385
1386         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1387
1388         /* Ensure this value is replaced in the incoming packet. */
1389         SSVAL(req->inbuf,smb_uid,session_tag);
1390
1391         /*
1392          * Ensure the correct username is in current_user_info.  This is a
1393          * really ugly bugfix for problems with multiple session_setup_and_X's
1394          * being done and allowing %U and %G substitutions to work correctly.
1395          * There is a reason this code is done here, don't move it unless you
1396          * know what you're doing... :-).
1397          * JRA.
1398          */
1399
1400         if (session_tag != last_session_tag) {
1401                 user_struct *vuser = NULL;
1402
1403                 last_session_tag = session_tag;
1404                 if(session_tag != UID_FIELD_INVALID) {
1405                         vuser = get_valid_user_struct(session_tag);
1406                         if (vuser) {
1407                                 set_current_user_info(&vuser->user);
1408                         }
1409                 }
1410         }
1411
1412         /* Does this call need to be run as the connected user? */
1413         if (flags & AS_USER) {
1414
1415                 /* Does this call need a valid tree connection? */
1416                 if (!conn) {
1417                         /*
1418                          * Amazingly, the error code depends on the command
1419                          * (from Samba4).
1420                          */
1421                         if (type == SMBntcreateX) {
1422                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1423                         } else {
1424                                 reply_doserror(req, ERRSRV, ERRinvnid);
1425                         }
1426                         return NULL;
1427                 }
1428
1429                 if (!change_to_user(conn,session_tag)) {
1430                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1431                         return conn;
1432                 }
1433
1434                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1435
1436                 /* Does it need write permission? */
1437                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1438                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1439                         return conn;
1440                 }
1441
1442                 /* IPC services are limited */
1443                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1444                         reply_doserror(req, ERRSRV,ERRaccess);
1445                         return conn;
1446                 }
1447         } else {
1448                 /* This call needs to be run as root */
1449                 change_to_root_user();
1450         }
1451
1452         /* load service specific parameters */
1453         if (conn) {
1454                 if (req->encrypted) {
1455                         conn->encrypted_tid = true;
1456                         /* encrypted required from now on. */
1457                         conn->encrypt_level = Required;
1458                 } else if (ENCRYPTION_REQUIRED(conn)) {
1459                         uint8 com = CVAL(req->inbuf,smb_com);
1460                         if (com != SMBtrans2 && com != SMBtranss2) {
1461                                 exit_server_cleanly("encryption required "
1462                                         "on connection");
1463                                 return conn;
1464                         }
1465                 }
1466
1467                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1468                                          (flags & (AS_USER|DO_CHDIR)
1469                                           ?True:False))) {
1470                         reply_doserror(req, ERRSRV, ERRaccess);
1471                         return conn;
1472                 }
1473                 conn->num_smb_operations++;
1474         }
1475
1476         /* does this protocol need to be run as guest? */
1477         if ((flags & AS_GUEST)
1478             && (!change_to_guest() ||
1479                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1480                               lp_hostsdeny(-1)))) {
1481                 reply_doserror(req, ERRSRV, ERRaccess);
1482                 return conn;
1483         }
1484
1485         smb_messages[type].fn_new(req);
1486         return req->conn;
1487 }
1488
1489 /****************************************************************************
1490  Construct a reply to the incoming packet.
1491 ****************************************************************************/
1492
1493 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1494 {
1495         uint8 type = CVAL(inbuf,smb_com);
1496         connection_struct *conn;
1497         struct smb_request *req;
1498
1499         chain_size = 0;
1500         file_chain_reset();
1501         reset_chain_p();
1502
1503         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1504                 smb_panic("could not allocate smb_request");
1505         }
1506         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1507
1508         conn = switch_message(type, req, size);
1509
1510         if (req->unread_bytes) {
1511                 /* writeX failed. drain socket. */
1512                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1513                                 req->unread_bytes) {
1514                         smb_panic("failed to drain pending bytes");
1515                 }
1516                 req->unread_bytes = 0;
1517         }
1518
1519         if (req->outbuf == NULL) {
1520                 return;
1521         }
1522
1523         if (CVAL(req->outbuf,0) == 0) {
1524                 show_msg((char *)req->outbuf);
1525         }
1526
1527         if (!srv_send_smb(smbd_server_fd(),
1528                         (char *)req->outbuf,
1529                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1530                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1531         }
1532
1533         TALLOC_FREE(req);
1534
1535         return;
1536 }
1537
1538 /****************************************************************************
1539  Process an smb from the client
1540 ****************************************************************************/
1541
1542 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1543 {
1544         static int trans_num;
1545         int msg_type = CVAL(inbuf,0);
1546
1547         DO_PROFILE_INC(smb_count);
1548
1549         if (trans_num == 0) {
1550                 char addr[INET6_ADDRSTRLEN];
1551
1552                 /* on the first packet, check the global hosts allow/ hosts
1553                 deny parameters before doing any parsing of the packet
1554                 passed to us by the client.  This prevents attacks on our
1555                 parsing code from hosts not in the hosts allow list */
1556
1557                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1558                                   lp_hostsdeny(-1))) {
1559                         /* send a negative session response "not listening on calling name" */
1560                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1561                         DEBUG( 1, ( "Connection denied from %s\n",
1562                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1563                         (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1564                         exit_server_cleanly("connection denied");
1565                 }
1566         }
1567
1568         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1569                     smb_len(inbuf) ) );
1570         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1571                                 (int)nread,
1572                                 (unsigned int)unread_bytes ));
1573
1574         if (msg_type != 0) {
1575                 /*
1576                  * NetBIOS session request, keepalive, etc.
1577                  */
1578                 reply_special(inbuf);
1579                 return;
1580         }
1581
1582         show_msg(inbuf);
1583
1584         construct_reply(inbuf,nread,unread_bytes,encrypted);
1585
1586         trans_num++;
1587 }
1588
1589 /****************************************************************************
1590  Return a string containing the function name of a SMB command.
1591 ****************************************************************************/
1592
1593 const char *smb_fn_name(int type)
1594 {
1595         const char *unknown_name = "SMBunknown";
1596
1597         if (smb_messages[type].name == NULL)
1598                 return(unknown_name);
1599
1600         return(smb_messages[type].name);
1601 }
1602
1603 /****************************************************************************
1604  Helper functions for contruct_reply.
1605 ****************************************************************************/
1606
1607 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1608
1609 void add_to_common_flags2(uint32 v)
1610 {
1611         common_flags2 |= v;
1612 }
1613
1614 void remove_from_common_flags2(uint32 v)
1615 {
1616         common_flags2 &= ~v;
1617 }
1618
1619 void construct_reply_common(const char *inbuf, char *outbuf)
1620 {
1621         srv_set_message(outbuf,0,0,false);
1622
1623         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1624         SIVAL(outbuf,smb_rcls,0);
1625         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1626         SSVAL(outbuf,smb_flg2,
1627                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1628                 common_flags2);
1629         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1630
1631         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1632         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1633         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1634         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1635 }
1636
1637 /****************************************************************************
1638  Construct a chained reply and add it to the already made reply
1639 ****************************************************************************/
1640
1641 void chain_reply(struct smb_request *req)
1642 {
1643         static char *orig_inbuf;
1644
1645         /*
1646          * Dirty little const_discard: We mess with req->inbuf, which is
1647          * declared as const. If maybe at some point this routine gets
1648          * rewritten, this const_discard could go away.
1649          */
1650         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1651         int size = smb_len(req->inbuf)+4;
1652
1653         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1654         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1655         char *inbuf2;
1656         int outsize2;
1657         int new_size;
1658         char inbuf_saved[smb_wct];
1659         char *outbuf = (char *)req->outbuf;
1660         size_t outsize = smb_len(outbuf) + 4;
1661         size_t outsize_padded;
1662         size_t ofs, to_move;
1663
1664         struct smb_request *req2;
1665         size_t caller_outputlen;
1666         char *caller_output;
1667
1668         /* Maybe its not chained, or it's an error packet. */
1669         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1670                 SCVAL(outbuf,smb_vwv0,0xFF);
1671                 return;
1672         }
1673
1674         if (chain_size == 0) {
1675                 /* this is the first part of the chain */
1676                 orig_inbuf = inbuf;
1677         }
1678
1679         /*
1680          * We need to save the output the caller added to the chain so that we
1681          * can splice it into the final output buffer later.
1682          */
1683
1684         caller_outputlen = outsize - smb_wct;
1685
1686         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1687
1688         if (caller_output == NULL) {
1689                 /* TODO: NT_STATUS_NO_MEMORY */
1690                 smb_panic("could not dup outbuf");
1691         }
1692
1693         /*
1694          * The original Win95 redirector dies on a reply to
1695          * a lockingX and read chain unless the chain reply is
1696          * 4 byte aligned. JRA.
1697          */
1698
1699         outsize_padded = (outsize + 3) & ~3;
1700
1701         /*
1702          * remember how much the caller added to the chain, only counting
1703          * stuff after the parameter words
1704          */
1705         chain_size += outsize_padded - smb_wct;
1706
1707         /*
1708          * work out pointers into the original packets. The
1709          * headers on these need to be filled in
1710          */
1711         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1712
1713         /* remember the original command type */
1714         smb_com1 = CVAL(orig_inbuf,smb_com);
1715
1716         /* save the data which will be overwritten by the new headers */
1717         memcpy(inbuf_saved,inbuf2,smb_wct);
1718
1719         /* give the new packet the same header as the last part of the SMB */
1720         memmove(inbuf2,inbuf,smb_wct);
1721
1722         /* create the in buffer */
1723         SCVAL(inbuf2,smb_com,smb_com2);
1724
1725         /* work out the new size for the in buffer. */
1726         new_size = size - (inbuf2 - inbuf);
1727         if (new_size < 0) {
1728                 DEBUG(0,("chain_reply: chain packet size incorrect "
1729                          "(orig size = %d, offset = %d)\n",
1730                          size, (int)(inbuf2 - inbuf) ));
1731                 exit_server_cleanly("Bad chained packet");
1732                 return;
1733         }
1734
1735         /* And set it in the header. */
1736         smb_setlen(inbuf2, new_size - 4);
1737
1738         DEBUG(3,("Chained message\n"));
1739         show_msg(inbuf2);
1740
1741         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1742                 smb_panic("could not allocate smb_request");
1743         }
1744         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1745
1746         /* process the request */
1747         switch_message(smb_com2, req2, new_size);
1748
1749         /*
1750          * We don't accept deferred operations in chained requests.
1751          */
1752         SMB_ASSERT(req2->outbuf != NULL);
1753         outsize2 = smb_len(req2->outbuf)+4;
1754
1755         /*
1756          * Move away the new command output so that caller_output fits in,
1757          * copy in the caller_output saved above.
1758          */
1759
1760         SMB_ASSERT(outsize_padded >= smb_wct);
1761
1762         /*
1763          * "ofs" is the space we need for caller_output. Equal to
1764          * caller_outputlen plus the padding.
1765          */
1766
1767         ofs = outsize_padded - smb_wct;
1768
1769         /*
1770          * "to_move" is the amount of bytes the secondary routine gave us
1771          */
1772
1773         to_move = outsize2 - smb_wct;
1774
1775         if (to_move + ofs + smb_wct + chain_size > max_send) {
1776                 smb_panic("replies too large -- would have to cut");
1777         }
1778
1779         /*
1780          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1781          * the first request in the chain. So we have to re-allocate it. In
1782          * the "old" API the only outbuf ever used is the global OutBuffer
1783          * which is always large enough.
1784          */
1785
1786         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1787                                       to_move + ofs + smb_wct);
1788         if (outbuf == NULL) {
1789                 smb_panic("could not realloc outbuf");
1790         }
1791
1792         req->outbuf = (uint8 *)outbuf;
1793
1794         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1795         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1796
1797         /*
1798          * copy the new reply header over the old one but preserve the smb_com
1799          * field
1800          */
1801         memmove(outbuf, req2->outbuf, smb_wct);
1802         SCVAL(outbuf, smb_com, smb_com1);
1803
1804         /*
1805          * We've just copied in the whole "wct" area from the secondary
1806          * function. Fix up the chaining: com2 and the offset need to be
1807          * readjusted.
1808          */
1809
1810         SCVAL(outbuf, smb_vwv0, smb_com2);
1811         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1812
1813         if (outsize_padded > outsize) {
1814
1815                 /*
1816                  * Due to padding we have some uninitialized bytes after the
1817                  * caller's output
1818                  */
1819
1820                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1821         }
1822
1823         smb_setlen(outbuf, outsize2 + chain_size - 4);
1824
1825         /*
1826          * restore the saved data, being careful not to overwrite any data
1827          * from the reply header
1828          */
1829         memcpy(inbuf2,inbuf_saved,smb_wct);
1830
1831         SAFE_FREE(caller_output);
1832         TALLOC_FREE(req2);
1833
1834         return;
1835 }
1836
1837 /****************************************************************************
1838  Setup the needed select timeout in milliseconds.
1839 ****************************************************************************/
1840
1841 static int setup_select_timeout(void)
1842 {
1843         int select_timeout;
1844
1845         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1846
1847         if (print_notify_messages_pending()) {
1848                 select_timeout = MIN(select_timeout, 1000);
1849         }
1850
1851         return select_timeout;
1852 }
1853
1854 /****************************************************************************
1855  Check if services need reloading.
1856 ****************************************************************************/
1857
1858 void check_reload(time_t t)
1859 {
1860         static pid_t mypid = 0;
1861         static time_t last_smb_conf_reload_time = 0;
1862         static time_t last_printer_reload_time = 0;
1863         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1864
1865         if(last_smb_conf_reload_time == 0) {
1866                 last_smb_conf_reload_time = t;
1867                 /* Our printing subsystem might not be ready at smbd start up.
1868                    Then no printer is available till the first printers check
1869                    is performed.  A lower initial interval circumvents this. */
1870                 if ( printcap_cache_time > 60 )
1871                         last_printer_reload_time = t - printcap_cache_time + 60;
1872                 else
1873                         last_printer_reload_time = t;
1874         }
1875
1876         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1877                 /* randomize over 60 second the printcap reload to avoid all
1878                  * process hitting cupsd at the same time */
1879                 int time_range = 60;
1880
1881                 last_printer_reload_time += random() % time_range;
1882                 mypid = getpid();
1883         }
1884
1885         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1886                 reload_services(True);
1887                 reload_after_sighup = False;
1888                 last_smb_conf_reload_time = t;
1889         }
1890
1891         /* 'printcap cache time = 0' disable the feature */
1892
1893         if ( printcap_cache_time != 0 )
1894         {
1895                 /* see if it's time to reload or if the clock has been set back */
1896
1897                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1898                         || (t-last_printer_reload_time  < 0) )
1899                 {
1900                         DEBUG( 3,( "Printcap cache time expired.\n"));
1901                         reload_printers();
1902                         last_printer_reload_time = t;
1903                 }
1904         }
1905 }
1906
1907 /****************************************************************************
1908  Process any timeout housekeeping. Return False if the caller should exit.
1909 ****************************************************************************/
1910
1911 static bool timeout_processing(int *select_timeout,
1912                                time_t *last_timeout_processing_time)
1913 {
1914         time_t t;
1915
1916         if (*get_srv_read_error() == SMB_READ_EOF) {
1917                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1918                 return false;
1919         }
1920
1921         if (*get_srv_read_error() == SMB_READ_ERROR) {
1922                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1923                         strerror(errno)));
1924                 return false;
1925         }
1926
1927         if (*get_srv_read_error() == SMB_READ_BAD_SIG) {
1928                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1929                 return false;
1930         }
1931
1932         *last_timeout_processing_time = t = time(NULL);
1933
1934         /* become root again if waiting */
1935         change_to_root_user();
1936
1937         /* check if we need to reload services */
1938         check_reload(t);
1939
1940         if(global_machine_password_needs_changing &&
1941                         /* for ADS we need to do a regular ADS password change, not a domain
1942                                         password change */
1943                         lp_security() == SEC_DOMAIN) {
1944
1945                 unsigned char trust_passwd_hash[16];
1946                 time_t lct;
1947
1948                 /*
1949                  * We're in domain level security, and the code that
1950                  * read the machine password flagged that the machine
1951                  * password needs changing.
1952                  */
1953
1954                 /*
1955                  * First, open the machine password file with an exclusive lock.
1956                  */
1957
1958                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1959                         DEBUG(0,("process: unable to lock the machine account password for \
1960 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1961                         return True;
1962                 }
1963
1964                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1965                         DEBUG(0,("process: unable to read the machine account password for \
1966 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1967                         secrets_lock_trust_account_password(lp_workgroup(), False);
1968                         return True;
1969                 }
1970
1971                 /*
1972                  * Make sure someone else hasn't already done this.
1973                  */
1974
1975                 if(t < lct + lp_machine_password_timeout()) {
1976                         global_machine_password_needs_changing = False;
1977                         secrets_lock_trust_account_password(lp_workgroup(), False);
1978                         return True;
1979                 }
1980
1981                 /* always just contact the PDC here */
1982
1983                 change_trust_account_password( lp_workgroup(), NULL);
1984                 global_machine_password_needs_changing = False;
1985                 secrets_lock_trust_account_password(lp_workgroup(), False);
1986         }
1987
1988         /* update printer queue caches if necessary */
1989
1990         update_monitored_printq_cache();
1991
1992         /*
1993          * Now we are root, check if the log files need pruning.
1994          * Force a log file check.
1995          */
1996         force_check_log_size();
1997         check_log_size();
1998
1999         /* Send any queued printer notify message to interested smbd's. */
2000
2001         print_notify_send_messages(smbd_messaging_context(), 0);
2002
2003         /*
2004          * Modify the select timeout depending upon
2005          * what we have remaining in our queues.
2006          */
2007
2008         *select_timeout = setup_select_timeout();
2009
2010         return True;
2011 }
2012
2013 /****************************************************************************
2014  Process commands from the client
2015 ****************************************************************************/
2016
2017 void smbd_process(void)
2018 {
2019         time_t last_timeout_processing_time = time(NULL);
2020         unsigned int num_smbs = 0;
2021         size_t unread_bytes = 0;
2022
2023         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2024
2025         while (True) {
2026                 int select_timeout = setup_select_timeout();
2027                 int num_echos;
2028                 char *inbuf;
2029                 size_t inbuf_len;
2030                 bool encrypted = false;
2031                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2032
2033                 errno = 0;
2034
2035                 /* Did someone ask for immediate checks on things like blocking locks ? */
2036                 if (select_timeout == 0) {
2037                         if(!timeout_processing(&select_timeout,
2038                                                &last_timeout_processing_time))
2039                                 return;
2040                         num_smbs = 0; /* Reset smb counter. */
2041                 }
2042
2043                 run_events(smbd_event_context(), 0, NULL, NULL);
2044
2045                 while (!receive_message_or_smb(talloc_tos(), &inbuf, &inbuf_len,
2046                                                 select_timeout,
2047                                                 &unread_bytes,
2048                                                 &encrypted)) {
2049                         if(!timeout_processing(&select_timeout,
2050                                                &last_timeout_processing_time))
2051                                 return;
2052                         num_smbs = 0; /* Reset smb counter. */
2053                 }
2054
2055
2056                 /*
2057                  * Ensure we do timeout processing if the SMB we just got was
2058                  * only an echo request. This allows us to set the select
2059                  * timeout in 'receive_message_or_smb()' to any value we like
2060                  * without worrying that the client will send echo requests
2061                  * faster than the select timeout, thus starving out the
2062                  * essential processing (change notify, blocking locks) that
2063                  * the timeout code does. JRA.
2064                  */
2065                 num_echos = smb_echo_count;
2066
2067                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2068
2069                 TALLOC_FREE(inbuf);
2070
2071                 if (smb_echo_count != num_echos) {
2072                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
2073                                 return;
2074                         num_smbs = 0; /* Reset smb counter. */
2075                 }
2076
2077                 num_smbs++;
2078
2079                 /*
2080                  * If we are getting smb requests in a constant stream
2081                  * with no echos, make sure we attempt timeout processing
2082                  * every select_timeout milliseconds - but only check for this
2083                  * every 200 smb requests.
2084                  */
2085
2086                 if ((num_smbs % 200) == 0) {
2087                         time_t new_check_time = time(NULL);
2088                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2089                                 if(!timeout_processing(
2090                                            &select_timeout,
2091                                            &last_timeout_processing_time))
2092                                         return;
2093                                 num_smbs = 0; /* Reset smb counter. */
2094                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2095                         }
2096                 }
2097
2098                 /* The timeout_processing function isn't run nearly
2099                    often enough to implement 'max log size' without
2100                    overrunning the size of the file by many megabytes.
2101                    This is especially true if we are running at debug
2102                    level 10.  Checking every 50 SMBs is a nice
2103                    tradeoff of performance vs log file size overrun. */
2104
2105                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2106                         change_to_root_user();
2107                         check_log_size();
2108                 }
2109                 TALLOC_FREE(frame);
2110         }
2111 }