source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern int smb_echo_count;
  24
  25 static enum smb_read_errors smb_read_error = SMB_READ_OK;
  26
  27 /*
  28  * Size of data we can send to client. Set
  29  *  by the client for all protocols above CORE.
  30  *  Set by us for CORE protocol.
  31  */
  32 int max_send = BUFFER_SIZE;
  33 /*
  34  * Size of the data we can receive. Set by us.
  35  * Can be modified by the max xmit parameter.
  36  */
  37 int max_recv = BUFFER_SIZE;
  38
  39 SIG_ATOMIC_T reload_after_sighup = 0;
  40 SIG_ATOMIC_T got_sig_term = 0;
  41 extern bool global_machine_password_needs_changing;
  42 extern int max_send;
  43
  44 /* Accessor function for smb_read_error for smbd functions. */
  45
  46 enum smb_read_errors *get_srv_read_error(void)
  47 {
  48         return &smb_read_error;
  49 }
  50
  51 /****************************************************************************
  52  Send an smb to a fd.
  53 ****************************************************************************/
  54
  55 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  56 {
  57         size_t len;
  58         size_t nwritten=0;
  59         ssize_t ret;
  60         char *buf_out = buffer;
  61
  62         /* Sign the outgoing packet if required. */
  63         srv_calculate_sign_mac(buf_out);
  64
  65         if (do_encrypt) {
  66                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  67                 if (!NT_STATUS_IS_OK(status)) {
  68                         DEBUG(0, ("send_smb: SMB encryption failed "
  69                                 "on outgoing packet! Error %s\n",
  70                                 nt_errstr(status) ));
  71                         return false;
  72                 }
  73         }
  74
  75         len = smb_len(buf_out) + 4;
  76
  77         while (nwritten < len) {
  78                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  79                 if (ret <= 0) {
  80                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  81                                 (int)len,(int)ret, strerror(errno) ));
  82                         srv_free_enc_buffer(buf_out);
  83                         return false;
  84                 }
  85                 nwritten += ret;
  86         }
  87
  88         srv_free_enc_buffer(buf_out);
  89         return true;
  90 }
  91
  92 /*******************************************************************
  93  Setup the word count and byte count for a smb message.
  94 ********************************************************************/
  95
  96 int srv_set_message(char *buf,
  97                         int num_words,
  98                         int num_bytes,
  99                         bool zero)
 100 {
 101         if (zero && (num_words || num_bytes)) {
 102                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 103         }
 104         SCVAL(buf,smb_wct,num_words);
 105         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 106         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 107         return (smb_size + num_words*2 + num_bytes);
 108 }
 109
 110 static bool valid_smb_header(const uint8_t *inbuf)
 111 {
 112         if (is_encrypted_packet(inbuf)) {
 113                 return true;
 114         }
 115         return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
 116 }
 117
 118 /* Socket functions for smbd packet processing. */
 119
 120 static bool valid_packet_size(size_t len)
 121 {
 122         /*
 123          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 124          * of header. Don't print the error if this fits.... JRA.
 125          */
 126
 127         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 128                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 129                                         (unsigned long)len));
 130                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
 131
 132                         /*
 133                          * Correct fix. smb_read_error may have already been
 134                          * set. Only set it here if not already set. Global
 135                          * variables still suck :-). JRA.
 136                          */
 137
 138                         cond_set_smb_read_error(get_srv_read_error(),
 139                                                 SMB_READ_ERROR);
 140                         return false;
 141                 }
 142         }
 143         return true;
 144 }
 145
 146 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 147                                       unsigned int timeout, ssize_t len)
 148 {
 149         if (len <= 0) {
 150                 return NT_STATUS_OK;
 151         }
 152
 153         return read_socket_with_timeout_ntstatus(fd, buffer, len, len,
 154                                                  timeout, NULL);
 155 }
 156
 157 /****************************************************************************
 158  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 159 ****************************************************************************/
 160
 161 /*
 162  * Unfortunately, earlier versions of smbclient/libsmbclient
 163  * don't send this "standard" writeX header. I've fixed this
 164  * for 3.2 but we'll use the old method with earlier versions.
 165  * Windows and CIFSFS at least use this standard size. Not
 166  * sure about MacOSX.
 167  */
 168
 169 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 170                                 (2*14) + /* word count (including bcc) */ \
 171                                 1 /* pad byte */)
 172
 173 static ssize_t receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 174                                         const char lenbuf[4],
 175                                         int fd,
 176                                         char **buffer,
 177                                         unsigned int timeout,
 178                                         size_t *p_unread)
 179 {
 180         /* Size of a WRITEX call (+4 byte len). */
 181         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 182         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 183         ssize_t toread;
 184         ssize_t ret;
 185
 186         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 187
 188         ret = read_socket_with_timeout(fd, writeX_header + 4,
 189                                        STANDARD_WRITE_AND_X_HEADER_SIZE,
 190                                        STANDARD_WRITE_AND_X_HEADER_SIZE,
 191                                        timeout, get_srv_read_error());
 192
 193         if (ret != STANDARD_WRITE_AND_X_HEADER_SIZE) {
 194                 cond_set_smb_read_error(get_srv_read_error(),
 195                                         SMB_READ_ERROR);
 196                 return -1;
 197         }
 198
 199         /*
 200          * Ok - now try and see if this is a possible
 201          * valid writeX call.
 202          */
 203
 204         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 205                 /*
 206                  * If the data offset is beyond what
 207                  * we've read, drain the extra bytes.
 208                  */
 209                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 210                 ssize_t newlen;
 211
 212                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 213                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 214                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 215                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 216                                         " failed to drain pending bytes");
 217                         }
 218                 } else {
 219                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 220                 }
 221
 222                 /* Spoof down the length and null out the bcc. */
 223                 set_message_bcc(writeX_header, 0);
 224                 newlen = smb_len(writeX_header);
 225
 226                 /* Copy the header we've written. */
 227
 228                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 229                                 writeX_header,
 230                                 sizeof(writeX_header));
 231
 232                 if (*buffer == NULL) {
 233                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 234                                   (int)sizeof(writeX_header)));
 235                         cond_set_smb_read_error(get_srv_read_error(),
 236                                                 SMB_READ_ERROR);
 237                         return -1;
 238                 }
 239
 240                 /* Work out the remaining bytes. */
 241                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 242
 243                 return newlen + 4;
 244         }
 245
 246         if (!valid_packet_size(len)) {
 247                 return -1;
 248         }
 249
 250         /*
 251          * Not a valid writeX call. Just do the standard
 252          * talloc and return.
 253          */
 254
 255         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 256
 257         if (*buffer == NULL) {
 258                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 259                           (int)len+4));
 260                 cond_set_smb_read_error(get_srv_read_error(),
 261                                         SMB_READ_ERROR);
 262                 return -1;
 263         }
 264
 265         /* Copy in what we already read. */
 266         memcpy(*buffer,
 267                 writeX_header,
 268                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 269         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 270
 271         if(toread > 0) {
 272                 NTSTATUS status;
 273
 274                 set_smb_read_error(get_srv_read_error(), SMB_READ_OK);
 275
 276                 status = read_packet_remainder(
 277                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 278                         timeout, toread);
 279
 280                 if (!NT_STATUS_IS_OK(status)) {
 281                         if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 282                                 set_smb_read_error(get_srv_read_error(),
 283                                                    SMB_READ_EOF);
 284                                 return -1;
 285                         }
 286
 287                         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 288                                 set_smb_read_error(get_srv_read_error(),
 289                                                    SMB_READ_TIMEOUT);
 290                                 return -1;
 291                         }
 292
 293                         set_smb_read_error(get_srv_read_error(),
 294                                            SMB_READ_ERROR);
 295                         return -1;
 296                 }
 297         }
 298
 299         return len + 4;
 300 }
 301
 302 static ssize_t receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 303                                         int fd,
 304                                         char **buffer,
 305                                         unsigned int timeout,
 306                                         size_t *p_unread)
 307 {
 308         char lenbuf[4];
 309         size_t len;
 310         int min_recv_size = lp_min_receive_file_size();
 311         NTSTATUS status;
 312
 313         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 314         *p_unread = 0;
 315
 316         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 319
 320                 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 321                         set_smb_read_error(get_srv_read_error(), SMB_READ_EOF);
 322                         return -1;
 323                 }
 324
 325                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 326                         set_smb_read_error(get_srv_read_error(),
 327                                            SMB_READ_TIMEOUT);
 328                         return -1;
 329                 }
 330
 331                 set_smb_read_error(get_srv_read_error(), SMB_READ_ERROR);
 332                 return -1;
 333         }
 334
 335         if (CVAL(lenbuf,0) == 0 &&
 336                         min_recv_size &&
 337                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 338                         !srv_is_signing_active()) {
 339
 340                 return receive_smb_raw_talloc_partial_read(mem_ctx,
 341                                                         lenbuf,
 342                                                         fd,
 343                                                         buffer,
 344                                                         timeout,
 345                                                         p_unread);
 346         }
 347
 348         if (!valid_packet_size(len)) {
 349                 return -1;
 350         }
 351
 352         /*
 353          * The +4 here can't wrap, we've checked the length above already.
 354          */
 355
 356         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 357
 358         if (*buffer == NULL) {
 359                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 360                           (int)len+4));
 361                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 362                 return -1;
 363         }
 364
 365         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 366
 367         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 368         if (!NT_STATUS_IS_OK(status)) {
 369                 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 370                         set_smb_read_error(get_srv_read_error(),
 371                                            SMB_READ_EOF);
 372                         return -1;
 373                 }
 374
 375                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 376                         set_smb_read_error(get_srv_read_error(),
 377                                            SMB_READ_TIMEOUT);
 378                         return -1;
 379                 }
 380
 381                 set_smb_read_error(get_srv_read_error(),
 382                                    SMB_READ_ERROR);
 383                 return -1;
 384         }
 385
 386         return len + 4;
 387 }
 388
 389 static ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx,
 390                                 int fd,
 391                                 char **buffer,
 392                                 unsigned int timeout,
 393                                 size_t *p_unread,
 394                                 bool *p_encrypted)
 395 {
 396         ssize_t len;
 397
 398         *p_encrypted = false;
 399
 400         len = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout, p_unread);
 401
 402         if (len < 0) {
 403                 return -1;
 404         }
 405
 406         if (is_encrypted_packet((uint8_t *)*buffer)) {
 407                 NTSTATUS status = srv_decrypt_buffer(*buffer);
 408                 if (!NT_STATUS_IS_OK(status)) {
 409                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 410                                 "incoming packet! Error %s\n",
 411                                 nt_errstr(status) ));
 412                         cond_set_smb_read_error(get_srv_read_error(),
 413                                         SMB_READ_BAD_DECRYPT);
 414                         return -1;
 415                 }
 416                 *p_encrypted = true;
 417         }
 418
 419         /* Check the incoming SMB signature. */
 420         if (!srv_check_sign_mac(*buffer, true)) {
 421                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 422                           "incoming packet!\n"));
 423                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_BAD_SIG);
 424                 return -1;
 425         }
 426
 427         return len;
 428 }
 429
 430 /*
 431  * Initialize a struct smb_request from an inbuf
 432  */
 433
 434 void init_smb_request(struct smb_request *req,
 435                         const uint8 *inbuf,
 436                         size_t unread_bytes,
 437                         bool encrypted)
 438 {
 439         size_t req_size = smb_len(inbuf) + 4;
 440         /* Ensure we have at least smb_size bytes. */
 441         if (req_size < smb_size) {
 442                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 443                         (unsigned int)req_size ));
 444                 exit_server_cleanly("Invalid SMB request");
 445         }
 446         req->flags2 = SVAL(inbuf, smb_flg2);
 447         req->smbpid = SVAL(inbuf, smb_pid);
 448         req->mid    = SVAL(inbuf, smb_mid);
 449         req->vuid   = SVAL(inbuf, smb_uid);
 450         req->tid    = SVAL(inbuf, smb_tid);
 451         req->wct    = CVAL(inbuf, smb_wct);
 452         req->unread_bytes = unread_bytes;
 453         req->encrypted = encrypted;
 454         req->conn = conn_find(req->tid);
 455
 456         /* Ensure we have at least wct words and 2 bytes of bcc. */
 457         if (smb_size + req->wct*2 > req_size) {
 458                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 459                         (unsigned int)req->wct,
 460                         (unsigned int)req_size));
 461                 exit_server_cleanly("Invalid SMB request");
 462         }
 463         /* Ensure bcc is correct. */
 464         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 465                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 466                         "(wct = %u, size %u)\n",
 467                         (unsigned int)smb_buflen(inbuf),
 468                         (unsigned int)req->wct,
 469                         (unsigned int)req_size));
 470                 exit_server_cleanly("Invalid SMB request");
 471         }
 472         req->inbuf  = inbuf;
 473         req->outbuf = NULL;
 474 }
 475
 476 /****************************************************************************
 477  structure to hold a linked list of queued messages.
 478  for processing.
 479 ****************************************************************************/
 480
 481 static struct pending_message_list *deferred_open_queue;
 482
 483 /****************************************************************************
 484  Function to push a message onto the tail of a linked list of smb messages ready
 485  for processing.
 486 ****************************************************************************/
 487
 488 static bool push_queued_message(struct smb_request *req,
 489                                 struct timeval request_time,
 490                                 struct timeval end_time,
 491                                 char *private_data, size_t private_len)
 492 {
 493         int msg_len = smb_len(req->inbuf) + 4;
 494         struct pending_message_list *msg;
 495
 496         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 497
 498         if(msg == NULL) {
 499                 DEBUG(0,("push_message: malloc fail (1)\n"));
 500                 return False;
 501         }
 502
 503         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 504         if(msg->buf.data == NULL) {
 505                 DEBUG(0,("push_message: malloc fail (2)\n"));
 506                 TALLOC_FREE(msg);
 507                 return False;
 508         }
 509
 510         msg->request_time = request_time;
 511         msg->end_time = end_time;
 512         msg->encrypted = req->encrypted;
 513
 514         if (private_data) {
 515                 msg->private_data = data_blob_talloc(msg, private_data,
 516                                                      private_len);
 517                 if (msg->private_data.data == NULL) {
 518                         DEBUG(0,("push_message: malloc fail (3)\n"));
 519                         TALLOC_FREE(msg);
 520                         return False;
 521                 }
 522         }
 523
 524         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 525
 526         DEBUG(10,("push_message: pushed message length %u on "
 527                   "deferred_open_queue\n", (unsigned int)msg_len));
 528
 529         return True;
 530 }
 531
 532 /****************************************************************************
 533  Function to delete a sharing violation open message by mid.
 534 ****************************************************************************/
 535
 536 void remove_deferred_open_smb_message(uint16 mid)
 537 {
 538         struct pending_message_list *pml;
 539
 540         for (pml = deferred_open_queue; pml; pml = pml->next) {
 541                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 542                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 543                                   "deleting mid %u len %u\n",
 544                                   (unsigned int)mid,
 545                                   (unsigned int)pml->buf.length ));
 546                         DLIST_REMOVE(deferred_open_queue, pml);
 547                         TALLOC_FREE(pml);
 548                         return;
 549                 }
 550         }
 551 }
 552
 553 /****************************************************************************
 554  Move a sharing violation open retry message to the front of the list and
 555  schedule it for immediate processing.
 556 ****************************************************************************/
 557
 558 void schedule_deferred_open_smb_message(uint16 mid)
 559 {
 560         struct pending_message_list *pml;
 561         int i = 0;
 562
 563         for (pml = deferred_open_queue; pml; pml = pml->next) {
 564                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 565                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 566                         (unsigned int)msg_mid ));
 567                 if (mid == msg_mid) {
 568                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 569                                 mid ));
 570                         pml->end_time.tv_sec = 0;
 571                         pml->end_time.tv_usec = 0;
 572                         DLIST_PROMOTE(deferred_open_queue, pml);
 573                         return;
 574                 }
 575         }
 576
 577         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 578                 mid ));
 579 }
 580
 581 /****************************************************************************
 582  Return true if this mid is on the deferred queue.
 583 ****************************************************************************/
 584
 585 bool open_was_deferred(uint16 mid)
 586 {
 587         struct pending_message_list *pml;
 588
 589         for (pml = deferred_open_queue; pml; pml = pml->next) {
 590                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 591                         return True;
 592                 }
 593         }
 594         return False;
 595 }
 596
 597 /****************************************************************************
 598  Return the message queued by this mid.
 599 ****************************************************************************/
 600
 601 struct pending_message_list *get_open_deferred_message(uint16 mid)
 602 {
 603         struct pending_message_list *pml;
 604
 605         for (pml = deferred_open_queue; pml; pml = pml->next) {
 606                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 607                         return pml;
 608                 }
 609         }
 610         return NULL;
 611 }
 612
 613 /****************************************************************************
 614  Function to push a deferred open smb message onto a linked list of local smb
 615  messages ready for processing.
 616 ****************************************************************************/
 617
 618 bool push_deferred_smb_message(struct smb_request *req,
 619                                struct timeval request_time,
 620                                struct timeval timeout,
 621                                char *private_data, size_t priv_len)
 622 {
 623         struct timeval end_time;
 624
 625         if (req->unread_bytes) {
 626                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 627                         "unread_bytes = %u\n",
 628                         (unsigned int)req->unread_bytes ));
 629                 smb_panic("push_deferred_smb_message: "
 630                         "logic error unread_bytes != 0" );
 631         }
 632
 633         end_time = timeval_sum(&request_time, &timeout);
 634
 635         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 636                   "timeout time [%u.%06u]\n",
 637                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 638                   (unsigned int)end_time.tv_sec,
 639                   (unsigned int)end_time.tv_usec));
 640
 641         return push_queued_message(req, request_time, end_time,
 642                                    private_data, priv_len);
 643 }
 644
 645 struct idle_event {
 646         struct timed_event *te;
 647         struct timeval interval;
 648         char *name;
 649         bool (*handler)(const struct timeval *now, void *private_data);
 650         void *private_data;
 651 };
 652
 653 static void idle_event_handler(struct event_context *ctx,
 654                                struct timed_event *te,
 655                                const struct timeval *now,
 656                                void *private_data)
 657 {
 658         struct idle_event *event =
 659                 talloc_get_type_abort(private_data, struct idle_event);
 660
 661         TALLOC_FREE(event->te);
 662
 663         if (!event->handler(now, event->private_data)) {
 664                 /* Don't repeat, delete ourselves */
 665                 TALLOC_FREE(event);
 666                 return;
 667         }
 668
 669         event->te = event_add_timed(ctx, event,
 670                                     timeval_sum(now, &event->interval),
 671                                     event->name,
 672                                     idle_event_handler, event);
 673
 674         /* We can't do much but fail here. */
 675         SMB_ASSERT(event->te != NULL);
 676 }
 677
 678 struct idle_event *event_add_idle(struct event_context *event_ctx,
 679                                   TALLOC_CTX *mem_ctx,
 680                                   struct timeval interval,
 681                                   const char *name,
 682                                   bool (*handler)(const struct timeval *now,
 683                                                   void *private_data),
 684                                   void *private_data)
 685 {
 686         struct idle_event *result;
 687         struct timeval now = timeval_current();
 688
 689         result = TALLOC_P(mem_ctx, struct idle_event);
 690         if (result == NULL) {
 691                 DEBUG(0, ("talloc failed\n"));
 692                 return NULL;
 693         }
 694
 695         result->interval = interval;
 696         result->handler = handler;
 697         result->private_data = private_data;
 698
 699         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 700                 DEBUG(0, ("talloc failed\n"));
 701                 TALLOC_FREE(result);
 702                 return NULL;
 703         }
 704
 705         result->te = event_add_timed(event_ctx, result,
 706                                      timeval_sum(&now, &interval),
 707                                      result->name,
 708                                      idle_event_handler, result);
 709         if (result->te == NULL) {
 710                 DEBUG(0, ("event_add_timed failed\n"));
 711                 TALLOC_FREE(result);
 712                 return NULL;
 713         }
 714
 715         return result;
 716 }
 717
 718 /****************************************************************************
 719  Do all async processing in here. This includes kernel oplock messages, change
 720  notify events etc.
 721 ****************************************************************************/
 722
 723 static void async_processing(fd_set *pfds)
 724 {
 725         DEBUG(10,("async_processing: Doing async processing.\n"));
 726
 727         process_aio_queue();
 728
 729         process_kernel_oplocks(smbd_messaging_context(), pfds);
 730
 731         /* Do the aio check again after receive_local_message as it does a
 732            select and may have eaten our signal. */
 733         /* Is this till true? -- vl */
 734         process_aio_queue();
 735
 736         if (got_sig_term) {
 737                 exit_server_cleanly("termination signal");
 738         }
 739
 740         /* check for sighup processing */
 741         if (reload_after_sighup) {
 742                 change_to_root_user();
 743                 DEBUG(1,("Reloading services after SIGHUP\n"));
 744                 reload_services(False);
 745                 reload_after_sighup = 0;
 746         }
 747 }
 748
 749 /****************************************************************************
 750  Add a fd to the set we will be select(2)ing on.
 751 ****************************************************************************/
 752
 753 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 754 {
 755         if (fd != -1) {
 756                 FD_SET(fd, fds);
 757                 maxfd = MAX(maxfd, fd);
 758         }
 759
 760         return maxfd;
 761 }
 762
 763 /****************************************************************************
 764   Do a select on an two fd's - with timeout.
 765
 766   If a local udp message has been pushed onto the
 767   queue (this can only happen during oplock break
 768   processing) call async_processing()
 769
 770   If a pending smb message has been pushed onto the
 771   queue (this can only happen during oplock break
 772   processing) return this next.
 773
 774   If the first smbfd is ready then read an smb from it.
 775   if the second (loopback UDP) fd is ready then read a message
 776   from it and setup the buffer header to identify the length
 777   and from address.
 778   Returns False on timeout or error.
 779   Else returns True.
 780
 781 The timeout is in milliseconds
 782 ****************************************************************************/
 783
 784 static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 785                                 char **buffer,
 786                                 size_t *buffer_len,
 787                                 int timeout,
 788                                 size_t *p_unread,
 789                                 bool *p_encrypted)
 790 {
 791         fd_set r_fds, w_fds;
 792         int selrtn;
 793         struct timeval to;
 794         int maxfd = 0;
 795         ssize_t len;
 796
 797         *p_unread = 0;
 798         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 799
 800  again:
 801
 802         if (timeout >= 0) {
 803                 to.tv_sec = timeout / 1000;
 804                 to.tv_usec = (timeout % 1000) * 1000;
 805         } else {
 806                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 807                 to.tv_usec = 0;
 808         }
 809
 810         /*
 811          * Note that this call must be before processing any SMB
 812          * messages as we need to synchronously process any messages
 813          * we may have sent to ourselves from the previous SMB.
 814          */
 815         message_dispatch(smbd_messaging_context());
 816
 817         /*
 818          * Check to see if we already have a message on the deferred open queue
 819          * and it's time to schedule.
 820          */
 821         if(deferred_open_queue != NULL) {
 822                 bool pop_message = False;
 823                 struct pending_message_list *msg = deferred_open_queue;
 824
 825                 if (timeval_is_zero(&msg->end_time)) {
 826                         pop_message = True;
 827                 } else {
 828                         struct timeval tv;
 829                         SMB_BIG_INT tdif;
 830
 831                         GetTimeOfDay(&tv);
 832                         tdif = usec_time_diff(&msg->end_time, &tv);
 833                         if (tdif <= 0) {
 834                                 /* Timed out. Schedule...*/
 835                                 pop_message = True;
 836                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 837                         } else {
 838                                 /* Make a more accurate select timeout. */
 839                                 to.tv_sec = tdif / 1000000;
 840                                 to.tv_usec = tdif % 1000000;
 841                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 842                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 843                         }
 844                 }
 845
 846                 if (pop_message) {
 847
 848                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 849                                                         msg->buf.length);
 850                         if (*buffer == NULL) {
 851                                 DEBUG(0, ("talloc failed\n"));
 852                                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 853                                 return False;
 854                         }
 855                         *buffer_len = msg->buf.length;
 856                         *p_encrypted = msg->encrypted;
 857
 858                         /* We leave this message on the queue so the open code can
 859                            know this is a retry. */
 860                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 861                         return True;
 862                 }
 863         }
 864
 865         /*
 866          * Setup the select fd sets.
 867          */
 868
 869         FD_ZERO(&r_fds);
 870         FD_ZERO(&w_fds);
 871
 872         /*
 873          * Ensure we process oplock break messages by preference.
 874          * We have to do this before the select, after the select
 875          * and if the select returns EINTR. This is due to the fact
 876          * that the selects called from async_processing can eat an EINTR
 877          * caused by a signal (we can't take the break message there).
 878          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 879          */
 880
 881         if (oplock_message_waiting(&r_fds)) {
 882                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 883                 async_processing(&r_fds);
 884                 /*
 885                  * After async processing we must go and do the select again, as
 886                  * the state of the flag in fds for the server file descriptor is
 887                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 888                  */
 889                 goto again;
 890         }
 891
 892         /*
 893          * Are there any timed events waiting ? If so, ensure we don't
 894          * select for longer than it would take to wait for them.
 895          */
 896
 897         {
 898                 struct timeval now;
 899                 GetTimeOfDay(&now);
 900
 901                 event_add_to_select_args(smbd_event_context(), &now,
 902                                          &r_fds, &w_fds, &to, &maxfd);
 903         }
 904
 905         if (timeval_is_zero(&to)) {
 906                 /* Process a timed event now... */
 907                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 908                         goto again;
 909                 }
 910         }
 911
 912         {
 913                 int sav;
 914                 START_PROFILE(smbd_idle);
 915
 916                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 917                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 918
 919                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 920                 sav = errno;
 921
 922                 END_PROFILE(smbd_idle);
 923                 errno = sav;
 924         }
 925
 926         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 927                 goto again;
 928         }
 929
 930         /* if we get EINTR then maybe we have received an oplock
 931            signal - treat this as select returning 1. This is ugly, but
 932            is the best we can do until the oplock code knows more about
 933            signals */
 934         if (selrtn == -1 && errno == EINTR) {
 935                 async_processing(&r_fds);
 936                 /*
 937                  * After async processing we must go and do the select again, as
 938                  * the state of the flag in fds for the server file descriptor is
 939                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 940                  */
 941                 goto again;
 942         }
 943
 944         /* Check if error */
 945         if (selrtn == -1) {
 946                 /* something is wrong. Maybe the socket is dead? */
 947                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 948                 return False;
 949         }
 950
 951         /* Did we timeout ? */
 952         if (selrtn == 0) {
 953                 set_smb_read_error(get_srv_read_error(),SMB_READ_TIMEOUT);
 954                 return False;
 955         }
 956
 957         /*
 958          * Ensure we process oplock break messages by preference.
 959          * This is IMPORTANT ! Otherwise we can starve other processes
 960          * sending us an oplock break message. JRA.
 961          */
 962
 963         if (oplock_message_waiting(&r_fds)) {
 964                 async_processing(&r_fds);
 965                 /*
 966                  * After async processing we must go and do the select again, as
 967                  * the state of the flag in fds for the server file descriptor is
 968                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 969                  */
 970                 goto again;
 971         }
 972
 973         len = receive_smb_talloc(mem_ctx, smbd_server_fd(),
 974                                 buffer, 0, p_unread, p_encrypted);
 975
 976         if (len == -1) {
 977                 return False;
 978         }
 979
 980         *buffer_len = (size_t)len;
 981
 982         return True;
 983 }
 984
 985 /*
 986  * Only allow 5 outstanding trans requests. We're allocating memory, so
 987  * prevent a DoS.
 988  */
 989
 990 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 991 {
 992         int count = 0;
 993         for (; list != NULL; list = list->next) {
 994
 995                 if (list->mid == mid) {
 996                         return NT_STATUS_INVALID_PARAMETER;
 997                 }
 998
 999                 count += 1;
1000         }
1001         if (count > 5) {
1002                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1003         }
1004
1005         return NT_STATUS_OK;
1006 }
1007
1008 /****************************************************************************
1009  We're terminating and have closed all our files/connections etc.
1010  If there are any pending local messages we need to respond to them
1011  before termination so that other smbds don't think we just died whilst
1012  holding oplocks.
1013 ****************************************************************************/
1014
1015 void respond_to_all_remaining_local_messages(void)
1016 {
1017         /*
1018          * Assert we have no exclusive open oplocks.
1019          */
1020
1021         if(get_number_of_exclusive_open_oplocks()) {
1022                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
1023                         get_number_of_exclusive_open_oplocks() ));
1024                 return;
1025         }
1026
1027         process_kernel_oplocks(smbd_messaging_context(), NULL);
1028
1029         return;
1030 }
1031
1032
1033 /*
1034 These flags determine some of the permissions required to do an operation
1035
1036 Note that I don't set NEED_WRITE on some write operations because they
1037 are used by some brain-dead clients when printing, and I don't want to
1038 force write permissions on print services.
1039 */
1040 #define AS_USER (1<<0)
1041 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1042 #define TIME_INIT (1<<2)
1043 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1044 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1045 #define DO_CHDIR (1<<6)
1046
1047 /*
1048    define a list of possible SMB messages and their corresponding
1049    functions. Any message that has a NULL function is unimplemented -
1050    please feel free to contribute implementations!
1051 */
1052 static const struct smb_message_struct {
1053         const char *name;
1054         void (*fn_new)(struct smb_request *req);
1055         int flags;
1056 } smb_messages[256] = {
1057
1058 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1059 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1060 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1061 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1062 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1063 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1064 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1065 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1066 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1067 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1068 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1069 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1070 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1071 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1072 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1073 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1074 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1075 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1076 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1077 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1078 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1079 /* 0x15 */ { NULL, NULL, 0 },
1080 /* 0x16 */ { NULL, NULL, 0 },
1081 /* 0x17 */ { NULL, NULL, 0 },
1082 /* 0x18 */ { NULL, NULL, 0 },
1083 /* 0x19 */ { NULL, NULL, 0 },
1084 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1085 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1086 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1087 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1088 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1089 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1090 /* 0x20 */ { "SMBwritec", NULL,0},
1091 /* 0x21 */ { NULL, NULL, 0 },
1092 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1093 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1094 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1095 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1096 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1097 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1098 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1099 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1100 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1101 /* 0x2b */ { "SMBecho",reply_echo,0},
1102 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1103 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1104 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1105 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1106 /* 0x30 */ { NULL, NULL, 0 },
1107 /* 0x31 */ { NULL, NULL, 0 },
1108 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1109 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1110 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1111 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1112 /* 0x36 */ { NULL, NULL, 0 },
1113 /* 0x37 */ { NULL, NULL, 0 },
1114 /* 0x38 */ { NULL, NULL, 0 },
1115 /* 0x39 */ { NULL, NULL, 0 },
1116 /* 0x3a */ { NULL, NULL, 0 },
1117 /* 0x3b */ { NULL, NULL, 0 },
1118 /* 0x3c */ { NULL, NULL, 0 },
1119 /* 0x3d */ { NULL, NULL, 0 },
1120 /* 0x3e */ { NULL, NULL, 0 },
1121 /* 0x3f */ { NULL, NULL, 0 },
1122 /* 0x40 */ { NULL, NULL, 0 },
1123 /* 0x41 */ { NULL, NULL, 0 },
1124 /* 0x42 */ { NULL, NULL, 0 },
1125 /* 0x43 */ { NULL, NULL, 0 },
1126 /* 0x44 */ { NULL, NULL, 0 },
1127 /* 0x45 */ { NULL, NULL, 0 },
1128 /* 0x46 */ { NULL, NULL, 0 },
1129 /* 0x47 */ { NULL, NULL, 0 },
1130 /* 0x48 */ { NULL, NULL, 0 },
1131 /* 0x49 */ { NULL, NULL, 0 },
1132 /* 0x4a */ { NULL, NULL, 0 },
1133 /* 0x4b */ { NULL, NULL, 0 },
1134 /* 0x4c */ { NULL, NULL, 0 },
1135 /* 0x4d */ { NULL, NULL, 0 },
1136 /* 0x4e */ { NULL, NULL, 0 },
1137 /* 0x4f */ { NULL, NULL, 0 },
1138 /* 0x50 */ { NULL, NULL, 0 },
1139 /* 0x51 */ { NULL, NULL, 0 },
1140 /* 0x52 */ { NULL, NULL, 0 },
1141 /* 0x53 */ { NULL, NULL, 0 },
1142 /* 0x54 */ { NULL, NULL, 0 },
1143 /* 0x55 */ { NULL, NULL, 0 },
1144 /* 0x56 */ { NULL, NULL, 0 },
1145 /* 0x57 */ { NULL, NULL, 0 },
1146 /* 0x58 */ { NULL, NULL, 0 },
1147 /* 0x59 */ { NULL, NULL, 0 },
1148 /* 0x5a */ { NULL, NULL, 0 },
1149 /* 0x5b */ { NULL, NULL, 0 },
1150 /* 0x5c */ { NULL, NULL, 0 },
1151 /* 0x5d */ { NULL, NULL, 0 },
1152 /* 0x5e */ { NULL, NULL, 0 },
1153 /* 0x5f */ { NULL, NULL, 0 },
1154 /* 0x60 */ { NULL, NULL, 0 },
1155 /* 0x61 */ { NULL, NULL, 0 },
1156 /* 0x62 */ { NULL, NULL, 0 },
1157 /* 0x63 */ { NULL, NULL, 0 },
1158 /* 0x64 */ { NULL, NULL, 0 },
1159 /* 0x65 */ { NULL, NULL, 0 },
1160 /* 0x66 */ { NULL, NULL, 0 },
1161 /* 0x67 */ { NULL, NULL, 0 },
1162 /* 0x68 */ { NULL, NULL, 0 },
1163 /* 0x69 */ { NULL, NULL, 0 },
1164 /* 0x6a */ { NULL, NULL, 0 },
1165 /* 0x6b */ { NULL, NULL, 0 },
1166 /* 0x6c */ { NULL, NULL, 0 },
1167 /* 0x6d */ { NULL, NULL, 0 },
1168 /* 0x6e */ { NULL, NULL, 0 },
1169 /* 0x6f */ { NULL, NULL, 0 },
1170 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1171 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1172 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1173 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1174 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1175 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1176 /* 0x76 */ { NULL, NULL, 0 },
1177 /* 0x77 */ { NULL, NULL, 0 },
1178 /* 0x78 */ { NULL, NULL, 0 },
1179 /* 0x79 */ { NULL, NULL, 0 },
1180 /* 0x7a */ { NULL, NULL, 0 },
1181 /* 0x7b */ { NULL, NULL, 0 },
1182 /* 0x7c */ { NULL, NULL, 0 },
1183 /* 0x7d */ { NULL, NULL, 0 },
1184 /* 0x7e */ { NULL, NULL, 0 },
1185 /* 0x7f */ { NULL, NULL, 0 },
1186 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1187 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1188 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1189 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1190 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1191 /* 0x85 */ { NULL, NULL, 0 },
1192 /* 0x86 */ { NULL, NULL, 0 },
1193 /* 0x87 */ { NULL, NULL, 0 },
1194 /* 0x88 */ { NULL, NULL, 0 },
1195 /* 0x89 */ { NULL, NULL, 0 },
1196 /* 0x8a */ { NULL, NULL, 0 },
1197 /* 0x8b */ { NULL, NULL, 0 },
1198 /* 0x8c */ { NULL, NULL, 0 },
1199 /* 0x8d */ { NULL, NULL, 0 },
1200 /* 0x8e */ { NULL, NULL, 0 },
1201 /* 0x8f */ { NULL, NULL, 0 },
1202 /* 0x90 */ { NULL, NULL, 0 },
1203 /* 0x91 */ { NULL, NULL, 0 },
1204 /* 0x92 */ { NULL, NULL, 0 },
1205 /* 0x93 */ { NULL, NULL, 0 },
1206 /* 0x94 */ { NULL, NULL, 0 },
1207 /* 0x95 */ { NULL, NULL, 0 },
1208 /* 0x96 */ { NULL, NULL, 0 },
1209 /* 0x97 */ { NULL, NULL, 0 },
1210 /* 0x98 */ { NULL, NULL, 0 },
1211 /* 0x99 */ { NULL, NULL, 0 },
1212 /* 0x9a */ { NULL, NULL, 0 },
1213 /* 0x9b */ { NULL, NULL, 0 },
1214 /* 0x9c */ { NULL, NULL, 0 },
1215 /* 0x9d */ { NULL, NULL, 0 },
1216 /* 0x9e */ { NULL, NULL, 0 },
1217 /* 0x9f */ { NULL, NULL, 0 },
1218 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1219 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1220 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1221 /* 0xa3 */ { NULL, NULL, 0 },
1222 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1223 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1224 /* 0xa6 */ { NULL, NULL, 0 },
1225 /* 0xa7 */ { NULL, NULL, 0 },
1226 /* 0xa8 */ { NULL, NULL, 0 },
1227 /* 0xa9 */ { NULL, NULL, 0 },
1228 /* 0xaa */ { NULL, NULL, 0 },
1229 /* 0xab */ { NULL, NULL, 0 },
1230 /* 0xac */ { NULL, NULL, 0 },
1231 /* 0xad */ { NULL, NULL, 0 },
1232 /* 0xae */ { NULL, NULL, 0 },
1233 /* 0xaf */ { NULL, NULL, 0 },
1234 /* 0xb0 */ { NULL, NULL, 0 },
1235 /* 0xb1 */ { NULL, NULL, 0 },
1236 /* 0xb2 */ { NULL, NULL, 0 },
1237 /* 0xb3 */ { NULL, NULL, 0 },
1238 /* 0xb4 */ { NULL, NULL, 0 },
1239 /* 0xb5 */ { NULL, NULL, 0 },
1240 /* 0xb6 */ { NULL, NULL, 0 },
1241 /* 0xb7 */ { NULL, NULL, 0 },
1242 /* 0xb8 */ { NULL, NULL, 0 },
1243 /* 0xb9 */ { NULL, NULL, 0 },
1244 /* 0xba */ { NULL, NULL, 0 },
1245 /* 0xbb */ { NULL, NULL, 0 },
1246 /* 0xbc */ { NULL, NULL, 0 },
1247 /* 0xbd */ { NULL, NULL, 0 },
1248 /* 0xbe */ { NULL, NULL, 0 },
1249 /* 0xbf */ { NULL, NULL, 0 },
1250 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1251 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1252 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1253 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1254 /* 0xc4 */ { NULL, NULL, 0 },
1255 /* 0xc5 */ { NULL, NULL, 0 },
1256 /* 0xc6 */ { NULL, NULL, 0 },
1257 /* 0xc7 */ { NULL, NULL, 0 },
1258 /* 0xc8 */ { NULL, NULL, 0 },
1259 /* 0xc9 */ { NULL, NULL, 0 },
1260 /* 0xca */ { NULL, NULL, 0 },
1261 /* 0xcb */ { NULL, NULL, 0 },
1262 /* 0xcc */ { NULL, NULL, 0 },
1263 /* 0xcd */ { NULL, NULL, 0 },
1264 /* 0xce */ { NULL, NULL, 0 },
1265 /* 0xcf */ { NULL, NULL, 0 },
1266 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1267 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1268 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1269 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1270 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1271 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1272 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1273 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1274 /* 0xd8 */ { NULL, NULL, 0 },
1275 /* 0xd9 */ { NULL, NULL, 0 },
1276 /* 0xda */ { NULL, NULL, 0 },
1277 /* 0xdb */ { NULL, NULL, 0 },
1278 /* 0xdc */ { NULL, NULL, 0 },
1279 /* 0xdd */ { NULL, NULL, 0 },
1280 /* 0xde */ { NULL, NULL, 0 },
1281 /* 0xdf */ { NULL, NULL, 0 },
1282 /* 0xe0 */ { NULL, NULL, 0 },
1283 /* 0xe1 */ { NULL, NULL, 0 },
1284 /* 0xe2 */ { NULL, NULL, 0 },
1285 /* 0xe3 */ { NULL, NULL, 0 },
1286 /* 0xe4 */ { NULL, NULL, 0 },
1287 /* 0xe5 */ { NULL, NULL, 0 },
1288 /* 0xe6 */ { NULL, NULL, 0 },
1289 /* 0xe7 */ { NULL, NULL, 0 },
1290 /* 0xe8 */ { NULL, NULL, 0 },
1291 /* 0xe9 */ { NULL, NULL, 0 },
1292 /* 0xea */ { NULL, NULL, 0 },
1293 /* 0xeb */ { NULL, NULL, 0 },
1294 /* 0xec */ { NULL, NULL, 0 },
1295 /* 0xed */ { NULL, NULL, 0 },
1296 /* 0xee */ { NULL, NULL, 0 },
1297 /* 0xef */ { NULL, NULL, 0 },
1298 /* 0xf0 */ { NULL, NULL, 0 },
1299 /* 0xf1 */ { NULL, NULL, 0 },
1300 /* 0xf2 */ { NULL, NULL, 0 },
1301 /* 0xf3 */ { NULL, NULL, 0 },
1302 /* 0xf4 */ { NULL, NULL, 0 },
1303 /* 0xf5 */ { NULL, NULL, 0 },
1304 /* 0xf6 */ { NULL, NULL, 0 },
1305 /* 0xf7 */ { NULL, NULL, 0 },
1306 /* 0xf8 */ { NULL, NULL, 0 },
1307 /* 0xf9 */ { NULL, NULL, 0 },
1308 /* 0xfa */ { NULL, NULL, 0 },
1309 /* 0xfb */ { NULL, NULL, 0 },
1310 /* 0xfc */ { NULL, NULL, 0 },
1311 /* 0xfd */ { NULL, NULL, 0 },
1312 /* 0xfe */ { NULL, NULL, 0 },
1313 /* 0xff */ { NULL, NULL, 0 }
1314
1315 };
1316
1317 /*******************************************************************
1318  allocate and initialize a reply packet
1319 ********************************************************************/
1320
1321 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1322 {
1323         /*
1324          * Protect against integer wrap
1325          */
1326         if ((num_bytes > 0xffffff)
1327             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1328                 char *msg;
1329                 asprintf(&msg, "num_bytes too large: %u",
1330                          (unsigned)num_bytes);
1331                 smb_panic(msg);
1332         }
1333
1334         if (!(req->outbuf = TALLOC_ARRAY(
1335                       req, uint8,
1336                       smb_size + num_words*2 + num_bytes))) {
1337                 smb_panic("could not allocate output buffer\n");
1338         }
1339
1340         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1341         srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1342         /*
1343          * Zero out the word area, the caller has to take care of the bcc area
1344          * himself
1345          */
1346         if (num_words != 0) {
1347                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1348         }
1349
1350         return;
1351 }
1352
1353
1354 /*******************************************************************
1355  Dump a packet to a file.
1356 ********************************************************************/
1357
1358 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1359 {
1360         int fd, i;
1361         char *fname = NULL;
1362         if (DEBUGLEVEL < 50) {
1363                 return;
1364         }
1365
1366         if (len < 4) len = smb_len(data)+4;
1367         for (i=1;i<100;i++) {
1368                 asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1369                                 type ? "req" : "resp");
1370                 if (!fname) {
1371                         return;
1372                 }
1373                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1374                 if (fd != -1 || errno != EEXIST) break;
1375         }
1376         if (fd != -1) {
1377                 ssize_t ret = write(fd, data, len);
1378                 if (ret != len)
1379                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1380                 close(fd);
1381                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1382         }
1383         SAFE_FREE(fname);
1384 }
1385
1386 /****************************************************************************
1387  Prepare everything for calling the actual request function, and potentially
1388  call the request function via the "new" interface.
1389
1390  Return False if the "legacy" function needs to be called, everything is
1391  prepared.
1392
1393  Return True if we're done.
1394
1395  I know this API sucks, but it is the one with the least code change I could
1396  find.
1397 ****************************************************************************/
1398
1399 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1400 {
1401         int flags;
1402         uint16 session_tag;
1403         connection_struct *conn = NULL;
1404
1405         static uint16 last_session_tag = UID_FIELD_INVALID;
1406
1407         errno = 0;
1408
1409         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1410          * so subtract 4 from it. */
1411         if (!valid_smb_header(req->inbuf)
1412             || (size < (smb_size - 4))) {
1413                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1414                          smb_len(req->inbuf)));
1415                 exit_server_cleanly("Non-SMB packet");
1416         }
1417
1418         if (smb_messages[type].fn_new == NULL) {
1419                 DEBUG(0,("Unknown message type %d!\n",type));
1420                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1421                 reply_unknown_new(req, type);
1422                 return NULL;
1423         }
1424
1425         flags = smb_messages[type].flags;
1426
1427         /* In share mode security we must ignore the vuid. */
1428         session_tag = (lp_security() == SEC_SHARE)
1429                 ? UID_FIELD_INVALID : req->vuid;
1430         conn = req->conn;
1431
1432         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1433                  (int)sys_getpid(), (unsigned long)conn));
1434
1435         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1436
1437         /* Ensure this value is replaced in the incoming packet. */
1438         SSVAL(req->inbuf,smb_uid,session_tag);
1439
1440         /*
1441          * Ensure the correct username is in current_user_info.  This is a
1442          * really ugly bugfix for problems with multiple session_setup_and_X's
1443          * being done and allowing %U and %G substitutions to work correctly.
1444          * There is a reason this code is done here, don't move it unless you
1445          * know what you're doing... :-).
1446          * JRA.
1447          */
1448
1449         if (session_tag != last_session_tag) {
1450                 user_struct *vuser = NULL;
1451
1452                 last_session_tag = session_tag;
1453                 if(session_tag != UID_FIELD_INVALID) {
1454                         vuser = get_valid_user_struct(session_tag);
1455                         if (vuser) {
1456                                 set_current_user_info(&vuser->user);
1457                         }
1458                 }
1459         }
1460
1461         /* Does this call need to be run as the connected user? */
1462         if (flags & AS_USER) {
1463
1464                 /* Does this call need a valid tree connection? */
1465                 if (!conn) {
1466                         /*
1467                          * Amazingly, the error code depends on the command
1468                          * (from Samba4).
1469                          */
1470                         if (type == SMBntcreateX) {
1471                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1472                         } else {
1473                                 reply_doserror(req, ERRSRV, ERRinvnid);
1474                         }
1475                         return NULL;
1476                 }
1477
1478                 if (!change_to_user(conn,session_tag)) {
1479                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1480                         return conn;
1481                 }
1482
1483                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1484
1485                 /* Does it need write permission? */
1486                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1487                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1488                         return conn;
1489                 }
1490
1491                 /* IPC services are limited */
1492                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1493                         reply_doserror(req, ERRSRV,ERRaccess);
1494                         return conn;
1495                 }
1496         } else {
1497                 /* This call needs to be run as root */
1498                 change_to_root_user();
1499         }
1500
1501         /* load service specific parameters */
1502         if (conn) {
1503                 if (req->encrypted) {
1504                         conn->encrypted_tid = true;
1505                         /* encrypted required from now on. */
1506                         conn->encrypt_level = Required;
1507                 } else if (ENCRYPTION_REQUIRED(conn)) {
1508                         uint8 com = CVAL(req->inbuf,smb_com);
1509                         if (com != SMBtrans2 && com != SMBtranss2) {
1510                                 exit_server_cleanly("encryption required "
1511                                         "on connection");
1512                                 return conn;
1513                         }
1514                 }
1515
1516                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1517                                          (flags & (AS_USER|DO_CHDIR)
1518                                           ?True:False))) {
1519                         reply_doserror(req, ERRSRV, ERRaccess);
1520                         return conn;
1521                 }
1522                 conn->num_smb_operations++;
1523         }
1524
1525         /* does this protocol need to be run as guest? */
1526         if ((flags & AS_GUEST)
1527             && (!change_to_guest() ||
1528                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1529                               lp_hostsdeny(-1)))) {
1530                 reply_doserror(req, ERRSRV, ERRaccess);
1531                 return conn;
1532         }
1533
1534         smb_messages[type].fn_new(req);
1535         return req->conn;
1536 }
1537
1538 /****************************************************************************
1539  Construct a reply to the incoming packet.
1540 ****************************************************************************/
1541
1542 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1543 {
1544         uint8 type = CVAL(inbuf,smb_com);
1545         connection_struct *conn;
1546         struct smb_request *req;
1547
1548         chain_size = 0;
1549         file_chain_reset();
1550         reset_chain_p();
1551
1552         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1553                 smb_panic("could not allocate smb_request");
1554         }
1555         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1556
1557         conn = switch_message(type, req, size);
1558
1559         if (req->unread_bytes) {
1560                 /* writeX failed. drain socket. */
1561                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1562                                 req->unread_bytes) {
1563                         smb_panic("failed to drain pending bytes");
1564                 }
1565                 req->unread_bytes = 0;
1566         }
1567
1568         if (req->outbuf == NULL) {
1569                 return;
1570         }
1571
1572         if (CVAL(req->outbuf,0) == 0) {
1573                 show_msg((char *)req->outbuf);
1574         }
1575
1576         if (!srv_send_smb(smbd_server_fd(),
1577                         (char *)req->outbuf,
1578                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1579                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1580         }
1581
1582         TALLOC_FREE(req);
1583
1584         return;
1585 }
1586
1587 /****************************************************************************
1588  Process an smb from the client
1589 ****************************************************************************/
1590
1591 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1592 {
1593         static int trans_num;
1594         int msg_type = CVAL(inbuf,0);
1595
1596         DO_PROFILE_INC(smb_count);
1597
1598         if (trans_num == 0) {
1599                 char addr[INET6_ADDRSTRLEN];
1600
1601                 /* on the first packet, check the global hosts allow/ hosts
1602                 deny parameters before doing any parsing of the packet
1603                 passed to us by the client.  This prevents attacks on our
1604                 parsing code from hosts not in the hosts allow list */
1605
1606                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1607                                   lp_hostsdeny(-1))) {
1608                         /* send a negative session response "not listening on calling name" */
1609                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1610                         DEBUG( 1, ( "Connection denied from %s\n",
1611                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1612                         (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1613                         exit_server_cleanly("connection denied");
1614                 }
1615         }
1616
1617         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1618                     smb_len(inbuf) ) );
1619         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1620                                 (int)nread,
1621                                 (unsigned int)unread_bytes ));
1622
1623         if (msg_type != 0) {
1624                 /*
1625                  * NetBIOS session request, keepalive, etc.
1626                  */
1627                 reply_special(inbuf);
1628                 return;
1629         }
1630
1631         show_msg(inbuf);
1632
1633         construct_reply(inbuf,nread,unread_bytes,encrypted);
1634
1635         trans_num++;
1636 }
1637
1638 /****************************************************************************
1639  Return a string containing the function name of a SMB command.
1640 ****************************************************************************/
1641
1642 const char *smb_fn_name(int type)
1643 {
1644         const char *unknown_name = "SMBunknown";
1645
1646         if (smb_messages[type].name == NULL)
1647                 return(unknown_name);
1648
1649         return(smb_messages[type].name);
1650 }
1651
1652 /****************************************************************************
1653  Helper functions for contruct_reply.
1654 ****************************************************************************/
1655
1656 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1657
1658 void add_to_common_flags2(uint32 v)
1659 {
1660         common_flags2 |= v;
1661 }
1662
1663 void remove_from_common_flags2(uint32 v)
1664 {
1665         common_flags2 &= ~v;
1666 }
1667
1668 void construct_reply_common(const char *inbuf, char *outbuf)
1669 {
1670         srv_set_message(outbuf,0,0,false);
1671
1672         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1673         SIVAL(outbuf,smb_rcls,0);
1674         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1675         SSVAL(outbuf,smb_flg2,
1676                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1677                 common_flags2);
1678         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1679
1680         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1681         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1682         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1683         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1684 }
1685
1686 /****************************************************************************
1687  Construct a chained reply and add it to the already made reply
1688 ****************************************************************************/
1689
1690 void chain_reply(struct smb_request *req)
1691 {
1692         static char *orig_inbuf;
1693
1694         /*
1695          * Dirty little const_discard: We mess with req->inbuf, which is
1696          * declared as const. If maybe at some point this routine gets
1697          * rewritten, this const_discard could go away.
1698          */
1699         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1700         int size = smb_len(req->inbuf)+4;
1701
1702         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1703         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1704         char *inbuf2;
1705         int outsize2;
1706         int new_size;
1707         char inbuf_saved[smb_wct];
1708         char *outbuf = (char *)req->outbuf;
1709         size_t outsize = smb_len(outbuf) + 4;
1710         size_t outsize_padded;
1711         size_t ofs, to_move;
1712
1713         struct smb_request *req2;
1714         size_t caller_outputlen;
1715         char *caller_output;
1716
1717         /* Maybe its not chained, or it's an error packet. */
1718         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1719                 SCVAL(outbuf,smb_vwv0,0xFF);
1720                 return;
1721         }
1722
1723         if (chain_size == 0) {
1724                 /* this is the first part of the chain */
1725                 orig_inbuf = inbuf;
1726         }
1727
1728         /*
1729          * We need to save the output the caller added to the chain so that we
1730          * can splice it into the final output buffer later.
1731          */
1732
1733         caller_outputlen = outsize - smb_wct;
1734
1735         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1736
1737         if (caller_output == NULL) {
1738                 /* TODO: NT_STATUS_NO_MEMORY */
1739                 smb_panic("could not dup outbuf");
1740         }
1741
1742         /*
1743          * The original Win95 redirector dies on a reply to
1744          * a lockingX and read chain unless the chain reply is
1745          * 4 byte aligned. JRA.
1746          */
1747
1748         outsize_padded = (outsize + 3) & ~3;
1749
1750         /*
1751          * remember how much the caller added to the chain, only counting
1752          * stuff after the parameter words
1753          */
1754         chain_size += outsize_padded - smb_wct;
1755
1756         /*
1757          * work out pointers into the original packets. The
1758          * headers on these need to be filled in
1759          */
1760         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1761
1762         /* remember the original command type */
1763         smb_com1 = CVAL(orig_inbuf,smb_com);
1764
1765         /* save the data which will be overwritten by the new headers */
1766         memcpy(inbuf_saved,inbuf2,smb_wct);
1767
1768         /* give the new packet the same header as the last part of the SMB */
1769         memmove(inbuf2,inbuf,smb_wct);
1770
1771         /* create the in buffer */
1772         SCVAL(inbuf2,smb_com,smb_com2);
1773
1774         /* work out the new size for the in buffer. */
1775         new_size = size - (inbuf2 - inbuf);
1776         if (new_size < 0) {
1777                 DEBUG(0,("chain_reply: chain packet size incorrect "
1778                          "(orig size = %d, offset = %d)\n",
1779                          size, (int)(inbuf2 - inbuf) ));
1780                 exit_server_cleanly("Bad chained packet");
1781                 return;
1782         }
1783
1784         /* And set it in the header. */
1785         smb_setlen(inbuf2, new_size - 4);
1786
1787         DEBUG(3,("Chained message\n"));
1788         show_msg(inbuf2);
1789
1790         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1791                 smb_panic("could not allocate smb_request");
1792         }
1793         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1794
1795         /* process the request */
1796         switch_message(smb_com2, req2, new_size);
1797
1798         /*
1799          * We don't accept deferred operations in chained requests.
1800          */
1801         SMB_ASSERT(req2->outbuf != NULL);
1802         outsize2 = smb_len(req2->outbuf)+4;
1803
1804         /*
1805          * Move away the new command output so that caller_output fits in,
1806          * copy in the caller_output saved above.
1807          */
1808
1809         SMB_ASSERT(outsize_padded >= smb_wct);
1810
1811         /*
1812          * "ofs" is the space we need for caller_output. Equal to
1813          * caller_outputlen plus the padding.
1814          */
1815
1816         ofs = outsize_padded - smb_wct;
1817
1818         /*
1819          * "to_move" is the amount of bytes the secondary routine gave us
1820          */
1821
1822         to_move = outsize2 - smb_wct;
1823
1824         if (to_move + ofs + smb_wct + chain_size > max_send) {
1825                 smb_panic("replies too large -- would have to cut");
1826         }
1827
1828         /*
1829          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1830          * the first request in the chain. So we have to re-allocate it. In
1831          * the "old" API the only outbuf ever used is the global OutBuffer
1832          * which is always large enough.
1833          */
1834
1835         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1836                                       to_move + ofs + smb_wct);
1837         if (outbuf == NULL) {
1838                 smb_panic("could not realloc outbuf");
1839         }
1840
1841         req->outbuf = (uint8 *)outbuf;
1842
1843         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1844         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1845
1846         /*
1847          * copy the new reply header over the old one but preserve the smb_com
1848          * field
1849          */
1850         memmove(outbuf, req2->outbuf, smb_wct);
1851         SCVAL(outbuf, smb_com, smb_com1);
1852
1853         /*
1854          * We've just copied in the whole "wct" area from the secondary
1855          * function. Fix up the chaining: com2 and the offset need to be
1856          * readjusted.
1857          */
1858
1859         SCVAL(outbuf, smb_vwv0, smb_com2);
1860         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1861
1862         if (outsize_padded > outsize) {
1863
1864                 /*
1865                  * Due to padding we have some uninitialized bytes after the
1866                  * caller's output
1867                  */
1868
1869                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1870         }
1871
1872         smb_setlen(outbuf, outsize2 + chain_size - 4);
1873
1874         /*
1875          * restore the saved data, being careful not to overwrite any data
1876          * from the reply header
1877          */
1878         memcpy(inbuf2,inbuf_saved,smb_wct);
1879
1880         SAFE_FREE(caller_output);
1881         TALLOC_FREE(req2);
1882
1883         return;
1884 }
1885
1886 /****************************************************************************
1887  Setup the needed select timeout in milliseconds.
1888 ****************************************************************************/
1889
1890 static int setup_select_timeout(void)
1891 {
1892         int select_timeout;
1893
1894         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1895
1896         if (print_notify_messages_pending()) {
1897                 select_timeout = MIN(select_timeout, 1000);
1898         }
1899
1900         return select_timeout;
1901 }
1902
1903 /****************************************************************************
1904  Check if services need reloading.
1905 ****************************************************************************/
1906
1907 void check_reload(time_t t)
1908 {
1909         static pid_t mypid = 0;
1910         static time_t last_smb_conf_reload_time = 0;
1911         static time_t last_printer_reload_time = 0;
1912         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1913
1914         if(last_smb_conf_reload_time == 0) {
1915                 last_smb_conf_reload_time = t;
1916                 /* Our printing subsystem might not be ready at smbd start up.
1917                    Then no printer is available till the first printers check
1918                    is performed.  A lower initial interval circumvents this. */
1919                 if ( printcap_cache_time > 60 )
1920                         last_printer_reload_time = t - printcap_cache_time + 60;
1921                 else
1922                         last_printer_reload_time = t;
1923         }
1924
1925         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1926                 /* randomize over 60 second the printcap reload to avoid all
1927                  * process hitting cupsd at the same time */
1928                 int time_range = 60;
1929
1930                 last_printer_reload_time += random() % time_range;
1931                 mypid = getpid();
1932         }
1933
1934         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1935                 reload_services(True);
1936                 reload_after_sighup = False;
1937                 last_smb_conf_reload_time = t;
1938         }
1939
1940         /* 'printcap cache time = 0' disable the feature */
1941
1942         if ( printcap_cache_time != 0 )
1943         {
1944                 /* see if it's time to reload or if the clock has been set back */
1945
1946                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1947                         || (t-last_printer_reload_time  < 0) )
1948                 {
1949                         DEBUG( 3,( "Printcap cache time expired.\n"));
1950                         reload_printers();
1951                         last_printer_reload_time = t;
1952                 }
1953         }
1954 }
1955
1956 /****************************************************************************
1957  Process any timeout housekeeping. Return False if the caller should exit.
1958 ****************************************************************************/
1959
1960 static bool timeout_processing(int *select_timeout,
1961                                time_t *last_timeout_processing_time)
1962 {
1963         time_t t;
1964
1965         if (*get_srv_read_error() == SMB_READ_EOF) {
1966                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1967                 return false;
1968         }
1969
1970         if (*get_srv_read_error() == SMB_READ_ERROR) {
1971                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1972                         strerror(errno)));
1973                 return false;
1974         }
1975
1976         if (*get_srv_read_error() == SMB_READ_BAD_SIG) {
1977                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1978                 return false;
1979         }
1980
1981         *last_timeout_processing_time = t = time(NULL);
1982
1983         /* become root again if waiting */
1984         change_to_root_user();
1985
1986         /* check if we need to reload services */
1987         check_reload(t);
1988
1989         if(global_machine_password_needs_changing &&
1990                         /* for ADS we need to do a regular ADS password change, not a domain
1991                                         password change */
1992                         lp_security() == SEC_DOMAIN) {
1993
1994                 unsigned char trust_passwd_hash[16];
1995                 time_t lct;
1996
1997                 /*
1998                  * We're in domain level security, and the code that
1999                  * read the machine password flagged that the machine
2000                  * password needs changing.
2001                  */
2002
2003                 /*
2004                  * First, open the machine password file with an exclusive lock.
2005                  */
2006
2007                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
2008                         DEBUG(0,("process: unable to lock the machine account password for \
2009 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
2010                         return True;
2011                 }
2012
2013                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
2014                         DEBUG(0,("process: unable to read the machine account password for \
2015 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
2016                         secrets_lock_trust_account_password(lp_workgroup(), False);
2017                         return True;
2018                 }
2019
2020                 /*
2021                  * Make sure someone else hasn't already done this.
2022                  */
2023
2024                 if(t < lct + lp_machine_password_timeout()) {
2025                         global_machine_password_needs_changing = False;
2026                         secrets_lock_trust_account_password(lp_workgroup(), False);
2027                         return True;
2028                 }
2029
2030                 /* always just contact the PDC here */
2031
2032                 change_trust_account_password( lp_workgroup(), NULL);
2033                 global_machine_password_needs_changing = False;
2034                 secrets_lock_trust_account_password(lp_workgroup(), False);
2035         }
2036
2037         /* update printer queue caches if necessary */
2038
2039         update_monitored_printq_cache();
2040
2041         /*
2042          * Now we are root, check if the log files need pruning.
2043          * Force a log file check.
2044          */
2045         force_check_log_size();
2046         check_log_size();
2047
2048         /* Send any queued printer notify message to interested smbd's. */
2049
2050         print_notify_send_messages(smbd_messaging_context(), 0);
2051
2052         /*
2053          * Modify the select timeout depending upon
2054          * what we have remaining in our queues.
2055          */
2056
2057         *select_timeout = setup_select_timeout();
2058
2059         return True;
2060 }
2061
2062 /****************************************************************************
2063  Process commands from the client
2064 ****************************************************************************/
2065
2066 void smbd_process(void)
2067 {
2068         time_t last_timeout_processing_time = time(NULL);
2069         unsigned int num_smbs = 0;
2070         size_t unread_bytes = 0;
2071
2072         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2073
2074         while (True) {
2075                 int select_timeout = setup_select_timeout();
2076                 int num_echos;
2077                 char *inbuf;
2078                 size_t inbuf_len;
2079                 bool encrypted = false;
2080                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2081
2082                 errno = 0;
2083
2084                 /* Did someone ask for immediate checks on things like blocking locks ? */
2085                 if (select_timeout == 0) {
2086                         if(!timeout_processing(&select_timeout,
2087                                                &last_timeout_processing_time))
2088                                 return;
2089                         num_smbs = 0; /* Reset smb counter. */
2090                 }
2091
2092                 run_events(smbd_event_context(), 0, NULL, NULL);
2093
2094                 while (!receive_message_or_smb(talloc_tos(), &inbuf, &inbuf_len,
2095                                                 select_timeout,
2096                                                 &unread_bytes,
2097                                                 &encrypted)) {
2098                         if(!timeout_processing(&select_timeout,
2099                                                &last_timeout_processing_time))
2100                                 return;
2101                         num_smbs = 0; /* Reset smb counter. */
2102                 }
2103
2104
2105                 /*
2106                  * Ensure we do timeout processing if the SMB we just got was
2107                  * only an echo request. This allows us to set the select
2108                  * timeout in 'receive_message_or_smb()' to any value we like
2109                  * without worrying that the client will send echo requests
2110                  * faster than the select timeout, thus starving out the
2111                  * essential processing (change notify, blocking locks) that
2112                  * the timeout code does. JRA.
2113                  */
2114                 num_echos = smb_echo_count;
2115
2116                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2117
2118                 TALLOC_FREE(inbuf);
2119
2120                 if (smb_echo_count != num_echos) {
2121                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
2122                                 return;
2123                         num_smbs = 0; /* Reset smb counter. */
2124                 }
2125
2126                 num_smbs++;
2127
2128                 /*
2129                  * If we are getting smb requests in a constant stream
2130                  * with no echos, make sure we attempt timeout processing
2131                  * every select_timeout milliseconds - but only check for this
2132                  * every 200 smb requests.
2133                  */
2134
2135                 if ((num_smbs % 200) == 0) {
2136                         time_t new_check_time = time(NULL);
2137                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2138                                 if(!timeout_processing(
2139                                            &select_timeout,
2140                                            &last_timeout_processing_time))
2141                                         return;
2142                                 num_smbs = 0; /* Reset smb counter. */
2143                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2144                         }
2145                 }
2146
2147                 /* The timeout_processing function isn't run nearly
2148                    often enough to implement 'max log size' without
2149                    overrunning the size of the file by many megabytes.
2150                    This is especially true if we are running at debug
2151                    level 10.  Checking every 50 SMBs is a nice
2152                    tradeoff of performance vs log file size overrun. */
2153
2154                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2155                         change_to_root_user();
2156                         check_log_size();
2157                 }
2158                 TALLOC_FREE(frame);
2159         }
2160 }