source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../librpc/gen_ndr/srv_dfs.h"
  24 #include "../librpc/gen_ndr/srv_dssetup.h"
  25 #include "../librpc/gen_ndr/srv_echo.h"
  26 #include "../librpc/gen_ndr/srv_eventlog.h"
  27 #include "../librpc/gen_ndr/srv_initshutdown.h"
  28 #include "../librpc/gen_ndr/srv_lsa.h"
  29 #include "../librpc/gen_ndr/srv_netlogon.h"
  30 #include "../librpc/gen_ndr/srv_ntsvcs.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32 #include "../librpc/gen_ndr/srv_spoolss.h"
  33 #include "../librpc/gen_ndr/srv_srvsvc.h"
  34 #include "../librpc/gen_ndr/srv_svcctl.h"
  35 #include "../librpc/gen_ndr/srv_winreg.h"
  36 #include "../librpc/gen_ndr/srv_wkssvc.h"
  37 #include "librpc/gen_ndr/messaging.h"
  38 #include "printing/nt_printing_migrate.h"
  39
  40 extern bool global_machine_password_needs_changing;
  41
  42 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  43                                    char *outbuf);
  44 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
  45
  46 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  47 {
  48         bool ok;
  49
  50         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  51                 return true;
  52         }
  53
  54         sconn->smb1.echo_handler.ref_count++;
  55
  56         if (sconn->smb1.echo_handler.ref_count > 1) {
  57                 return true;
  58         }
  59
  60         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  61
  62         ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
  63                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  64         if (!ok) {
  65                 return false;
  66         }
  67
  68         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  69
  70         return true;
  71 }
  72
  73 void smbd_lock_socket(struct smbd_server_connection *sconn)
  74 {
  75         if (!smbd_lock_socket_internal(sconn)) {
  76                 exit_server_cleanly("failed to lock socket");
  77         }
  78 }
  79
  80 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  81 {
  82         bool ok;
  83
  84         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  85                 return true;
  86         }
  87
  88         sconn->smb1.echo_handler.ref_count--;
  89
  90         if (sconn->smb1.echo_handler.ref_count > 0) {
  91                 return true;
  92         }
  93
  94         ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
  95                         SMB_F_SETLKW, 0, 0, F_UNLCK);
  96         if (!ok) {
  97                 return false;
  98         }
  99
 100         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 101
 102         return true;
 103 }
 104
 105 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 106 {
 107         if (!smbd_unlock_socket_internal(sconn)) {
 108                 exit_server_cleanly("failed to unlock socket");
 109         }
 110 }
 111
 112 /* Accessor function for smb_read_error for smbd functions. */
 113
 114 /****************************************************************************
 115  Send an smb to a fd.
 116 ****************************************************************************/
 117
 118 bool srv_send_smb(int fd, char *buffer,
 119                   bool do_signing, uint32_t seqnum,
 120                   bool do_encrypt,
 121                   struct smb_perfcount_data *pcd)
 122 {
 123         size_t len = 0;
 124         size_t nwritten=0;
 125         ssize_t ret;
 126         char *buf_out = buffer;
 127
 128         smbd_lock_socket(smbd_server_conn);
 129
 130         if (do_signing) {
 131                 /* Sign the outgoing packet if required. */
 132                 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
 133         }
 134
 135         if (do_encrypt) {
 136                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 137                 if (!NT_STATUS_IS_OK(status)) {
 138                         DEBUG(0, ("send_smb: SMB encryption failed "
 139                                 "on outgoing packet! Error %s\n",
 140                                 nt_errstr(status) ));
 141                         goto out;
 142                 }
 143         }
 144
 145         len = smb_len(buf_out) + 4;
 146
 147         ret = write_data(fd,buf_out+nwritten,len - nwritten);
 148         if (ret <= 0) {
 149                 DEBUG(0,("pid[%d] Error writing %d bytes to client. %d. (%s)\n",
 150                         (int)sys_getpid(), (int)len,(int)ret, strerror(errno) ));
 151                 srv_free_enc_buffer(buf_out);
 152                 goto out;
 153         }
 154
 155         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 156         srv_free_enc_buffer(buf_out);
 157 out:
 158         SMB_PERFCOUNT_END(pcd);
 159
 160         smbd_unlock_socket(smbd_server_conn);
 161         return true;
 162 }
 163
 164 /*******************************************************************
 165  Setup the word count and byte count for a smb message.
 166 ********************************************************************/
 167
 168 int srv_set_message(char *buf,
 169                         int num_words,
 170                         int num_bytes,
 171                         bool zero)
 172 {
 173         if (zero && (num_words || num_bytes)) {
 174                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 175         }
 176         SCVAL(buf,smb_wct,num_words);
 177         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 178         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 179         return (smb_size + num_words*2 + num_bytes);
 180 }
 181
 182 static bool valid_smb_header(const uint8_t *inbuf)
 183 {
 184         if (is_encrypted_packet(inbuf)) {
 185                 return true;
 186         }
 187         /*
 188          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 189          * but it just looks weird to call strncmp for this one.
 190          */
 191         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 192 }
 193
 194 /* Socket functions for smbd packet processing. */
 195
 196 static bool valid_packet_size(size_t len)
 197 {
 198         /*
 199          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 200          * of header. Don't print the error if this fits.... JRA.
 201          */
 202
 203         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 204                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 205                                         (unsigned long)len));
 206                 return false;
 207         }
 208         return true;
 209 }
 210
 211 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 212                                       unsigned int timeout, ssize_t len)
 213 {
 214         if (len <= 0) {
 215                 return NT_STATUS_OK;
 216         }
 217
 218         return read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 219 }
 220
 221 /****************************************************************************
 222  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 223 ****************************************************************************/
 224
 225 /*
 226  * Unfortunately, earlier versions of smbclient/libsmbclient
 227  * don't send this "standard" writeX header. I've fixed this
 228  * for 3.2 but we'll use the old method with earlier versions.
 229  * Windows and CIFSFS at least use this standard size. Not
 230  * sure about MacOSX.
 231  */
 232
 233 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 234                                 (2*14) + /* word count (including bcc) */ \
 235                                 1 /* pad byte */)
 236
 237 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 238                                                     const char lenbuf[4],
 239                                                     int fd, char **buffer,
 240                                                     unsigned int timeout,
 241                                                     size_t *p_unread,
 242                                                     size_t *len_ret)
 243 {
 244         /* Size of a WRITEX call (+4 byte len). */
 245         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 246         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 247         ssize_t toread;
 248         NTSTATUS status;
 249
 250         memcpy(writeX_header, lenbuf, 4);
 251
 252         status = read_fd_with_timeout(
 253                 fd, writeX_header + 4,
 254                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 255                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 256                 timeout, NULL);
 257
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 return status;
 260         }
 261
 262         /*
 263          * Ok - now try and see if this is a possible
 264          * valid writeX call.
 265          */
 266
 267         if (is_valid_writeX_buffer(smbd_server_conn,
 268                                    (uint8_t *)writeX_header)) {
 269                 /*
 270                  * If the data offset is beyond what
 271                  * we've read, drain the extra bytes.
 272                  */
 273                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 274                 ssize_t newlen;
 275
 276                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 277                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 278                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 279                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 280                                         " failed to drain pending bytes");
 281                         }
 282                 } else {
 283                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 284                 }
 285
 286                 /* Spoof down the length and null out the bcc. */
 287                 set_message_bcc(writeX_header, 0);
 288                 newlen = smb_len(writeX_header);
 289
 290                 /* Copy the header we've written. */
 291
 292                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 293                                 writeX_header,
 294                                 sizeof(writeX_header));
 295
 296                 if (*buffer == NULL) {
 297                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 298                                   (int)sizeof(writeX_header)));
 299                         return NT_STATUS_NO_MEMORY;
 300                 }
 301
 302                 /* Work out the remaining bytes. */
 303                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 304                 *len_ret = newlen + 4;
 305                 return NT_STATUS_OK;
 306         }
 307
 308         if (!valid_packet_size(len)) {
 309                 return NT_STATUS_INVALID_PARAMETER;
 310         }
 311
 312         /*
 313          * Not a valid writeX call. Just do the standard
 314          * talloc and return.
 315          */
 316
 317         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 318
 319         if (*buffer == NULL) {
 320                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 321                           (int)len+4));
 322                 return NT_STATUS_NO_MEMORY;
 323         }
 324
 325         /* Copy in what we already read. */
 326         memcpy(*buffer,
 327                 writeX_header,
 328                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 329         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 330
 331         if(toread > 0) {
 332                 status = read_packet_remainder(
 333                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 334                         timeout, toread);
 335
 336                 if (!NT_STATUS_IS_OK(status)) {
 337                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 338                                    nt_errstr(status)));
 339                         return status;
 340                 }
 341         }
 342
 343         *len_ret = len + 4;
 344         return NT_STATUS_OK;
 345 }
 346
 347 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 348                                        char **buffer, unsigned int timeout,
 349                                        size_t *p_unread, size_t *plen)
 350 {
 351         char lenbuf[4];
 352         size_t len;
 353         int min_recv_size = lp_min_receive_file_size();
 354         NTSTATUS status;
 355
 356         *p_unread = 0;
 357
 358         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 359         if (!NT_STATUS_IS_OK(status)) {
 360                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 361                 return status;
 362         }
 363
 364         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 365             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 366                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 367             !srv_is_signing_active(smbd_server_conn) &&
 368             smbd_server_conn->smb1.echo_handler.trusted_fde == NULL) {
 369
 370                 return receive_smb_raw_talloc_partial_read(
 371                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 372         }
 373
 374         if (!valid_packet_size(len)) {
 375                 return NT_STATUS_INVALID_PARAMETER;
 376         }
 377
 378         /*
 379          * The +4 here can't wrap, we've checked the length above already.
 380          */
 381
 382         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 383
 384         if (*buffer == NULL) {
 385                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 386                           (int)len+4));
 387                 return NT_STATUS_NO_MEMORY;
 388         }
 389
 390         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 391
 392         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 393         if (!NT_STATUS_IS_OK(status)) {
 394                 return status;
 395         }
 396
 397         *plen = len + 4;
 398         return NT_STATUS_OK;
 399 }
 400
 401 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 402                                    char **buffer, unsigned int timeout,
 403                                    size_t *p_unread, bool *p_encrypted,
 404                                    size_t *p_len,
 405                                    uint32_t *seqnum,
 406                                    bool trusted_channel)
 407 {
 408         size_t len = 0;
 409         NTSTATUS status;
 410
 411         *p_encrypted = false;
 412
 413         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 414                                         p_unread, &len);
 415         if (!NT_STATUS_IS_OK(status)) {
 416                 return status;
 417         }
 418
 419         if (is_encrypted_packet((uint8_t *)*buffer)) {
 420                 status = srv_decrypt_buffer(*buffer);
 421                 if (!NT_STATUS_IS_OK(status)) {
 422                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 423                                 "incoming packet! Error %s\n",
 424                                 nt_errstr(status) ));
 425                         return status;
 426                 }
 427                 *p_encrypted = true;
 428         }
 429
 430         /* Check the incoming SMB signature. */
 431         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, trusted_channel)) {
 432                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 433                           "incoming packet!\n"));
 434                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 435         }
 436
 437         *p_len = len;
 438         return NT_STATUS_OK;
 439 }
 440
 441 /*
 442  * Initialize a struct smb_request from an inbuf
 443  */
 444
 445 static bool init_smb_request(struct smb_request *req,
 446                              struct smbd_server_connection *sconn,
 447                              const uint8 *inbuf,
 448                              size_t unread_bytes, bool encrypted,
 449                              uint32_t seqnum)
 450 {
 451         size_t req_size = smb_len(inbuf) + 4;
 452         /* Ensure we have at least smb_size bytes. */
 453         if (req_size < smb_size) {
 454                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 455                         (unsigned int)req_size ));
 456                 return false;
 457         }
 458         req->cmd    = CVAL(inbuf, smb_com);
 459         req->flags2 = SVAL(inbuf, smb_flg2);
 460         req->smbpid = SVAL(inbuf, smb_pid);
 461         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 462         req->seqnum = seqnum;
 463         req->vuid   = SVAL(inbuf, smb_uid);
 464         req->tid    = SVAL(inbuf, smb_tid);
 465         req->wct    = CVAL(inbuf, smb_wct);
 466         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 467         req->buflen = smb_buflen(inbuf);
 468         req->buf    = (const uint8_t *)smb_buf(inbuf);
 469         req->unread_bytes = unread_bytes;
 470         req->encrypted = encrypted;
 471         req->sconn = sconn;
 472         req->conn = conn_find(sconn,req->tid);
 473         req->chain_fsp = NULL;
 474         req->chain_outbuf = NULL;
 475         req->done = false;
 476         req->smb2req = NULL;
 477         smb_init_perfcount_data(&req->pcd);
 478
 479         /* Ensure we have at least wct words and 2 bytes of bcc. */
 480         if (smb_size + req->wct*2 > req_size) {
 481                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 482                         (unsigned int)req->wct,
 483                         (unsigned int)req_size));
 484                 return false;
 485         }
 486         /* Ensure bcc is correct. */
 487         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 488                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 489                         "(wct = %u, size %u)\n",
 490                         (unsigned int)req->buflen,
 491                         (unsigned int)req->wct,
 492                         (unsigned int)req_size));
 493                 return false;
 494         }
 495
 496         req->outbuf = NULL;
 497         return true;
 498 }
 499
 500 static void process_smb(struct smbd_server_connection *conn,
 501                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 502                         uint32_t seqnum, bool encrypted,
 503                         struct smb_perfcount_data *deferred_pcd);
 504
 505 static void smbd_deferred_open_timer(struct event_context *ev,
 506                                      struct timed_event *te,
 507                                      struct timeval _tval,
 508                                      void *private_data)
 509 {
 510         struct pending_message_list *msg = talloc_get_type(private_data,
 511                                            struct pending_message_list);
 512         TALLOC_CTX *mem_ctx = talloc_tos();
 513         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 514         uint8_t *inbuf;
 515
 516         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 517                                          msg->buf.length);
 518         if (inbuf == NULL) {
 519                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 520                 return;
 521         }
 522
 523         /* We leave this message on the queue so the open code can
 524            know this is a retry. */
 525         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 526                 (unsigned long long)mid ));
 527
 528         /* Mark the message as processed so this is not
 529          * re-processed in error. */
 530         msg->processed = true;
 531
 532         process_smb(smbd_server_conn, inbuf,
 533                     msg->buf.length, 0,
 534                     msg->seqnum, msg->encrypted, &msg->pcd);
 535
 536         /* If it's still there and was processed, remove it. */
 537         msg = get_deferred_open_message_smb(mid);
 538         if (msg && msg->processed) {
 539                 remove_deferred_open_message_smb(mid);
 540         }
 541 }
 542
 543 /****************************************************************************
 544  Function to push a message onto the tail of a linked list of smb messages ready
 545  for processing.
 546 ****************************************************************************/
 547
 548 static bool push_queued_message(struct smb_request *req,
 549                                 struct timeval request_time,
 550                                 struct timeval end_time,
 551                                 char *private_data, size_t private_len)
 552 {
 553         int msg_len = smb_len(req->inbuf) + 4;
 554         struct pending_message_list *msg;
 555
 556         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 557
 558         if(msg == NULL) {
 559                 DEBUG(0,("push_message: malloc fail (1)\n"));
 560                 return False;
 561         }
 562
 563         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 564         if(msg->buf.data == NULL) {
 565                 DEBUG(0,("push_message: malloc fail (2)\n"));
 566                 TALLOC_FREE(msg);
 567                 return False;
 568         }
 569
 570         msg->request_time = request_time;
 571         msg->seqnum = req->seqnum;
 572         msg->encrypted = req->encrypted;
 573         msg->processed = false;
 574         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 575
 576         if (private_data) {
 577                 msg->private_data = data_blob_talloc(msg, private_data,
 578                                                      private_len);
 579                 if (msg->private_data.data == NULL) {
 580                         DEBUG(0,("push_message: malloc fail (3)\n"));
 581                         TALLOC_FREE(msg);
 582                         return False;
 583                 }
 584         }
 585
 586         msg->te = event_add_timed(smbd_event_context(),
 587                                   msg,
 588                                   end_time,
 589                                   smbd_deferred_open_timer,
 590                                   msg);
 591         if (!msg->te) {
 592                 DEBUG(0,("push_message: event_add_timed failed\n"));
 593                 TALLOC_FREE(msg);
 594                 return false;
 595         }
 596
 597         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 598
 599         DEBUG(10,("push_message: pushed message length %u on "
 600                   "deferred_open_queue\n", (unsigned int)msg_len));
 601
 602         return True;
 603 }
 604
 605 /****************************************************************************
 606  Function to delete a sharing violation open message by mid.
 607 ****************************************************************************/
 608
 609 void remove_deferred_open_message_smb(uint64_t mid)
 610 {
 611         struct pending_message_list *pml;
 612
 613         if (smbd_server_conn->using_smb2) {
 614                 remove_deferred_open_message_smb2(smbd_server_conn, mid);
 615                 return;
 616         }
 617
 618         for (pml = deferred_open_queue; pml; pml = pml->next) {
 619                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 620                         DEBUG(10,("remove_deferred_open_message_smb: "
 621                                   "deleting mid %llu len %u\n",
 622                                   (unsigned long long)mid,
 623                                   (unsigned int)pml->buf.length ));
 624                         DLIST_REMOVE(deferred_open_queue, pml);
 625                         TALLOC_FREE(pml);
 626                         return;
 627                 }
 628         }
 629 }
 630
 631 /****************************************************************************
 632  Move a sharing violation open retry message to the front of the list and
 633  schedule it for immediate processing.
 634 ****************************************************************************/
 635
 636 void schedule_deferred_open_message_smb(uint64_t mid)
 637 {
 638         struct pending_message_list *pml;
 639         int i = 0;
 640
 641         if (smbd_server_conn->using_smb2) {
 642                 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
 643                 return;
 644         }
 645
 646         for (pml = deferred_open_queue; pml; pml = pml->next) {
 647                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 648
 649                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 650                         "msg_mid = %llu\n",
 651                         i++,
 652                         (unsigned long long)msg_mid ));
 653
 654                 if (mid == msg_mid) {
 655                         struct timed_event *te;
 656
 657                         if (pml->processed) {
 658                                 /* A processed message should not be
 659                                  * rescheduled. */
 660                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 661                                         "message mid %llu was already processed\n",
 662                                         (unsigned long long)msg_mid ));
 663                                 continue;
 664                         }
 665
 666                         DEBUG(10,("schedule_deferred_open_message_smb: "
 667                                 "scheduling mid %llu\n",
 668                                 (unsigned long long)mid ));
 669
 670                         te = event_add_timed(smbd_event_context(),
 671                                              pml,
 672                                              timeval_zero(),
 673                                              smbd_deferred_open_timer,
 674                                              pml);
 675                         if (!te) {
 676                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 677                                         "event_add_timed() failed, "
 678                                         "skipping mid %llu\n",
 679                                         (unsigned long long)msg_mid ));
 680                         }
 681
 682                         TALLOC_FREE(pml->te);
 683                         pml->te = te;
 684                         DLIST_PROMOTE(deferred_open_queue, pml);
 685                         return;
 686                 }
 687         }
 688
 689         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 690                 "find message mid %llu\n",
 691                 (unsigned long long)mid ));
 692 }
 693
 694 /****************************************************************************
 695  Return true if this mid is on the deferred queue and was not yet processed.
 696 ****************************************************************************/
 697
 698 bool open_was_deferred(uint64_t mid)
 699 {
 700         struct pending_message_list *pml;
 701
 702         if (smbd_server_conn->using_smb2) {
 703                 return open_was_deferred_smb2(smbd_server_conn, mid);
 704         }
 705
 706         for (pml = deferred_open_queue; pml; pml = pml->next) {
 707                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 708                         return True;
 709                 }
 710         }
 711         return False;
 712 }
 713
 714 /****************************************************************************
 715  Return the message queued by this mid.
 716 ****************************************************************************/
 717
 718 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
 719 {
 720         struct pending_message_list *pml;
 721
 722         for (pml = deferred_open_queue; pml; pml = pml->next) {
 723                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 724                         return pml;
 725                 }
 726         }
 727         return NULL;
 728 }
 729
 730 /****************************************************************************
 731  Get the state data queued by this mid.
 732 ****************************************************************************/
 733
 734 bool get_deferred_open_message_state(struct smb_request *smbreq,
 735                                 struct timeval *p_request_time,
 736                                 void **pp_state)
 737 {
 738         struct pending_message_list *pml;
 739
 740         if (smbd_server_conn->using_smb2) {
 741                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 742                                         p_request_time,
 743                                         pp_state);
 744         }
 745
 746         pml = get_deferred_open_message_smb(smbreq->mid);
 747         if (!pml) {
 748                 return false;
 749         }
 750         if (p_request_time) {
 751                 *p_request_time = pml->request_time;
 752         }
 753         if (pp_state) {
 754                 *pp_state = (void *)pml->private_data.data;
 755         }
 756         return true;
 757 }
 758
 759 /****************************************************************************
 760  Function to push a deferred open smb message onto a linked list of local smb
 761  messages ready for processing.
 762 ****************************************************************************/
 763
 764 bool push_deferred_open_message_smb(struct smb_request *req,
 765                                struct timeval request_time,
 766                                struct timeval timeout,
 767                                struct file_id id,
 768                                char *private_data, size_t priv_len)
 769 {
 770         struct timeval end_time;
 771
 772         if (req->smb2req) {
 773                 return push_deferred_open_message_smb2(req->smb2req,
 774                                                 request_time,
 775                                                 timeout,
 776                                                 id,
 777                                                 private_data,
 778                                                 priv_len);
 779         }
 780
 781         if (req->unread_bytes) {
 782                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 783                         "unread_bytes = %u\n",
 784                         (unsigned int)req->unread_bytes ));
 785                 smb_panic("push_deferred_open_message_smb: "
 786                         "logic error unread_bytes != 0" );
 787         }
 788
 789         end_time = timeval_sum(&request_time, &timeout);
 790
 791         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 792                 "len %u mid %llu timeout time [%u.%06u]\n",
 793                 (unsigned int) smb_len(req->inbuf)+4,
 794                 (unsigned long long)req->mid,
 795                 (unsigned int)end_time.tv_sec,
 796                 (unsigned int)end_time.tv_usec));
 797
 798         return push_queued_message(req, request_time, end_time,
 799                                    private_data, priv_len);
 800 }
 801
 802 struct idle_event {
 803         struct timed_event *te;
 804         struct timeval interval;
 805         char *name;
 806         bool (*handler)(const struct timeval *now, void *private_data);
 807         void *private_data;
 808 };
 809
 810 static void smbd_idle_event_handler(struct event_context *ctx,
 811                                     struct timed_event *te,
 812                                     struct timeval now,
 813                                     void *private_data)
 814 {
 815         struct idle_event *event =
 816                 talloc_get_type_abort(private_data, struct idle_event);
 817
 818         TALLOC_FREE(event->te);
 819
 820         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 821                   event->name, event->te));
 822
 823         if (!event->handler(&now, event->private_data)) {
 824                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 825                           event->name, event->te));
 826                 /* Don't repeat, delete ourselves */
 827                 TALLOC_FREE(event);
 828                 return;
 829         }
 830
 831         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 832                   event->name, event->te));
 833
 834         event->te = event_add_timed(ctx, event,
 835                                     timeval_sum(&now, &event->interval),
 836                                     smbd_idle_event_handler, event);
 837
 838         /* We can't do much but fail here. */
 839         SMB_ASSERT(event->te != NULL);
 840 }
 841
 842 struct idle_event *event_add_idle(struct event_context *event_ctx,
 843                                   TALLOC_CTX *mem_ctx,
 844                                   struct timeval interval,
 845                                   const char *name,
 846                                   bool (*handler)(const struct timeval *now,
 847                                                   void *private_data),
 848                                   void *private_data)
 849 {
 850         struct idle_event *result;
 851         struct timeval now = timeval_current();
 852
 853         result = TALLOC_P(mem_ctx, struct idle_event);
 854         if (result == NULL) {
 855                 DEBUG(0, ("talloc failed\n"));
 856                 return NULL;
 857         }
 858
 859         result->interval = interval;
 860         result->handler = handler;
 861         result->private_data = private_data;
 862
 863         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 864                 DEBUG(0, ("talloc failed\n"));
 865                 TALLOC_FREE(result);
 866                 return NULL;
 867         }
 868
 869         result->te = event_add_timed(event_ctx, result,
 870                                      timeval_sum(&now, &interval),
 871                                      smbd_idle_event_handler, result);
 872         if (result->te == NULL) {
 873                 DEBUG(0, ("event_add_timed failed\n"));
 874                 TALLOC_FREE(result);
 875                 return NULL;
 876         }
 877
 878         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 879         return result;
 880 }
 881
 882 static void smbd_sig_term_handler(struct tevent_context *ev,
 883                                   struct tevent_signal *se,
 884                                   int signum,
 885                                   int count,
 886                                   void *siginfo,
 887                                   void *private_data)
 888 {
 889         exit_server_cleanly("termination signal");
 890 }
 891
 892 void smbd_setup_sig_term_handler(void)
 893 {
 894         struct tevent_signal *se;
 895
 896         se = tevent_add_signal(smbd_event_context(),
 897                                smbd_event_context(),
 898                                SIGTERM, 0,
 899                                smbd_sig_term_handler,
 900                                NULL);
 901         if (!se) {
 902                 exit_server("failed to setup SIGTERM handler");
 903         }
 904 }
 905
 906 static void smbd_sig_hup_handler(struct tevent_context *ev,
 907                                   struct tevent_signal *se,
 908                                   int signum,
 909                                   int count,
 910                                   void *siginfo,
 911                                   void *private_data)
 912 {
 913         struct messaging_context *msg_ctx = talloc_get_type_abort(
 914                 private_data, struct messaging_context);
 915         change_to_root_user();
 916         DEBUG(1,("Reloading services after SIGHUP\n"));
 917         reload_services(msg_ctx, False);
 918 }
 919
 920 void smbd_setup_sig_hup_handler(void)
 921 {
 922         struct tevent_signal *se;
 923
 924         se = tevent_add_signal(smbd_event_context(),
 925                                smbd_event_context(),
 926                                SIGHUP, 0,
 927                                smbd_sig_hup_handler,
 928                                smbd_messaging_context());
 929         if (!se) {
 930                 exit_server("failed to setup SIGHUP handler");
 931         }
 932 }
 933
 934 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 935 {
 936         fd_set r_fds, w_fds;
 937         int selrtn;
 938         struct timeval to;
 939         int maxfd = 0;
 940
 941         to.tv_sec = SMBD_SELECT_TIMEOUT;
 942         to.tv_usec = 0;
 943
 944         /*
 945          * Setup the select fd sets.
 946          */
 947
 948         FD_ZERO(&r_fds);
 949         FD_ZERO(&w_fds);
 950
 951         /*
 952          * Are there any timed events waiting ? If so, ensure we don't
 953          * select for longer than it would take to wait for them.
 954          */
 955
 956         {
 957                 struct timeval now;
 958                 GetTimeOfDay(&now);
 959
 960                 event_add_to_select_args(smbd_event_context(), &now,
 961                                          &r_fds, &w_fds, &to, &maxfd);
 962         }
 963
 964         /* Process a signal and timed events now... */
 965         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 966                 return NT_STATUS_RETRY;
 967         }
 968
 969         {
 970                 int sav;
 971                 START_PROFILE(smbd_idle);
 972
 973                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 974                 sav = errno;
 975
 976                 END_PROFILE(smbd_idle);
 977                 errno = sav;
 978         }
 979
 980         if ((conn->smb1.echo_handler.trusted_fd != -1)
 981             && FD_ISSET(smbd_server_fd(), &r_fds)
 982             && FD_ISSET(conn->smb1.echo_handler.trusted_fd, &r_fds)) {
 983                 /*
 984                  * Prefer to read pending requests from the echo handler. To
 985                  * quote Jeremy (da70f8ab1): This is a hack of monstrous
 986                  * proportions...
 987                  */
 988                 FD_CLR(smbd_server_fd(), &r_fds);
 989         }
 990
 991         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 992                 return NT_STATUS_RETRY;
 993         }
 994
 995         /* Check if error */
 996         if (selrtn == -1) {
 997                 /* something is wrong. Maybe the socket is dead? */
 998                 return map_nt_error_from_unix(errno);
 999         }
1000
1001         /* Did we timeout ? */
1002         if (selrtn == 0) {
1003                 return NT_STATUS_RETRY;
1004         }
1005
1006         /* should not be reached */
1007         return NT_STATUS_INTERNAL_ERROR;
1008 }
1009
1010 /*
1011  * Only allow 5 outstanding trans requests. We're allocating memory, so
1012  * prevent a DoS.
1013  */
1014
1015 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1016 {
1017         int count = 0;
1018         for (; list != NULL; list = list->next) {
1019
1020                 if (list->mid == mid) {
1021                         return NT_STATUS_INVALID_PARAMETER;
1022                 }
1023
1024                 count += 1;
1025         }
1026         if (count > 5) {
1027                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1028         }
1029
1030         return NT_STATUS_OK;
1031 }
1032
1033 /*
1034 These flags determine some of the permissions required to do an operation
1035
1036 Note that I don't set NEED_WRITE on some write operations because they
1037 are used by some brain-dead clients when printing, and I don't want to
1038 force write permissions on print services.
1039 */
1040 #define AS_USER (1<<0)
1041 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1042 #define TIME_INIT (1<<2)
1043 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1044 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1045 #define DO_CHDIR (1<<6)
1046
1047 /*
1048    define a list of possible SMB messages and their corresponding
1049    functions. Any message that has a NULL function is unimplemented -
1050    please feel free to contribute implementations!
1051 */
1052 static const struct smb_message_struct {
1053         const char *name;
1054         void (*fn)(struct smb_request *req);
1055         int flags;
1056 } smb_messages[256] = {
1057
1058 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1059 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1060 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1061 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1062 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1063 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1064 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1065 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1066 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1067 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1068 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1069 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1070 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1071 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1072 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1073 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1074 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1075 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1076 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1077 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1078 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1079 /* 0x15 */ { NULL, NULL, 0 },
1080 /* 0x16 */ { NULL, NULL, 0 },
1081 /* 0x17 */ { NULL, NULL, 0 },
1082 /* 0x18 */ { NULL, NULL, 0 },
1083 /* 0x19 */ { NULL, NULL, 0 },
1084 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1085 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1086 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1087 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1088 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1089 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1090 /* 0x20 */ { "SMBwritec", NULL,0},
1091 /* 0x21 */ { NULL, NULL, 0 },
1092 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1093 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1094 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1095 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1096 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1097 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1098 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1099 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1100 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1101 /* 0x2b */ { "SMBecho",reply_echo,0},
1102 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1103 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1104 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1105 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1106 /* 0x30 */ { NULL, NULL, 0 },
1107 /* 0x31 */ { NULL, NULL, 0 },
1108 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1109 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1110 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1111 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1112 /* 0x36 */ { NULL, NULL, 0 },
1113 /* 0x37 */ { NULL, NULL, 0 },
1114 /* 0x38 */ { NULL, NULL, 0 },
1115 /* 0x39 */ { NULL, NULL, 0 },
1116 /* 0x3a */ { NULL, NULL, 0 },
1117 /* 0x3b */ { NULL, NULL, 0 },
1118 /* 0x3c */ { NULL, NULL, 0 },
1119 /* 0x3d */ { NULL, NULL, 0 },
1120 /* 0x3e */ { NULL, NULL, 0 },
1121 /* 0x3f */ { NULL, NULL, 0 },
1122 /* 0x40 */ { NULL, NULL, 0 },
1123 /* 0x41 */ { NULL, NULL, 0 },
1124 /* 0x42 */ { NULL, NULL, 0 },
1125 /* 0x43 */ { NULL, NULL, 0 },
1126 /* 0x44 */ { NULL, NULL, 0 },
1127 /* 0x45 */ { NULL, NULL, 0 },
1128 /* 0x46 */ { NULL, NULL, 0 },
1129 /* 0x47 */ { NULL, NULL, 0 },
1130 /* 0x48 */ { NULL, NULL, 0 },
1131 /* 0x49 */ { NULL, NULL, 0 },
1132 /* 0x4a */ { NULL, NULL, 0 },
1133 /* 0x4b */ { NULL, NULL, 0 },
1134 /* 0x4c */ { NULL, NULL, 0 },
1135 /* 0x4d */ { NULL, NULL, 0 },
1136 /* 0x4e */ { NULL, NULL, 0 },
1137 /* 0x4f */ { NULL, NULL, 0 },
1138 /* 0x50 */ { NULL, NULL, 0 },
1139 /* 0x51 */ { NULL, NULL, 0 },
1140 /* 0x52 */ { NULL, NULL, 0 },
1141 /* 0x53 */ { NULL, NULL, 0 },
1142 /* 0x54 */ { NULL, NULL, 0 },
1143 /* 0x55 */ { NULL, NULL, 0 },
1144 /* 0x56 */ { NULL, NULL, 0 },
1145 /* 0x57 */ { NULL, NULL, 0 },
1146 /* 0x58 */ { NULL, NULL, 0 },
1147 /* 0x59 */ { NULL, NULL, 0 },
1148 /* 0x5a */ { NULL, NULL, 0 },
1149 /* 0x5b */ { NULL, NULL, 0 },
1150 /* 0x5c */ { NULL, NULL, 0 },
1151 /* 0x5d */ { NULL, NULL, 0 },
1152 /* 0x5e */ { NULL, NULL, 0 },
1153 /* 0x5f */ { NULL, NULL, 0 },
1154 /* 0x60 */ { NULL, NULL, 0 },
1155 /* 0x61 */ { NULL, NULL, 0 },
1156 /* 0x62 */ { NULL, NULL, 0 },
1157 /* 0x63 */ { NULL, NULL, 0 },
1158 /* 0x64 */ { NULL, NULL, 0 },
1159 /* 0x65 */ { NULL, NULL, 0 },
1160 /* 0x66 */ { NULL, NULL, 0 },
1161 /* 0x67 */ { NULL, NULL, 0 },
1162 /* 0x68 */ { NULL, NULL, 0 },
1163 /* 0x69 */ { NULL, NULL, 0 },
1164 /* 0x6a */ { NULL, NULL, 0 },
1165 /* 0x6b */ { NULL, NULL, 0 },
1166 /* 0x6c */ { NULL, NULL, 0 },
1167 /* 0x6d */ { NULL, NULL, 0 },
1168 /* 0x6e */ { NULL, NULL, 0 },
1169 /* 0x6f */ { NULL, NULL, 0 },
1170 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1171 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1172 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1173 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1174 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1175 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1176 /* 0x76 */ { NULL, NULL, 0 },
1177 /* 0x77 */ { NULL, NULL, 0 },
1178 /* 0x78 */ { NULL, NULL, 0 },
1179 /* 0x79 */ { NULL, NULL, 0 },
1180 /* 0x7a */ { NULL, NULL, 0 },
1181 /* 0x7b */ { NULL, NULL, 0 },
1182 /* 0x7c */ { NULL, NULL, 0 },
1183 /* 0x7d */ { NULL, NULL, 0 },
1184 /* 0x7e */ { NULL, NULL, 0 },
1185 /* 0x7f */ { NULL, NULL, 0 },
1186 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1187 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1188 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1189 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1190 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1191 /* 0x85 */ { NULL, NULL, 0 },
1192 /* 0x86 */ { NULL, NULL, 0 },
1193 /* 0x87 */ { NULL, NULL, 0 },
1194 /* 0x88 */ { NULL, NULL, 0 },
1195 /* 0x89 */ { NULL, NULL, 0 },
1196 /* 0x8a */ { NULL, NULL, 0 },
1197 /* 0x8b */ { NULL, NULL, 0 },
1198 /* 0x8c */ { NULL, NULL, 0 },
1199 /* 0x8d */ { NULL, NULL, 0 },
1200 /* 0x8e */ { NULL, NULL, 0 },
1201 /* 0x8f */ { NULL, NULL, 0 },
1202 /* 0x90 */ { NULL, NULL, 0 },
1203 /* 0x91 */ { NULL, NULL, 0 },
1204 /* 0x92 */ { NULL, NULL, 0 },
1205 /* 0x93 */ { NULL, NULL, 0 },
1206 /* 0x94 */ { NULL, NULL, 0 },
1207 /* 0x95 */ { NULL, NULL, 0 },
1208 /* 0x96 */ { NULL, NULL, 0 },
1209 /* 0x97 */ { NULL, NULL, 0 },
1210 /* 0x98 */ { NULL, NULL, 0 },
1211 /* 0x99 */ { NULL, NULL, 0 },
1212 /* 0x9a */ { NULL, NULL, 0 },
1213 /* 0x9b */ { NULL, NULL, 0 },
1214 /* 0x9c */ { NULL, NULL, 0 },
1215 /* 0x9d */ { NULL, NULL, 0 },
1216 /* 0x9e */ { NULL, NULL, 0 },
1217 /* 0x9f */ { NULL, NULL, 0 },
1218 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1219 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1220 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1221 /* 0xa3 */ { NULL, NULL, 0 },
1222 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1223 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1224 /* 0xa6 */ { NULL, NULL, 0 },
1225 /* 0xa7 */ { NULL, NULL, 0 },
1226 /* 0xa8 */ { NULL, NULL, 0 },
1227 /* 0xa9 */ { NULL, NULL, 0 },
1228 /* 0xaa */ { NULL, NULL, 0 },
1229 /* 0xab */ { NULL, NULL, 0 },
1230 /* 0xac */ { NULL, NULL, 0 },
1231 /* 0xad */ { NULL, NULL, 0 },
1232 /* 0xae */ { NULL, NULL, 0 },
1233 /* 0xaf */ { NULL, NULL, 0 },
1234 /* 0xb0 */ { NULL, NULL, 0 },
1235 /* 0xb1 */ { NULL, NULL, 0 },
1236 /* 0xb2 */ { NULL, NULL, 0 },
1237 /* 0xb3 */ { NULL, NULL, 0 },
1238 /* 0xb4 */ { NULL, NULL, 0 },
1239 /* 0xb5 */ { NULL, NULL, 0 },
1240 /* 0xb6 */ { NULL, NULL, 0 },
1241 /* 0xb7 */ { NULL, NULL, 0 },
1242 /* 0xb8 */ { NULL, NULL, 0 },
1243 /* 0xb9 */ { NULL, NULL, 0 },
1244 /* 0xba */ { NULL, NULL, 0 },
1245 /* 0xbb */ { NULL, NULL, 0 },
1246 /* 0xbc */ { NULL, NULL, 0 },
1247 /* 0xbd */ { NULL, NULL, 0 },
1248 /* 0xbe */ { NULL, NULL, 0 },
1249 /* 0xbf */ { NULL, NULL, 0 },
1250 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1251 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1252 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1253 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1254 /* 0xc4 */ { NULL, NULL, 0 },
1255 /* 0xc5 */ { NULL, NULL, 0 },
1256 /* 0xc6 */ { NULL, NULL, 0 },
1257 /* 0xc7 */ { NULL, NULL, 0 },
1258 /* 0xc8 */ { NULL, NULL, 0 },
1259 /* 0xc9 */ { NULL, NULL, 0 },
1260 /* 0xca */ { NULL, NULL, 0 },
1261 /* 0xcb */ { NULL, NULL, 0 },
1262 /* 0xcc */ { NULL, NULL, 0 },
1263 /* 0xcd */ { NULL, NULL, 0 },
1264 /* 0xce */ { NULL, NULL, 0 },
1265 /* 0xcf */ { NULL, NULL, 0 },
1266 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1267 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1268 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1269 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1270 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1271 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1272 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1273 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1274 /* 0xd8 */ { NULL, NULL, 0 },
1275 /* 0xd9 */ { NULL, NULL, 0 },
1276 /* 0xda */ { NULL, NULL, 0 },
1277 /* 0xdb */ { NULL, NULL, 0 },
1278 /* 0xdc */ { NULL, NULL, 0 },
1279 /* 0xdd */ { NULL, NULL, 0 },
1280 /* 0xde */ { NULL, NULL, 0 },
1281 /* 0xdf */ { NULL, NULL, 0 },
1282 /* 0xe0 */ { NULL, NULL, 0 },
1283 /* 0xe1 */ { NULL, NULL, 0 },
1284 /* 0xe2 */ { NULL, NULL, 0 },
1285 /* 0xe3 */ { NULL, NULL, 0 },
1286 /* 0xe4 */ { NULL, NULL, 0 },
1287 /* 0xe5 */ { NULL, NULL, 0 },
1288 /* 0xe6 */ { NULL, NULL, 0 },
1289 /* 0xe7 */ { NULL, NULL, 0 },
1290 /* 0xe8 */ { NULL, NULL, 0 },
1291 /* 0xe9 */ { NULL, NULL, 0 },
1292 /* 0xea */ { NULL, NULL, 0 },
1293 /* 0xeb */ { NULL, NULL, 0 },
1294 /* 0xec */ { NULL, NULL, 0 },
1295 /* 0xed */ { NULL, NULL, 0 },
1296 /* 0xee */ { NULL, NULL, 0 },
1297 /* 0xef */ { NULL, NULL, 0 },
1298 /* 0xf0 */ { NULL, NULL, 0 },
1299 /* 0xf1 */ { NULL, NULL, 0 },
1300 /* 0xf2 */ { NULL, NULL, 0 },
1301 /* 0xf3 */ { NULL, NULL, 0 },
1302 /* 0xf4 */ { NULL, NULL, 0 },
1303 /* 0xf5 */ { NULL, NULL, 0 },
1304 /* 0xf6 */ { NULL, NULL, 0 },
1305 /* 0xf7 */ { NULL, NULL, 0 },
1306 /* 0xf8 */ { NULL, NULL, 0 },
1307 /* 0xf9 */ { NULL, NULL, 0 },
1308 /* 0xfa */ { NULL, NULL, 0 },
1309 /* 0xfb */ { NULL, NULL, 0 },
1310 /* 0xfc */ { NULL, NULL, 0 },
1311 /* 0xfd */ { NULL, NULL, 0 },
1312 /* 0xfe */ { NULL, NULL, 0 },
1313 /* 0xff */ { NULL, NULL, 0 }
1314
1315 };
1316
1317 /*******************************************************************
1318  allocate and initialize a reply packet
1319 ********************************************************************/
1320
1321 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1322                           const char *inbuf, char **outbuf, uint8_t num_words,
1323                           uint32_t num_bytes)
1324 {
1325         /*
1326          * Protect against integer wrap
1327          */
1328         if ((num_bytes > 0xffffff)
1329             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1330                 char *msg;
1331                 if (asprintf(&msg, "num_bytes too large: %u",
1332                              (unsigned)num_bytes) == -1) {
1333                         msg = CONST_DISCARD(char *, "num_bytes too large");
1334                 }
1335                 smb_panic(msg);
1336         }
1337
1338         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1339                                smb_size + num_words*2 + num_bytes);
1340         if (*outbuf == NULL) {
1341                 return false;
1342         }
1343
1344         construct_reply_common(req, inbuf, *outbuf);
1345         srv_set_message(*outbuf, num_words, num_bytes, false);
1346         /*
1347          * Zero out the word area, the caller has to take care of the bcc area
1348          * himself
1349          */
1350         if (num_words != 0) {
1351                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1352         }
1353
1354         return true;
1355 }
1356
1357 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1358 {
1359         char *outbuf;
1360         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1361                            num_bytes)) {
1362                 smb_panic("could not allocate output buffer\n");
1363         }
1364         req->outbuf = (uint8_t *)outbuf;
1365 }
1366
1367
1368 /*******************************************************************
1369  Dump a packet to a file.
1370 ********************************************************************/
1371
1372 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1373 {
1374         int fd, i;
1375         char *fname = NULL;
1376         if (DEBUGLEVEL < 50) {
1377                 return;
1378         }
1379
1380         if (len < 4) len = smb_len(data)+4;
1381         for (i=1;i<100;i++) {
1382                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1383                              type ? "req" : "resp") == -1) {
1384                         return;
1385                 }
1386                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1387                 if (fd != -1 || errno != EEXIST) break;
1388         }
1389         if (fd != -1) {
1390                 ssize_t ret = write(fd, data, len);
1391                 if (ret != len)
1392                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1393                 close(fd);
1394                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1395         }
1396         SAFE_FREE(fname);
1397 }
1398
1399 /****************************************************************************
1400  Prepare everything for calling the actual request function, and potentially
1401  call the request function via the "new" interface.
1402
1403  Return False if the "legacy" function needs to be called, everything is
1404  prepared.
1405
1406  Return True if we're done.
1407
1408  I know this API sucks, but it is the one with the least code change I could
1409  find.
1410 ****************************************************************************/
1411
1412 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1413 {
1414         int flags;
1415         uint16 session_tag;
1416         connection_struct *conn = NULL;
1417         struct smbd_server_connection *sconn = req->sconn;
1418
1419         errno = 0;
1420
1421         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1422          * so subtract 4 from it. */
1423         if (!valid_smb_header(req->inbuf)
1424             || (size < (smb_size - 4))) {
1425                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1426                          smb_len(req->inbuf)));
1427                 exit_server_cleanly("Non-SMB packet");
1428         }
1429
1430         if (smb_messages[type].fn == NULL) {
1431                 DEBUG(0,("Unknown message type %d!\n",type));
1432                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1433                 reply_unknown_new(req, type);
1434                 return NULL;
1435         }
1436
1437         flags = smb_messages[type].flags;
1438
1439         /* In share mode security we must ignore the vuid. */
1440         session_tag = (lp_security() == SEC_SHARE)
1441                 ? UID_FIELD_INVALID : req->vuid;
1442         conn = req->conn;
1443
1444         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1445                  (int)sys_getpid(), (unsigned long)conn));
1446
1447         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1448
1449         /* Ensure this value is replaced in the incoming packet. */
1450         SSVAL(req->inbuf,smb_uid,session_tag);
1451
1452         /*
1453          * Ensure the correct username is in current_user_info.  This is a
1454          * really ugly bugfix for problems with multiple session_setup_and_X's
1455          * being done and allowing %U and %G substitutions to work correctly.
1456          * There is a reason this code is done here, don't move it unless you
1457          * know what you're doing... :-).
1458          * JRA.
1459          */
1460
1461         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1462                 user_struct *vuser = NULL;
1463
1464                 sconn->smb1.sessions.last_session_tag = session_tag;
1465                 if(session_tag != UID_FIELD_INVALID) {
1466                         vuser = get_valid_user_struct(sconn, session_tag);
1467                         if (vuser) {
1468                                 set_current_user_info(
1469                                         vuser->server_info->sanitized_username,
1470                                         vuser->server_info->unix_name,
1471                                         vuser->server_info->info3->base.domain.string);
1472                         }
1473                 }
1474         }
1475
1476         /* Does this call need to be run as the connected user? */
1477         if (flags & AS_USER) {
1478
1479                 /* Does this call need a valid tree connection? */
1480                 if (!conn) {
1481                         /*
1482                          * Amazingly, the error code depends on the command
1483                          * (from Samba4).
1484                          */
1485                         if (type == SMBntcreateX) {
1486                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1487                         } else {
1488                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1489                         }
1490                         return NULL;
1491                 }
1492
1493                 if (!change_to_user(conn,session_tag)) {
1494                         DEBUG(0, ("Error: Could not change to user. Removing "
1495                                 "deferred open, mid=%llu.\n",
1496                                 (unsigned long long)req->mid));
1497                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1498                         return conn;
1499                 }
1500
1501                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1502
1503                 /* Does it need write permission? */
1504                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1505                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1506                         return conn;
1507                 }
1508
1509                 /* IPC services are limited */
1510                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1511                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1512                         return conn;
1513                 }
1514         } else {
1515                 /* This call needs to be run as root */
1516                 change_to_root_user();
1517         }
1518
1519         /* load service specific parameters */
1520         if (conn) {
1521                 if (req->encrypted) {
1522                         conn->encrypted_tid = true;
1523                         /* encrypted required from now on. */
1524                         conn->encrypt_level = Required;
1525                 } else if (ENCRYPTION_REQUIRED(conn)) {
1526                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1527                                 exit_server_cleanly("encryption required "
1528                                         "on connection");
1529                                 return conn;
1530                         }
1531                 }
1532
1533                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1534                                          (flags & (AS_USER|DO_CHDIR)
1535                                           ?True:False))) {
1536                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1537                         return conn;
1538                 }
1539                 conn->num_smb_operations++;
1540         }
1541
1542         /* does this protocol need to be run as guest? */
1543         if ((flags & AS_GUEST)
1544             && (!change_to_guest() ||
1545                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1546                               lp_hostsdeny(-1)))) {
1547                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1548                 return conn;
1549         }
1550
1551         smb_messages[type].fn(req);
1552         return req->conn;
1553 }
1554
1555 /****************************************************************************
1556  Construct a reply to the incoming packet.
1557 ****************************************************************************/
1558
1559 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1560                             uint32_t seqnum, bool encrypted,
1561                             struct smb_perfcount_data *deferred_pcd)
1562 {
1563         connection_struct *conn;
1564         struct smb_request *req;
1565
1566         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1567                 smb_panic("could not allocate smb_request");
1568         }
1569
1570         if (!init_smb_request(req, smbd_server_conn, (uint8 *)inbuf,
1571                               unread_bytes, encrypted, seqnum)) {
1572                 exit_server_cleanly("Invalid SMB request");
1573         }
1574
1575         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1576
1577         /* we popped this message off the queue - keep original perf data */
1578         if (deferred_pcd)
1579                 req->pcd = *deferred_pcd;
1580         else {
1581                 SMB_PERFCOUNT_START(&req->pcd);
1582                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1583                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1584         }
1585
1586         conn = switch_message(req->cmd, req, size);
1587
1588         if (req->unread_bytes) {
1589                 /* writeX failed. drain socket. */
1590                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1591                                 req->unread_bytes) {
1592                         smb_panic("failed to drain pending bytes");
1593                 }
1594                 req->unread_bytes = 0;
1595         }
1596
1597         if (req->done) {
1598                 TALLOC_FREE(req);
1599                 return;
1600         }
1601
1602         if (req->outbuf == NULL) {
1603                 return;
1604         }
1605
1606         if (CVAL(req->outbuf,0) == 0) {
1607                 show_msg((char *)req->outbuf);
1608         }
1609
1610         if (!srv_send_smb(smbd_server_fd(),
1611                         (char *)req->outbuf,
1612                         true, req->seqnum+1,
1613                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1614                         &req->pcd)) {
1615                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1616         }
1617
1618         TALLOC_FREE(req);
1619
1620         return;
1621 }
1622
1623 /****************************************************************************
1624  Process an smb from the client
1625 ****************************************************************************/
1626 static void process_smb(struct smbd_server_connection *conn,
1627                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1628                         uint32_t seqnum, bool encrypted,
1629                         struct smb_perfcount_data *deferred_pcd)
1630 {
1631         int msg_type = CVAL(inbuf,0);
1632
1633         DO_PROFILE_INC(smb_count);
1634
1635         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1636                     smb_len(inbuf) ) );
1637         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1638                                 (int)nread,
1639                                 (unsigned int)unread_bytes ));
1640
1641         if (msg_type != 0) {
1642                 /*
1643                  * NetBIOS session request, keepalive, etc.
1644                  */
1645                 reply_special(conn, (char *)inbuf);
1646                 goto done;
1647         }
1648
1649         if (smbd_server_conn->using_smb2) {
1650                 /* At this point we're not really using smb2,
1651                  * we make the decision here.. */
1652                 if (smbd_is_smb2_header(inbuf, nread)) {
1653                         smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1654                         return;
1655                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1656                                 && CVAL(inbuf, smb_com) != 0x72) {
1657                         /* This is a non-negprot SMB1 packet.
1658                            Disable SMB2 from now on. */
1659                         smbd_server_conn->using_smb2 = false;
1660                 }
1661         }
1662
1663         show_msg((char *)inbuf);
1664
1665         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1666         trans_num++;
1667
1668 done:
1669         conn->smb1.num_requests++;
1670
1671         /* The timeout_processing function isn't run nearly
1672            often enough to implement 'max log size' without
1673            overrunning the size of the file by many megabytes.
1674            This is especially true if we are running at debug
1675            level 10.  Checking every 50 SMBs is a nice
1676            tradeoff of performance vs log file size overrun. */
1677
1678         if ((conn->smb1.num_requests % 50) == 0 &&
1679             need_to_check_log_size()) {
1680                 change_to_root_user();
1681                 check_log_size();
1682         }
1683 }
1684
1685 /****************************************************************************
1686  Return a string containing the function name of a SMB command.
1687 ****************************************************************************/
1688
1689 const char *smb_fn_name(int type)
1690 {
1691         const char *unknown_name = "SMBunknown";
1692
1693         if (smb_messages[type].name == NULL)
1694                 return(unknown_name);
1695
1696         return(smb_messages[type].name);
1697 }
1698
1699 /****************************************************************************
1700  Helper functions for contruct_reply.
1701 ****************************************************************************/
1702
1703 void add_to_common_flags2(uint32 v)
1704 {
1705         common_flags2 |= v;
1706 }
1707
1708 void remove_from_common_flags2(uint32 v)
1709 {
1710         common_flags2 &= ~v;
1711 }
1712
1713 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1714                                    char *outbuf)
1715 {
1716         srv_set_message(outbuf,0,0,false);
1717
1718         SCVAL(outbuf, smb_com, req->cmd);
1719         SIVAL(outbuf,smb_rcls,0);
1720         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1721         SSVAL(outbuf,smb_flg2,
1722                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1723                 common_flags2);
1724         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1725
1726         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1727         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1728         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1729         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1730 }
1731
1732 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1733 {
1734         construct_reply_common(req, (char *)req->inbuf, outbuf);
1735 }
1736
1737 /*
1738  * How many bytes have we already accumulated up to the current wct field
1739  * offset?
1740  */
1741
1742 size_t req_wct_ofs(struct smb_request *req)
1743 {
1744         size_t buf_size;
1745
1746         if (req->chain_outbuf == NULL) {
1747                 return smb_wct - 4;
1748         }
1749         buf_size = talloc_get_size(req->chain_outbuf);
1750         if ((buf_size % 4) != 0) {
1751                 buf_size += (4 - (buf_size % 4));
1752         }
1753         return buf_size - 4;
1754 }
1755
1756 /*
1757  * Hack around reply_nterror & friends not being aware of chained requests,
1758  * generating illegal (i.e. wct==0) chain replies.
1759  */
1760
1761 static void fixup_chain_error_packet(struct smb_request *req)
1762 {
1763         uint8_t *outbuf = req->outbuf;
1764         req->outbuf = NULL;
1765         reply_outbuf(req, 2, 0);
1766         memcpy(req->outbuf, outbuf, smb_wct);
1767         TALLOC_FREE(outbuf);
1768         SCVAL(req->outbuf, smb_vwv0, 0xff);
1769 }
1770
1771 /**
1772  * @brief Find the smb_cmd offset of the last command pushed
1773  * @param[in] buf       The buffer we're building up
1774  * @retval              Where can we put our next andx cmd?
1775  *
1776  * While chaining requests, the "next" request we're looking at needs to put
1777  * its SMB_Command before the data the previous request already built up added
1778  * to the chain. Find the offset to the place where we have to put our cmd.
1779  */
1780
1781 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1782 {
1783         uint8_t cmd;
1784         size_t ofs;
1785
1786         cmd = CVAL(buf, smb_com);
1787
1788         SMB_ASSERT(is_andx_req(cmd));
1789
1790         ofs = smb_vwv0;
1791
1792         while (CVAL(buf, ofs) != 0xff) {
1793
1794                 if (!is_andx_req(CVAL(buf, ofs))) {
1795                         return false;
1796                 }
1797
1798                 /*
1799                  * ofs is from start of smb header, so add the 4 length
1800                  * bytes. The next cmd is right after the wct field.
1801                  */
1802                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1803
1804                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1805         }
1806
1807         *pofs = ofs;
1808         return true;
1809 }
1810
1811 /**
1812  * @brief Do the smb chaining at a buffer level
1813  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1814  * @param[in] smb_command       The command that we want to issue
1815  * @param[in] wct               How many words?
1816  * @param[in] vwv               The words, already in network order
1817  * @param[in] bytes_alignment   How shall we align "bytes"?
1818  * @param[in] num_bytes         How many bytes?
1819  * @param[in] bytes             The data the request ships
1820  *
1821  * smb_splice_chain() adds the vwv and bytes to the request already present in
1822  * *poutbuf.
1823  */
1824
1825 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1826                              uint8_t wct, const uint16_t *vwv,
1827                              size_t bytes_alignment,
1828                              uint32_t num_bytes, const uint8_t *bytes)
1829 {
1830         uint8_t *outbuf;
1831         size_t old_size, new_size;
1832         size_t ofs;
1833         size_t chain_padding = 0;
1834         size_t bytes_padding = 0;
1835         bool first_request;
1836
1837         old_size = talloc_get_size(*poutbuf);
1838
1839         /*
1840          * old_size == smb_wct means we're pushing the first request in for
1841          * libsmb/
1842          */
1843
1844         first_request = (old_size == smb_wct);
1845
1846         if (!first_request && ((old_size % 4) != 0)) {
1847                 /*
1848                  * Align the wct field of subsequent requests to a 4-byte
1849                  * boundary
1850                  */
1851                 chain_padding = 4 - (old_size % 4);
1852         }
1853
1854         /*
1855          * After the old request comes the new wct field (1 byte), the vwv's
1856          * and the num_bytes field. After at we might need to align the bytes
1857          * given to us to "bytes_alignment", increasing the num_bytes value.
1858          */
1859
1860         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1861
1862         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1863                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1864         }
1865
1866         new_size += bytes_padding + num_bytes;
1867
1868         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1869                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1870                           (unsigned)new_size));
1871                 return false;
1872         }
1873
1874         outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1875         if (outbuf == NULL) {
1876                 DEBUG(0, ("talloc failed\n"));
1877                 return false;
1878         }
1879         *poutbuf = outbuf;
1880
1881         if (first_request) {
1882                 SCVAL(outbuf, smb_com, smb_command);
1883         } else {
1884                 size_t andx_cmd_ofs;
1885
1886                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1887                         DEBUG(1, ("invalid command chain\n"));
1888                         *poutbuf = TALLOC_REALLOC_ARRAY(
1889                                 NULL, *poutbuf, uint8_t, old_size);
1890                         return false;
1891                 }
1892
1893                 if (chain_padding != 0) {
1894                         memset(outbuf + old_size, 0, chain_padding);
1895                         old_size += chain_padding;
1896                 }
1897
1898                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1899                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1900         }
1901
1902         ofs = old_size;
1903
1904         /*
1905          * Push the chained request:
1906          *
1907          * wct field
1908          */
1909
1910         SCVAL(outbuf, ofs, wct);
1911         ofs += 1;
1912
1913         /*
1914          * vwv array
1915          */
1916
1917         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1918         ofs += sizeof(uint16_t) * wct;
1919
1920         /*
1921          * bcc (byte count)
1922          */
1923
1924         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1925         ofs += sizeof(uint16_t);
1926
1927         /*
1928          * padding
1929          */
1930
1931         if (bytes_padding != 0) {
1932                 memset(outbuf + ofs, 0, bytes_padding);
1933                 ofs += bytes_padding;
1934         }
1935
1936         /*
1937          * The bytes field
1938          */
1939
1940         memcpy(outbuf + ofs, bytes, num_bytes);
1941
1942         return true;
1943 }
1944
1945 /****************************************************************************
1946  Construct a chained reply and add it to the already made reply
1947 ****************************************************************************/
1948
1949 void chain_reply(struct smb_request *req)
1950 {
1951         size_t smblen = smb_len(req->inbuf);
1952         size_t already_used, length_needed;
1953         uint8_t chain_cmd;
1954         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1955
1956         uint8_t wct;
1957         uint16_t *vwv;
1958         uint16_t buflen;
1959         uint8_t *buf;
1960
1961         if (IVAL(req->outbuf, smb_rcls) != 0) {
1962                 fixup_chain_error_packet(req);
1963         }
1964
1965         /*
1966          * Any of the AndX requests and replies have at least a wct of
1967          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1968          * beginning of the SMB header to the next wct field.
1969          *
1970          * None of the AndX requests put anything valuable in vwv[0] and [1],
1971          * so we can overwrite it here to form the chain.
1972          */
1973
1974         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1975                 if (req->chain_outbuf == NULL) {
1976                         req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1977                                 req, req->outbuf, uint8_t,
1978                                 smb_len(req->outbuf) + 4);
1979                         if (req->chain_outbuf == NULL) {
1980                                 smb_panic("talloc failed");
1981                         }
1982                 }
1983                 req->outbuf = NULL;
1984                 goto error;
1985         }
1986
1987         /*
1988          * Here we assume that this is the end of the chain. For that we need
1989          * to set "next command" to 0xff and the offset to 0. If we later find
1990          * more commands in the chain, this will be overwritten again.
1991          */
1992
1993         SCVAL(req->outbuf, smb_vwv0, 0xff);
1994         SCVAL(req->outbuf, smb_vwv0+1, 0);
1995         SSVAL(req->outbuf, smb_vwv1, 0);
1996
1997         if (req->chain_outbuf == NULL) {
1998                 /*
1999                  * In req->chain_outbuf we collect all the replies. Start the
2000                  * chain by copying in the first reply.
2001                  *
2002                  * We do the realloc because later on we depend on
2003                  * talloc_get_size to determine the length of
2004                  * chain_outbuf. The reply_xxx routines might have
2005                  * over-allocated (reply_pipe_read_and_X used to be such an
2006                  * example).
2007                  */
2008                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
2009                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
2010                 if (req->chain_outbuf == NULL) {
2011                         smb_panic("talloc failed");
2012                 }
2013                 req->outbuf = NULL;
2014         } else {
2015                 /*
2016                  * Update smb headers where subsequent chained commands
2017                  * may have updated them.
2018                  */
2019                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
2020                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
2021
2022                 if (!smb_splice_chain(&req->chain_outbuf,
2023                                       CVAL(req->outbuf, smb_com),
2024                                       CVAL(req->outbuf, smb_wct),
2025                                       (uint16_t *)(req->outbuf + smb_vwv),
2026                                       0, smb_buflen(req->outbuf),
2027                                       (uint8_t *)smb_buf(req->outbuf))) {
2028                         goto error;
2029                 }
2030                 TALLOC_FREE(req->outbuf);
2031         }
2032
2033         /*
2034          * We use the old request's vwv field to grab the next chained command
2035          * and offset into the chained fields.
2036          */
2037
2038         chain_cmd = CVAL(req->vwv+0, 0);
2039         chain_offset = SVAL(req->vwv+1, 0);
2040
2041         if (chain_cmd == 0xff) {
2042                 /*
2043                  * End of chain, no more requests from the client. So ship the
2044                  * replies.
2045                  */
2046                 smb_setlen((char *)(req->chain_outbuf),
2047                            talloc_get_size(req->chain_outbuf) - 4);
2048
2049                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2050                                   true, req->seqnum+1,
2051                                   IS_CONN_ENCRYPTED(req->conn)
2052                                   ||req->encrypted,
2053                                   &req->pcd)) {
2054                         exit_server_cleanly("chain_reply: srv_send_smb "
2055                                             "failed.");
2056                 }
2057                 TALLOC_FREE(req->chain_outbuf);
2058                 req->done = true;
2059                 return;
2060         }
2061
2062         /* add a new perfcounter for this element of chain */
2063         SMB_PERFCOUNT_ADD(&req->pcd);
2064         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2065         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2066
2067         /*
2068          * Check if the client tries to fool us. The request so far uses the
2069          * space to the end of the byte buffer in the request just
2070          * processed. The chain_offset can't point into that area. If that was
2071          * the case, we could end up with an endless processing of the chain,
2072          * we would always handle the same request.
2073          */
2074
2075         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2076         if (chain_offset < already_used) {
2077                 goto error;
2078         }
2079
2080         /*
2081          * Next check: Make sure the chain offset does not point beyond the
2082          * overall smb request length.
2083          */
2084
2085         length_needed = chain_offset+1; /* wct */
2086         if (length_needed > smblen) {
2087                 goto error;
2088         }
2089
2090         /*
2091          * Now comes the pointer magic. Goal here is to set up req->vwv and
2092          * req->buf correctly again to be able to call the subsequent
2093          * switch_message(). The chain offset (the former vwv[1]) points at
2094          * the new wct field.
2095          */
2096
2097         wct = CVAL(smb_base(req->inbuf), chain_offset);
2098
2099         /*
2100          * Next consistency check: Make the new vwv array fits in the overall
2101          * smb request.
2102          */
2103
2104         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2105         if (length_needed > smblen) {
2106                 goto error;
2107         }
2108         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2109
2110         /*
2111          * Now grab the new byte buffer....
2112          */
2113
2114         buflen = SVAL(vwv+wct, 0);
2115
2116         /*
2117          * .. and check that it fits.
2118          */
2119
2120         length_needed += buflen;
2121         if (length_needed > smblen) {
2122                 goto error;
2123         }
2124         buf = (uint8_t *)(vwv+wct+1);
2125
2126         req->cmd = chain_cmd;
2127         req->wct = wct;
2128         req->vwv = vwv;
2129         req->buflen = buflen;
2130         req->buf = buf;
2131
2132         switch_message(chain_cmd, req, smblen);
2133
2134         if (req->outbuf == NULL) {
2135                 /*
2136                  * This happens if the chained command has suspended itself or
2137                  * if it has called srv_send_smb() itself.
2138                  */
2139                 return;
2140         }
2141
2142         /*
2143          * We end up here if the chained command was not itself chained or
2144          * suspended, but for example a close() command. We now need to splice
2145          * the chained commands' outbuf into the already built up chain_outbuf
2146          * and ship the result.
2147          */
2148         goto done;
2149
2150  error:
2151         /*
2152          * We end up here if there's any error in the chain syntax. Report a
2153          * DOS error, just like Windows does.
2154          */
2155         reply_force_doserror(req, ERRSRV, ERRerror);
2156         fixup_chain_error_packet(req);
2157
2158  done:
2159         /*
2160          * This scary statement intends to set the
2161          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2162          * to the value req->outbuf carries
2163          */
2164         SSVAL(req->chain_outbuf, smb_flg2,
2165               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2166               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2167
2168         /*
2169          * Transfer the error codes from the subrequest to the main one
2170          */
2171         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2172         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2173
2174         if (!smb_splice_chain(&req->chain_outbuf,
2175                               CVAL(req->outbuf, smb_com),
2176                               CVAL(req->outbuf, smb_wct),
2177                               (uint16_t *)(req->outbuf + smb_vwv),
2178                               0, smb_buflen(req->outbuf),
2179                               (uint8_t *)smb_buf(req->outbuf))) {
2180                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2181         }
2182         TALLOC_FREE(req->outbuf);
2183
2184         smb_setlen((char *)(req->chain_outbuf),
2185                    talloc_get_size(req->chain_outbuf) - 4);
2186
2187         show_msg((char *)(req->chain_outbuf));
2188
2189         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2190                           true, req->seqnum+1,
2191                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2192                           &req->pcd)) {
2193                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2194         }
2195         TALLOC_FREE(req->chain_outbuf);
2196         req->done = true;
2197 }
2198
2199 /****************************************************************************
2200  Check if services need reloading.
2201 ****************************************************************************/
2202
2203 void check_reload(time_t t)
2204 {
2205         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2206
2207         if(last_smb_conf_reload_time == 0) {
2208                 last_smb_conf_reload_time = t;
2209                 /* Our printing subsystem might not be ready at smbd start up.
2210                    Then no printer is available till the first printers check
2211                    is performed.  A lower initial interval circumvents this. */
2212                 if ( printcap_cache_time > 60 )
2213                         last_printer_reload_time = t - printcap_cache_time + 60;
2214                 else
2215                         last_printer_reload_time = t;
2216         }
2217
2218         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2219                 /* randomize over 60 second the printcap reload to avoid all
2220                  * process hitting cupsd at the same time */
2221                 int time_range = 60;
2222
2223                 last_printer_reload_time += random() % time_range;
2224                 mypid = getpid();
2225         }
2226
2227         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2228                 reload_services(smbd_messaging_context(), True);
2229                 last_smb_conf_reload_time = t;
2230         }
2231
2232         /* 'printcap cache time = 0' disable the feature */
2233
2234         if ( printcap_cache_time != 0 )
2235         {
2236                 /* see if it's time to reload or if the clock has been set back */
2237
2238                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2239                         || (t-last_printer_reload_time  < 0) )
2240                 {
2241                         DEBUG( 3,( "Printcap cache time expired.\n"));
2242                         reload_printers(smbd_messaging_context());
2243                         last_printer_reload_time = t;
2244                 }
2245         }
2246 }
2247
2248 static bool fd_is_readable(int fd)
2249 {
2250         fd_set fds;
2251         struct timeval timeout = {0, };
2252         int ret;
2253
2254         FD_ZERO(&fds);
2255         FD_SET(fd, &fds);
2256
2257         ret = sys_select(fd+1, &fds, NULL, NULL, &timeout);
2258         if (ret == -1) {
2259                 return false;
2260         }
2261         return FD_ISSET(fd, &fds);
2262 }
2263
2264 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2265 {
2266         /* TODO: make write nonblocking */
2267 }
2268
2269 static void smbd_server_connection_read_handler(
2270         struct smbd_server_connection *conn, int fd)
2271 {
2272         uint8_t *inbuf = NULL;
2273         size_t inbuf_len = 0;
2274         size_t unread_bytes = 0;
2275         bool encrypted = false;
2276         TALLOC_CTX *mem_ctx = talloc_tos();
2277         NTSTATUS status;
2278         uint32_t seqnum;
2279
2280         bool from_client = (smbd_server_fd() == fd)?true:false;
2281
2282         if (from_client) {
2283                 smbd_lock_socket(conn);
2284
2285                 if (!fd_is_readable(smbd_server_fd())) {
2286                         DEBUG(10,("the echo listener was faster\n"));
2287                         smbd_unlock_socket(conn);
2288                         return;
2289                 }
2290
2291                 /* TODO: make this completely nonblocking */
2292                 status = receive_smb_talloc(mem_ctx, fd,
2293                                             (char **)(void *)&inbuf,
2294                                             0, /* timeout */
2295                                             &unread_bytes,
2296                                             &encrypted,
2297                                             &inbuf_len, &seqnum,
2298                                             false /* trusted channel */);
2299                 smbd_unlock_socket(conn);
2300         } else {
2301                 /* TODO: make this completely nonblocking */
2302                 status = receive_smb_talloc(mem_ctx, fd,
2303                                             (char **)(void *)&inbuf,
2304                                             0, /* timeout */
2305                                             &unread_bytes,
2306                                             &encrypted,
2307                                             &inbuf_len, &seqnum,
2308                                             true /* trusted channel */);
2309         }
2310
2311         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2312                 goto process;
2313         }
2314         if (NT_STATUS_IS_ERR(status)) {
2315                 exit_server_cleanly("failed to receive smb request");
2316         }
2317         if (!NT_STATUS_IS_OK(status)) {
2318                 return;
2319         }
2320
2321 process:
2322         process_smb(conn, inbuf, inbuf_len, unread_bytes,
2323                     seqnum, encrypted, NULL);
2324 }
2325
2326 static void smbd_server_connection_handler(struct event_context *ev,
2327                                            struct fd_event *fde,
2328                                            uint16_t flags,
2329                                            void *private_data)
2330 {
2331         struct smbd_server_connection *conn = talloc_get_type(private_data,
2332                                               struct smbd_server_connection);
2333
2334         if (flags & EVENT_FD_WRITE) {
2335                 smbd_server_connection_write_handler(conn);
2336         } else if (flags & EVENT_FD_READ) {
2337                 smbd_server_connection_read_handler(conn, smbd_server_fd());
2338         }
2339 }
2340
2341 static void smbd_server_echo_handler(struct event_context *ev,
2342                                      struct fd_event *fde,
2343                                      uint16_t flags,
2344                                      void *private_data)
2345 {
2346         struct smbd_server_connection *conn = talloc_get_type(private_data,
2347                                               struct smbd_server_connection);
2348
2349         if (flags & EVENT_FD_WRITE) {
2350                 smbd_server_connection_write_handler(conn);
2351         } else if (flags & EVENT_FD_READ) {
2352                 smbd_server_connection_read_handler(
2353                         conn, conn->smb1.echo_handler.trusted_fd);
2354         }
2355 }
2356
2357 /****************************************************************************
2358 received when we should release a specific IP
2359 ****************************************************************************/
2360 static void release_ip(const char *ip, void *priv)
2361 {
2362         char addr[INET6_ADDRSTRLEN];
2363         char *p = addr;
2364
2365         client_socket_addr(get_client_fd(),addr,sizeof(addr));
2366
2367         if (strncmp("::ffff:", addr, 7) == 0) {
2368                 p = addr + 7;
2369         }
2370
2371         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2372                 /* we can't afford to do a clean exit - that involves
2373                    database writes, which would potentially mean we
2374                    are still running after the failover has finished -
2375                    we have to get rid of this process ID straight
2376                    away */
2377                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2378                         ip));
2379                 /* note we must exit with non-zero status so the unclean handler gets
2380                    called in the parent, so that the brl database is tickled */
2381                 _exit(1);
2382         }
2383 }
2384
2385 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2386                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2387 {
2388         release_ip((char *)data->data, NULL);
2389 }
2390
2391 #ifdef CLUSTER_SUPPORT
2392 static int client_get_tcp_info(struct sockaddr_storage *server,
2393                                struct sockaddr_storage *client)
2394 {
2395         socklen_t length;
2396         if (server_fd == -1) {
2397                 return -1;
2398         }
2399         length = sizeof(*server);
2400         if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
2401                 return -1;
2402         }
2403         length = sizeof(*client);
2404         if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
2405                 return -1;
2406         }
2407         return 0;
2408 }
2409 #endif
2410
2411 /*
2412  * Send keepalive packets to our client
2413  */
2414 static bool keepalive_fn(const struct timeval *now, void *private_data)
2415 {
2416         struct smbd_server_connection *sconn = smbd_server_conn;
2417         bool ret;
2418
2419         if (sconn->using_smb2) {
2420                 /* Don't do keepalives on an SMB2 connection. */
2421                 return false;
2422         }
2423
2424         smbd_lock_socket(smbd_server_conn);
2425         ret = send_keepalive(smbd_server_fd());
2426         smbd_unlock_socket(smbd_server_conn);
2427
2428         if (!ret) {
2429                 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2430                 return False;
2431         }
2432         return True;
2433 }
2434
2435 /*
2436  * Do the recurring check if we're idle
2437  */
2438 static bool deadtime_fn(const struct timeval *now, void *private_data)
2439 {
2440         struct smbd_server_connection *sconn =
2441                 (struct smbd_server_connection *)private_data;
2442
2443         if (sconn->using_smb2) {
2444                 /* TODO: implement real idle check */
2445                 if (sconn->smb2.sessions.list) {
2446                         return true;
2447                 }
2448                 DEBUG( 2, ( "Closing idle SMB2 connection\n" ) );
2449                 messaging_send(sconn->msg_ctx, procid_self(),
2450                                MSG_SHUTDOWN, &data_blob_null);
2451                 return false;
2452         }
2453
2454         if ((conn_num_open(sconn) == 0)
2455             || (conn_idle_all(sconn, now->tv_sec))) {
2456                 DEBUG( 2, ( "Closing idle SMB1 connection\n" ) );
2457                 messaging_send(sconn->msg_ctx, procid_self(),
2458                                MSG_SHUTDOWN, &data_blob_null);
2459                 return False;
2460         }
2461
2462         return True;
2463 }
2464
2465 /*
2466  * Do the recurring log file and smb.conf reload checks.
2467  */
2468
2469 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2470 {
2471         change_to_root_user();
2472
2473         /* update printer queue caches if necessary */
2474         update_monitored_printq_cache();
2475
2476         /* check if we need to reload services */
2477         check_reload(time(NULL));
2478
2479         /* Change machine password if neccessary. */
2480         attempt_machine_password_change();
2481
2482         /*
2483          * Force a log file check.
2484          */
2485         force_check_log_size();
2486         check_log_size();
2487         return true;
2488 }
2489
2490 static int create_unlink_tmp(const char *dir)
2491 {
2492         char *fname;
2493         int fd;
2494
2495         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2496         if (fname == NULL) {
2497                 errno = ENOMEM;
2498                 return -1;
2499         }
2500         fd = mkstemp(fname);
2501         if (fd == -1) {
2502                 TALLOC_FREE(fname);
2503                 return -1;
2504         }
2505         if (unlink(fname) == -1) {
2506                 int sys_errno = errno;
2507                 close(fd);
2508                 TALLOC_FREE(fname);
2509                 errno = sys_errno;
2510                 return -1;
2511         }
2512         TALLOC_FREE(fname);
2513         return fd;
2514 }
2515
2516 struct smbd_echo_state {
2517         struct tevent_context *ev;
2518         struct iovec *pending;
2519         struct smbd_server_connection *sconn;
2520         int parent_pipe;
2521
2522         struct tevent_fd *parent_fde;
2523
2524         struct tevent_fd *read_fde;
2525         struct tevent_req *write_req;
2526 };
2527
2528 static void smbd_echo_writer_done(struct tevent_req *req);
2529
2530 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2531 {
2532         int num_pending;
2533
2534         if (state->write_req != NULL) {
2535                 return;
2536         }
2537
2538         num_pending = talloc_array_length(state->pending);
2539         if (num_pending == 0) {
2540                 return;
2541         }
2542
2543         state->write_req = writev_send(state, state->ev, NULL,
2544                                        state->parent_pipe, false,
2545                                        state->pending, num_pending);
2546         if (state->write_req == NULL) {
2547                 DEBUG(1, ("writev_send failed\n"));
2548                 exit(1);
2549         }
2550
2551         talloc_steal(state->write_req, state->pending);
2552         state->pending = NULL;
2553
2554         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2555                                 state);
2556 }
2557
2558 static void smbd_echo_writer_done(struct tevent_req *req)
2559 {
2560         struct smbd_echo_state *state = tevent_req_callback_data(
2561                 req, struct smbd_echo_state);
2562         ssize_t written;
2563         int err;
2564
2565         written = writev_recv(req, &err);
2566         TALLOC_FREE(req);
2567         state->write_req = NULL;
2568         if (written == -1) {
2569                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2570                 exit(1);
2571         }
2572         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2573         smbd_echo_activate_writer(state);
2574 }
2575
2576 static bool smbd_echo_reply(int fd,
2577                             uint8_t *inbuf, size_t inbuf_len,
2578                             uint32_t seqnum)
2579 {
2580         struct smb_request req;
2581         uint16_t num_replies;
2582         size_t out_len;
2583         char *outbuf;
2584         bool ok;
2585
2586         if (inbuf_len < smb_size) {
2587                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2588                 return false;
2589         }
2590         if (!valid_smb_header(inbuf)) {
2591                 DEBUG(10, ("Got invalid SMB header\n"));
2592                 return false;
2593         }
2594
2595         if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2596                               seqnum)) {
2597                 return false;
2598         }
2599         req.inbuf = inbuf;
2600
2601         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2602                    smb_messages[req.cmd].name
2603                    ? smb_messages[req.cmd].name : "unknown"));
2604
2605         if (req.cmd != SMBecho) {
2606                 return false;
2607         }
2608         if (req.wct < 1) {
2609                 return false;
2610         }
2611
2612         num_replies = SVAL(req.vwv+0, 0);
2613         if (num_replies != 1) {
2614                 /* Not a Windows "Hey, you're still there?" request */
2615                 return false;
2616         }
2617
2618         if (!create_outbuf(talloc_tos(), &req, (char *)req.inbuf, &outbuf,
2619                            1, req.buflen)) {
2620                 DEBUG(10, ("create_outbuf failed\n"));
2621                 return false;
2622         }
2623         req.outbuf = (uint8_t *)outbuf;
2624
2625         SSVAL(req.outbuf, smb_vwv0, num_replies);
2626
2627         if (req.buflen > 0) {
2628                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2629         }
2630
2631         out_len = smb_len(req.outbuf) + 4;
2632
2633         ok = srv_send_smb(smbd_server_fd(),
2634                           (char *)outbuf,
2635                           true, seqnum+1,
2636                           false, &req.pcd);
2637         TALLOC_FREE(outbuf);
2638         if (!ok) {
2639                 exit(1);
2640         }
2641
2642         return true;
2643 }
2644
2645 static void smbd_echo_exit(struct tevent_context *ev,
2646                            struct tevent_fd *fde, uint16_t flags,
2647                            void *private_data)
2648 {
2649         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2650         exit(0);
2651 }
2652
2653 static void smbd_echo_reader(struct tevent_context *ev,
2654                              struct tevent_fd *fde, uint16_t flags,
2655                              void *private_data)
2656 {
2657         struct smbd_echo_state *state = talloc_get_type_abort(
2658                 private_data, struct smbd_echo_state);
2659         struct smbd_server_connection *sconn = state->sconn;
2660         size_t unread, num_pending;
2661         NTSTATUS status;
2662         struct iovec *tmp;
2663         uint32_t seqnum = 0;
2664         bool reply;
2665         bool ok;
2666         bool encrypted = false;
2667
2668         ok = smbd_lock_socket_internal(sconn);
2669         if (!ok) {
2670                 DEBUG(0, ("%s: failed to lock socket\n",
2671                         __location__));
2672                 exit(1);
2673         }
2674
2675         if (!fd_is_readable(smbd_server_fd())) {
2676                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2677                           (int)sys_getpid()));
2678                 ok = smbd_unlock_socket_internal(sconn);
2679                 if (!ok) {
2680                         DEBUG(1, ("%s: failed to unlock socket in\n",
2681                                 __location__));
2682                         exit(1);
2683                 }
2684                 return;
2685         }
2686
2687         num_pending = talloc_array_length(state->pending);
2688         tmp = talloc_realloc(state, state->pending, struct iovec,
2689                              num_pending+1);
2690         if (tmp == NULL) {
2691                 DEBUG(1, ("talloc_realloc failed\n"));
2692                 exit(1);
2693         }
2694         state->pending = tmp;
2695
2696         DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2697
2698         status = receive_smb_talloc(state->pending, smbd_server_fd(),
2699                                     (char **)(void *)&state->pending[num_pending].iov_base,
2700                                     0 /* timeout */,
2701                                     &unread,
2702                                     &encrypted,
2703                                     &state->pending[num_pending].iov_len,
2704                                     &seqnum,
2705                                     false /* trusted_channel*/);
2706         if (!NT_STATUS_IS_OK(status)) {
2707                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2708                           (int)sys_getpid(), nt_errstr(status)));
2709                 exit(1);
2710         }
2711
2712         ok = smbd_unlock_socket_internal(sconn);
2713         if (!ok) {
2714                 DEBUG(1, ("%s: failed to unlock socket in\n",
2715                         __location__));
2716                 exit(1);
2717         }
2718
2719         /*
2720          * place the seqnum in the packet so that the main process can reply
2721          * with signing
2722          */
2723         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field, seqnum);
2724         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2725
2726         reply = smbd_echo_reply(smbd_server_fd(),
2727                                 (uint8_t *)state->pending[num_pending].iov_base,
2728                                 state->pending[num_pending].iov_len,
2729                                 seqnum);
2730         if (reply) {
2731                 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2732                 /* no check, shrinking by some bytes does not fail */
2733                 state->pending = talloc_realloc(state, state->pending,
2734                                                 struct iovec,
2735                                                 num_pending);
2736         } else {
2737                 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2738                 smbd_echo_activate_writer(state);
2739         }
2740 }
2741
2742 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2743                            int parent_pipe)
2744 {
2745         struct smbd_echo_state *state;
2746
2747         state = talloc_zero(sconn, struct smbd_echo_state);
2748         if (state == NULL) {
2749                 DEBUG(1, ("talloc failed\n"));
2750                 return;
2751         }
2752         state->sconn = sconn;
2753         state->parent_pipe = parent_pipe;
2754         state->ev = s3_tevent_context_init(state);
2755         if (state->ev == NULL) {
2756                 DEBUG(1, ("tevent_context_init failed\n"));
2757                 TALLOC_FREE(state);
2758                 return;
2759         }
2760         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2761                                         TEVENT_FD_READ, smbd_echo_exit,
2762                                         state);
2763         if (state->parent_fde == NULL) {
2764                 DEBUG(1, ("tevent_add_fd failed\n"));
2765                 TALLOC_FREE(state);
2766                 return;
2767         }
2768         state->read_fde = tevent_add_fd(state->ev, state, smbd_server_fd(),
2769                                         TEVENT_FD_READ, smbd_echo_reader,
2770                                         state);
2771         if (state->read_fde == NULL) {
2772                 DEBUG(1, ("tevent_add_fd failed\n"));
2773                 TALLOC_FREE(state);
2774                 return;
2775         }
2776
2777         while (true) {
2778                 if (tevent_loop_once(state->ev) == -1) {
2779                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2780                                   strerror(errno)));
2781                         break;
2782                 }
2783         }
2784         TALLOC_FREE(state);
2785 }
2786
2787 /*
2788  * Handle SMBecho requests in a forked child process
2789  */
2790 static bool fork_echo_handler(struct smbd_server_connection *sconn)
2791 {
2792         int listener_pipe[2];
2793         int res;
2794         pid_t child;
2795
2796         res = pipe(listener_pipe);
2797         if (res == -1) {
2798                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2799                 return false;
2800         }
2801         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2802         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2803                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2804                 goto fail;
2805         }
2806
2807         child = sys_fork();
2808         if (child == 0) {
2809                 NTSTATUS status;
2810
2811                 close(listener_pipe[0]);
2812
2813                 status = reinit_after_fork(sconn->msg_ctx,
2814                                            smbd_event_context(),
2815                                            procid_self(), false);
2816                 if (!NT_STATUS_IS_OK(status)) {
2817                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2818                                   nt_errstr(status)));
2819                         exit(1);
2820                 }
2821                 smbd_echo_loop(sconn, listener_pipe[1]);
2822                 exit(0);
2823         }
2824         close(listener_pipe[1]);
2825         listener_pipe[1] = -1;
2826         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2827
2828         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2829
2830         /*
2831          * Without smb signing this is the same as the normal smbd
2832          * listener. This needs to change once signing comes in.
2833          */
2834         sconn->smb1.echo_handler.trusted_fde = event_add_fd(smbd_event_context(),
2835                                         sconn,
2836                                         sconn->smb1.echo_handler.trusted_fd,
2837                                         EVENT_FD_READ,
2838                                         smbd_server_echo_handler,
2839                                         sconn);
2840         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2841                 DEBUG(1, ("event_add_fd failed\n"));
2842                 goto fail;
2843         }
2844
2845         return true;
2846
2847 fail:
2848         if (listener_pipe[0] != -1) {
2849                 close(listener_pipe[0]);
2850         }
2851         if (listener_pipe[1] != -1) {
2852                 close(listener_pipe[1]);
2853         }
2854         sconn->smb1.echo_handler.trusted_fd = -1;
2855         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2856                 close(sconn->smb1.echo_handler.socket_lock_fd);
2857         }
2858         sconn->smb1.echo_handler.trusted_fd = -1;
2859         sconn->smb1.echo_handler.socket_lock_fd = -1;
2860         return false;
2861 }
2862
2863 static bool spoolss_init_cb(void *ptr)
2864 {
2865         return nt_printing_tdb_migrate(smbd_messaging_context());
2866 }
2867
2868 /****************************************************************************
2869  Process commands from the client
2870 ****************************************************************************/
2871
2872 void smbd_process(void)
2873 {
2874         TALLOC_CTX *frame = talloc_stackframe();
2875         struct sockaddr_storage ss;
2876         struct sockaddr *sa = NULL;
2877         socklen_t sa_len;
2878         struct tsocket_address *local_address = NULL;
2879         struct tsocket_address *remote_address = NULL;
2880         const char *remaddr = NULL;
2881         int ret;
2882         struct rpc_srv_callbacks spoolss_cb;
2883
2884         if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2885             lp_security() != SEC_SHARE &&
2886             !lp_async_smb_echo_handler()) {
2887                 /*
2888                  * We're not making the desion here,
2889                  * we're just allowing the client
2890                  * to decide between SMB1 and SMB2
2891                  * with the first negprot
2892                  * packet.
2893                  */
2894                 smbd_server_conn->using_smb2 = true;
2895         }
2896
2897         /* Ensure child is set to blocking mode */
2898         set_blocking(smbd_server_fd(),True);
2899
2900         set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2901         set_socket_options(smbd_server_fd(), lp_socket_options());
2902
2903         sa = (struct sockaddr *)(void *)&ss;
2904         sa_len = sizeof(ss);
2905         ret = getpeername(smbd_server_fd(), sa, &sa_len);
2906         if (ret != 0) {
2907                 int level = (errno == ENOTCONN)?2:0;
2908                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2909                 exit_server_cleanly("getpeername() failed.\n");
2910         }
2911         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2912                                                 sa, sa_len,
2913                                                 &remote_address);
2914         if (ret != 0) {
2915                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2916                         __location__, strerror(errno)));
2917                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2918         }
2919
2920         sa = (struct sockaddr *)(void *)&ss;
2921         sa_len = sizeof(ss);
2922         ret = getsockname(smbd_server_fd(), sa, &sa_len);
2923         if (ret != 0) {
2924                 int level = (errno == ENOTCONN)?2:0;
2925                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2926                 exit_server_cleanly("getsockname() failed.\n");
2927         }
2928         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2929                                                 sa, sa_len,
2930                                                 &local_address);
2931         if (ret != 0) {
2932                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2933                         __location__, strerror(errno)));
2934                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2935         }
2936
2937         smbd_server_conn->local_address = local_address;
2938         smbd_server_conn->remote_address = remote_address;
2939
2940         if (tsocket_address_is_inet(remote_address, "ip")) {
2941                 remaddr = tsocket_address_inet_addr_string(
2942                                 smbd_server_conn->remote_address,
2943                                 talloc_tos());
2944                 if (remaddr == NULL) {
2945
2946                 }
2947         } else {
2948                 remaddr = "0.0.0.0";
2949         }
2950
2951         /* this is needed so that we get decent entries
2952            in smbstatus for port 445 connects */
2953         set_remote_machine_name(remaddr, false);
2954         reload_services(smbd_server_conn->msg_ctx, true);
2955
2956         /*
2957          * Before the first packet, check the global hosts allow/ hosts deny
2958          * parameters before doing any parsing of packets passed to us by the
2959          * client. This prevents attacks on our parsing code from hosts not in
2960          * the hosts allow list.
2961          */
2962
2963         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2964                           lp_hostsdeny(-1))) {
2965                 /*
2966                  * send a negative session response "not listening on calling
2967                  * name"
2968                  */
2969                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2970                 DEBUG( 1, ("Connection denied from %s to %s\n",
2971                            tsocket_address_string(remote_address, talloc_tos()),
2972                            tsocket_address_string(local_address, talloc_tos())));
2973                 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2974                                    0, false, NULL);
2975                 exit_server_cleanly("connection denied");
2976         }
2977
2978         DEBUG(10, ("Connection allowed from %s to %s\n",
2979                    tsocket_address_string(remote_address, talloc_tos()),
2980                    tsocket_address_string(local_address, talloc_tos())));
2981
2982         init_modules();
2983
2984         smb_perfcount_init();
2985
2986         if (!init_account_policy()) {
2987                 exit_server("Could not open account policy tdb.\n");
2988         }
2989
2990         if (*lp_rootdir()) {
2991                 if (chroot(lp_rootdir()) != 0) {
2992                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2993                         exit_server("Failed to chroot()");
2994                 }
2995                 if (chdir("/") == -1) {
2996                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2997                         exit_server("Failed to chroot()");
2998                 }
2999                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3000         }
3001
3002         if (!srv_init_signing(smbd_server_conn)) {
3003                 exit_server("Failed to init smb_signing");
3004         }
3005
3006         if (lp_async_smb_echo_handler() && !fork_echo_handler(smbd_server_conn)) {
3007                 exit_server("Failed to fork echo handler");
3008         }
3009
3010         /* Setup oplocks */
3011         if (!init_oplocks(smbd_messaging_context()))
3012                 exit_server("Failed to init oplocks");
3013
3014         /* register our message handlers */
3015         messaging_register(smbd_messaging_context(), NULL,
3016                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3017         messaging_register(smbd_messaging_context(), NULL,
3018                            MSG_SMB_RELEASE_IP, msg_release_ip);
3019         messaging_register(smbd_messaging_context(), NULL,
3020                            MSG_SMB_CLOSE_FILE, msg_close_file);
3021
3022         /*
3023          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3024          * MSGs to all child processes
3025          */
3026         messaging_deregister(smbd_messaging_context(),
3027                              MSG_DEBUG, NULL);
3028         messaging_register(smbd_messaging_context(), NULL,
3029                            MSG_DEBUG, debug_message);
3030
3031         if ((lp_keepalive() != 0)
3032             && !(event_add_idle(smbd_event_context(), NULL,
3033                                 timeval_set(lp_keepalive(), 0),
3034                                 "keepalive", keepalive_fn,
3035                                 NULL))) {
3036                 DEBUG(0, ("Could not add keepalive event\n"));
3037                 exit(1);
3038         }
3039
3040         if (!(event_add_idle(smbd_event_context(), NULL,
3041                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3042                              "deadtime", deadtime_fn, smbd_server_conn))) {
3043                 DEBUG(0, ("Could not add deadtime event\n"));
3044                 exit(1);
3045         }
3046
3047         if (!(event_add_idle(smbd_event_context(), NULL,
3048                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
3049                              "housekeeping", housekeeping_fn, NULL))) {
3050                 DEBUG(0, ("Could not add housekeeping event\n"));
3051                 exit(1);
3052         }
3053
3054 #ifdef CLUSTER_SUPPORT
3055
3056         if (lp_clustering()) {
3057                 /*
3058                  * We need to tell ctdb about our client's TCP
3059                  * connection, so that for failover ctdbd can send
3060                  * tickle acks, triggering a reconnection by the
3061                  * client.
3062                  */
3063
3064                 struct sockaddr_storage srv, clnt;
3065
3066                 if (client_get_tcp_info(&srv, &clnt) == 0) {
3067
3068                         NTSTATUS status;
3069
3070                         status = ctdbd_register_ips(
3071                                 messaging_ctdbd_connection(procid_self()),
3072                                 &srv, &clnt, release_ip, NULL);
3073
3074                         if (!NT_STATUS_IS_OK(status)) {
3075                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3076                                           nt_errstr(status)));
3077                         }
3078                 } else
3079                 {
3080                         DEBUG(0,("Unable to get tcp info for "
3081                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3082                                  strerror(errno)));
3083                 }
3084         }
3085
3086 #endif
3087
3088         smbd_server_conn->nbt.got_session = false;
3089
3090         smbd_server_conn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3091
3092         smbd_server_conn->smb1.sessions.done_sesssetup = false;
3093         smbd_server_conn->smb1.sessions.max_send = BUFFER_SIZE;
3094         smbd_server_conn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3095         /* users from session setup */
3096         smbd_server_conn->smb1.sessions.session_userlist = NULL;
3097         /* workgroup from session setup. */
3098         smbd_server_conn->smb1.sessions.session_workgroup = NULL;
3099         /* this holds info on user ids that are already validated for this VC */
3100         smbd_server_conn->smb1.sessions.validated_users = NULL;
3101         smbd_server_conn->smb1.sessions.next_vuid = VUID_OFFSET;
3102         smbd_server_conn->smb1.sessions.num_validated_vuids = 0;
3103
3104         conn_init(smbd_server_conn);
3105         if (!init_dptrs(smbd_server_conn)) {
3106                 exit_server("init_dptrs() failed");
3107         }
3108
3109         smbd_server_conn->smb1.fde = event_add_fd(smbd_event_context(),
3110                                                   smbd_server_conn,
3111                                                   smbd_server_fd(),
3112                                                   EVENT_FD_READ,
3113                                                   smbd_server_connection_handler,
3114                                                   smbd_server_conn);
3115         if (!smbd_server_conn->smb1.fde) {
3116                 exit_server("failed to create smbd_server_connection fde");
3117         }
3118
3119         /*
3120          * Initialize spoolss with an init function to convert printers first.
3121          * static_init_rpc will try to initialize the spoolss server too but you
3122          * can't register it twice.
3123          */
3124         spoolss_cb.init = spoolss_init_cb;
3125         spoolss_cb.shutdown = NULL;
3126
3127
3128         if (!NT_STATUS_IS_OK(rpc_winreg_init(NULL))) {
3129                 exit(1);
3130         }
3131
3132         if (!NT_STATUS_IS_OK(rpc_spoolss_init(&spoolss_cb))) {
3133                 exit(1);
3134         }
3135
3136         static_init_rpc;
3137
3138         TALLOC_FREE(frame);
3139
3140         while (True) {
3141                 NTSTATUS status;
3142
3143                 frame = talloc_stackframe_pool(8192);
3144
3145                 errno = 0;
3146
3147                 status = smbd_server_connection_loop_once(smbd_server_conn);
3148                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3149                     !NT_STATUS_IS_OK(status)) {
3150                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3151                                   " exiting\n", nt_errstr(status)));
3152                         break;
3153                 }
3154
3155                 TALLOC_FREE(frame);
3156         }
3157
3158         exit_server_cleanly(NULL);
3159 }
3160
3161 bool req_is_in_chain(struct smb_request *req)
3162 {
3163         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
3164                 /*
3165                  * We're right now handling a subsequent request, so we must
3166                  * be in a chain
3167                  */
3168                 return true;
3169         }
3170
3171         if (!is_andx_req(req->cmd)) {
3172                 return false;
3173         }
3174
3175         if (req->wct < 2) {
3176                 /*
3177                  * Okay, an illegal request, but definitely not chained :-)
3178                  */
3179                 return false;
3180         }
3181
3182         return (CVAL(req->vwv+0, 0) != 0xFF);
3183 }