source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42
  43 extern bool global_machine_password_needs_changing;
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct timed_event *te;
  51         struct smb_perfcount_data pcd;
  52         uint32_t seqnum;
  53         bool encrypted;
  54         bool processed;
  55         DATA_BLOB buf;
  56         DATA_BLOB private_data;
  57 };
  58
  59 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  60                                    char *outbuf);
  61 static struct pending_message_list *get_deferred_open_message_smb(
  62         struct smbd_server_connection *sconn, uint64_t mid);
  63
  64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  65 {
  66         bool ok;
  67
  68         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  69                 return true;
  70         }
  71
  72         sconn->smb1.echo_handler.ref_count++;
  73
  74         if (sconn->smb1.echo_handler.ref_count > 1) {
  75                 return true;
  76         }
  77
  78         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  79
  80         do {
  81                 ok = fcntl_lock(
  82                         sconn->smb1.echo_handler.socket_lock_fd,
  83                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  84         } while (!ok && (errno == EINTR));
  85
  86         if (!ok) {
  87                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  88                 return false;
  89         }
  90
  91         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  92
  93         return true;
  94 }
  95
  96 void smbd_lock_socket(struct smbd_server_connection *sconn)
  97 {
  98         if (!smbd_lock_socket_internal(sconn)) {
  99                 exit_server_cleanly("failed to lock socket");
 100         }
 101 }
 102
 103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 104 {
 105         bool ok;
 106
 107         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
 108                 return true;
 109         }
 110
 111         sconn->smb1.echo_handler.ref_count--;
 112
 113         if (sconn->smb1.echo_handler.ref_count > 0) {
 114                 return true;
 115         }
 116
 117         do {
 118                 ok = fcntl_lock(
 119                         sconn->smb1.echo_handler.socket_lock_fd,
 120                         SMB_F_SETLKW, 0, 0, F_UNLCK);
 121         } while (!ok && (errno == EINTR));
 122
 123         if (!ok) {
 124                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 125                 return false;
 126         }
 127
 128         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 129
 130         return true;
 131 }
 132
 133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 134 {
 135         if (!smbd_unlock_socket_internal(sconn)) {
 136                 exit_server_cleanly("failed to unlock socket");
 137         }
 138 }
 139
 140 /* Accessor function for smb_read_error for smbd functions. */
 141
 142 /****************************************************************************
 143  Send an smb to a fd.
 144 ****************************************************************************/
 145
 146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 147                   bool do_signing, uint32_t seqnum,
 148                   bool do_encrypt,
 149                   struct smb_perfcount_data *pcd)
 150 {
 151         size_t len = 0;
 152         size_t nwritten=0;
 153         ssize_t ret;
 154         char *buf_out = buffer;
 155
 156         smbd_lock_socket(sconn);
 157
 158         if (do_signing) {
 159                 /* Sign the outgoing packet if required. */
 160                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 161         }
 162
 163         if (do_encrypt) {
 164                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 165                 if (!NT_STATUS_IS_OK(status)) {
 166                         DEBUG(0, ("send_smb: SMB encryption failed "
 167                                 "on outgoing packet! Error %s\n",
 168                                 nt_errstr(status) ));
 169                         goto out;
 170                 }
 171         }
 172
 173         len = smb_len(buf_out) + 4;
 174
 175         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
 176         if (ret <= 0) {
 177
 178                 char addr[INET6_ADDRSTRLEN];
 179                 /*
 180                  * Try and give an error message saying what
 181                  * client failed.
 182                  */
 183                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 184                          (int)sys_getpid(), (int)len,
 185                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 186                          (int)ret, strerror(errno) ));
 187
 188                 srv_free_enc_buffer(sconn, buf_out);
 189                 goto out;
 190         }
 191
 192         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 193         srv_free_enc_buffer(sconn, buf_out);
 194 out:
 195         SMB_PERFCOUNT_END(pcd);
 196
 197         smbd_unlock_socket(sconn);
 198         return true;
 199 }
 200
 201 /*******************************************************************
 202  Setup the word count and byte count for a smb message.
 203 ********************************************************************/
 204
 205 int srv_set_message(char *buf,
 206                         int num_words,
 207                         int num_bytes,
 208                         bool zero)
 209 {
 210         if (zero && (num_words || num_bytes)) {
 211                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 212         }
 213         SCVAL(buf,smb_wct,num_words);
 214         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 215         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 216         return (smb_size + num_words*2 + num_bytes);
 217 }
 218
 219 static bool valid_smb_header(struct smbd_server_connection *sconn,
 220                              const uint8_t *inbuf)
 221 {
 222         if (is_encrypted_packet(sconn, inbuf)) {
 223                 return true;
 224         }
 225         /*
 226          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 227          * but it just looks weird to call strncmp for this one.
 228          */
 229         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 230 }
 231
 232 /* Socket functions for smbd packet processing. */
 233
 234 static bool valid_packet_size(size_t len)
 235 {
 236         /*
 237          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 238          * of header. Don't print the error if this fits.... JRA.
 239          */
 240
 241         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 242                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 243                                         (unsigned long)len));
 244                 return false;
 245         }
 246         return true;
 247 }
 248
 249 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 250                                       unsigned int timeout, ssize_t len)
 251 {
 252         NTSTATUS status;
 253
 254         if (len <= 0) {
 255                 return NT_STATUS_OK;
 256         }
 257
 258         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 259         if (!NT_STATUS_IS_OK(status)) {
 260                 char addr[INET6_ADDRSTRLEN];
 261                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 262                           "error = %s.\n",
 263                           get_peer_addr(fd, addr, sizeof(addr)),
 264                           nt_errstr(status)));
 265         }
 266         return status;
 267 }
 268
 269 /****************************************************************************
 270  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 271 ****************************************************************************/
 272
 273 /*
 274  * Unfortunately, earlier versions of smbclient/libsmbclient
 275  * don't send this "standard" writeX header. I've fixed this
 276  * for 3.2 but we'll use the old method with earlier versions.
 277  * Windows and CIFSFS at least use this standard size. Not
 278  * sure about MacOSX.
 279  */
 280
 281 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 282                                 (2*14) + /* word count (including bcc) */ \
 283                                 1 /* pad byte */)
 284
 285 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 286                                                     const char lenbuf[4],
 287                                                     struct smbd_server_connection *sconn,
 288                                                     int sock,
 289                                                     char **buffer,
 290                                                     unsigned int timeout,
 291                                                     size_t *p_unread,
 292                                                     size_t *len_ret)
 293 {
 294         /* Size of a WRITEX call (+4 byte len). */
 295         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 296         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 297         ssize_t toread;
 298         NTSTATUS status;
 299
 300         memcpy(writeX_header, lenbuf, 4);
 301
 302         status = read_fd_with_timeout(
 303                 sock, writeX_header + 4,
 304                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 305                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 306                 timeout, NULL);
 307
 308         if (!NT_STATUS_IS_OK(status)) {
 309                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 310                           "error = %s.\n",
 311                           tsocket_address_string(sconn->remote_address,
 312                                                  talloc_tos()),
 313                           nt_errstr(status)));
 314                 return status;
 315         }
 316
 317         /*
 318          * Ok - now try and see if this is a possible
 319          * valid writeX call.
 320          */
 321
 322         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 323                 /*
 324                  * If the data offset is beyond what
 325                  * we've read, drain the extra bytes.
 326                  */
 327                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 328                 ssize_t newlen;
 329
 330                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 331                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 332                         if (drain_socket(sock, drain) != drain) {
 333                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 334                                         " failed to drain pending bytes");
 335                         }
 336                 } else {
 337                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 338                 }
 339
 340                 /* Spoof down the length and null out the bcc. */
 341                 set_message_bcc(writeX_header, 0);
 342                 newlen = smb_len(writeX_header);
 343
 344                 /* Copy the header we've written. */
 345
 346                 *buffer = (char *)talloc_memdup(mem_ctx,
 347                                 writeX_header,
 348                                 sizeof(writeX_header));
 349
 350                 if (*buffer == NULL) {
 351                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 352                                   (int)sizeof(writeX_header)));
 353                         return NT_STATUS_NO_MEMORY;
 354                 }
 355
 356                 /* Work out the remaining bytes. */
 357                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 358                 *len_ret = newlen + 4;
 359                 return NT_STATUS_OK;
 360         }
 361
 362         if (!valid_packet_size(len)) {
 363                 return NT_STATUS_INVALID_PARAMETER;
 364         }
 365
 366         /*
 367          * Not a valid writeX call. Just do the standard
 368          * talloc and return.
 369          */
 370
 371         *buffer = talloc_array(mem_ctx, char, len+4);
 372
 373         if (*buffer == NULL) {
 374                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 375                           (int)len+4));
 376                 return NT_STATUS_NO_MEMORY;
 377         }
 378
 379         /* Copy in what we already read. */
 380         memcpy(*buffer,
 381                 writeX_header,
 382                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 383         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 384
 385         if(toread > 0) {
 386                 status = read_packet_remainder(
 387                         sock,
 388                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 389                         timeout, toread);
 390
 391                 if (!NT_STATUS_IS_OK(status)) {
 392                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 393                                    nt_errstr(status)));
 394                         return status;
 395                 }
 396         }
 397
 398         *len_ret = len + 4;
 399         return NT_STATUS_OK;
 400 }
 401
 402 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 403                                        struct smbd_server_connection *sconn,
 404                                        int sock,
 405                                        char **buffer, unsigned int timeout,
 406                                        size_t *p_unread, size_t *plen)
 407 {
 408         char lenbuf[4];
 409         size_t len;
 410         int min_recv_size = lp_min_receive_file_size();
 411         NTSTATUS status;
 412
 413         *p_unread = 0;
 414
 415         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 416                                                   &len);
 417         if (!NT_STATUS_IS_OK(status)) {
 418                 return status;
 419         }
 420
 421         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 422             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 423                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 424             !srv_is_signing_active(sconn) &&
 425             sconn->smb1.echo_handler.trusted_fde == NULL) {
 426
 427                 return receive_smb_raw_talloc_partial_read(
 428                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 429                         p_unread, plen);
 430         }
 431
 432         if (!valid_packet_size(len)) {
 433                 return NT_STATUS_INVALID_PARAMETER;
 434         }
 435
 436         /*
 437          * The +4 here can't wrap, we've checked the length above already.
 438          */
 439
 440         *buffer = talloc_array(mem_ctx, char, len+4);
 441
 442         if (*buffer == NULL) {
 443                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 444                           (int)len+4));
 445                 return NT_STATUS_NO_MEMORY;
 446         }
 447
 448         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 449
 450         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 451         if (!NT_STATUS_IS_OK(status)) {
 452                 return status;
 453         }
 454
 455         *plen = len + 4;
 456         return NT_STATUS_OK;
 457 }
 458
 459 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 460                                    struct smbd_server_connection *sconn,
 461                                    int sock,
 462                                    char **buffer, unsigned int timeout,
 463                                    size_t *p_unread, bool *p_encrypted,
 464                                    size_t *p_len,
 465                                    uint32_t *seqnum,
 466                                    bool trusted_channel)
 467 {
 468         size_t len = 0;
 469         NTSTATUS status;
 470
 471         *p_encrypted = false;
 472
 473         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 474                                         p_unread, &len);
 475         if (!NT_STATUS_IS_OK(status)) {
 476                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 477                       ("receive_smb_raw_talloc failed for client %s "
 478                        "read error = %s.\n",
 479                        tsocket_address_string(sconn->remote_address,
 480                                               talloc_tos()),
 481                        nt_errstr(status)) );
 482                 return status;
 483         }
 484
 485         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 486                 status = srv_decrypt_buffer(sconn, *buffer);
 487                 if (!NT_STATUS_IS_OK(status)) {
 488                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 489                                 "incoming packet! Error %s\n",
 490                                 nt_errstr(status) ));
 491                         return status;
 492                 }
 493                 *p_encrypted = true;
 494         }
 495
 496         /* Check the incoming SMB signature. */
 497         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 498                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 499                           "incoming packet!\n"));
 500                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 501         }
 502
 503         *p_len = len;
 504         return NT_STATUS_OK;
 505 }
 506
 507 /*
 508  * Initialize a struct smb_request from an inbuf
 509  */
 510
 511 static bool init_smb_request(struct smb_request *req,
 512                              struct smbd_server_connection *sconn,
 513                              const uint8 *inbuf,
 514                              size_t unread_bytes, bool encrypted,
 515                              uint32_t seqnum)
 516 {
 517         size_t req_size = smb_len(inbuf) + 4;
 518         /* Ensure we have at least smb_size bytes. */
 519         if (req_size < smb_size) {
 520                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 521                         (unsigned int)req_size ));
 522                 return false;
 523         }
 524         req->cmd    = CVAL(inbuf, smb_com);
 525         req->flags2 = SVAL(inbuf, smb_flg2);
 526         req->smbpid = SVAL(inbuf, smb_pid);
 527         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 528         req->seqnum = seqnum;
 529         req->vuid   = SVAL(inbuf, smb_uid);
 530         req->tid    = SVAL(inbuf, smb_tid);
 531         req->wct    = CVAL(inbuf, smb_wct);
 532         req->vwv    = discard_const_p(uint16_t, (inbuf+smb_vwv));
 533         req->buflen = smb_buflen(inbuf);
 534         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 535         req->unread_bytes = unread_bytes;
 536         req->encrypted = encrypted;
 537         req->sconn = sconn;
 538         req->conn = conn_find(sconn,req->tid);
 539         req->chain_fsp = NULL;
 540         req->chain_outbuf = NULL;
 541         req->done = false;
 542         req->smb2req = NULL;
 543         smb_init_perfcount_data(&req->pcd);
 544
 545         /* Ensure we have at least wct words and 2 bytes of bcc. */
 546         if (smb_size + req->wct*2 > req_size) {
 547                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 548                         (unsigned int)req->wct,
 549                         (unsigned int)req_size));
 550                 return false;
 551         }
 552         /* Ensure bcc is correct. */
 553         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 554                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 555                         "(wct = %u, size %u)\n",
 556                         (unsigned int)req->buflen,
 557                         (unsigned int)req->wct,
 558                         (unsigned int)req_size));
 559                 return false;
 560         }
 561
 562         req->outbuf = NULL;
 563         return true;
 564 }
 565
 566 static void process_smb(struct smbd_server_connection *conn,
 567                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 568                         uint32_t seqnum, bool encrypted,
 569                         struct smb_perfcount_data *deferred_pcd);
 570
 571 static void smbd_deferred_open_timer(struct event_context *ev,
 572                                      struct timed_event *te,
 573                                      struct timeval _tval,
 574                                      void *private_data)
 575 {
 576         struct pending_message_list *msg = talloc_get_type(private_data,
 577                                            struct pending_message_list);
 578         struct smbd_server_connection *sconn = msg->sconn;
 579         TALLOC_CTX *mem_ctx = talloc_tos();
 580         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 581         uint8_t *inbuf;
 582
 583         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 584                                          msg->buf.length);
 585         if (inbuf == NULL) {
 586                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 587                 return;
 588         }
 589
 590         /* We leave this message on the queue so the open code can
 591            know this is a retry. */
 592         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 593                 (unsigned long long)mid ));
 594
 595         /* Mark the message as processed so this is not
 596          * re-processed in error. */
 597         msg->processed = true;
 598
 599         process_smb(sconn, inbuf,
 600                     msg->buf.length, 0,
 601                     msg->seqnum, msg->encrypted, &msg->pcd);
 602
 603         /* If it's still there and was processed, remove it. */
 604         msg = get_deferred_open_message_smb(sconn, mid);
 605         if (msg && msg->processed) {
 606                 remove_deferred_open_message_smb(sconn, mid);
 607         }
 608 }
 609
 610 /****************************************************************************
 611  Function to push a message onto the tail of a linked list of smb messages ready
 612  for processing.
 613 ****************************************************************************/
 614
 615 static bool push_queued_message(struct smb_request *req,
 616                                 struct timeval request_time,
 617                                 struct timeval end_time,
 618                                 char *private_data, size_t private_len)
 619 {
 620         int msg_len = smb_len(req->inbuf) + 4;
 621         struct pending_message_list *msg;
 622
 623         msg = talloc_zero(NULL, struct pending_message_list);
 624
 625         if(msg == NULL) {
 626                 DEBUG(0,("push_message: malloc fail (1)\n"));
 627                 return False;
 628         }
 629         msg->sconn = req->sconn;
 630
 631         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 632         if(msg->buf.data == NULL) {
 633                 DEBUG(0,("push_message: malloc fail (2)\n"));
 634                 TALLOC_FREE(msg);
 635                 return False;
 636         }
 637
 638         msg->request_time = request_time;
 639         msg->seqnum = req->seqnum;
 640         msg->encrypted = req->encrypted;
 641         msg->processed = false;
 642         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 643
 644         if (private_data) {
 645                 msg->private_data = data_blob_talloc(msg, private_data,
 646                                                      private_len);
 647                 if (msg->private_data.data == NULL) {
 648                         DEBUG(0,("push_message: malloc fail (3)\n"));
 649                         TALLOC_FREE(msg);
 650                         return False;
 651                 }
 652         }
 653
 654         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 655                                    msg,
 656                                    end_time,
 657                                    smbd_deferred_open_timer,
 658                                    msg);
 659         if (!msg->te) {
 660                 DEBUG(0,("push_message: event_add_timed failed\n"));
 661                 TALLOC_FREE(msg);
 662                 return false;
 663         }
 664
 665         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 666                       struct pending_message_list *);
 667
 668         DEBUG(10,("push_message: pushed message length %u on "
 669                   "deferred_open_queue\n", (unsigned int)msg_len));
 670
 671         return True;
 672 }
 673
 674 /****************************************************************************
 675  Function to delete a sharing violation open message by mid.
 676 ****************************************************************************/
 677
 678 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 679                                       uint64_t mid)
 680 {
 681         struct pending_message_list *pml;
 682
 683         if (sconn->using_smb2) {
 684                 remove_deferred_open_message_smb2(sconn, mid);
 685                 return;
 686         }
 687
 688         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 689                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 690                         DEBUG(10,("remove_deferred_open_message_smb: "
 691                                   "deleting mid %llu len %u\n",
 692                                   (unsigned long long)mid,
 693                                   (unsigned int)pml->buf.length ));
 694                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 695                         TALLOC_FREE(pml);
 696                         return;
 697                 }
 698         }
 699 }
 700
 701 /****************************************************************************
 702  Move a sharing violation open retry message to the front of the list and
 703  schedule it for immediate processing.
 704 ****************************************************************************/
 705
 706 void schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 707                                         uint64_t mid)
 708 {
 709         struct pending_message_list *pml;
 710         int i = 0;
 711
 712         if (sconn->using_smb2) {
 713                 schedule_deferred_open_message_smb2(sconn, mid);
 714                 return;
 715         }
 716
 717         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 718                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 719
 720                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 721                         "msg_mid = %llu\n",
 722                         i++,
 723                         (unsigned long long)msg_mid ));
 724
 725                 if (mid == msg_mid) {
 726                         struct timed_event *te;
 727
 728                         if (pml->processed) {
 729                                 /* A processed message should not be
 730                                  * rescheduled. */
 731                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 732                                         "message mid %llu was already processed\n",
 733                                         (unsigned long long)msg_mid ));
 734                                 continue;
 735                         }
 736
 737                         DEBUG(10,("schedule_deferred_open_message_smb: "
 738                                 "scheduling mid %llu\n",
 739                                 (unsigned long long)mid ));
 740
 741                         te = tevent_add_timer(pml->sconn->ev_ctx,
 742                                               pml,
 743                                               timeval_zero(),
 744                                               smbd_deferred_open_timer,
 745                                               pml);
 746                         if (!te) {
 747                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 748                                         "event_add_timed() failed, "
 749                                         "skipping mid %llu\n",
 750                                         (unsigned long long)msg_mid ));
 751                         }
 752
 753                         TALLOC_FREE(pml->te);
 754                         pml->te = te;
 755                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 756                         return;
 757                 }
 758         }
 759
 760         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 761                 "find message mid %llu\n",
 762                 (unsigned long long)mid ));
 763 }
 764
 765 /****************************************************************************
 766  Return true if this mid is on the deferred queue and was not yet processed.
 767 ****************************************************************************/
 768
 769 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 770 {
 771         struct pending_message_list *pml;
 772
 773         if (sconn->using_smb2) {
 774                 return open_was_deferred_smb2(sconn, mid);
 775         }
 776
 777         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 778                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 779                         return True;
 780                 }
 781         }
 782         return False;
 783 }
 784
 785 /****************************************************************************
 786  Return the message queued by this mid.
 787 ****************************************************************************/
 788
 789 static struct pending_message_list *get_deferred_open_message_smb(
 790         struct smbd_server_connection *sconn, uint64_t mid)
 791 {
 792         struct pending_message_list *pml;
 793
 794         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 795                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 796                         return pml;
 797                 }
 798         }
 799         return NULL;
 800 }
 801
 802 /****************************************************************************
 803  Get the state data queued by this mid.
 804 ****************************************************************************/
 805
 806 bool get_deferred_open_message_state(struct smb_request *smbreq,
 807                                 struct timeval *p_request_time,
 808                                 void **pp_state)
 809 {
 810         struct pending_message_list *pml;
 811
 812         if (smbreq->sconn->using_smb2) {
 813                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 814                                         p_request_time,
 815                                         pp_state);
 816         }
 817
 818         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 819         if (!pml) {
 820                 return false;
 821         }
 822         if (p_request_time) {
 823                 *p_request_time = pml->request_time;
 824         }
 825         if (pp_state) {
 826                 *pp_state = (void *)pml->private_data.data;
 827         }
 828         return true;
 829 }
 830
 831 /****************************************************************************
 832  Function to push a deferred open smb message onto a linked list of local smb
 833  messages ready for processing.
 834 ****************************************************************************/
 835
 836 bool push_deferred_open_message_smb(struct smb_request *req,
 837                                struct timeval request_time,
 838                                struct timeval timeout,
 839                                struct file_id id,
 840                                char *private_data, size_t priv_len)
 841 {
 842         struct timeval end_time;
 843
 844         if (req->smb2req) {
 845                 return push_deferred_open_message_smb2(req->smb2req,
 846                                                 request_time,
 847                                                 timeout,
 848                                                 id,
 849                                                 private_data,
 850                                                 priv_len);
 851         }
 852
 853         if (req->unread_bytes) {
 854                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 855                         "unread_bytes = %u\n",
 856                         (unsigned int)req->unread_bytes ));
 857                 smb_panic("push_deferred_open_message_smb: "
 858                         "logic error unread_bytes != 0" );
 859         }
 860
 861         end_time = timeval_sum(&request_time, &timeout);
 862
 863         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 864                 "len %u mid %llu timeout time [%u.%06u]\n",
 865                 (unsigned int) smb_len(req->inbuf)+4,
 866                 (unsigned long long)req->mid,
 867                 (unsigned int)end_time.tv_sec,
 868                 (unsigned int)end_time.tv_usec));
 869
 870         return push_queued_message(req, request_time, end_time,
 871                                    private_data, priv_len);
 872 }
 873
 874 static void smbd_sig_term_handler(struct tevent_context *ev,
 875                                   struct tevent_signal *se,
 876                                   int signum,
 877                                   int count,
 878                                   void *siginfo,
 879                                   void *private_data)
 880 {
 881         exit_server_cleanly("termination signal");
 882 }
 883
 884 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 885 {
 886         struct tevent_signal *se;
 887
 888         se = tevent_add_signal(sconn->ev_ctx,
 889                                sconn,
 890                                SIGTERM, 0,
 891                                smbd_sig_term_handler,
 892                                sconn);
 893         if (!se) {
 894                 exit_server("failed to setup SIGTERM handler");
 895         }
 896 }
 897
 898 static void smbd_sig_hup_handler(struct tevent_context *ev,
 899                                   struct tevent_signal *se,
 900                                   int signum,
 901                                   int count,
 902                                   void *siginfo,
 903                                   void *private_data)
 904 {
 905         struct smbd_server_connection *sconn =
 906                 talloc_get_type_abort(private_data,
 907                 struct smbd_server_connection);
 908
 909         change_to_root_user();
 910         DEBUG(1,("Reloading services after SIGHUP\n"));
 911         reload_services(sconn, conn_snum_used, false);
 912 }
 913
 914 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
 915 {
 916         struct tevent_signal *se;
 917
 918         se = tevent_add_signal(sconn->ev_ctx,
 919                                sconn,
 920                                SIGHUP, 0,
 921                                smbd_sig_hup_handler,
 922                                sconn);
 923         if (!se) {
 924                 exit_server("failed to setup SIGHUP handler");
 925         }
 926 }
 927
 928 static void smbd_conf_updated(struct messaging_context *msg,
 929                               void *private_data,
 930                               uint32_t msg_type,
 931                               struct server_id server_id,
 932                               DATA_BLOB *data)
 933 {
 934         struct smbd_server_connection *sconn =
 935                 talloc_get_type_abort(private_data,
 936                 struct smbd_server_connection);
 937
 938         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
 939                   "updated. Reloading.\n"));
 940         change_to_root_user();
 941         reload_services(sconn, conn_snum_used, false);
 942 }
 943
 944 static NTSTATUS smbd_server_connection_loop_once(struct tevent_context *ev_ctx,
 945                                                  struct smbd_server_connection *conn)
 946 {
 947         int timeout;
 948         int num_pfds = 0;
 949         int ret;
 950         bool retry;
 951
 952         timeout = SMBD_SELECT_TIMEOUT * 1000;
 953
 954         /*
 955          * Are there any timed events waiting ? If so, ensure we don't
 956          * select for longer than it would take to wait for them.
 957          */
 958
 959         event_add_to_poll_args(ev_ctx, conn, &conn->pfds, &num_pfds, &timeout);
 960
 961         /* Process a signal and timed events now... */
 962         if (run_events_poll(ev_ctx, 0, NULL, 0)) {
 963                 return NT_STATUS_RETRY;
 964         }
 965
 966         {
 967                 int sav;
 968                 START_PROFILE(smbd_idle);
 969
 970                 ret = sys_poll(conn->pfds, num_pfds, timeout);
 971                 sav = errno;
 972
 973                 END_PROFILE(smbd_idle);
 974                 errno = sav;
 975         }
 976
 977         if (ret == -1) {
 978                 if (errno == EINTR) {
 979                         return NT_STATUS_RETRY;
 980                 }
 981                 return map_nt_error_from_unix(errno);
 982         }
 983
 984         retry = run_events_poll(ev_ctx, ret, conn->pfds, num_pfds);
 985         if (retry) {
 986                 return NT_STATUS_RETRY;
 987         }
 988
 989         /* Did we timeout ? */
 990         if (ret == 0) {
 991                 return NT_STATUS_RETRY;
 992         }
 993
 994         /* should not be reached */
 995         return NT_STATUS_INTERNAL_ERROR;
 996 }
 997
 998 /*
 999  * Only allow 5 outstanding trans requests. We're allocating memory, so
1000  * prevent a DoS.
1001  */
1002
1003 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1004 {
1005         int count = 0;
1006         for (; list != NULL; list = list->next) {
1007
1008                 if (list->mid == mid) {
1009                         return NT_STATUS_INVALID_PARAMETER;
1010                 }
1011
1012                 count += 1;
1013         }
1014         if (count > 5) {
1015                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1016         }
1017
1018         return NT_STATUS_OK;
1019 }
1020
1021 /*
1022 These flags determine some of the permissions required to do an operation
1023
1024 Note that I don't set NEED_WRITE on some write operations because they
1025 are used by some brain-dead clients when printing, and I don't want to
1026 force write permissions on print services.
1027 */
1028 #define AS_USER (1<<0)
1029 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1030 #define TIME_INIT (1<<2)
1031 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1032 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1033 #define DO_CHDIR (1<<6)
1034
1035 /*
1036    define a list of possible SMB messages and their corresponding
1037    functions. Any message that has a NULL function is unimplemented -
1038    please feel free to contribute implementations!
1039 */
1040 static const struct smb_message_struct {
1041         const char *name;
1042         void (*fn)(struct smb_request *req);
1043         int flags;
1044 } smb_messages[256] = {
1045
1046 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1047 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1048 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1049 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1050 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1051 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1052 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1053 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1054 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1055 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1056 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1057 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1058 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1059 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1060 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1061 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1062 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1063 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1064 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1065 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1066 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1067 /* 0x15 */ { NULL, NULL, 0 },
1068 /* 0x16 */ { NULL, NULL, 0 },
1069 /* 0x17 */ { NULL, NULL, 0 },
1070 /* 0x18 */ { NULL, NULL, 0 },
1071 /* 0x19 */ { NULL, NULL, 0 },
1072 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1073 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1074 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1075 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1076 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1077 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1078 /* 0x20 */ { "SMBwritec", NULL,0},
1079 /* 0x21 */ { NULL, NULL, 0 },
1080 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1081 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1082 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1083 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1084 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1085 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1086 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1087 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1088 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1089 /* 0x2b */ { "SMBecho",reply_echo,0},
1090 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1091 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1092 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1093 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1094 /* 0x30 */ { NULL, NULL, 0 },
1095 /* 0x31 */ { NULL, NULL, 0 },
1096 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1097 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1098 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1099 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1100 /* 0x36 */ { NULL, NULL, 0 },
1101 /* 0x37 */ { NULL, NULL, 0 },
1102 /* 0x38 */ { NULL, NULL, 0 },
1103 /* 0x39 */ { NULL, NULL, 0 },
1104 /* 0x3a */ { NULL, NULL, 0 },
1105 /* 0x3b */ { NULL, NULL, 0 },
1106 /* 0x3c */ { NULL, NULL, 0 },
1107 /* 0x3d */ { NULL, NULL, 0 },
1108 /* 0x3e */ { NULL, NULL, 0 },
1109 /* 0x3f */ { NULL, NULL, 0 },
1110 /* 0x40 */ { NULL, NULL, 0 },
1111 /* 0x41 */ { NULL, NULL, 0 },
1112 /* 0x42 */ { NULL, NULL, 0 },
1113 /* 0x43 */ { NULL, NULL, 0 },
1114 /* 0x44 */ { NULL, NULL, 0 },
1115 /* 0x45 */ { NULL, NULL, 0 },
1116 /* 0x46 */ { NULL, NULL, 0 },
1117 /* 0x47 */ { NULL, NULL, 0 },
1118 /* 0x48 */ { NULL, NULL, 0 },
1119 /* 0x49 */ { NULL, NULL, 0 },
1120 /* 0x4a */ { NULL, NULL, 0 },
1121 /* 0x4b */ { NULL, NULL, 0 },
1122 /* 0x4c */ { NULL, NULL, 0 },
1123 /* 0x4d */ { NULL, NULL, 0 },
1124 /* 0x4e */ { NULL, NULL, 0 },
1125 /* 0x4f */ { NULL, NULL, 0 },
1126 /* 0x50 */ { NULL, NULL, 0 },
1127 /* 0x51 */ { NULL, NULL, 0 },
1128 /* 0x52 */ { NULL, NULL, 0 },
1129 /* 0x53 */ { NULL, NULL, 0 },
1130 /* 0x54 */ { NULL, NULL, 0 },
1131 /* 0x55 */ { NULL, NULL, 0 },
1132 /* 0x56 */ { NULL, NULL, 0 },
1133 /* 0x57 */ { NULL, NULL, 0 },
1134 /* 0x58 */ { NULL, NULL, 0 },
1135 /* 0x59 */ { NULL, NULL, 0 },
1136 /* 0x5a */ { NULL, NULL, 0 },
1137 /* 0x5b */ { NULL, NULL, 0 },
1138 /* 0x5c */ { NULL, NULL, 0 },
1139 /* 0x5d */ { NULL, NULL, 0 },
1140 /* 0x5e */ { NULL, NULL, 0 },
1141 /* 0x5f */ { NULL, NULL, 0 },
1142 /* 0x60 */ { NULL, NULL, 0 },
1143 /* 0x61 */ { NULL, NULL, 0 },
1144 /* 0x62 */ { NULL, NULL, 0 },
1145 /* 0x63 */ { NULL, NULL, 0 },
1146 /* 0x64 */ { NULL, NULL, 0 },
1147 /* 0x65 */ { NULL, NULL, 0 },
1148 /* 0x66 */ { NULL, NULL, 0 },
1149 /* 0x67 */ { NULL, NULL, 0 },
1150 /* 0x68 */ { NULL, NULL, 0 },
1151 /* 0x69 */ { NULL, NULL, 0 },
1152 /* 0x6a */ { NULL, NULL, 0 },
1153 /* 0x6b */ { NULL, NULL, 0 },
1154 /* 0x6c */ { NULL, NULL, 0 },
1155 /* 0x6d */ { NULL, NULL, 0 },
1156 /* 0x6e */ { NULL, NULL, 0 },
1157 /* 0x6f */ { NULL, NULL, 0 },
1158 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1159 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1160 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1161 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1162 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1163 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1164 /* 0x76 */ { NULL, NULL, 0 },
1165 /* 0x77 */ { NULL, NULL, 0 },
1166 /* 0x78 */ { NULL, NULL, 0 },
1167 /* 0x79 */ { NULL, NULL, 0 },
1168 /* 0x7a */ { NULL, NULL, 0 },
1169 /* 0x7b */ { NULL, NULL, 0 },
1170 /* 0x7c */ { NULL, NULL, 0 },
1171 /* 0x7d */ { NULL, NULL, 0 },
1172 /* 0x7e */ { NULL, NULL, 0 },
1173 /* 0x7f */ { NULL, NULL, 0 },
1174 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1175 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1176 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1177 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1178 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1179 /* 0x85 */ { NULL, NULL, 0 },
1180 /* 0x86 */ { NULL, NULL, 0 },
1181 /* 0x87 */ { NULL, NULL, 0 },
1182 /* 0x88 */ { NULL, NULL, 0 },
1183 /* 0x89 */ { NULL, NULL, 0 },
1184 /* 0x8a */ { NULL, NULL, 0 },
1185 /* 0x8b */ { NULL, NULL, 0 },
1186 /* 0x8c */ { NULL, NULL, 0 },
1187 /* 0x8d */ { NULL, NULL, 0 },
1188 /* 0x8e */ { NULL, NULL, 0 },
1189 /* 0x8f */ { NULL, NULL, 0 },
1190 /* 0x90 */ { NULL, NULL, 0 },
1191 /* 0x91 */ { NULL, NULL, 0 },
1192 /* 0x92 */ { NULL, NULL, 0 },
1193 /* 0x93 */ { NULL, NULL, 0 },
1194 /* 0x94 */ { NULL, NULL, 0 },
1195 /* 0x95 */ { NULL, NULL, 0 },
1196 /* 0x96 */ { NULL, NULL, 0 },
1197 /* 0x97 */ { NULL, NULL, 0 },
1198 /* 0x98 */ { NULL, NULL, 0 },
1199 /* 0x99 */ { NULL, NULL, 0 },
1200 /* 0x9a */ { NULL, NULL, 0 },
1201 /* 0x9b */ { NULL, NULL, 0 },
1202 /* 0x9c */ { NULL, NULL, 0 },
1203 /* 0x9d */ { NULL, NULL, 0 },
1204 /* 0x9e */ { NULL, NULL, 0 },
1205 /* 0x9f */ { NULL, NULL, 0 },
1206 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1207 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1208 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1209 /* 0xa3 */ { NULL, NULL, 0 },
1210 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1211 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1212 /* 0xa6 */ { NULL, NULL, 0 },
1213 /* 0xa7 */ { NULL, NULL, 0 },
1214 /* 0xa8 */ { NULL, NULL, 0 },
1215 /* 0xa9 */ { NULL, NULL, 0 },
1216 /* 0xaa */ { NULL, NULL, 0 },
1217 /* 0xab */ { NULL, NULL, 0 },
1218 /* 0xac */ { NULL, NULL, 0 },
1219 /* 0xad */ { NULL, NULL, 0 },
1220 /* 0xae */ { NULL, NULL, 0 },
1221 /* 0xaf */ { NULL, NULL, 0 },
1222 /* 0xb0 */ { NULL, NULL, 0 },
1223 /* 0xb1 */ { NULL, NULL, 0 },
1224 /* 0xb2 */ { NULL, NULL, 0 },
1225 /* 0xb3 */ { NULL, NULL, 0 },
1226 /* 0xb4 */ { NULL, NULL, 0 },
1227 /* 0xb5 */ { NULL, NULL, 0 },
1228 /* 0xb6 */ { NULL, NULL, 0 },
1229 /* 0xb7 */ { NULL, NULL, 0 },
1230 /* 0xb8 */ { NULL, NULL, 0 },
1231 /* 0xb9 */ { NULL, NULL, 0 },
1232 /* 0xba */ { NULL, NULL, 0 },
1233 /* 0xbb */ { NULL, NULL, 0 },
1234 /* 0xbc */ { NULL, NULL, 0 },
1235 /* 0xbd */ { NULL, NULL, 0 },
1236 /* 0xbe */ { NULL, NULL, 0 },
1237 /* 0xbf */ { NULL, NULL, 0 },
1238 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1239 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1240 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1241 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1242 /* 0xc4 */ { NULL, NULL, 0 },
1243 /* 0xc5 */ { NULL, NULL, 0 },
1244 /* 0xc6 */ { NULL, NULL, 0 },
1245 /* 0xc7 */ { NULL, NULL, 0 },
1246 /* 0xc8 */ { NULL, NULL, 0 },
1247 /* 0xc9 */ { NULL, NULL, 0 },
1248 /* 0xca */ { NULL, NULL, 0 },
1249 /* 0xcb */ { NULL, NULL, 0 },
1250 /* 0xcc */ { NULL, NULL, 0 },
1251 /* 0xcd */ { NULL, NULL, 0 },
1252 /* 0xce */ { NULL, NULL, 0 },
1253 /* 0xcf */ { NULL, NULL, 0 },
1254 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1255 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1256 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1257 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1258 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1259 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1260 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1261 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1262 /* 0xd8 */ { NULL, NULL, 0 },
1263 /* 0xd9 */ { NULL, NULL, 0 },
1264 /* 0xda */ { NULL, NULL, 0 },
1265 /* 0xdb */ { NULL, NULL, 0 },
1266 /* 0xdc */ { NULL, NULL, 0 },
1267 /* 0xdd */ { NULL, NULL, 0 },
1268 /* 0xde */ { NULL, NULL, 0 },
1269 /* 0xdf */ { NULL, NULL, 0 },
1270 /* 0xe0 */ { NULL, NULL, 0 },
1271 /* 0xe1 */ { NULL, NULL, 0 },
1272 /* 0xe2 */ { NULL, NULL, 0 },
1273 /* 0xe3 */ { NULL, NULL, 0 },
1274 /* 0xe4 */ { NULL, NULL, 0 },
1275 /* 0xe5 */ { NULL, NULL, 0 },
1276 /* 0xe6 */ { NULL, NULL, 0 },
1277 /* 0xe7 */ { NULL, NULL, 0 },
1278 /* 0xe8 */ { NULL, NULL, 0 },
1279 /* 0xe9 */ { NULL, NULL, 0 },
1280 /* 0xea */ { NULL, NULL, 0 },
1281 /* 0xeb */ { NULL, NULL, 0 },
1282 /* 0xec */ { NULL, NULL, 0 },
1283 /* 0xed */ { NULL, NULL, 0 },
1284 /* 0xee */ { NULL, NULL, 0 },
1285 /* 0xef */ { NULL, NULL, 0 },
1286 /* 0xf0 */ { NULL, NULL, 0 },
1287 /* 0xf1 */ { NULL, NULL, 0 },
1288 /* 0xf2 */ { NULL, NULL, 0 },
1289 /* 0xf3 */ { NULL, NULL, 0 },
1290 /* 0xf4 */ { NULL, NULL, 0 },
1291 /* 0xf5 */ { NULL, NULL, 0 },
1292 /* 0xf6 */ { NULL, NULL, 0 },
1293 /* 0xf7 */ { NULL, NULL, 0 },
1294 /* 0xf8 */ { NULL, NULL, 0 },
1295 /* 0xf9 */ { NULL, NULL, 0 },
1296 /* 0xfa */ { NULL, NULL, 0 },
1297 /* 0xfb */ { NULL, NULL, 0 },
1298 /* 0xfc */ { NULL, NULL, 0 },
1299 /* 0xfd */ { NULL, NULL, 0 },
1300 /* 0xfe */ { NULL, NULL, 0 },
1301 /* 0xff */ { NULL, NULL, 0 }
1302
1303 };
1304
1305 /*******************************************************************
1306  allocate and initialize a reply packet
1307 ********************************************************************/
1308
1309 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1310                           const char *inbuf, char **outbuf, uint8_t num_words,
1311                           uint32_t num_bytes)
1312 {
1313         /*
1314          * Protect against integer wrap
1315          */
1316         if ((num_bytes > 0xffffff)
1317             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1318                 char *msg;
1319                 if (asprintf(&msg, "num_bytes too large: %u",
1320                              (unsigned)num_bytes) == -1) {
1321                         msg = discard_const_p(char, "num_bytes too large");
1322                 }
1323                 smb_panic(msg);
1324         }
1325
1326         *outbuf = talloc_array(mem_ctx, char,
1327                                smb_size + num_words*2 + num_bytes);
1328         if (*outbuf == NULL) {
1329                 return false;
1330         }
1331
1332         construct_reply_common(req, inbuf, *outbuf);
1333         srv_set_message(*outbuf, num_words, num_bytes, false);
1334         /*
1335          * Zero out the word area, the caller has to take care of the bcc area
1336          * himself
1337          */
1338         if (num_words != 0) {
1339                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1340         }
1341
1342         return true;
1343 }
1344
1345 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1346 {
1347         char *outbuf;
1348         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1349                            num_bytes)) {
1350                 smb_panic("could not allocate output buffer\n");
1351         }
1352         req->outbuf = (uint8_t *)outbuf;
1353 }
1354
1355
1356 /*******************************************************************
1357  Dump a packet to a file.
1358 ********************************************************************/
1359
1360 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1361 {
1362         int fd, i;
1363         char *fname = NULL;
1364         if (DEBUGLEVEL < 50) {
1365                 return;
1366         }
1367
1368         if (len < 4) len = smb_len(data)+4;
1369         for (i=1;i<100;i++) {
1370                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1371                              type ? "req" : "resp") == -1) {
1372                         return;
1373                 }
1374                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1375                 if (fd != -1 || errno != EEXIST) break;
1376         }
1377         if (fd != -1) {
1378                 ssize_t ret = write(fd, data, len);
1379                 if (ret != len)
1380                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1381                 close(fd);
1382                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1383         }
1384         SAFE_FREE(fname);
1385 }
1386
1387 /****************************************************************************
1388  Prepare everything for calling the actual request function, and potentially
1389  call the request function via the "new" interface.
1390
1391  Return False if the "legacy" function needs to be called, everything is
1392  prepared.
1393
1394  Return True if we're done.
1395
1396  I know this API sucks, but it is the one with the least code change I could
1397  find.
1398 ****************************************************************************/
1399
1400 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1401 {
1402         int flags;
1403         uint16 session_tag;
1404         connection_struct *conn = NULL;
1405         struct smbd_server_connection *sconn = req->sconn;
1406         char *raddr;
1407
1408         errno = 0;
1409
1410         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1411          * so subtract 4 from it. */
1412         if (!valid_smb_header(sconn, req->inbuf)
1413             || (size < (smb_size - 4))) {
1414                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1415                          smb_len(req->inbuf)));
1416                 exit_server_cleanly("Non-SMB packet");
1417         }
1418
1419         if (smb_messages[type].fn == NULL) {
1420                 DEBUG(0,("Unknown message type %d!\n",type));
1421                 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1422                 reply_unknown_new(req, type);
1423                 return NULL;
1424         }
1425
1426         flags = smb_messages[type].flags;
1427
1428         /* In share mode security we must ignore the vuid. */
1429         session_tag = (lp_security() == SEC_SHARE)
1430                 ? UID_FIELD_INVALID : req->vuid;
1431         conn = req->conn;
1432
1433         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1434                  (int)sys_getpid(), (unsigned long)conn));
1435
1436         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1437
1438         /* Ensure this value is replaced in the incoming packet. */
1439         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1440
1441         /*
1442          * Ensure the correct username is in current_user_info.  This is a
1443          * really ugly bugfix for problems with multiple session_setup_and_X's
1444          * being done and allowing %U and %G substitutions to work correctly.
1445          * There is a reason this code is done here, don't move it unless you
1446          * know what you're doing... :-).
1447          * JRA.
1448          */
1449
1450         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1451                 user_struct *vuser = NULL;
1452
1453                 sconn->smb1.sessions.last_session_tag = session_tag;
1454                 if(session_tag != UID_FIELD_INVALID) {
1455                         vuser = get_valid_user_struct(sconn, session_tag);
1456                         if (vuser) {
1457                                 set_current_user_info(
1458                                         vuser->session_info->unix_info->sanitized_username,
1459                                         vuser->session_info->unix_info->unix_name,
1460                                         vuser->session_info->info->domain_name);
1461                         }
1462                 }
1463         }
1464
1465         /* Does this call need to be run as the connected user? */
1466         if (flags & AS_USER) {
1467
1468                 /* Does this call need a valid tree connection? */
1469                 if (!conn) {
1470                         /*
1471                          * Amazingly, the error code depends on the command
1472                          * (from Samba4).
1473                          */
1474                         if (type == SMBntcreateX) {
1475                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1476                         } else {
1477                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1478                         }
1479                         return NULL;
1480                 }
1481
1482                 if (!change_to_user(conn,session_tag)) {
1483                         DEBUG(0, ("Error: Could not change to user. Removing "
1484                                 "deferred open, mid=%llu.\n",
1485                                 (unsigned long long)req->mid));
1486                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1487                         return conn;
1488                 }
1489
1490                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1491
1492                 /* Does it need write permission? */
1493                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1494                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1495                         return conn;
1496                 }
1497
1498                 /* IPC services are limited */
1499                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1500                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1501                         return conn;
1502                 }
1503         } else {
1504                 /* This call needs to be run as root */
1505                 change_to_root_user();
1506         }
1507
1508         /* load service specific parameters */
1509         if (conn) {
1510                 if (req->encrypted) {
1511                         conn->encrypted_tid = true;
1512                         /* encrypted required from now on. */
1513                         conn->encrypt_level = Required;
1514                 } else if (ENCRYPTION_REQUIRED(conn)) {
1515                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1516                                 exit_server_cleanly("encryption required "
1517                                         "on connection");
1518                                 return conn;
1519                         }
1520                 }
1521
1522                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1523                                          (flags & (AS_USER|DO_CHDIR)
1524                                           ?True:False))) {
1525                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1526                         return conn;
1527                 }
1528                 conn->num_smb_operations++;
1529         }
1530
1531         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1532                                                  talloc_tos());
1533         if (raddr == NULL) {
1534                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1535                 return conn;
1536         }
1537
1538         /* does this protocol need to be run as guest? */
1539         if ((flags & AS_GUEST)
1540             && (!change_to_guest() ||
1541                 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1542                               sconn->remote_hostname,
1543                               raddr))) {
1544                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1545                 return conn;
1546         }
1547
1548         smb_messages[type].fn(req);
1549         return req->conn;
1550 }
1551
1552 /****************************************************************************
1553  Construct a reply to the incoming packet.
1554 ****************************************************************************/
1555
1556 static void construct_reply(struct smbd_server_connection *sconn,
1557                             char *inbuf, int size, size_t unread_bytes,
1558                             uint32_t seqnum, bool encrypted,
1559                             struct smb_perfcount_data *deferred_pcd)
1560 {
1561         connection_struct *conn;
1562         struct smb_request *req;
1563
1564         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1565                 smb_panic("could not allocate smb_request");
1566         }
1567
1568         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1569                               encrypted, seqnum)) {
1570                 exit_server_cleanly("Invalid SMB request");
1571         }
1572
1573         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1574
1575         /* we popped this message off the queue - keep original perf data */
1576         if (deferred_pcd)
1577                 req->pcd = *deferred_pcd;
1578         else {
1579                 SMB_PERFCOUNT_START(&req->pcd);
1580                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1581                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1582         }
1583
1584         conn = switch_message(req->cmd, req, size);
1585
1586         if (req->unread_bytes) {
1587                 /* writeX failed. drain socket. */
1588                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1589                                 req->unread_bytes) {
1590                         smb_panic("failed to drain pending bytes");
1591                 }
1592                 req->unread_bytes = 0;
1593         }
1594
1595         if (req->done) {
1596                 TALLOC_FREE(req);
1597                 return;
1598         }
1599
1600         if (req->outbuf == NULL) {
1601                 return;
1602         }
1603
1604         if (CVAL(req->outbuf,0) == 0) {
1605                 show_msg((char *)req->outbuf);
1606         }
1607
1608         if (!srv_send_smb(req->sconn,
1609                         (char *)req->outbuf,
1610                         true, req->seqnum+1,
1611                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1612                         &req->pcd)) {
1613                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1614         }
1615
1616         TALLOC_FREE(req);
1617
1618         return;
1619 }
1620
1621 /****************************************************************************
1622  Process an smb from the client
1623 ****************************************************************************/
1624 static void process_smb(struct smbd_server_connection *sconn,
1625                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1626                         uint32_t seqnum, bool encrypted,
1627                         struct smb_perfcount_data *deferred_pcd)
1628 {
1629         int msg_type = CVAL(inbuf,0);
1630
1631         DO_PROFILE_INC(smb_count);
1632
1633         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1634                     smb_len(inbuf) ) );
1635         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1636                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1637
1638         if (msg_type != NBSSmessage) {
1639                 /*
1640                  * NetBIOS session request, keepalive, etc.
1641                  */
1642                 reply_special(sconn, (char *)inbuf, nread);
1643                 goto done;
1644         }
1645
1646         if (sconn->using_smb2) {
1647                 /* At this point we're not really using smb2,
1648                  * we make the decision here.. */
1649                 if (smbd_is_smb2_header(inbuf, nread)) {
1650                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1651                         return;
1652                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1653                                 && CVAL(inbuf, smb_com) != 0x72) {
1654                         /* This is a non-negprot SMB1 packet.
1655                            Disable SMB2 from now on. */
1656                         sconn->using_smb2 = false;
1657                 }
1658         }
1659
1660         show_msg((char *)inbuf);
1661
1662         construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1663                         encrypted, deferred_pcd);
1664         sconn->trans_num++;
1665
1666 done:
1667         sconn->num_requests++;
1668
1669         /* The timeout_processing function isn't run nearly
1670            often enough to implement 'max log size' without
1671            overrunning the size of the file by many megabytes.
1672            This is especially true if we are running at debug
1673            level 10.  Checking every 50 SMBs is a nice
1674            tradeoff of performance vs log file size overrun. */
1675
1676         if ((sconn->num_requests % 50) == 0 &&
1677             need_to_check_log_size()) {
1678                 change_to_root_user();
1679                 check_log_size();
1680         }
1681 }
1682
1683 /****************************************************************************
1684  Return a string containing the function name of a SMB command.
1685 ****************************************************************************/
1686
1687 const char *smb_fn_name(int type)
1688 {
1689         const char *unknown_name = "SMBunknown";
1690
1691         if (smb_messages[type].name == NULL)
1692                 return(unknown_name);
1693
1694         return(smb_messages[type].name);
1695 }
1696
1697 /****************************************************************************
1698  Helper functions for contruct_reply.
1699 ****************************************************************************/
1700
1701 void add_to_common_flags2(uint32 v)
1702 {
1703         common_flags2 |= v;
1704 }
1705
1706 void remove_from_common_flags2(uint32 v)
1707 {
1708         common_flags2 &= ~v;
1709 }
1710
1711 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1712                                    char *outbuf)
1713 {
1714         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1715         uint16_t out_flags2 = common_flags2;
1716
1717         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1718         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1719         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1720
1721         srv_set_message(outbuf,0,0,false);
1722
1723         SCVAL(outbuf, smb_com, req->cmd);
1724         SIVAL(outbuf,smb_rcls,0);
1725         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1726         SSVAL(outbuf,smb_flg2, out_flags2);
1727         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1728         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1729
1730         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1731         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1732         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1733         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1734 }
1735
1736 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1737 {
1738         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1739 }
1740
1741 /*
1742  * How many bytes have we already accumulated up to the current wct field
1743  * offset?
1744  */
1745
1746 size_t req_wct_ofs(struct smb_request *req)
1747 {
1748         size_t buf_size;
1749
1750         if (req->chain_outbuf == NULL) {
1751                 return smb_wct - 4;
1752         }
1753         buf_size = talloc_get_size(req->chain_outbuf);
1754         if ((buf_size % 4) != 0) {
1755                 buf_size += (4 - (buf_size % 4));
1756         }
1757         return buf_size - 4;
1758 }
1759
1760 /*
1761  * Hack around reply_nterror & friends not being aware of chained requests,
1762  * generating illegal (i.e. wct==0) chain replies.
1763  */
1764
1765 static void fixup_chain_error_packet(struct smb_request *req)
1766 {
1767         uint8_t *outbuf = req->outbuf;
1768         req->outbuf = NULL;
1769         reply_outbuf(req, 2, 0);
1770         memcpy(req->outbuf, outbuf, smb_wct);
1771         TALLOC_FREE(outbuf);
1772         SCVAL(req->outbuf, smb_vwv0, 0xff);
1773 }
1774
1775 /**
1776  * @brief Find the smb_cmd offset of the last command pushed
1777  * @param[in] buf       The buffer we're building up
1778  * @retval              Where can we put our next andx cmd?
1779  *
1780  * While chaining requests, the "next" request we're looking at needs to put
1781  * its SMB_Command before the data the previous request already built up added
1782  * to the chain. Find the offset to the place where we have to put our cmd.
1783  */
1784
1785 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1786 {
1787         uint8_t cmd;
1788         size_t ofs;
1789
1790         cmd = CVAL(buf, smb_com);
1791
1792         SMB_ASSERT(is_andx_req(cmd));
1793
1794         ofs = smb_vwv0;
1795
1796         while (CVAL(buf, ofs) != 0xff) {
1797
1798                 if (!is_andx_req(CVAL(buf, ofs))) {
1799                         return false;
1800                 }
1801
1802                 /*
1803                  * ofs is from start of smb header, so add the 4 length
1804                  * bytes. The next cmd is right after the wct field.
1805                  */
1806                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1807
1808                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1809         }
1810
1811         *pofs = ofs;
1812         return true;
1813 }
1814
1815 /**
1816  * @brief Do the smb chaining at a buffer level
1817  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1818  * @param[in] smb_command       The command that we want to issue
1819  * @param[in] wct               How many words?
1820  * @param[in] vwv               The words, already in network order
1821  * @param[in] bytes_alignment   How shall we align "bytes"?
1822  * @param[in] num_bytes         How many bytes?
1823  * @param[in] bytes             The data the request ships
1824  *
1825  * smb_splice_chain() adds the vwv and bytes to the request already present in
1826  * *poutbuf.
1827  */
1828
1829 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1830                              uint8_t wct, const uint16_t *vwv,
1831                              size_t bytes_alignment,
1832                              uint32_t num_bytes, const uint8_t *bytes)
1833 {
1834         uint8_t *outbuf;
1835         size_t old_size, new_size;
1836         size_t ofs;
1837         size_t chain_padding = 0;
1838         size_t bytes_padding = 0;
1839         bool first_request;
1840
1841         old_size = talloc_get_size(*poutbuf);
1842
1843         /*
1844          * old_size == smb_wct means we're pushing the first request in for
1845          * libsmb/
1846          */
1847
1848         first_request = (old_size == smb_wct);
1849
1850         if (!first_request && ((old_size % 4) != 0)) {
1851                 /*
1852                  * Align the wct field of subsequent requests to a 4-byte
1853                  * boundary
1854                  */
1855                 chain_padding = 4 - (old_size % 4);
1856         }
1857
1858         /*
1859          * After the old request comes the new wct field (1 byte), the vwv's
1860          * and the num_bytes field. After at we might need to align the bytes
1861          * given to us to "bytes_alignment", increasing the num_bytes value.
1862          */
1863
1864         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1865
1866         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1867                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1868         }
1869
1870         new_size += bytes_padding + num_bytes;
1871
1872         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1873                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1874                           (unsigned)new_size));
1875                 return false;
1876         }
1877
1878         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1879         if (outbuf == NULL) {
1880                 DEBUG(0, ("talloc failed\n"));
1881                 return false;
1882         }
1883         *poutbuf = outbuf;
1884
1885         if (first_request) {
1886                 SCVAL(outbuf, smb_com, smb_command);
1887         } else {
1888                 size_t andx_cmd_ofs;
1889
1890                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1891                         DEBUG(1, ("invalid command chain\n"));
1892                         *poutbuf = talloc_realloc(
1893                                 NULL, *poutbuf, uint8_t, old_size);
1894                         return false;
1895                 }
1896
1897                 if (chain_padding != 0) {
1898                         memset(outbuf + old_size, 0, chain_padding);
1899                         old_size += chain_padding;
1900                 }
1901
1902                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1903                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1904         }
1905
1906         ofs = old_size;
1907
1908         /*
1909          * Push the chained request:
1910          *
1911          * wct field
1912          */
1913
1914         SCVAL(outbuf, ofs, wct);
1915         ofs += 1;
1916
1917         /*
1918          * vwv array
1919          */
1920
1921         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1922         ofs += sizeof(uint16_t) * wct;
1923
1924         /*
1925          * bcc (byte count)
1926          */
1927
1928         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1929         ofs += sizeof(uint16_t);
1930
1931         /*
1932          * padding
1933          */
1934
1935         if (bytes_padding != 0) {
1936                 memset(outbuf + ofs, 0, bytes_padding);
1937                 ofs += bytes_padding;
1938         }
1939
1940         /*
1941          * The bytes field
1942          */
1943
1944         memcpy(outbuf + ofs, bytes, num_bytes);
1945
1946         return true;
1947 }
1948
1949 /****************************************************************************
1950  Construct a chained reply and add it to the already made reply
1951 ****************************************************************************/
1952
1953 void chain_reply(struct smb_request *req)
1954 {
1955         size_t smblen = smb_len(req->inbuf);
1956         size_t already_used, length_needed;
1957         uint8_t chain_cmd;
1958         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1959
1960         uint8_t wct;
1961         const uint16_t *vwv;
1962         uint16_t buflen;
1963         const uint8_t *buf;
1964
1965         if (IVAL(req->outbuf, smb_rcls) != 0) {
1966                 fixup_chain_error_packet(req);
1967         }
1968
1969         /*
1970          * Any of the AndX requests and replies have at least a wct of
1971          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1972          * beginning of the SMB header to the next wct field.
1973          *
1974          * None of the AndX requests put anything valuable in vwv[0] and [1],
1975          * so we can overwrite it here to form the chain.
1976          */
1977
1978         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1979                 if (req->chain_outbuf == NULL) {
1980                         req->chain_outbuf = talloc_realloc(
1981                                 req, req->outbuf, uint8_t,
1982                                 smb_len(req->outbuf) + 4);
1983                         if (req->chain_outbuf == NULL) {
1984                                 smb_panic("talloc failed");
1985                         }
1986                 }
1987                 req->outbuf = NULL;
1988                 goto error;
1989         }
1990
1991         /*
1992          * Here we assume that this is the end of the chain. For that we need
1993          * to set "next command" to 0xff and the offset to 0. If we later find
1994          * more commands in the chain, this will be overwritten again.
1995          */
1996
1997         SCVAL(req->outbuf, smb_vwv0, 0xff);
1998         SCVAL(req->outbuf, smb_vwv0+1, 0);
1999         SSVAL(req->outbuf, smb_vwv1, 0);
2000
2001         if (req->chain_outbuf == NULL) {
2002                 /*
2003                  * In req->chain_outbuf we collect all the replies. Start the
2004                  * chain by copying in the first reply.
2005                  *
2006                  * We do the realloc because later on we depend on
2007                  * talloc_get_size to determine the length of
2008                  * chain_outbuf. The reply_xxx routines might have
2009                  * over-allocated (reply_pipe_read_and_X used to be such an
2010                  * example).
2011                  */
2012                 req->chain_outbuf = talloc_realloc(
2013                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
2014                 if (req->chain_outbuf == NULL) {
2015                         smb_panic("talloc failed");
2016                 }
2017                 req->outbuf = NULL;
2018         } else {
2019                 /*
2020                  * Update smb headers where subsequent chained commands
2021                  * may have updated them.
2022                  */
2023                 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
2024                 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
2025
2026                 if (!smb_splice_chain(&req->chain_outbuf,
2027                                       CVAL(req->outbuf, smb_com),
2028                                       CVAL(req->outbuf, smb_wct),
2029                                       (uint16_t *)(req->outbuf + smb_vwv),
2030                                       0, smb_buflen(req->outbuf),
2031                                       (uint8_t *)smb_buf(req->outbuf))) {
2032                         goto error;
2033                 }
2034                 TALLOC_FREE(req->outbuf);
2035         }
2036
2037         /*
2038          * We use the old request's vwv field to grab the next chained command
2039          * and offset into the chained fields.
2040          */
2041
2042         chain_cmd = CVAL(req->vwv+0, 0);
2043         chain_offset = SVAL(req->vwv+1, 0);
2044
2045         if (chain_cmd == 0xff) {
2046                 /*
2047                  * End of chain, no more requests from the client. So ship the
2048                  * replies.
2049                  */
2050                 smb_setlen((char *)(req->chain_outbuf),
2051                            talloc_get_size(req->chain_outbuf) - 4);
2052
2053                 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2054                                   true, req->seqnum+1,
2055                                   IS_CONN_ENCRYPTED(req->conn)
2056                                   ||req->encrypted,
2057                                   &req->pcd)) {
2058                         exit_server_cleanly("chain_reply: srv_send_smb "
2059                                             "failed.");
2060                 }
2061                 TALLOC_FREE(req->chain_outbuf);
2062                 req->done = true;
2063                 return;
2064         }
2065
2066         /* add a new perfcounter for this element of chain */
2067         SMB_PERFCOUNT_ADD(&req->pcd);
2068         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2069         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2070
2071         /*
2072          * Check if the client tries to fool us. The chain offset
2073          * needs to point beyond the current request in the chain, it
2074          * needs to strictly grow. Otherwise we might be tricked into
2075          * an endless loop always processing the same request over and
2076          * over again. We used to assume that vwv and the byte buffer
2077          * array in a chain are always attached, but OS/2 the
2078          * Write&X/Read&X chain puts the Read&X vwv array right behind
2079          * the Write&X vwv chain. The Write&X bcc array is put behind
2080          * the Read&X vwv array. So now we check whether the chain
2081          * offset points strictly behind the previous vwv
2082          * array. req->buf points right after the vwv array of the
2083          * previous request. See
2084          * https://bugzilla.samba.org/show_bug.cgi?id=8360 for more
2085          * information.
2086          */
2087
2088         already_used = PTR_DIFF(req->buf, smb_base(req->inbuf));
2089         if (chain_offset <= already_used) {
2090                 goto error;
2091         }
2092
2093         /*
2094          * Next check: Make sure the chain offset does not point beyond the
2095          * overall smb request length.
2096          */
2097
2098         length_needed = chain_offset+1; /* wct */
2099         if (length_needed > smblen) {
2100                 goto error;
2101         }
2102
2103         /*
2104          * Now comes the pointer magic. Goal here is to set up req->vwv and
2105          * req->buf correctly again to be able to call the subsequent
2106          * switch_message(). The chain offset (the former vwv[1]) points at
2107          * the new wct field.
2108          */
2109
2110         wct = CVAL(smb_base(req->inbuf), chain_offset);
2111
2112         /*
2113          * Next consistency check: Make the new vwv array fits in the overall
2114          * smb request.
2115          */
2116
2117         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2118         if (length_needed > smblen) {
2119                 goto error;
2120         }
2121         vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2122
2123         /*
2124          * Now grab the new byte buffer....
2125          */
2126
2127         buflen = SVAL(vwv+wct, 0);
2128
2129         /*
2130          * .. and check that it fits.
2131          */
2132
2133         length_needed += buflen;
2134         if (length_needed > smblen) {
2135                 goto error;
2136         }
2137         buf = (const uint8_t *)(vwv+wct+1);
2138
2139         req->cmd = chain_cmd;
2140         req->wct = wct;
2141         req->vwv = discard_const_p(uint16_t, vwv);
2142         req->buflen = buflen;
2143         req->buf = buf;
2144
2145         switch_message(chain_cmd, req, smblen);
2146
2147         if (req->outbuf == NULL) {
2148                 /*
2149                  * This happens if the chained command has suspended itself or
2150                  * if it has called srv_send_smb() itself.
2151                  */
2152                 return;
2153         }
2154
2155         /*
2156          * We end up here if the chained command was not itself chained or
2157          * suspended, but for example a close() command. We now need to splice
2158          * the chained commands' outbuf into the already built up chain_outbuf
2159          * and ship the result.
2160          */
2161         goto done;
2162
2163  error:
2164         /*
2165          * We end up here if there's any error in the chain syntax. Report a
2166          * DOS error, just like Windows does.
2167          */
2168         reply_force_doserror(req, ERRSRV, ERRerror);
2169         fixup_chain_error_packet(req);
2170
2171  done:
2172         /*
2173          * This scary statement intends to set the
2174          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2175          * to the value req->outbuf carries
2176          */
2177         SSVAL(req->chain_outbuf, smb_flg2,
2178               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2179               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2180
2181         /*
2182          * Transfer the error codes from the subrequest to the main one
2183          */
2184         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2185         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2186
2187         if (!smb_splice_chain(&req->chain_outbuf,
2188                               CVAL(req->outbuf, smb_com),
2189                               CVAL(req->outbuf, smb_wct),
2190                               (uint16_t *)(req->outbuf + smb_vwv),
2191                               0, smb_buflen(req->outbuf),
2192                               (uint8_t *)smb_buf(req->outbuf))) {
2193                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2194         }
2195         TALLOC_FREE(req->outbuf);
2196
2197         smb_setlen((char *)(req->chain_outbuf),
2198                    talloc_get_size(req->chain_outbuf) - 4);
2199
2200         show_msg((char *)(req->chain_outbuf));
2201
2202         if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2203                           true, req->seqnum+1,
2204                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2205                           &req->pcd)) {
2206                 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2207         }
2208         TALLOC_FREE(req->chain_outbuf);
2209         req->done = true;
2210 }
2211
2212 /****************************************************************************
2213  Check if services need reloading.
2214 ****************************************************************************/
2215
2216 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2217 {
2218
2219         if (last_smb_conf_reload_time == 0) {
2220                 last_smb_conf_reload_time = t;
2221         }
2222
2223         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2224                 reload_services(sconn, conn_snum_used, true);
2225                 last_smb_conf_reload_time = t;
2226         }
2227 }
2228
2229 static bool fd_is_readable(int fd)
2230 {
2231         int ret, revents;
2232
2233         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2234
2235         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2236
2237 }
2238
2239 static void smbd_server_connection_write_handler(
2240         struct smbd_server_connection *sconn)
2241 {
2242         /* TODO: make write nonblocking */
2243 }
2244
2245 static void smbd_server_connection_read_handler(
2246         struct smbd_server_connection *sconn, int fd)
2247 {
2248         uint8_t *inbuf = NULL;
2249         size_t inbuf_len = 0;
2250         size_t unread_bytes = 0;
2251         bool encrypted = false;
2252         TALLOC_CTX *mem_ctx = talloc_tos();
2253         NTSTATUS status;
2254         uint32_t seqnum;
2255
2256         bool from_client;
2257
2258         if (lp_async_smb_echo_handler()
2259             && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2260                 /*
2261                  * This is the super-ugly hack to prefer the packets
2262                  * forwarded by the echo handler over the ones by the
2263                  * client directly
2264                  */
2265                 fd = sconn->smb1.echo_handler.trusted_fd;
2266         }
2267
2268         from_client = (sconn->sock == fd);
2269
2270         if (from_client) {
2271                 smbd_lock_socket(sconn);
2272
2273                 if (!fd_is_readable(fd)) {
2274                         DEBUG(10,("the echo listener was faster\n"));
2275                         smbd_unlock_socket(sconn);
2276                         return;
2277                 }
2278         }
2279
2280         /* TODO: make this completely nonblocking */
2281         status = receive_smb_talloc(mem_ctx, sconn, fd,
2282                                     (char **)(void *)&inbuf,
2283                                     0, /* timeout */
2284                                     &unread_bytes,
2285                                     &encrypted,
2286                                     &inbuf_len, &seqnum,
2287                                     false /* trusted channel */);
2288
2289         if (from_client) {
2290                 smbd_unlock_socket(sconn);
2291         }
2292
2293         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2294                 goto process;
2295         }
2296         if (NT_STATUS_IS_ERR(status)) {
2297                 exit_server_cleanly("failed to receive smb request");
2298         }
2299         if (!NT_STATUS_IS_OK(status)) {
2300                 return;
2301         }
2302
2303 process:
2304         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2305                     seqnum, encrypted, NULL);
2306 }
2307
2308 static void smbd_server_connection_handler(struct event_context *ev,
2309                                            struct fd_event *fde,
2310                                            uint16_t flags,
2311                                            void *private_data)
2312 {
2313         struct smbd_server_connection *conn = talloc_get_type(private_data,
2314                                               struct smbd_server_connection);
2315
2316         if (flags & EVENT_FD_WRITE) {
2317                 smbd_server_connection_write_handler(conn);
2318                 return;
2319         }
2320         if (flags & EVENT_FD_READ) {
2321                 smbd_server_connection_read_handler(conn, conn->sock);
2322                 return;
2323         }
2324 }
2325
2326 static void smbd_server_echo_handler(struct event_context *ev,
2327                                      struct fd_event *fde,
2328                                      uint16_t flags,
2329                                      void *private_data)
2330 {
2331         struct smbd_server_connection *conn = talloc_get_type(private_data,
2332                                               struct smbd_server_connection);
2333
2334         if (flags & EVENT_FD_WRITE) {
2335                 smbd_server_connection_write_handler(conn);
2336                 return;
2337         }
2338         if (flags & EVENT_FD_READ) {
2339                 smbd_server_connection_read_handler(
2340                         conn, conn->smb1.echo_handler.trusted_fd);
2341                 return;
2342         }
2343 }
2344
2345 #ifdef CLUSTER_SUPPORT
2346 /****************************************************************************
2347 received when we should release a specific IP
2348 ****************************************************************************/
2349 static void release_ip(const char *ip, void *priv)
2350 {
2351         const char *addr = (const char *)priv;
2352         const char *p = addr;
2353
2354         if (strncmp("::ffff:", addr, 7) == 0) {
2355                 p = addr + 7;
2356         }
2357
2358         DEBUG(10, ("Got release IP message for %s, "
2359                    "our address is %s\n", ip, p));
2360
2361         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2362                 /* we can't afford to do a clean exit - that involves
2363                    database writes, which would potentially mean we
2364                    are still running after the failover has finished -
2365                    we have to get rid of this process ID straight
2366                    away */
2367                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2368                         ip));
2369                 /* note we must exit with non-zero status so the unclean handler gets
2370                    called in the parent, so that the brl database is tickled */
2371                 _exit(1);
2372         }
2373 }
2374
2375 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2376                                struct sockaddr_storage *client)
2377 {
2378         socklen_t length;
2379         length = sizeof(*server);
2380         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2381                 return -1;
2382         }
2383         length = sizeof(*client);
2384         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2385                 return -1;
2386         }
2387         return 0;
2388 }
2389 #endif
2390
2391 /*
2392  * Send keepalive packets to our client
2393  */
2394 static bool keepalive_fn(const struct timeval *now, void *private_data)
2395 {
2396         struct smbd_server_connection *sconn = talloc_get_type_abort(
2397                 private_data, struct smbd_server_connection);
2398         bool ret;
2399
2400         if (sconn->using_smb2) {
2401                 /* Don't do keepalives on an SMB2 connection. */
2402                 return false;
2403         }
2404
2405         smbd_lock_socket(sconn);
2406         ret = send_keepalive(sconn->sock);
2407         smbd_unlock_socket(sconn);
2408
2409         if (!ret) {
2410                 char addr[INET6_ADDRSTRLEN];
2411                 /*
2412                  * Try and give an error message saying what
2413                  * client failed.
2414                  */
2415                 DEBUG(0, ("send_keepalive failed for client %s. "
2416                           "Error %s - exiting\n",
2417                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2418                           strerror(errno)));
2419                 return False;
2420         }
2421         return True;
2422 }
2423
2424 /*
2425  * Do the recurring check if we're idle
2426  */
2427 static bool deadtime_fn(const struct timeval *now, void *private_data)
2428 {
2429         struct smbd_server_connection *sconn =
2430                 (struct smbd_server_connection *)private_data;
2431
2432         if ((conn_num_open(sconn) == 0)
2433             || (conn_idle_all(sconn, now->tv_sec))) {
2434                 DEBUG( 2, ( "Closing idle connection\n" ) );
2435                 messaging_send(sconn->msg_ctx,
2436                                messaging_server_id(sconn->msg_ctx),
2437                                MSG_SHUTDOWN, &data_blob_null);
2438                 return False;
2439         }
2440
2441         return True;
2442 }
2443
2444 /*
2445  * Do the recurring log file and smb.conf reload checks.
2446  */
2447
2448 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2449 {
2450         struct smbd_server_connection *sconn = talloc_get_type_abort(
2451                 private_data, struct smbd_server_connection);
2452
2453         DEBUG(5, ("housekeeping\n"));
2454
2455         change_to_root_user();
2456
2457         /* update printer queue caches if necessary */
2458         update_monitored_printq_cache(sconn->msg_ctx);
2459
2460         /* check if we need to reload services */
2461         check_reload(sconn, time_mono(NULL));
2462
2463         /* Change machine password if neccessary. */
2464         attempt_machine_password_change();
2465
2466         /*
2467          * Force a log file check.
2468          */
2469         force_check_log_size();
2470         check_log_size();
2471         return true;
2472 }
2473
2474 /*
2475  * Read an smb packet in the echo handler child, giving the parent
2476  * smbd one second to react once the socket becomes readable.
2477  */
2478
2479 struct smbd_echo_read_state {
2480         struct tevent_context *ev;
2481         struct smbd_server_connection *sconn;
2482
2483         char *buf;
2484         size_t buflen;
2485         uint32_t seqnum;
2486 };
2487
2488 static void smbd_echo_read_readable(struct tevent_req *subreq);
2489 static void smbd_echo_read_waited(struct tevent_req *subreq);
2490
2491 static struct tevent_req *smbd_echo_read_send(
2492         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2493         struct smbd_server_connection *sconn)
2494 {
2495         struct tevent_req *req, *subreq;
2496         struct smbd_echo_read_state *state;
2497
2498         req = tevent_req_create(mem_ctx, &state,
2499                                 struct smbd_echo_read_state);
2500         if (req == NULL) {
2501                 return NULL;
2502         }
2503         state->ev = ev;
2504         state->sconn = sconn;
2505
2506         subreq = wait_for_read_send(state, ev, sconn->sock);
2507         if (tevent_req_nomem(subreq, req)) {
2508                 return tevent_req_post(req, ev);
2509         }
2510         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2511         return req;
2512 }
2513
2514 static void smbd_echo_read_readable(struct tevent_req *subreq)
2515 {
2516         struct tevent_req *req = tevent_req_callback_data(
2517                 subreq, struct tevent_req);
2518         struct smbd_echo_read_state *state = tevent_req_data(
2519                 req, struct smbd_echo_read_state);
2520         bool ok;
2521         int err;
2522
2523         ok = wait_for_read_recv(subreq, &err);
2524         TALLOC_FREE(subreq);
2525         if (!ok) {
2526                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2527                 return;
2528         }
2529
2530         /*
2531          * Give the parent smbd one second to step in
2532          */
2533
2534         subreq = tevent_wakeup_send(
2535                 state, state->ev, timeval_current_ofs(1, 0));
2536         if (tevent_req_nomem(subreq, req)) {
2537                 return;
2538         }
2539         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2540 }
2541
2542 static void smbd_echo_read_waited(struct tevent_req *subreq)
2543 {
2544         struct tevent_req *req = tevent_req_callback_data(
2545                 subreq, struct tevent_req);
2546         struct smbd_echo_read_state *state = tevent_req_data(
2547                 req, struct smbd_echo_read_state);
2548         struct smbd_server_connection *sconn = state->sconn;
2549         bool ok;
2550         NTSTATUS status;
2551         size_t unread = 0;
2552         bool encrypted;
2553
2554         ok = tevent_wakeup_recv(subreq);
2555         TALLOC_FREE(subreq);
2556         if (!ok) {
2557                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2558                 return;
2559         }
2560
2561         ok = smbd_lock_socket_internal(sconn);
2562         if (!ok) {
2563                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2564                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2565                 return;
2566         }
2567
2568         if (!fd_is_readable(sconn->sock)) {
2569                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2570                           (int)sys_getpid()));
2571
2572                 ok = smbd_unlock_socket_internal(sconn);
2573                 if (!ok) {
2574                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2575                         DEBUG(1, ("%s: failed to unlock socket\n",
2576                                 __location__));
2577                         return;
2578                 }
2579
2580                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2581                 if (tevent_req_nomem(subreq, req)) {
2582                         return;
2583                 }
2584                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2585                 return;
2586         }
2587
2588         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2589                                     0 /* timeout */,
2590                                     &unread,
2591                                     &encrypted,
2592                                     &state->buflen,
2593                                     &state->seqnum,
2594                                     false /* trusted_channel*/);
2595
2596         if (tevent_req_nterror(req, status)) {
2597                 tevent_req_nterror(req, status);
2598                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2599                           (int)sys_getpid(), nt_errstr(status)));
2600                 return;
2601         }
2602
2603         ok = smbd_unlock_socket_internal(sconn);
2604         if (!ok) {
2605                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2606                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2607                 return;
2608         }
2609         tevent_req_done(req);
2610 }
2611
2612 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2613                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2614 {
2615         struct smbd_echo_read_state *state = tevent_req_data(
2616                 req, struct smbd_echo_read_state);
2617         NTSTATUS status;
2618
2619         if (tevent_req_is_nterror(req, &status)) {
2620                 return status;
2621         }
2622         *pbuf = talloc_move(mem_ctx, &state->buf);
2623         *pbuflen = state->buflen;
2624         *pseqnum = state->seqnum;
2625         return NT_STATUS_OK;
2626 }
2627
2628 struct smbd_echo_state {
2629         struct tevent_context *ev;
2630         struct iovec *pending;
2631         struct smbd_server_connection *sconn;
2632         int parent_pipe;
2633
2634         struct tevent_fd *parent_fde;
2635
2636         struct tevent_req *write_req;
2637 };
2638
2639 static void smbd_echo_writer_done(struct tevent_req *req);
2640
2641 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2642 {
2643         int num_pending;
2644
2645         if (state->write_req != NULL) {
2646                 return;
2647         }
2648
2649         num_pending = talloc_array_length(state->pending);
2650         if (num_pending == 0) {
2651                 return;
2652         }
2653
2654         state->write_req = writev_send(state, state->ev, NULL,
2655                                        state->parent_pipe, false,
2656                                        state->pending, num_pending);
2657         if (state->write_req == NULL) {
2658                 DEBUG(1, ("writev_send failed\n"));
2659                 exit(1);
2660         }
2661
2662         talloc_steal(state->write_req, state->pending);
2663         state->pending = NULL;
2664
2665         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2666                                 state);
2667 }
2668
2669 static void smbd_echo_writer_done(struct tevent_req *req)
2670 {
2671         struct smbd_echo_state *state = tevent_req_callback_data(
2672                 req, struct smbd_echo_state);
2673         ssize_t written;
2674         int err;
2675
2676         written = writev_recv(req, &err);
2677         TALLOC_FREE(req);
2678         state->write_req = NULL;
2679         if (written == -1) {
2680                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2681                 exit(1);
2682         }
2683         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2684         smbd_echo_activate_writer(state);
2685 }
2686
2687 static bool smbd_echo_reply(struct smbd_echo_state *state,
2688                             uint8_t *inbuf, size_t inbuf_len,
2689                             uint32_t seqnum)
2690 {
2691         struct smb_request req;
2692         uint16_t num_replies;
2693         size_t out_len;
2694         char *outbuf;
2695         bool ok;
2696
2697         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2698                 DEBUG(10, ("Got netbios keepalive\n"));
2699                 /*
2700                  * Just swallow it
2701                  */
2702                 return true;
2703         }
2704
2705         if (inbuf_len < smb_size) {
2706                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2707                 return false;
2708         }
2709         if (!valid_smb_header(state->sconn, inbuf)) {
2710                 DEBUG(10, ("Got invalid SMB header\n"));
2711                 return false;
2712         }
2713
2714         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2715                               seqnum)) {
2716                 return false;
2717         }
2718         req.inbuf = inbuf;
2719
2720         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2721                    smb_messages[req.cmd].name
2722                    ? smb_messages[req.cmd].name : "unknown"));
2723
2724         if (req.cmd != SMBecho) {
2725                 return false;
2726         }
2727         if (req.wct < 1) {
2728                 return false;
2729         }
2730
2731         num_replies = SVAL(req.vwv+0, 0);
2732         if (num_replies != 1) {
2733                 /* Not a Windows "Hey, you're still there?" request */
2734                 return false;
2735         }
2736
2737         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2738                            1, req.buflen)) {
2739                 DEBUG(10, ("create_outbuf failed\n"));
2740                 return false;
2741         }
2742         req.outbuf = (uint8_t *)outbuf;
2743
2744         SSVAL(req.outbuf, smb_vwv0, num_replies);
2745
2746         if (req.buflen > 0) {
2747                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2748         }
2749
2750         out_len = smb_len(req.outbuf) + 4;
2751
2752         ok = srv_send_smb(req.sconn,
2753                           (char *)outbuf,
2754                           true, seqnum+1,
2755                           false, &req.pcd);
2756         TALLOC_FREE(outbuf);
2757         if (!ok) {
2758                 exit(1);
2759         }
2760
2761         return true;
2762 }
2763
2764 static void smbd_echo_exit(struct tevent_context *ev,
2765                            struct tevent_fd *fde, uint16_t flags,
2766                            void *private_data)
2767 {
2768         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2769         exit(0);
2770 }
2771
2772 static void smbd_echo_got_packet(struct tevent_req *req);
2773
2774 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2775                            int parent_pipe)
2776 {
2777         struct smbd_echo_state *state;
2778         struct tevent_req *read_req;
2779
2780         state = talloc_zero(sconn, struct smbd_echo_state);
2781         if (state == NULL) {
2782                 DEBUG(1, ("talloc failed\n"));
2783                 return;
2784         }
2785         state->sconn = sconn;
2786         state->parent_pipe = parent_pipe;
2787         state->ev = s3_tevent_context_init(state);
2788         if (state->ev == NULL) {
2789                 DEBUG(1, ("tevent_context_init failed\n"));
2790                 TALLOC_FREE(state);
2791                 return;
2792         }
2793         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2794                                         TEVENT_FD_READ, smbd_echo_exit,
2795                                         state);
2796         if (state->parent_fde == NULL) {
2797                 DEBUG(1, ("tevent_add_fd failed\n"));
2798                 TALLOC_FREE(state);
2799                 return;
2800         }
2801
2802         read_req = smbd_echo_read_send(state, state->ev, sconn);
2803         if (read_req == NULL) {
2804                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2805                 TALLOC_FREE(state);
2806                 return;
2807         }
2808         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2809
2810         while (true) {
2811                 if (tevent_loop_once(state->ev) == -1) {
2812                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2813                                   strerror(errno)));
2814                         break;
2815                 }
2816         }
2817         TALLOC_FREE(state);
2818 }
2819
2820 static void smbd_echo_got_packet(struct tevent_req *req)
2821 {
2822         struct smbd_echo_state *state = tevent_req_callback_data(
2823                 req, struct smbd_echo_state);
2824         NTSTATUS status;
2825         char *buf = NULL;
2826         size_t buflen = 0;
2827         uint32_t seqnum = 0;
2828         bool reply;
2829
2830         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2831         TALLOC_FREE(req);
2832         if (!NT_STATUS_IS_OK(status)) {
2833                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2834                           nt_errstr(status)));
2835                 exit(1);
2836         }
2837
2838         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
2839         if (!reply) {
2840                 size_t num_pending;
2841                 struct iovec *tmp;
2842                 struct iovec *iov;
2843
2844                 num_pending = talloc_array_length(state->pending);
2845                 tmp = talloc_realloc(state, state->pending, struct iovec,
2846                                      num_pending+1);
2847                 if (tmp == NULL) {
2848                         DEBUG(1, ("talloc_realloc failed\n"));
2849                         exit(1);
2850                 }
2851                 state->pending = tmp;
2852
2853                 if (buflen >= smb_size) {
2854                         /*
2855                          * place the seqnum in the packet so that the main process
2856                          * can reply with signing
2857                          */
2858                         SIVAL(buf, smb_ss_field, seqnum);
2859                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2860                 }
2861
2862                 iov = &state->pending[num_pending];
2863                 iov->iov_base = buf;
2864                 iov->iov_len = buflen;
2865
2866                 DEBUG(10,("echo_handler[%d]: forward to main\n",
2867                           (int)sys_getpid()));
2868                 smbd_echo_activate_writer(state);
2869         }
2870
2871         req = smbd_echo_read_send(state, state->ev, state->sconn);
2872         if (req == NULL) {
2873                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2874                 exit(1);
2875         }
2876         tevent_req_set_callback(req, smbd_echo_got_packet, state);
2877 }
2878
2879
2880 /*
2881  * Handle SMBecho requests in a forked child process
2882  */
2883 bool fork_echo_handler(struct smbd_server_connection *sconn)
2884 {
2885         int listener_pipe[2];
2886         int res;
2887         pid_t child;
2888
2889         res = pipe(listener_pipe);
2890         if (res == -1) {
2891                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2892                 return false;
2893         }
2894         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2895         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2896                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2897                 goto fail;
2898         }
2899
2900         child = sys_fork();
2901         if (child == 0) {
2902                 NTSTATUS status;
2903
2904                 close(listener_pipe[0]);
2905                 set_blocking(listener_pipe[1], false);
2906
2907                 status = reinit_after_fork(sconn->msg_ctx,
2908                                            sconn->ev_ctx,
2909                                            false);
2910                 if (!NT_STATUS_IS_OK(status)) {
2911                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2912                                   nt_errstr(status)));
2913                         exit(1);
2914                 }
2915                 smbd_echo_loop(sconn, listener_pipe[1]);
2916                 exit(0);
2917         }
2918         close(listener_pipe[1]);
2919         listener_pipe[1] = -1;
2920         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2921
2922         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2923
2924         /*
2925          * Without smb signing this is the same as the normal smbd
2926          * listener. This needs to change once signing comes in.
2927          */
2928         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
2929                                         sconn,
2930                                         sconn->smb1.echo_handler.trusted_fd,
2931                                         TEVENT_FD_READ,
2932                                         smbd_server_echo_handler,
2933                                         sconn);
2934         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2935                 DEBUG(1, ("event_add_fd failed\n"));
2936                 goto fail;
2937         }
2938
2939         return true;
2940
2941 fail:
2942         if (listener_pipe[0] != -1) {
2943                 close(listener_pipe[0]);
2944         }
2945         if (listener_pipe[1] != -1) {
2946                 close(listener_pipe[1]);
2947         }
2948         sconn->smb1.echo_handler.trusted_fd = -1;
2949         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2950                 close(sconn->smb1.echo_handler.socket_lock_fd);
2951         }
2952         sconn->smb1.echo_handler.trusted_fd = -1;
2953         sconn->smb1.echo_handler.socket_lock_fd = -1;
2954         return false;
2955 }
2956
2957 #if CLUSTER_SUPPORT
2958
2959 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2960                                   struct sockaddr_storage *srv,
2961                                   struct sockaddr_storage *clnt)
2962 {
2963         struct ctdbd_connection *cconn;
2964         char tmp_addr[INET6_ADDRSTRLEN];
2965         char *addr;
2966
2967         cconn = messaging_ctdbd_connection();
2968         if (cconn == NULL) {
2969                 return NT_STATUS_NO_MEMORY;
2970         }
2971
2972         client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2973         addr = talloc_strdup(cconn, tmp_addr);
2974         if (addr == NULL) {
2975                 return NT_STATUS_NO_MEMORY;
2976         }
2977         return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2978 }
2979
2980 #endif
2981
2982 static bool uid_in_use(const struct user_struct *user, uid_t uid)
2983 {
2984         while (user) {
2985                 if (user->session_info &&
2986                     (user->session_info->unix_token->uid == uid)) {
2987                         return true;
2988                 }
2989                 user = user->next;
2990         }
2991         return false;
2992 }
2993
2994 static bool gid_in_use(const struct user_struct *user, gid_t gid)
2995 {
2996         while (user) {
2997                 if (user->session_info != NULL) {
2998                         int i;
2999                         struct security_unix_token *utok;
3000
3001                         utok = user->session_info->unix_token;
3002                         if (utok->gid == gid) {
3003                                 return true;
3004                         }
3005                         for(i=0; i<utok->ngroups; i++) {
3006                                 if (utok->groups[i] == gid) {
3007                                         return true;
3008                                 }
3009                         }
3010                 }
3011                 user = user->next;
3012         }
3013         return false;
3014 }
3015
3016 static bool sid_in_use(const struct user_struct *user,
3017                        const struct dom_sid *psid)
3018 {
3019         while (user) {
3020                 struct security_token *tok;
3021
3022                 if (user->session_info == NULL) {
3023                         continue;
3024                 }
3025                 tok = user->session_info->security_token;
3026                 if (tok == NULL) {
3027                         /*
3028                          * Not sure session_info->security_token can
3029                          * ever be NULL. This check might be not
3030                          * necessary.
3031                          */
3032                         continue;
3033                 }
3034                 if (security_token_has_sid(tok, psid)) {
3035                         return true;
3036                 }
3037                 user = user->next;
3038         }
3039         return false;
3040 }
3041
3042 static bool id_in_use(const struct user_struct *user,
3043                       const struct id_cache_ref *id)
3044 {
3045         switch(id->type) {
3046         case UID:
3047                 return uid_in_use(user, id->id.uid);
3048         case GID:
3049                 return gid_in_use(user, id->id.gid);
3050         case SID:
3051                 return sid_in_use(user, &id->id.sid);
3052         default:
3053                 break;
3054         }
3055         return false;
3056 }
3057
3058 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3059                                void *private_data,
3060                                uint32_t msg_type,
3061                                struct server_id server_id,
3062                                DATA_BLOB* data)
3063 {
3064         const char *msg = (data && data->data)
3065                 ? (const char *)data->data : "<NULL>";
3066         struct user_struct *validated_users;
3067         struct id_cache_ref id;
3068         struct smbd_server_connection *sconn =
3069                 talloc_get_type_abort(private_data,
3070                 struct smbd_server_connection);
3071
3072         validated_users = sconn->smb1.sessions.validated_users;
3073
3074         if (!id_cache_ref_parse(msg, &id)) {
3075                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3076                 return;
3077         }
3078
3079         if (id_in_use(validated_users, &id)) {
3080                 exit_server_cleanly(msg);
3081         }
3082         id_cache_delete_from_cache(&id);
3083 }
3084
3085 /****************************************************************************
3086  Process commands from the client
3087 ****************************************************************************/
3088
3089 void smbd_process(struct tevent_context *ev_ctx,
3090                   struct smbd_server_connection *sconn)
3091 {
3092         TALLOC_CTX *frame = talloc_stackframe();
3093         struct sockaddr_storage ss;
3094         struct sockaddr *sa = NULL;
3095         socklen_t sa_socklen;
3096         struct tsocket_address *local_address = NULL;
3097         struct tsocket_address *remote_address = NULL;
3098         const char *locaddr = NULL;
3099         const char *remaddr = NULL;
3100         char *rhost;
3101         int ret;
3102
3103         if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
3104                 /*
3105                  * We're not making the decision here,
3106                  * we're just allowing the client
3107                  * to decide between SMB1 and SMB2
3108                  * with the first negprot
3109                  * packet.
3110                  */
3111                 sconn->using_smb2 = true;
3112         }
3113
3114         /* Ensure child is set to blocking mode */
3115         set_blocking(sconn->sock,True);
3116
3117         set_socket_options(sconn->sock, "SO_KEEPALIVE");
3118         set_socket_options(sconn->sock, lp_socket_options());
3119
3120         sa = (struct sockaddr *)(void *)&ss;
3121         sa_socklen = sizeof(ss);
3122         ret = getpeername(sconn->sock, sa, &sa_socklen);
3123         if (ret != 0) {
3124                 int level = (errno == ENOTCONN)?2:0;
3125                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3126                 exit_server_cleanly("getpeername() failed.\n");
3127         }
3128         ret = tsocket_address_bsd_from_sockaddr(sconn,
3129                                                 sa, sa_socklen,
3130                                                 &remote_address);
3131         if (ret != 0) {
3132                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3133                         __location__, strerror(errno)));
3134                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3135         }
3136
3137         sa = (struct sockaddr *)(void *)&ss;
3138         sa_socklen = sizeof(ss);
3139         ret = getsockname(sconn->sock, sa, &sa_socklen);
3140         if (ret != 0) {
3141                 int level = (errno == ENOTCONN)?2:0;
3142                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3143                 exit_server_cleanly("getsockname() failed.\n");
3144         }
3145         ret = tsocket_address_bsd_from_sockaddr(sconn,
3146                                                 sa, sa_socklen,
3147                                                 &local_address);
3148         if (ret != 0) {
3149                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3150                         __location__, strerror(errno)));
3151                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3152         }
3153
3154         sconn->local_address = local_address;
3155         sconn->remote_address = remote_address;
3156
3157         if (tsocket_address_is_inet(local_address, "ip")) {
3158                 locaddr = tsocket_address_inet_addr_string(
3159                                 sconn->local_address,
3160                                 talloc_tos());
3161                 if (locaddr == NULL) {
3162                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3163                                  __location__, strerror(errno)));
3164                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3165                 }
3166         } else {
3167                 locaddr = "0.0.0.0";
3168         }
3169
3170         if (tsocket_address_is_inet(remote_address, "ip")) {
3171                 remaddr = tsocket_address_inet_addr_string(
3172                                 sconn->remote_address,
3173                                 talloc_tos());
3174                 if (remaddr == NULL) {
3175                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3176                                  __location__, strerror(errno)));
3177                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3178                 }
3179         } else {
3180                 remaddr = "0.0.0.0";
3181         }
3182
3183         /* this is needed so that we get decent entries
3184            in smbstatus for port 445 connects */
3185         set_remote_machine_name(remaddr, false);
3186         reload_services(sconn, conn_snum_used, true);
3187
3188         /*
3189          * Before the first packet, check the global hosts allow/ hosts deny
3190          * parameters before doing any parsing of packets passed to us by the
3191          * client. This prevents attacks on our parsing code from hosts not in
3192          * the hosts allow list.
3193          */
3194
3195         ret = get_remote_hostname(remote_address,
3196                                   &rhost,
3197                                   talloc_tos());
3198         if (ret < 0) {
3199                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3200                         __location__, strerror(errno)));
3201                 exit_server_cleanly("get_remote_hostname failed.\n");
3202         }
3203         if (strequal(rhost, "UNKNOWN")) {
3204                 rhost = talloc_strdup(talloc_tos(), remaddr);
3205         }
3206         sconn->remote_hostname = talloc_move(sconn, &rhost);
3207
3208         sub_set_socket_ids(remaddr,
3209                            sconn->remote_hostname,
3210                            locaddr);
3211
3212         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3213                           sconn->remote_hostname,
3214                           remaddr)) {
3215                 /*
3216                  * send a negative session response "not listening on calling
3217                  * name"
3218                  */
3219                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3220                 DEBUG( 1, ("Connection denied from %s to %s\n",
3221                            tsocket_address_string(remote_address, talloc_tos()),
3222                            tsocket_address_string(local_address, talloc_tos())));
3223                 (void)srv_send_smb(sconn,(char *)buf, false,
3224                                    0, false, NULL);
3225                 exit_server_cleanly("connection denied");
3226         }
3227
3228         DEBUG(10, ("Connection allowed from %s to %s\n",
3229                    tsocket_address_string(remote_address, talloc_tos()),
3230                    tsocket_address_string(local_address, talloc_tos())));
3231
3232         init_modules();
3233
3234         smb_perfcount_init();
3235
3236         if (!init_account_policy()) {
3237                 exit_server("Could not open account policy tdb.\n");
3238         }
3239
3240         if (*lp_rootdir()) {
3241                 if (chroot(lp_rootdir()) != 0) {
3242                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3243                         exit_server("Failed to chroot()");
3244                 }
3245                 if (chdir("/") == -1) {
3246                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3247                         exit_server("Failed to chroot()");
3248                 }
3249                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3250         }
3251
3252         if (!srv_init_signing(sconn)) {
3253                 exit_server("Failed to init smb_signing");
3254         }
3255
3256         /* Setup oplocks */
3257         if (!init_oplocks(sconn))
3258                 exit_server("Failed to init oplocks");
3259
3260         /* register our message handlers */
3261         messaging_register(sconn->msg_ctx, sconn,
3262                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3263         messaging_register(sconn->msg_ctx, sconn,
3264                            MSG_SMB_CLOSE_FILE, msg_close_file);
3265         messaging_register(sconn->msg_ctx, sconn,
3266                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3267
3268         id_cache_register_msgs(sconn->msg_ctx);
3269         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3270         messaging_register(sconn->msg_ctx, sconn,
3271                            ID_CACHE_KILL, smbd_id_cache_kill);
3272
3273         messaging_deregister(sconn->msg_ctx,
3274                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3275         messaging_register(sconn->msg_ctx, sconn,
3276                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3277
3278         /*
3279          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3280          * MSGs to all child processes
3281          */
3282         messaging_deregister(sconn->msg_ctx,
3283                              MSG_DEBUG, NULL);
3284         messaging_register(sconn->msg_ctx, NULL,
3285                            MSG_DEBUG, debug_message);
3286
3287         if ((lp_keepalive() != 0)
3288             && !(event_add_idle(ev_ctx, NULL,
3289                                 timeval_set(lp_keepalive(), 0),
3290                                 "keepalive", keepalive_fn,
3291                                 sconn))) {
3292                 DEBUG(0, ("Could not add keepalive event\n"));
3293                 exit(1);
3294         }
3295
3296         if (!(event_add_idle(ev_ctx, NULL,
3297                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3298                              "deadtime", deadtime_fn, sconn))) {
3299                 DEBUG(0, ("Could not add deadtime event\n"));
3300                 exit(1);
3301         }
3302
3303         if (!(event_add_idle(ev_ctx, NULL,
3304                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3305                              "housekeeping", housekeeping_fn, sconn))) {
3306                 DEBUG(0, ("Could not add housekeeping event\n"));
3307                 exit(1);
3308         }
3309
3310 #ifdef CLUSTER_SUPPORT
3311
3312         if (lp_clustering()) {
3313                 /*
3314                  * We need to tell ctdb about our client's TCP
3315                  * connection, so that for failover ctdbd can send
3316                  * tickle acks, triggering a reconnection by the
3317                  * client.
3318                  */
3319
3320                 struct sockaddr_storage srv, clnt;
3321
3322                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3323                         NTSTATUS status;
3324                         status = smbd_register_ips(sconn, &srv, &clnt);
3325                         if (!NT_STATUS_IS_OK(status)) {
3326                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3327                                           nt_errstr(status)));
3328                         }
3329                 } else
3330                 {
3331                         DEBUG(0,("Unable to get tcp info for "
3332                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3333                                  strerror(errno)));
3334                 }
3335         }
3336
3337 #endif
3338
3339         sconn->nbt.got_session = false;
3340
3341         sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3342
3343         sconn->smb1.sessions.done_sesssetup = false;
3344         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3345         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3346         /* users from session setup */
3347         sconn->smb1.sessions.session_userlist = NULL;
3348         /* workgroup from session setup. */
3349         sconn->smb1.sessions.session_workgroup = NULL;
3350         /* this holds info on user ids that are already validated for this VC */
3351         sconn->smb1.sessions.validated_users = NULL;
3352         sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3353         sconn->smb1.sessions.num_validated_vuids = 0;
3354
3355         conn_init(sconn);
3356         if (!init_dptrs(sconn)) {
3357                 exit_server("init_dptrs() failed");
3358         }
3359
3360         sconn->smb1.fde = event_add_fd(ev_ctx,
3361                                                   sconn,
3362                                                   sconn->sock,
3363                                                   EVENT_FD_READ,
3364                                                   smbd_server_connection_handler,
3365                                                   sconn);
3366         if (!sconn->smb1.fde) {
3367                 exit_server("failed to create smbd_server_connection fde");
3368         }
3369
3370         TALLOC_FREE(frame);
3371
3372         while (True) {
3373                 NTSTATUS status;
3374
3375                 frame = talloc_stackframe_pool(8192);
3376
3377                 errno = 0;
3378
3379                 status = smbd_server_connection_loop_once(ev_ctx, sconn);
3380                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3381                     !NT_STATUS_IS_OK(status)) {
3382                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3383                                   " exiting\n", nt_errstr(status)));
3384                         break;
3385                 }
3386
3387                 TALLOC_FREE(frame);
3388         }
3389
3390         exit_server_cleanly(NULL);
3391 }
3392
3393 bool req_is_in_chain(struct smb_request *req)
3394 {
3395         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3396                 /*
3397                  * We're right now handling a subsequent request, so we must
3398                  * be in a chain
3399                  */
3400                 return true;
3401         }
3402
3403         if (!is_andx_req(req->cmd)) {
3404                 return false;
3405         }
3406
3407         if (req->wct < 2) {
3408                 /*
3409                  * Okay, an illegal request, but definitely not chained :-)
3410                  */
3411                 return false;
3412         }
3413
3414         return (CVAL(req->vwv+0, 0) != 0xFF);
3415 }