source/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 uint16 global_smbpid;
  25 extern int keepalive;
  26 extern struct auth_context *negprot_global_auth_context;
  27 extern int smb_echo_count;
  28
  29 static char *InBuffer = NULL;
  30 static char *OutBuffer = NULL;
  31 static char *current_inbuf = NULL;
  32
  33 /*
  34  * Size of data we can send to client. Set
  35  *  by the client for all protocols above CORE.
  36  *  Set by us for CORE protocol.
  37  */
  38 int max_send = BUFFER_SIZE;
  39 /*
  40  * Size of the data we can receive. Set by us.
  41  * Can be modified by the max xmit parameter.
  42  */
  43 int max_recv = BUFFER_SIZE;
  44
  45 extern int last_message;
  46 extern int smb_read_error;
  47 SIG_ATOMIC_T reload_after_sighup = 0;
  48 SIG_ATOMIC_T got_sig_term = 0;
  49 extern BOOL global_machine_password_needs_changing;
  50 extern int max_send;
  51
  52 /****************************************************************************
  53  Function to return the current request mid from Inbuffer.
  54 ****************************************************************************/
  55
  56 uint16 get_current_mid(void)
  57 {
  58         return SVAL(InBuffer,smb_mid);
  59 }
  60
  61 /****************************************************************************
  62  structure to hold a linked list of queued messages.
  63  for processing.
  64 ****************************************************************************/
  65
  66 static struct pending_message_list *deferred_open_queue;
  67
  68 /****************************************************************************
  69  Function to push a message onto the tail of a linked list of smb messages ready
  70  for processing.
  71 ****************************************************************************/
  72
  73 static BOOL push_queued_message(char *buf, int msg_len,
  74                                 struct timeval request_time,
  75                                 struct timeval end_time,
  76                                 char *private_data, size_t private_len)
  77 {
  78         struct pending_message_list *msg;
  79
  80         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
  81
  82         if(msg == NULL) {
  83                 DEBUG(0,("push_message: malloc fail (1)\n"));
  84                 return False;
  85         }
  86
  87         msg->buf = data_blob_talloc(msg, buf, msg_len);
  88         if(msg->buf.data == NULL) {
  89                 DEBUG(0,("push_message: malloc fail (2)\n"));
  90                 TALLOC_FREE(msg);
  91                 return False;
  92         }
  93
  94         msg->request_time = request_time;
  95         msg->end_time = end_time;
  96
  97         if (private_data) {
  98                 msg->private_data = data_blob_talloc(msg, private_data,
  99                                                      private_len);
 100                 if (msg->private_data.data == NULL) {
 101                         DEBUG(0,("push_message: malloc fail (3)\n"));
 102                         TALLOC_FREE(msg);
 103                         return False;
 104                 }
 105         }
 106
 107         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 108
 109         DEBUG(10,("push_message: pushed message length %u on "
 110                   "deferred_open_queue\n", (unsigned int)msg_len));
 111
 112         return True;
 113 }
 114
 115 /****************************************************************************
 116  Function to delete a sharing violation open message by mid.
 117 ****************************************************************************/
 118
 119 void remove_deferred_open_smb_message(uint16 mid)
 120 {
 121         struct pending_message_list *pml;
 122
 123         for (pml = deferred_open_queue; pml; pml = pml->next) {
 124                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 125                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 126                                   "deleting mid %u len %u\n",
 127                                   (unsigned int)mid,
 128                                   (unsigned int)pml->buf.length ));
 129                         DLIST_REMOVE(deferred_open_queue, pml);
 130                         TALLOC_FREE(pml);
 131                         return;
 132                 }
 133         }
 134 }
 135
 136 /****************************************************************************
 137  Move a sharing violation open retry message to the front of the list and
 138  schedule it for immediate processing.
 139 ****************************************************************************/
 140
 141 void schedule_deferred_open_smb_message(uint16 mid)
 142 {
 143         struct pending_message_list *pml;
 144         int i = 0;
 145
 146         for (pml = deferred_open_queue; pml; pml = pml->next) {
 147                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 148                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 149                         (unsigned int)msg_mid ));
 150                 if (mid == msg_mid) {
 151                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 152                                 mid ));
 153                         pml->end_time.tv_sec = 0;
 154                         pml->end_time.tv_usec = 0;
 155                         DLIST_PROMOTE(deferred_open_queue, pml);
 156                         return;
 157                 }
 158         }
 159
 160         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 161                 mid ));
 162 }
 163
 164 /****************************************************************************
 165  Return true if this mid is on the deferred queue.
 166 ****************************************************************************/
 167
 168 BOOL open_was_deferred(uint16 mid)
 169 {
 170         struct pending_message_list *pml;
 171
 172         for (pml = deferred_open_queue; pml; pml = pml->next) {
 173                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 174                         return True;
 175                 }
 176         }
 177         return False;
 178 }
 179
 180 /****************************************************************************
 181  Return the message queued by this mid.
 182 ****************************************************************************/
 183
 184 struct pending_message_list *get_open_deferred_message(uint16 mid)
 185 {
 186         struct pending_message_list *pml;
 187
 188         for (pml = deferred_open_queue; pml; pml = pml->next) {
 189                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 190                         return pml;
 191                 }
 192         }
 193         return NULL;
 194 }
 195
 196 /****************************************************************************
 197  Function to push a deferred open smb message onto a linked list of local smb
 198  messages ready for processing.
 199 ****************************************************************************/
 200
 201 BOOL push_deferred_smb_message(uint16 mid,
 202                                struct timeval request_time,
 203                                struct timeval timeout,
 204                                char *private_data, size_t priv_len)
 205 {
 206         struct timeval end_time;
 207
 208         end_time = timeval_sum(&request_time, &timeout);
 209
 210         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 211                   "timeout time [%u.%06u]\n",
 212                   (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
 213                   (unsigned int)end_time.tv_sec,
 214                   (unsigned int)end_time.tv_usec));
 215
 216         return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
 217                                    request_time, end_time,
 218                                    private_data, priv_len);
 219 }
 220
 221 struct idle_event {
 222         struct timed_event *te;
 223         struct timeval interval;
 224         BOOL (*handler)(const struct timeval *now, void *private_data);
 225         void *private_data;
 226 };
 227
 228 static void idle_event_handler(struct event_context *ctx,
 229                                struct timed_event *te,
 230                                const struct timeval *now,
 231                                void *private_data)
 232 {
 233         struct idle_event *event =
 234                 talloc_get_type_abort(private_data, struct idle_event);
 235
 236         TALLOC_FREE(event->te);
 237
 238         if (!event->handler(now, event->private_data)) {
 239                 /* Don't repeat, delete ourselves */
 240                 TALLOC_FREE(event);
 241                 return;
 242         }
 243
 244         event->te = event_add_timed(smbd_event_context(), event,
 245                                     timeval_sum(now, &event->interval),
 246                                     "idle_event_handler",
 247                                     idle_event_handler, event);
 248
 249         /* We can't do much but fail here. */
 250         SMB_ASSERT(event->te != NULL);
 251 }
 252
 253 struct idle_event *add_idle_event(TALLOC_CTX *mem_ctx,
 254                                   struct timeval interval,
 255                                   BOOL (*handler)(const struct timeval *now,
 256                                                   void *private_data),
 257                                   void *private_data)
 258 {
 259         struct idle_event *result;
 260         struct timeval now = timeval_current();
 261
 262         result = TALLOC_P(mem_ctx, struct idle_event);
 263         if (result == NULL) {
 264                 DEBUG(0, ("talloc failed\n"));
 265                 return NULL;
 266         }
 267
 268         result->interval = interval;
 269         result->handler = handler;
 270         result->private_data = private_data;
 271
 272         result->te = event_add_timed(smbd_event_context(), result,
 273                                      timeval_sum(&now, &interval),
 274                                      "idle_event_handler",
 275                                      idle_event_handler, result);
 276         if (result->te == NULL) {
 277                 DEBUG(0, ("event_add_timed failed\n"));
 278                 TALLOC_FREE(result);
 279                 return NULL;
 280         }
 281
 282         return result;
 283 }
 284
 285 /****************************************************************************
 286  Do all async processing in here. This includes kernel oplock messages, change
 287  notify events etc.
 288 ****************************************************************************/
 289
 290 static void async_processing(fd_set *pfds)
 291 {
 292         DEBUG(10,("async_processing: Doing async processing.\n"));
 293
 294         process_aio_queue();
 295
 296         process_kernel_oplocks(pfds);
 297
 298         /* Do the aio check again after receive_local_message as it does a
 299            select and may have eaten our signal. */
 300         /* Is this till true? -- vl */
 301         process_aio_queue();
 302
 303         if (got_sig_term) {
 304                 exit_server_cleanly("termination signal");
 305         }
 306
 307         /* check for sighup processing */
 308         if (reload_after_sighup) {
 309                 change_to_root_user();
 310                 DEBUG(1,("Reloading services after SIGHUP\n"));
 311                 reload_services(False);
 312                 reload_after_sighup = 0;
 313         }
 314 }
 315
 316 /****************************************************************************
 317  Add a fd to the set we will be select(2)ing on.
 318 ****************************************************************************/
 319
 320 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 321 {
 322         if (fd != -1) {
 323                 FD_SET(fd, fds);
 324                 maxfd = MAX(maxfd, fd);
 325         }
 326
 327         return maxfd;
 328 }
 329
 330 /****************************************************************************
 331   Do a select on an two fd's - with timeout.
 332
 333   If a local udp message has been pushed onto the
 334   queue (this can only happen during oplock break
 335   processing) call async_processing()
 336
 337   If a pending smb message has been pushed onto the
 338   queue (this can only happen during oplock break
 339   processing) return this next.
 340
 341   If the first smbfd is ready then read an smb from it.
 342   if the second (loopback UDP) fd is ready then read a message
 343   from it and setup the buffer header to identify the length
 344   and from address.
 345   Returns False on timeout or error.
 346   Else returns True.
 347
 348 The timeout is in milliseconds
 349 ****************************************************************************/
 350
 351 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 352 {
 353         fd_set r_fds, w_fds;
 354         int selrtn;
 355         struct timeval to;
 356         int maxfd = 0;
 357
 358         smb_read_error = 0;
 359
 360  again:
 361
 362         if (timeout >= 0) {
 363                 to.tv_sec = timeout / 1000;
 364                 to.tv_usec = (timeout % 1000) * 1000;
 365         } else {
 366                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 367                 to.tv_usec = 0;
 368         }
 369
 370         /*
 371          * Note that this call must be before processing any SMB
 372          * messages as we need to synchronously process any messages
 373          * we may have sent to ourselves from the previous SMB.
 374          */
 375         message_dispatch();
 376
 377         /*
 378          * Check to see if we already have a message on the deferred open queue
 379          * and it's time to schedule.
 380          */
 381         if(deferred_open_queue != NULL) {
 382                 BOOL pop_message = False;
 383                 struct pending_message_list *msg = deferred_open_queue;
 384
 385                 if (timeval_is_zero(&msg->end_time)) {
 386                         pop_message = True;
 387                 } else {
 388                         struct timeval tv;
 389                         SMB_BIG_INT tdif;
 390
 391                         GetTimeOfDay(&tv);
 392                         tdif = usec_time_diff(&msg->end_time, &tv);
 393                         if (tdif <= 0) {
 394                                 /* Timed out. Schedule...*/
 395                                 pop_message = True;
 396                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 397                         } else {
 398                                 /* Make a more accurate select timeout. */
 399                                 to.tv_sec = tdif / 1000000;
 400                                 to.tv_usec = tdif % 1000000;
 401                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 402                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 403                         }
 404                 }
 405
 406                 if (pop_message) {
 407                         memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 408
 409                         /* We leave this message on the queue so the open code can
 410                            know this is a retry. */
 411                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 412                         return True;
 413                 }
 414         }
 415
 416         /*
 417          * Setup the select fd sets.
 418          */
 419
 420         FD_ZERO(&r_fds);
 421         FD_ZERO(&w_fds);
 422
 423         /*
 424          * Ensure we process oplock break messages by preference.
 425          * We have to do this before the select, after the select
 426          * and if the select returns EINTR. This is due to the fact
 427          * that the selects called from async_processing can eat an EINTR
 428          * caused by a signal (we can't take the break message there).
 429          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 430          */
 431
 432         if (oplock_message_waiting(&r_fds)) {
 433                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 434                 async_processing(&r_fds);
 435                 /*
 436                  * After async processing we must go and do the select again, as
 437                  * the state of the flag in fds for the server file descriptor is
 438                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 439                  */
 440                 goto again;
 441         }
 442
 443         /*
 444          * Are there any timed events waiting ? If so, ensure we don't
 445          * select for longer than it would take to wait for them.
 446          */
 447
 448         {
 449                 struct timeval now;
 450                 GetTimeOfDay(&now);
 451
 452                 event_add_to_select_args(smbd_event_context(), &now,
 453                                          &r_fds, &w_fds, &to, &maxfd);
 454         }
 455
 456         if (timeval_is_zero(&to)) {
 457                 /* Process a timed event now... */
 458                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 459                         goto again;
 460                 }
 461         }
 462
 463         {
 464                 int sav;
 465                 START_PROFILE(smbd_idle);
 466
 467                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 468                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 469
 470                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 471                 sav = errno;
 472
 473                 END_PROFILE(smbd_idle);
 474                 errno = sav;
 475         }
 476
 477         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 478                 goto again;
 479         }
 480
 481         /* if we get EINTR then maybe we have received an oplock
 482            signal - treat this as select returning 1. This is ugly, but
 483            is the best we can do until the oplock code knows more about
 484            signals */
 485         if (selrtn == -1 && errno == EINTR) {
 486                 async_processing(&r_fds);
 487                 /*
 488                  * After async processing we must go and do the select again, as
 489                  * the state of the flag in fds for the server file descriptor is
 490                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 491                  */
 492                 goto again;
 493         }
 494
 495         /* Check if error */
 496         if (selrtn == -1) {
 497                 /* something is wrong. Maybe the socket is dead? */
 498                 smb_read_error = READ_ERROR;
 499                 return False;
 500         }
 501
 502         /* Did we timeout ? */
 503         if (selrtn == 0) {
 504                 smb_read_error = READ_TIMEOUT;
 505                 return False;
 506         }
 507
 508         /*
 509          * Ensure we process oplock break messages by preference.
 510          * This is IMPORTANT ! Otherwise we can starve other processes
 511          * sending us an oplock break message. JRA.
 512          */
 513
 514         if (oplock_message_waiting(&r_fds)) {
 515                 async_processing(&r_fds);
 516                 /*
 517                  * After async processing we must go and do the select again, as
 518                  * the state of the flag in fds for the server file descriptor is
 519                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 520                  */
 521                 goto again;
 522         }
 523
 524         return receive_smb(smbd_server_fd(), buffer,
 525                         BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE, 0);
 526 }
 527
 528 /*
 529  * Only allow 5 outstanding trans requests. We're allocating memory, so
 530  * prevent a DoS.
 531  */
 532
 533 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 534 {
 535         int count = 0;
 536         for (; list != NULL; list = list->next) {
 537
 538                 if (list->mid == mid) {
 539                         return NT_STATUS_INVALID_PARAMETER;
 540                 }
 541
 542                 count += 1;
 543         }
 544         if (count > 5) {
 545                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 546         }
 547
 548         return NT_STATUS_OK;
 549 }
 550
 551 /****************************************************************************
 552  We're terminating and have closed all our files/connections etc.
 553  If there are any pending local messages we need to respond to them
 554  before termination so that other smbds don't think we just died whilst
 555  holding oplocks.
 556 ****************************************************************************/
 557
 558 void respond_to_all_remaining_local_messages(void)
 559 {
 560         /*
 561          * Assert we have no exclusive open oplocks.
 562          */
 563
 564         if(get_number_of_exclusive_open_oplocks()) {
 565                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 566                         get_number_of_exclusive_open_oplocks() ));
 567                 return;
 568         }
 569
 570         process_kernel_oplocks(NULL);
 571
 572         return;
 573 }
 574
 575
 576 /*
 577 These flags determine some of the permissions required to do an operation
 578
 579 Note that I don't set NEED_WRITE on some write operations because they
 580 are used by some brain-dead clients when printing, and I don't want to
 581 force write permissions on print services.
 582 */
 583 #define AS_USER (1<<0)
 584 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 585 #define TIME_INIT (1<<2)
 586 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 587 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 588 #define DO_CHDIR (1<<6)
 589
 590 /*
 591    define a list of possible SMB messages and their corresponding
 592    functions. Any message that has a NULL function is unimplemented -
 593    please feel free to contribute implementations!
 594 */
 595 static const struct smb_message_struct {
 596         const char *name;
 597         int (*fn)(connection_struct *conn, char *, char *, int, int);
 598         int flags;
 599 } smb_messages[256] = {
 600
 601 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 602 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 603 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 604 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 605 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 606 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 607 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 608 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 609 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 610 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 611 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 612 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 613 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 614 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 615 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 616 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 617 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 618 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 619 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 620 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 621 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 622 /* 0x15 */ { NULL, NULL, 0 },
 623 /* 0x16 */ { NULL, NULL, 0 },
 624 /* 0x17 */ { NULL, NULL, 0 },
 625 /* 0x18 */ { NULL, NULL, 0 },
 626 /* 0x19 */ { NULL, NULL, 0 },
 627 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 628 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 629 /* 0x1c */ { "SMBreadBs",NULL,0 },
 630 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 631 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 632 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 633 /* 0x20 */ { "SMBwritec",NULL,0},
 634 /* 0x21 */ { NULL, NULL, 0 },
 635 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 636 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 637 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 638 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 639 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 640 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 641 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 642 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 643 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
 644 /* 0x2b */ { "SMBecho",reply_echo,0},
 645 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 646 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 647 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 648 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 649 /* 0x30 */ { NULL, NULL, 0 },
 650 /* 0x31 */ { NULL, NULL, 0 },
 651 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 652 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 653 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 654 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 655 /* 0x36 */ { NULL, NULL, 0 },
 656 /* 0x37 */ { NULL, NULL, 0 },
 657 /* 0x38 */ { NULL, NULL, 0 },
 658 /* 0x39 */ { NULL, NULL, 0 },
 659 /* 0x3a */ { NULL, NULL, 0 },
 660 /* 0x3b */ { NULL, NULL, 0 },
 661 /* 0x3c */ { NULL, NULL, 0 },
 662 /* 0x3d */ { NULL, NULL, 0 },
 663 /* 0x3e */ { NULL, NULL, 0 },
 664 /* 0x3f */ { NULL, NULL, 0 },
 665 /* 0x40 */ { NULL, NULL, 0 },
 666 /* 0x41 */ { NULL, NULL, 0 },
 667 /* 0x42 */ { NULL, NULL, 0 },
 668 /* 0x43 */ { NULL, NULL, 0 },
 669 /* 0x44 */ { NULL, NULL, 0 },
 670 /* 0x45 */ { NULL, NULL, 0 },
 671 /* 0x46 */ { NULL, NULL, 0 },
 672 /* 0x47 */ { NULL, NULL, 0 },
 673 /* 0x48 */ { NULL, NULL, 0 },
 674 /* 0x49 */ { NULL, NULL, 0 },
 675 /* 0x4a */ { NULL, NULL, 0 },
 676 /* 0x4b */ { NULL, NULL, 0 },
 677 /* 0x4c */ { NULL, NULL, 0 },
 678 /* 0x4d */ { NULL, NULL, 0 },
 679 /* 0x4e */ { NULL, NULL, 0 },
 680 /* 0x4f */ { NULL, NULL, 0 },
 681 /* 0x50 */ { NULL, NULL, 0 },
 682 /* 0x51 */ { NULL, NULL, 0 },
 683 /* 0x52 */ { NULL, NULL, 0 },
 684 /* 0x53 */ { NULL, NULL, 0 },
 685 /* 0x54 */ { NULL, NULL, 0 },
 686 /* 0x55 */ { NULL, NULL, 0 },
 687 /* 0x56 */ { NULL, NULL, 0 },
 688 /* 0x57 */ { NULL, NULL, 0 },
 689 /* 0x58 */ { NULL, NULL, 0 },
 690 /* 0x59 */ { NULL, NULL, 0 },
 691 /* 0x5a */ { NULL, NULL, 0 },
 692 /* 0x5b */ { NULL, NULL, 0 },
 693 /* 0x5c */ { NULL, NULL, 0 },
 694 /* 0x5d */ { NULL, NULL, 0 },
 695 /* 0x5e */ { NULL, NULL, 0 },
 696 /* 0x5f */ { NULL, NULL, 0 },
 697 /* 0x60 */ { NULL, NULL, 0 },
 698 /* 0x61 */ { NULL, NULL, 0 },
 699 /* 0x62 */ { NULL, NULL, 0 },
 700 /* 0x63 */ { NULL, NULL, 0 },
 701 /* 0x64 */ { NULL, NULL, 0 },
 702 /* 0x65 */ { NULL, NULL, 0 },
 703 /* 0x66 */ { NULL, NULL, 0 },
 704 /* 0x67 */ { NULL, NULL, 0 },
 705 /* 0x68 */ { NULL, NULL, 0 },
 706 /* 0x69 */ { NULL, NULL, 0 },
 707 /* 0x6a */ { NULL, NULL, 0 },
 708 /* 0x6b */ { NULL, NULL, 0 },
 709 /* 0x6c */ { NULL, NULL, 0 },
 710 /* 0x6d */ { NULL, NULL, 0 },
 711 /* 0x6e */ { NULL, NULL, 0 },
 712 /* 0x6f */ { NULL, NULL, 0 },
 713 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 714 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
 715 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 716 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 717 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 718 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 719 /* 0x76 */ { NULL, NULL, 0 },
 720 /* 0x77 */ { NULL, NULL, 0 },
 721 /* 0x78 */ { NULL, NULL, 0 },
 722 /* 0x79 */ { NULL, NULL, 0 },
 723 /* 0x7a */ { NULL, NULL, 0 },
 724 /* 0x7b */ { NULL, NULL, 0 },
 725 /* 0x7c */ { NULL, NULL, 0 },
 726 /* 0x7d */ { NULL, NULL, 0 },
 727 /* 0x7e */ { NULL, NULL, 0 },
 728 /* 0x7f */ { NULL, NULL, 0 },
 729 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 730 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 731 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 732 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 733 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 734 /* 0x85 */ { NULL, NULL, 0 },
 735 /* 0x86 */ { NULL, NULL, 0 },
 736 /* 0x87 */ { NULL, NULL, 0 },
 737 /* 0x88 */ { NULL, NULL, 0 },
 738 /* 0x89 */ { NULL, NULL, 0 },
 739 /* 0x8a */ { NULL, NULL, 0 },
 740 /* 0x8b */ { NULL, NULL, 0 },
 741 /* 0x8c */ { NULL, NULL, 0 },
 742 /* 0x8d */ { NULL, NULL, 0 },
 743 /* 0x8e */ { NULL, NULL, 0 },
 744 /* 0x8f */ { NULL, NULL, 0 },
 745 /* 0x90 */ { NULL, NULL, 0 },
 746 /* 0x91 */ { NULL, NULL, 0 },
 747 /* 0x92 */ { NULL, NULL, 0 },
 748 /* 0x93 */ { NULL, NULL, 0 },
 749 /* 0x94 */ { NULL, NULL, 0 },
 750 /* 0x95 */ { NULL, NULL, 0 },
 751 /* 0x96 */ { NULL, NULL, 0 },
 752 /* 0x97 */ { NULL, NULL, 0 },
 753 /* 0x98 */ { NULL, NULL, 0 },
 754 /* 0x99 */ { NULL, NULL, 0 },
 755 /* 0x9a */ { NULL, NULL, 0 },
 756 /* 0x9b */ { NULL, NULL, 0 },
 757 /* 0x9c */ { NULL, NULL, 0 },
 758 /* 0x9d */ { NULL, NULL, 0 },
 759 /* 0x9e */ { NULL, NULL, 0 },
 760 /* 0x9f */ { NULL, NULL, 0 },
 761 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
 762 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 763 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
 764 /* 0xa3 */ { NULL, NULL, 0 },
 765 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 766 /* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
 767 /* 0xa6 */ { NULL, NULL, 0 },
 768 /* 0xa7 */ { NULL, NULL, 0 },
 769 /* 0xa8 */ { NULL, NULL, 0 },
 770 /* 0xa9 */ { NULL, NULL, 0 },
 771 /* 0xaa */ { NULL, NULL, 0 },
 772 /* 0xab */ { NULL, NULL, 0 },
 773 /* 0xac */ { NULL, NULL, 0 },
 774 /* 0xad */ { NULL, NULL, 0 },
 775 /* 0xae */ { NULL, NULL, 0 },
 776 /* 0xaf */ { NULL, NULL, 0 },
 777 /* 0xb0 */ { NULL, NULL, 0 },
 778 /* 0xb1 */ { NULL, NULL, 0 },
 779 /* 0xb2 */ { NULL, NULL, 0 },
 780 /* 0xb3 */ { NULL, NULL, 0 },
 781 /* 0xb4 */ { NULL, NULL, 0 },
 782 /* 0xb5 */ { NULL, NULL, 0 },
 783 /* 0xb6 */ { NULL, NULL, 0 },
 784 /* 0xb7 */ { NULL, NULL, 0 },
 785 /* 0xb8 */ { NULL, NULL, 0 },
 786 /* 0xb9 */ { NULL, NULL, 0 },
 787 /* 0xba */ { NULL, NULL, 0 },
 788 /* 0xbb */ { NULL, NULL, 0 },
 789 /* 0xbc */ { NULL, NULL, 0 },
 790 /* 0xbd */ { NULL, NULL, 0 },
 791 /* 0xbe */ { NULL, NULL, 0 },
 792 /* 0xbf */ { NULL, NULL, 0 },
 793 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
 794 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 795 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 796 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 797 /* 0xc4 */ { NULL, NULL, 0 },
 798 /* 0xc5 */ { NULL, NULL, 0 },
 799 /* 0xc6 */ { NULL, NULL, 0 },
 800 /* 0xc7 */ { NULL, NULL, 0 },
 801 /* 0xc8 */ { NULL, NULL, 0 },
 802 /* 0xc9 */ { NULL, NULL, 0 },
 803 /* 0xca */ { NULL, NULL, 0 },
 804 /* 0xcb */ { NULL, NULL, 0 },
 805 /* 0xcc */ { NULL, NULL, 0 },
 806 /* 0xcd */ { NULL, NULL, 0 },
 807 /* 0xce */ { NULL, NULL, 0 },
 808 /* 0xcf */ { NULL, NULL, 0 },
 809 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 810 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 811 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 812 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 813 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 814 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 815 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 816 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 817 /* 0xd8 */ { NULL, NULL, 0 },
 818 /* 0xd9 */ { NULL, NULL, 0 },
 819 /* 0xda */ { NULL, NULL, 0 },
 820 /* 0xdb */ { NULL, NULL, 0 },
 821 /* 0xdc */ { NULL, NULL, 0 },
 822 /* 0xdd */ { NULL, NULL, 0 },
 823 /* 0xde */ { NULL, NULL, 0 },
 824 /* 0xdf */ { NULL, NULL, 0 },
 825 /* 0xe0 */ { NULL, NULL, 0 },
 826 /* 0xe1 */ { NULL, NULL, 0 },
 827 /* 0xe2 */ { NULL, NULL, 0 },
 828 /* 0xe3 */ { NULL, NULL, 0 },
 829 /* 0xe4 */ { NULL, NULL, 0 },
 830 /* 0xe5 */ { NULL, NULL, 0 },
 831 /* 0xe6 */ { NULL, NULL, 0 },
 832 /* 0xe7 */ { NULL, NULL, 0 },
 833 /* 0xe8 */ { NULL, NULL, 0 },
 834 /* 0xe9 */ { NULL, NULL, 0 },
 835 /* 0xea */ { NULL, NULL, 0 },
 836 /* 0xeb */ { NULL, NULL, 0 },
 837 /* 0xec */ { NULL, NULL, 0 },
 838 /* 0xed */ { NULL, NULL, 0 },
 839 /* 0xee */ { NULL, NULL, 0 },
 840 /* 0xef */ { NULL, NULL, 0 },
 841 /* 0xf0 */ { NULL, NULL, 0 },
 842 /* 0xf1 */ { NULL, NULL, 0 },
 843 /* 0xf2 */ { NULL, NULL, 0 },
 844 /* 0xf3 */ { NULL, NULL, 0 },
 845 /* 0xf4 */ { NULL, NULL, 0 },
 846 /* 0xf5 */ { NULL, NULL, 0 },
 847 /* 0xf6 */ { NULL, NULL, 0 },
 848 /* 0xf7 */ { NULL, NULL, 0 },
 849 /* 0xf8 */ { NULL, NULL, 0 },
 850 /* 0xf9 */ { NULL, NULL, 0 },
 851 /* 0xfa */ { NULL, NULL, 0 },
 852 /* 0xfb */ { NULL, NULL, 0 },
 853 /* 0xfc */ { NULL, NULL, 0 },
 854 /* 0xfd */ { NULL, NULL, 0 },
 855 /* 0xfe */ { NULL, NULL, 0 },
 856 /* 0xff */ { NULL, NULL, 0 }
 857
 858 };
 859
 860 /*******************************************************************
 861  Dump a packet to a file.
 862 ********************************************************************/
 863
 864 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 865 {
 866         int fd, i;
 867         pstring fname;
 868         if (DEBUGLEVEL < 50) return;
 869
 870         if (len < 4) len = smb_len(data)+4;
 871         for (i=1;i<100;i++) {
 872                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 873                                 type ? "req" : "resp");
 874                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 875                 if (fd != -1 || errno != EEXIST) break;
 876         }
 877         if (fd != -1) {
 878                 ssize_t ret = write(fd, data, len);
 879                 if (ret != len)
 880                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 881                 close(fd);
 882                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
 883         }
 884 }
 885
 886
 887 /****************************************************************************
 888  Do a switch on the message type, and return the response size
 889 ****************************************************************************/
 890
 891 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 892 {
 893         static pid_t pid= (pid_t)-1;
 894         int outsize = 0;
 895
 896         type &= 0xff;
 897
 898         if (pid == (pid_t)-1)
 899                 pid = sys_getpid();
 900
 901         errno = 0;
 902
 903         last_message = type;
 904
 905         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 906         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 907                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 908                 exit_server_cleanly("Non-SMB packet");
 909                 return(-1);
 910         }
 911
 912         /* yuck! this is an interim measure before we get rid of our
 913                 current inbuf/outbuf system */
 914         global_smbpid = SVAL(inbuf,smb_pid);
 915
 916         if (smb_messages[type].fn == NULL) {
 917                 DEBUG(0,("Unknown message type %d!\n",type));
 918                 smb_dump("Unknown", 1, inbuf, size);
 919                 outsize = reply_unknown(inbuf,outbuf);
 920         } else {
 921                 int flags = smb_messages[type].flags;
 922                 static uint16 last_session_tag = UID_FIELD_INVALID;
 923                 /* In share mode security we must ignore the vuid. */
 924                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 925                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 926
 927                 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
 928
 929                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 930
 931                 /* Ensure this value is replaced in the incoming packet. */
 932                 SSVAL(inbuf,smb_uid,session_tag);
 933
 934                 /*
 935                  * Ensure the correct username is in current_user_info.
 936                  * This is a really ugly bugfix for problems with
 937                  * multiple session_setup_and_X's being done and
 938                  * allowing %U and %G substitutions to work correctly.
 939                  * There is a reason this code is done here, don't
 940                  * move it unless you know what you're doing... :-).
 941                  * JRA.
 942                  */
 943
 944                 if (session_tag != last_session_tag) {
 945                         user_struct *vuser = NULL;
 946
 947                         last_session_tag = session_tag;
 948                         if(session_tag != UID_FIELD_INVALID) {
 949                                 vuser = get_valid_user_struct(session_tag);
 950                                 if (vuser) {
 951                                         set_current_user_info(&vuser->user);
 952                                 }
 953                         }
 954                 }
 955
 956                 /* Does this call need to be run as the connected user? */
 957                 if (flags & AS_USER) {
 958
 959                         /* Does this call need a valid tree connection? */
 960                         if (!conn) {
 961                                 /* Amazingly, the error code depends on the command (from Samba4). */
 962                                 if (type == SMBntcreateX) {
 963                                         return ERROR_NT(NT_STATUS_INVALID_HANDLE);
 964                                 } else {
 965                                         return ERROR_DOS(ERRSRV, ERRinvnid);
 966                                 }
 967                         }
 968
 969                         if (!change_to_user(conn,session_tag)) {
 970                                 return(ERROR_NT(NT_STATUS_DOS(ERRSRV,ERRbaduid)));
 971                         }
 972
 973                         /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
 974
 975                         /* Does it need write permission? */
 976                         if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
 977                                 return ERROR_NT(NT_STATUS_MEDIA_WRITE_PROTECTED);
 978                         }
 979
 980                         /* IPC services are limited */
 981                         if (IS_IPC(conn) && !(flags & CAN_IPC)) {
 982                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 983                         }
 984                 } else {
 985                         /* This call needs to be run as root */
 986                         change_to_root_user();
 987                 }
 988
 989                 /* load service specific parameters */
 990                 if (conn) {
 991                         if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
 992                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 993                         }
 994                         conn->num_smb_operations++;
 995                 }
 996
 997                 /* does this protocol need to be run as guest? */
 998                 if ((flags & AS_GUEST) && (!change_to_guest() ||
 999                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
1000                         return(ERROR_DOS(ERRSRV,ERRaccess));
1001                 }
1002
1003                 current_inbuf = inbuf; /* In case we need to defer this message in open... */
1004                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1005         }
1006
1007         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1008
1009         return(outsize);
1010 }
1011
1012 /****************************************************************************
1013  Construct a reply to the incoming packet.
1014 ****************************************************************************/
1015
1016 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1017 {
1018         int type = CVAL(inbuf,smb_com);
1019         int outsize = 0;
1020         int msg_type = CVAL(inbuf,0);
1021
1022         chain_size = 0;
1023         file_chain_reset();
1024         reset_chain_p();
1025
1026         if (msg_type != 0)
1027                 return(reply_special(inbuf,outbuf));
1028
1029         construct_reply_common(inbuf, outbuf);
1030
1031         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1032
1033         outsize += chain_size;
1034
1035         if(outsize > 4)
1036                 smb_setlen(outbuf,outsize - 4);
1037         return(outsize);
1038 }
1039
1040 /****************************************************************************
1041  Process an smb from the client
1042 ****************************************************************************/
1043
1044 static void process_smb(char *inbuf, char *outbuf)
1045 {
1046         static int trans_num;
1047         int msg_type = CVAL(inbuf,0);
1048         int32 len = smb_len(inbuf);
1049         int nread = len + 4;
1050
1051         DO_PROFILE_INC(smb_count);
1052
1053         if (trans_num == 0) {
1054                 /* on the first packet, check the global hosts allow/ hosts
1055                 deny parameters before doing any parsing of the packet
1056                 passed to us by the client.  This prevents attacks on our
1057                 parsing code from hosts not in the hosts allow list */
1058                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1059                                   lp_hostsdeny(-1))) {
1060                         /* send a negative session response "not listening on calling name" */
1061                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1062                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1063                         (void)send_smb(smbd_server_fd(),(char *)buf);
1064                         exit_server_cleanly("connection denied");
1065                 }
1066         }
1067
1068         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1069         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1070
1071         if (msg_type == 0)
1072                 show_msg(inbuf);
1073         else if(msg_type == SMBkeepalive)
1074                 return; /* Keepalive packet. */
1075
1076         nread = construct_reply(inbuf,outbuf,nread,max_send);
1077
1078         if(nread > 0) {
1079                 if (CVAL(outbuf,0) == 0)
1080                         show_msg(outbuf);
1081
1082                 if (nread != smb_len(outbuf) + 4) {
1083                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1084                                 nread, smb_len(outbuf)));
1085                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1086                         exit_server_cleanly("process_smb: send_smb failed.");
1087                 }
1088         }
1089         trans_num++;
1090 }
1091
1092 /****************************************************************************
1093  Return a string containing the function name of a SMB command.
1094 ****************************************************************************/
1095
1096 const char *smb_fn_name(int type)
1097 {
1098         const char *unknown_name = "SMBunknown";
1099
1100         if (smb_messages[type].name == NULL)
1101                 return(unknown_name);
1102
1103         return(smb_messages[type].name);
1104 }
1105
1106 /****************************************************************************
1107  Helper functions for contruct_reply.
1108 ****************************************************************************/
1109
1110 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1111
1112 void add_to_common_flags2(uint32 v)
1113 {
1114         common_flags2 |= v;
1115 }
1116
1117 void remove_from_common_flags2(uint32 v)
1118 {
1119         common_flags2 &= ~v;
1120 }
1121
1122 void construct_reply_common(const char *inbuf, char *outbuf)
1123 {
1124         set_message(outbuf,0,0,False);
1125
1126         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1127         SIVAL(outbuf,smb_rcls,0);
1128         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1129         SSVAL(outbuf,smb_flg2,
1130                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1131                 common_flags2);
1132         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1133
1134         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1135         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1136         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1137         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1138 }
1139
1140 /****************************************************************************
1141  Construct a chained reply and add it to the already made reply
1142 ****************************************************************************/
1143
1144 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1145 {
1146         static char *orig_inbuf;
1147         static char *orig_outbuf;
1148         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1149         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1150         char *inbuf2, *outbuf2;
1151         int outsize2;
1152         int new_size;
1153         char inbuf_saved[smb_wct];
1154         char outbuf_saved[smb_wct];
1155         int outsize = smb_len(outbuf) + 4;
1156
1157         /* Maybe its not chained, or it's an error packet. */
1158         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1159                 SCVAL(outbuf,smb_vwv0,0xFF);
1160                 return outsize;
1161         }
1162
1163         if (chain_size == 0) {
1164                 /* this is the first part of the chain */
1165                 orig_inbuf = inbuf;
1166                 orig_outbuf = outbuf;
1167         }
1168
1169         /*
1170          * The original Win95 redirector dies on a reply to
1171          * a lockingX and read chain unless the chain reply is
1172          * 4 byte aligned. JRA.
1173          */
1174
1175         outsize = (outsize + 3) & ~3;
1176
1177         /* we need to tell the client where the next part of the reply will be */
1178         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1179         SCVAL(outbuf,smb_vwv0,smb_com2);
1180
1181         /* remember how much the caller added to the chain, only counting stuff
1182                 after the parameter words */
1183         chain_size += outsize - smb_wct;
1184
1185         /* work out pointers into the original packets. The
1186                 headers on these need to be filled in */
1187         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1188         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1189
1190         /* remember the original command type */
1191         smb_com1 = CVAL(orig_inbuf,smb_com);
1192
1193         /* save the data which will be overwritten by the new headers */
1194         memcpy(inbuf_saved,inbuf2,smb_wct);
1195         memcpy(outbuf_saved,outbuf2,smb_wct);
1196
1197         /* give the new packet the same header as the last part of the SMB */
1198         memmove(inbuf2,inbuf,smb_wct);
1199
1200         /* create the in buffer */
1201         SCVAL(inbuf2,smb_com,smb_com2);
1202
1203         /* work out the new size for the in buffer. */
1204         new_size = size - (inbuf2 - inbuf);
1205         if (new_size < 0) {
1206                 DEBUG(0,("chain_reply: chain packet size incorrect (orig size = %d, "
1207                         "offset = %d)\n",
1208                         size,
1209                         (inbuf2 - inbuf) ));
1210                 exit_server_cleanly("Bad chained packet");
1211                 return(-1);
1212         }
1213
1214         /* And set it in the header. */
1215         smb_setlen(inbuf2, new_size);
1216
1217         /* create the out buffer */
1218         construct_reply_common(inbuf2, outbuf2);
1219
1220         DEBUG(3,("Chained message\n"));
1221         show_msg(inbuf2);
1222
1223         /* process the request */
1224         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,new_size,
1225                                 bufsize-chain_size);
1226
1227         /* copy the new reply and request headers over the old ones, but
1228                 preserve the smb_com field */
1229         memmove(orig_outbuf,outbuf2,smb_wct);
1230         SCVAL(orig_outbuf,smb_com,smb_com1);
1231
1232         /* restore the saved data, being careful not to overwrite any
1233                 data from the reply header */
1234         memcpy(inbuf2,inbuf_saved,smb_wct);
1235
1236         {
1237                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1238                 if (ofs < 0) {
1239                         ofs = 0;
1240                 }
1241                 memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1242         }
1243
1244         return outsize2;
1245 }
1246
1247 /****************************************************************************
1248  Setup the needed select timeout in milliseconds.
1249 ****************************************************************************/
1250
1251 static int setup_select_timeout(void)
1252 {
1253         int select_timeout;
1254
1255         select_timeout = blocking_locks_timeout_ms(SMBD_SELECT_TIMEOUT*1000);
1256
1257         if (print_notify_messages_pending()) {
1258                 select_timeout = MIN(select_timeout, 1000);
1259         }
1260
1261         return select_timeout;
1262 }
1263
1264 /****************************************************************************
1265  Check if services need reloading.
1266 ****************************************************************************/
1267
1268 void check_reload(time_t t)
1269 {
1270         static pid_t mypid = 0;
1271         static time_t last_smb_conf_reload_time = 0;
1272         static time_t last_printer_reload_time = 0;
1273         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1274
1275         if(last_smb_conf_reload_time == 0) {
1276                 last_smb_conf_reload_time = t;
1277                 /* Our printing subsystem might not be ready at smbd start up.
1278                    Then no printer is available till the first printers check
1279                    is performed.  A lower initial interval circumvents this. */
1280                 if ( printcap_cache_time > 60 )
1281                         last_printer_reload_time = t - printcap_cache_time + 60;
1282                 else
1283                         last_printer_reload_time = t;
1284         }
1285
1286         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1287                 /* randomize over 60 second the printcap reload to avoid all
1288                  * process hitting cupsd at the same time */
1289                 int time_range = 60;
1290
1291                 last_printer_reload_time += random() % time_range;
1292                 mypid = getpid();
1293         }
1294
1295         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1296                 reload_services(True);
1297                 reload_after_sighup = False;
1298                 last_smb_conf_reload_time = t;
1299         }
1300
1301         /* 'printcap cache time = 0' disable the feature */
1302
1303         if ( printcap_cache_time != 0 )
1304         {
1305                 /* see if it's time to reload or if the clock has been set back */
1306
1307                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1308                         || (t-last_printer_reload_time  < 0) )
1309                 {
1310                         DEBUG( 3,( "Printcap cache time expired.\n"));
1311                         reload_printers();
1312                         last_printer_reload_time = t;
1313                 }
1314         }
1315 }
1316
1317 /****************************************************************************
1318  Process any timeout housekeeping. Return False if the caller should exit.
1319 ****************************************************************************/
1320
1321 static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1322 {
1323         static time_t last_keepalive_sent_time = 0;
1324         static time_t last_idle_closed_check = 0;
1325         time_t t;
1326         BOOL allidle = True;
1327
1328         if (smb_read_error == READ_EOF) {
1329                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1330                 return False;
1331         }
1332
1333         if (smb_read_error == READ_ERROR) {
1334                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1335                         strerror(errno)));
1336                 return False;
1337         }
1338
1339         if (smb_read_error == READ_BAD_SIG) {
1340                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1341                 return False;
1342         }
1343
1344         *last_timeout_processing_time = t = time(NULL);
1345
1346         if(last_keepalive_sent_time == 0)
1347                 last_keepalive_sent_time = t;
1348
1349         if(last_idle_closed_check == 0)
1350                 last_idle_closed_check = t;
1351
1352         /* become root again if waiting */
1353         change_to_root_user();
1354
1355         /* run all registered idle events */
1356         smb_run_idle_events(t);
1357
1358         /* check if we need to reload services */
1359         check_reload(t);
1360
1361         /* automatic timeout if all connections are closed */
1362         if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1363                 DEBUG( 2, ( "Closing idle connection\n" ) );
1364                 return False;
1365         } else {
1366                 last_idle_closed_check = t;
1367         }
1368
1369         if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1370                 if (!send_keepalive(smbd_server_fd())) {
1371                         DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1372                         return False;
1373                 }
1374
1375                 /* send a keepalive for a password server or the like.
1376                         This is attached to the auth_info created in the
1377                 negprot */
1378                 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1379                                 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1380
1381                         negprot_global_auth_context->challenge_set_method->send_keepalive
1382                         (&negprot_global_auth_context->challenge_set_method->private_data);
1383                 }
1384
1385                 last_keepalive_sent_time = t;
1386         }
1387
1388         /* check for connection timeouts */
1389         allidle = conn_idle_all(t, deadtime);
1390
1391         if (allidle && conn_num_open()>0) {
1392                 DEBUG(2,("Closing idle connection 2.\n"));
1393                 return False;
1394         }
1395
1396         if(global_machine_password_needs_changing &&
1397                         /* for ADS we need to do a regular ADS password change, not a domain
1398                                         password change */
1399                         lp_security() == SEC_DOMAIN) {
1400
1401                 unsigned char trust_passwd_hash[16];
1402                 time_t lct;
1403
1404                 /*
1405                  * We're in domain level security, and the code that
1406                  * read the machine password flagged that the machine
1407                  * password needs changing.
1408                  */
1409
1410                 /*
1411                  * First, open the machine password file with an exclusive lock.
1412                  */
1413
1414                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1415                         DEBUG(0,("process: unable to lock the machine account password for \
1416 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1417                         return True;
1418                 }
1419
1420                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1421                         DEBUG(0,("process: unable to read the machine account password for \
1422 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1423                         secrets_lock_trust_account_password(lp_workgroup(), False);
1424                         return True;
1425                 }
1426
1427                 /*
1428                  * Make sure someone else hasn't already done this.
1429                  */
1430
1431                 if(t < lct + lp_machine_password_timeout()) {
1432                         global_machine_password_needs_changing = False;
1433                         secrets_lock_trust_account_password(lp_workgroup(), False);
1434                         return True;
1435                 }
1436
1437                 /* always just contact the PDC here */
1438
1439                 change_trust_account_password( lp_workgroup(), NULL);
1440                 global_machine_password_needs_changing = False;
1441                 secrets_lock_trust_account_password(lp_workgroup(), False);
1442         }
1443
1444         /*
1445          * Check to see if we have any blocking locks
1446          * outstanding on the queue.
1447          */
1448         process_blocking_lock_queue();
1449
1450         /* update printer queue caches if necessary */
1451
1452         update_monitored_printq_cache();
1453
1454         /*
1455          * Now we are root, check if the log files need pruning.
1456          * Force a log file check.
1457          */
1458         force_check_log_size();
1459         check_log_size();
1460
1461         /* Send any queued printer notify message to interested smbd's. */
1462
1463         print_notify_send_messages(0);
1464
1465         /*
1466          * Modify the select timeout depending upon
1467          * what we have remaining in our queues.
1468          */
1469
1470         *select_timeout = setup_select_timeout();
1471
1472         return True;
1473 }
1474
1475 /****************************************************************************
1476  Accessor functions for InBuffer, OutBuffer.
1477 ****************************************************************************/
1478
1479 char *get_InBuffer(void)
1480 {
1481         return InBuffer;
1482 }
1483
1484 char *get_OutBuffer(void)
1485 {
1486         return OutBuffer;
1487 }
1488
1489 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1490
1491 /****************************************************************************
1492  Allocate a new InBuffer. Returns the new and old ones.
1493 ****************************************************************************/
1494
1495 static char *NewInBuffer(char **old_inbuf)
1496 {
1497         char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1498         if (!new_inbuf) {
1499                 return NULL;
1500         }
1501         if (old_inbuf) {
1502                 *old_inbuf = InBuffer;
1503         }
1504         InBuffer = new_inbuf;
1505 #if defined(DEVELOPER)
1506         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1507 #endif
1508         return InBuffer;
1509 }
1510
1511 /****************************************************************************
1512  Allocate a new OutBuffer. Returns the new and old ones.
1513 ****************************************************************************/
1514
1515 static char *NewOutBuffer(char **old_outbuf)
1516 {
1517         char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1518         if (!new_outbuf) {
1519                 return NULL;
1520         }
1521         if (old_outbuf) {
1522                 *old_outbuf = OutBuffer;
1523         }
1524         OutBuffer = new_outbuf;
1525 #if defined(DEVELOPER)
1526         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1527 #endif
1528         return OutBuffer;
1529 }
1530
1531 /****************************************************************************
1532  Process commands from the client
1533 ****************************************************************************/
1534
1535 void smbd_process(void)
1536 {
1537         time_t last_timeout_processing_time = time(NULL);
1538         unsigned int num_smbs = 0;
1539
1540         /* Allocate the primary Inbut/Output buffers. */
1541
1542         if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1543                 return;
1544
1545         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1546
1547         while (True) {
1548                 int deadtime = lp_deadtime()*60;
1549                 int select_timeout = setup_select_timeout();
1550                 int num_echos;
1551
1552                 if (deadtime <= 0)
1553                         deadtime = DEFAULT_SMBD_TIMEOUT;
1554
1555                 errno = 0;
1556
1557                 /* free up temporary memory */
1558                 lp_TALLOC_FREE();
1559                 main_loop_TALLOC_FREE();
1560
1561                 /* Did someone ask for immediate checks on things like blocking locks ? */
1562                 if (select_timeout == 0) {
1563                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1564                                 return;
1565                         num_smbs = 0; /* Reset smb counter. */
1566                 }
1567
1568                 run_events(smbd_event_context(), 0, NULL, NULL);
1569
1570 #if defined(DEVELOPER)
1571                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1572 #endif
1573
1574                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1575                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1576                                 return;
1577                         num_smbs = 0; /* Reset smb counter. */
1578                 }
1579
1580                 /*
1581                  * Ensure we do timeout processing if the SMB we just got was
1582                  * only an echo request. This allows us to set the select
1583                  * timeout in 'receive_message_or_smb()' to any value we like
1584                  * without worrying that the client will send echo requests
1585                  * faster than the select timeout, thus starving out the
1586                  * essential processing (change notify, blocking locks) that
1587                  * the timeout code does. JRA.
1588                  */
1589                 num_echos = smb_echo_count;
1590
1591                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1592
1593                 process_smb(InBuffer, OutBuffer);
1594
1595                 if (smb_echo_count != num_echos) {
1596                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1597                                 return;
1598                         num_smbs = 0; /* Reset smb counter. */
1599                 }
1600
1601                 num_smbs++;
1602
1603                 /*
1604                  * If we are getting smb requests in a constant stream
1605                  * with no echos, make sure we attempt timeout processing
1606                  * every select_timeout milliseconds - but only check for this
1607                  * every 200 smb requests.
1608                  */
1609
1610                 if ((num_smbs % 200) == 0) {
1611                         time_t new_check_time = time(NULL);
1612                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1613                                 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1614                                         return;
1615                                 num_smbs = 0; /* Reset smb counter. */
1616                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1617                         }
1618                 }
1619
1620                 /* The timeout_processing function isn't run nearly
1621                    often enough to implement 'max log size' without
1622                    overrunning the size of the file by many megabytes.
1623                    This is especially true if we are running at debug
1624                    level 10.  Checking every 50 SMBs is a nice
1625                    tradeoff of performance vs log file size overrun. */
1626
1627                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1628                         change_to_root_user();
1629                         check_log_size();
1630                 }
1631         }
1632 }