source/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 uint16 global_smbpid;
  25 extern int keepalive;
  26 extern struct auth_context *negprot_global_auth_context;
  27 extern int smb_echo_count;
  28
  29 static char *InBuffer = NULL;
  30 static char *OutBuffer = NULL;
  31 static char *current_inbuf = NULL;
  32
  33 /*
  34  * Size of data we can send to client. Set
  35  *  by the client for all protocols above CORE.
  36  *  Set by us for CORE protocol.
  37  */
  38 int max_send = BUFFER_SIZE;
  39 /*
  40  * Size of the data we can receive. Set by us.
  41  * Can be modified by the max xmit parameter.
  42  */
  43 int max_recv = BUFFER_SIZE;
  44
  45 extern int last_message;
  46 extern int smb_read_error;
  47 SIG_ATOMIC_T reload_after_sighup = 0;
  48 SIG_ATOMIC_T got_sig_term = 0;
  49 extern BOOL global_machine_password_needs_changing;
  50 extern int max_send;
  51
  52 /****************************************************************************
  53  Function to return the current request mid from Inbuffer.
  54 ****************************************************************************/
  55
  56 uint16 get_current_mid(void)
  57 {
  58         return SVAL(InBuffer,smb_mid);
  59 }
  60
  61 /****************************************************************************
  62  structure to hold a linked list of queued messages.
  63  for processing.
  64 ****************************************************************************/
  65
  66 static struct pending_message_list *deferred_open_queue;
  67
  68 /****************************************************************************
  69  Function to push a message onto the tail of a linked list of smb messages ready
  70  for processing.
  71 ****************************************************************************/
  72
  73 static BOOL push_queued_message(char *buf, int msg_len,
  74                                 struct timeval request_time,
  75                                 struct timeval end_time,
  76                                 char *private_data, size_t private_len)
  77 {
  78         struct pending_message_list *msg;
  79
  80         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
  81
  82         if(msg == NULL) {
  83                 DEBUG(0,("push_message: malloc fail (1)\n"));
  84                 return False;
  85         }
  86
  87         msg->buf = data_blob_talloc(msg, buf, msg_len);
  88         if(msg->buf.data == NULL) {
  89                 DEBUG(0,("push_message: malloc fail (2)\n"));
  90                 TALLOC_FREE(msg);
  91                 return False;
  92         }
  93
  94         msg->request_time = request_time;
  95         msg->end_time = end_time;
  96
  97         if (private_data) {
  98                 msg->private_data = data_blob_talloc(msg, private_data,
  99                                                      private_len);
 100                 if (msg->private_data.data == NULL) {
 101                         DEBUG(0,("push_message: malloc fail (3)\n"));
 102                         TALLOC_FREE(msg);
 103                         return False;
 104                 }
 105         }
 106
 107         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 108
 109         DEBUG(10,("push_message: pushed message length %u on "
 110                   "deferred_open_queue\n", (unsigned int)msg_len));
 111
 112         return True;
 113 }
 114
 115 /****************************************************************************
 116  Function to delete a sharing violation open message by mid.
 117 ****************************************************************************/
 118
 119 void remove_deferred_open_smb_message(uint16 mid)
 120 {
 121         struct pending_message_list *pml;
 122
 123         for (pml = deferred_open_queue; pml; pml = pml->next) {
 124                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 125                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 126                                   "deleting mid %u len %u\n",
 127                                   (unsigned int)mid,
 128                                   (unsigned int)pml->buf.length ));
 129                         DLIST_REMOVE(deferred_open_queue, pml);
 130                         TALLOC_FREE(pml);
 131                         return;
 132                 }
 133         }
 134 }
 135
 136 /****************************************************************************
 137  Move a sharing violation open retry message to the front of the list and
 138  schedule it for immediate processing.
 139 ****************************************************************************/
 140
 141 void schedule_deferred_open_smb_message(uint16 mid)
 142 {
 143         struct pending_message_list *pml;
 144         int i = 0;
 145
 146         for (pml = deferred_open_queue; pml; pml = pml->next) {
 147                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 148                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 149                         (unsigned int)msg_mid ));
 150                 if (mid == msg_mid) {
 151                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 152                                 mid ));
 153                         pml->end_time.tv_sec = 0;
 154                         pml->end_time.tv_usec = 0;
 155                         DLIST_PROMOTE(deferred_open_queue, pml);
 156                         return;
 157                 }
 158         }
 159
 160         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 161                 mid ));
 162 }
 163
 164 /****************************************************************************
 165  Return true if this mid is on the deferred queue.
 166 ****************************************************************************/
 167
 168 BOOL open_was_deferred(uint16 mid)
 169 {
 170         struct pending_message_list *pml;
 171
 172         for (pml = deferred_open_queue; pml; pml = pml->next) {
 173                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 174                         return True;
 175                 }
 176         }
 177         return False;
 178 }
 179
 180 /****************************************************************************
 181  Return the message queued by this mid.
 182 ****************************************************************************/
 183
 184 struct pending_message_list *get_open_deferred_message(uint16 mid)
 185 {
 186         struct pending_message_list *pml;
 187
 188         for (pml = deferred_open_queue; pml; pml = pml->next) {
 189                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 190                         return pml;
 191                 }
 192         }
 193         return NULL;
 194 }
 195
 196 /****************************************************************************
 197  Function to push a deferred open smb message onto a linked list of local smb
 198  messages ready for processing.
 199 ****************************************************************************/
 200
 201 BOOL push_deferred_smb_message(uint16 mid,
 202                                struct timeval request_time,
 203                                struct timeval timeout,
 204                                char *private_data, size_t priv_len)
 205 {
 206         struct timeval end_time;
 207
 208         end_time = timeval_sum(&request_time, &timeout);
 209
 210         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 211                   "timeout time [%u.%06u]\n",
 212                   (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
 213                   (unsigned int)end_time.tv_sec,
 214                   (unsigned int)end_time.tv_usec));
 215
 216         return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
 217                                    request_time, end_time,
 218                                    private_data, priv_len);
 219 }
 220
 221 struct idle_event {
 222         struct timed_event *te;
 223         struct timeval interval;
 224         BOOL (*handler)(const struct timeval *now, void *private_data);
 225         void *private_data;
 226 };
 227
 228 static void idle_event_handler(struct event_context *ctx,
 229                                struct timed_event *te,
 230                                const struct timeval *now,
 231                                void *private_data)
 232 {
 233         struct idle_event *event =
 234                 talloc_get_type_abort(private_data, struct idle_event);
 235
 236         TALLOC_FREE(event->te);
 237
 238         if (!event->handler(now, event->private_data)) {
 239                 /* Don't repeat, delete ourselves */
 240                 TALLOC_FREE(event);
 241                 return;
 242         }
 243
 244         event->te = event_add_timed(smbd_event_context(), event,
 245                                     timeval_sum(now, &event->interval),
 246                                     "idle_event_handler",
 247                                     idle_event_handler, event);
 248
 249         /* We can't do much but fail here. */
 250         SMB_ASSERT(event->te != NULL);
 251 }
 252
 253 struct idle_event *add_idle_event(TALLOC_CTX *mem_ctx,
 254                                   struct timeval interval,
 255                                   BOOL (*handler)(const struct timeval *now,
 256                                                   void *private_data),
 257                                   void *private_data)
 258 {
 259         struct idle_event *result;
 260         struct timeval now = timeval_current();
 261
 262         result = TALLOC_P(mem_ctx, struct idle_event);
 263         if (result == NULL) {
 264                 DEBUG(0, ("talloc failed\n"));
 265                 return NULL;
 266         }
 267
 268         result->interval = interval;
 269         result->handler = handler;
 270         result->private_data = private_data;
 271
 272         result->te = event_add_timed(smbd_event_context(), result,
 273                                      timeval_sum(&now, &interval),
 274                                      "idle_event_handler",
 275                                      idle_event_handler, result);
 276         if (result->te == NULL) {
 277                 DEBUG(0, ("event_add_timed failed\n"));
 278                 TALLOC_FREE(result);
 279                 return NULL;
 280         }
 281
 282         return result;
 283 }
 284
 285 /****************************************************************************
 286  Do all async processing in here. This includes kernel oplock messages, change
 287  notify events etc.
 288 ****************************************************************************/
 289
 290 static void async_processing(fd_set *pfds)
 291 {
 292         DEBUG(10,("async_processing: Doing async processing.\n"));
 293
 294         process_aio_queue();
 295
 296         process_kernel_oplocks(pfds);
 297
 298         /* Do the aio check again after receive_local_message as it does a
 299            select and may have eaten our signal. */
 300         /* Is this till true? -- vl */
 301         process_aio_queue();
 302
 303         if (got_sig_term) {
 304                 exit_server_cleanly("termination signal");
 305         }
 306
 307         /* check for sighup processing */
 308         if (reload_after_sighup) {
 309                 change_to_root_user();
 310                 DEBUG(1,("Reloading services after SIGHUP\n"));
 311                 reload_services(False);
 312                 reload_after_sighup = 0;
 313         }
 314 }
 315
 316 /****************************************************************************
 317  Add a fd to the set we will be select(2)ing on.
 318 ****************************************************************************/
 319
 320 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 321 {
 322         if (fd != -1) {
 323                 FD_SET(fd, fds);
 324                 maxfd = MAX(maxfd, fd);
 325         }
 326
 327         return maxfd;
 328 }
 329
 330 /****************************************************************************
 331   Do a select on an two fd's - with timeout.
 332
 333   If a local udp message has been pushed onto the
 334   queue (this can only happen during oplock break
 335   processing) call async_processing()
 336
 337   If a pending smb message has been pushed onto the
 338   queue (this can only happen during oplock break
 339   processing) return this next.
 340
 341   If the first smbfd is ready then read an smb from it.
 342   if the second (loopback UDP) fd is ready then read a message
 343   from it and setup the buffer header to identify the length
 344   and from address.
 345   Returns False on timeout or error.
 346   Else returns True.
 347
 348 The timeout is in milliseconds
 349 ****************************************************************************/
 350
 351 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 352 {
 353         fd_set r_fds, w_fds;
 354         int selrtn;
 355         struct timeval to;
 356         int maxfd = 0;
 357
 358         smb_read_error = 0;
 359
 360  again:
 361
 362         if (timeout >= 0) {
 363                 to.tv_sec = timeout / 1000;
 364                 to.tv_usec = (timeout % 1000) * 1000;
 365         } else {
 366                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 367                 to.tv_usec = 0;
 368         }
 369
 370         /*
 371          * Note that this call must be before processing any SMB
 372          * messages as we need to synchronously process any messages
 373          * we may have sent to ourselves from the previous SMB.
 374          */
 375         message_dispatch();
 376
 377         /*
 378          * Check to see if we already have a message on the deferred open queue
 379          * and it's time to schedule.
 380          */
 381         if(deferred_open_queue != NULL) {
 382                 BOOL pop_message = False;
 383                 struct pending_message_list *msg = deferred_open_queue;
 384
 385                 if (timeval_is_zero(&msg->end_time)) {
 386                         pop_message = True;
 387                 } else {
 388                         struct timeval tv;
 389                         SMB_BIG_INT tdif;
 390
 391                         GetTimeOfDay(&tv);
 392                         tdif = usec_time_diff(&msg->end_time, &tv);
 393                         if (tdif <= 0) {
 394                                 /* Timed out. Schedule...*/
 395                                 pop_message = True;
 396                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 397                         } else {
 398                                 /* Make a more accurate select timeout. */
 399                                 to.tv_sec = tdif / 1000000;
 400                                 to.tv_usec = tdif % 1000000;
 401                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 402                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 403                         }
 404                 }
 405
 406                 if (pop_message) {
 407                         memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 408
 409                         /* We leave this message on the queue so the open code can
 410                            know this is a retry. */
 411                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 412                         return True;
 413                 }
 414         }
 415
 416         /*
 417          * Setup the select fd sets.
 418          */
 419
 420         FD_ZERO(&r_fds);
 421         FD_ZERO(&w_fds);
 422
 423         /*
 424          * Ensure we process oplock break messages by preference.
 425          * We have to do this before the select, after the select
 426          * and if the select returns EINTR. This is due to the fact
 427          * that the selects called from async_processing can eat an EINTR
 428          * caused by a signal (we can't take the break message there).
 429          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 430          */
 431
 432         if (oplock_message_waiting(&r_fds)) {
 433                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 434                 async_processing(&r_fds);
 435                 /*
 436                  * After async processing we must go and do the select again, as
 437                  * the state of the flag in fds for the server file descriptor is
 438                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 439                  */
 440                 goto again;
 441         }
 442
 443         /*
 444          * Are there any timed events waiting ? If so, ensure we don't
 445          * select for longer than it would take to wait for them.
 446          */
 447
 448         {
 449                 struct timeval now;
 450                 GetTimeOfDay(&now);
 451
 452                 event_add_to_select_args(smbd_event_context(), &now,
 453                                          &r_fds, &w_fds, &to, &maxfd);
 454         }
 455
 456         if (timeval_is_zero(&to)) {
 457                 /* Process a timed event now... */
 458                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 459                         goto again;
 460                 }
 461         }
 462
 463         {
 464                 int sav;
 465                 START_PROFILE(smbd_idle);
 466
 467                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 468                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 469
 470                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 471                 sav = errno;
 472
 473                 END_PROFILE(smbd_idle);
 474                 errno = sav;
 475         }
 476
 477         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 478                 goto again;
 479         }
 480
 481         /* if we get EINTR then maybe we have received an oplock
 482            signal - treat this as select returning 1. This is ugly, but
 483            is the best we can do until the oplock code knows more about
 484            signals */
 485         if (selrtn == -1 && errno == EINTR) {
 486                 async_processing(&r_fds);
 487                 /*
 488                  * After async processing we must go and do the select again, as
 489                  * the state of the flag in fds for the server file descriptor is
 490                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 491                  */
 492                 goto again;
 493         }
 494
 495         /* Check if error */
 496         if (selrtn == -1) {
 497                 /* something is wrong. Maybe the socket is dead? */
 498                 smb_read_error = READ_ERROR;
 499                 return False;
 500         }
 501
 502         /* Did we timeout ? */
 503         if (selrtn == 0) {
 504                 smb_read_error = READ_TIMEOUT;
 505                 return False;
 506         }
 507
 508         /*
 509          * Ensure we process oplock break messages by preference.
 510          * This is IMPORTANT ! Otherwise we can starve other processes
 511          * sending us an oplock break message. JRA.
 512          */
 513
 514         if (oplock_message_waiting(&r_fds)) {
 515                 async_processing(&r_fds);
 516                 /*
 517                  * After async processing we must go and do the select again, as
 518                  * the state of the flag in fds for the server file descriptor is
 519                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 520                  */
 521                 goto again;
 522         }
 523
 524         return receive_smb(smbd_server_fd(), buffer,
 525                         BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE, 0);
 526 }
 527
 528 /*
 529  * Only allow 5 outstanding trans requests. We're allocating memory, so
 530  * prevent a DoS.
 531  */
 532
 533 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 534 {
 535         int count = 0;
 536         for (; list != NULL; list = list->next) {
 537
 538                 if (list->mid == mid) {
 539                         return NT_STATUS_INVALID_PARAMETER;
 540                 }
 541
 542                 count += 1;
 543         }
 544         if (count > 5) {
 545                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 546         }
 547
 548         return NT_STATUS_OK;
 549 }
 550
 551 /****************************************************************************
 552  We're terminating and have closed all our files/connections etc.
 553  If there are any pending local messages we need to respond to them
 554  before termination so that other smbds don't think we just died whilst
 555  holding oplocks.
 556 ****************************************************************************/
 557
 558 void respond_to_all_remaining_local_messages(void)
 559 {
 560         /*
 561          * Assert we have no exclusive open oplocks.
 562          */
 563
 564         if(get_number_of_exclusive_open_oplocks()) {
 565                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 566                         get_number_of_exclusive_open_oplocks() ));
 567                 return;
 568         }
 569
 570         process_kernel_oplocks(NULL);
 571
 572         return;
 573 }
 574
 575
 576 /*
 577 These flags determine some of the permissions required to do an operation
 578
 579 Note that I don't set NEED_WRITE on some write operations because they
 580 are used by some brain-dead clients when printing, and I don't want to
 581 force write permissions on print services.
 582 */
 583 #define AS_USER (1<<0)
 584 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 585 #define TIME_INIT (1<<2)
 586 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 587 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 588 #define DO_CHDIR (1<<6)
 589
 590 /*
 591    define a list of possible SMB messages and their corresponding
 592    functions. Any message that has a NULL function is unimplemented -
 593    please feel free to contribute implementations!
 594 */
 595 static const struct smb_message_struct {
 596         const char *name;
 597         int (*fn)(connection_struct *conn, char *, char *, int, int);
 598         int flags;
 599 } smb_messages[256] = {
 600
 601 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 602 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 603 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 604 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 605 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 606 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 607 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 608 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 609 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 610 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 611 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 612 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 613 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 614 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 615 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 616 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 617 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 618 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 619 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 620 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 621 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 622 /* 0x15 */ { NULL, NULL, 0 },
 623 /* 0x16 */ { NULL, NULL, 0 },
 624 /* 0x17 */ { NULL, NULL, 0 },
 625 /* 0x18 */ { NULL, NULL, 0 },
 626 /* 0x19 */ { NULL, NULL, 0 },
 627 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 628 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 629 /* 0x1c */ { "SMBreadBs",NULL,0 },
 630 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 631 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 632 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 633 /* 0x20 */ { "SMBwritec",NULL,0},
 634 /* 0x21 */ { NULL, NULL, 0 },
 635 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 636 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 637 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 638 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 639 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 640 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 641 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 642 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 643 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
 644 /* 0x2b */ { "SMBecho",reply_echo,0},
 645 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 646 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 647 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 648 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 649 /* 0x30 */ { NULL, NULL, 0 },
 650 /* 0x31 */ { NULL, NULL, 0 },
 651 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 652 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 653 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 654 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 655 /* 0x36 */ { NULL, NULL, 0 },
 656 /* 0x37 */ { NULL, NULL, 0 },
 657 /* 0x38 */ { NULL, NULL, 0 },
 658 /* 0x39 */ { NULL, NULL, 0 },
 659 /* 0x3a */ { NULL, NULL, 0 },
 660 /* 0x3b */ { NULL, NULL, 0 },
 661 /* 0x3c */ { NULL, NULL, 0 },
 662 /* 0x3d */ { NULL, NULL, 0 },
 663 /* 0x3e */ { NULL, NULL, 0 },
 664 /* 0x3f */ { NULL, NULL, 0 },
 665 /* 0x40 */ { NULL, NULL, 0 },
 666 /* 0x41 */ { NULL, NULL, 0 },
 667 /* 0x42 */ { NULL, NULL, 0 },
 668 /* 0x43 */ { NULL, NULL, 0 },
 669 /* 0x44 */ { NULL, NULL, 0 },
 670 /* 0x45 */ { NULL, NULL, 0 },
 671 /* 0x46 */ { NULL, NULL, 0 },
 672 /* 0x47 */ { NULL, NULL, 0 },
 673 /* 0x48 */ { NULL, NULL, 0 },
 674 /* 0x49 */ { NULL, NULL, 0 },
 675 /* 0x4a */ { NULL, NULL, 0 },
 676 /* 0x4b */ { NULL, NULL, 0 },
 677 /* 0x4c */ { NULL, NULL, 0 },
 678 /* 0x4d */ { NULL, NULL, 0 },
 679 /* 0x4e */ { NULL, NULL, 0 },
 680 /* 0x4f */ { NULL, NULL, 0 },
 681 /* 0x50 */ { NULL, NULL, 0 },
 682 /* 0x51 */ { NULL, NULL, 0 },
 683 /* 0x52 */ { NULL, NULL, 0 },
 684 /* 0x53 */ { NULL, NULL, 0 },
 685 /* 0x54 */ { NULL, NULL, 0 },
 686 /* 0x55 */ { NULL, NULL, 0 },
 687 /* 0x56 */ { NULL, NULL, 0 },
 688 /* 0x57 */ { NULL, NULL, 0 },
 689 /* 0x58 */ { NULL, NULL, 0 },
 690 /* 0x59 */ { NULL, NULL, 0 },
 691 /* 0x5a */ { NULL, NULL, 0 },
 692 /* 0x5b */ { NULL, NULL, 0 },
 693 /* 0x5c */ { NULL, NULL, 0 },
 694 /* 0x5d */ { NULL, NULL, 0 },
 695 /* 0x5e */ { NULL, NULL, 0 },
 696 /* 0x5f */ { NULL, NULL, 0 },
 697 /* 0x60 */ { NULL, NULL, 0 },
 698 /* 0x61 */ { NULL, NULL, 0 },
 699 /* 0x62 */ { NULL, NULL, 0 },
 700 /* 0x63 */ { NULL, NULL, 0 },
 701 /* 0x64 */ { NULL, NULL, 0 },
 702 /* 0x65 */ { NULL, NULL, 0 },
 703 /* 0x66 */ { NULL, NULL, 0 },
 704 /* 0x67 */ { NULL, NULL, 0 },
 705 /* 0x68 */ { NULL, NULL, 0 },
 706 /* 0x69 */ { NULL, NULL, 0 },
 707 /* 0x6a */ { NULL, NULL, 0 },
 708 /* 0x6b */ { NULL, NULL, 0 },
 709 /* 0x6c */ { NULL, NULL, 0 },
 710 /* 0x6d */ { NULL, NULL, 0 },
 711 /* 0x6e */ { NULL, NULL, 0 },
 712 /* 0x6f */ { NULL, NULL, 0 },
 713 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 714 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
 715 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 716 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 717 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 718 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 719 /* 0x76 */ { NULL, NULL, 0 },
 720 /* 0x77 */ { NULL, NULL, 0 },
 721 /* 0x78 */ { NULL, NULL, 0 },
 722 /* 0x79 */ { NULL, NULL, 0 },
 723 /* 0x7a */ { NULL, NULL, 0 },
 724 /* 0x7b */ { NULL, NULL, 0 },
 725 /* 0x7c */ { NULL, NULL, 0 },
 726 /* 0x7d */ { NULL, NULL, 0 },
 727 /* 0x7e */ { NULL, NULL, 0 },
 728 /* 0x7f */ { NULL, NULL, 0 },
 729 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 730 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 731 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 732 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 733 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 734 /* 0x85 */ { NULL, NULL, 0 },
 735 /* 0x86 */ { NULL, NULL, 0 },
 736 /* 0x87 */ { NULL, NULL, 0 },
 737 /* 0x88 */ { NULL, NULL, 0 },
 738 /* 0x89 */ { NULL, NULL, 0 },
 739 /* 0x8a */ { NULL, NULL, 0 },
 740 /* 0x8b */ { NULL, NULL, 0 },
 741 /* 0x8c */ { NULL, NULL, 0 },
 742 /* 0x8d */ { NULL, NULL, 0 },
 743 /* 0x8e */ { NULL, NULL, 0 },
 744 /* 0x8f */ { NULL, NULL, 0 },
 745 /* 0x90 */ { NULL, NULL, 0 },
 746 /* 0x91 */ { NULL, NULL, 0 },
 747 /* 0x92 */ { NULL, NULL, 0 },
 748 /* 0x93 */ { NULL, NULL, 0 },
 749 /* 0x94 */ { NULL, NULL, 0 },
 750 /* 0x95 */ { NULL, NULL, 0 },
 751 /* 0x96 */ { NULL, NULL, 0 },
 752 /* 0x97 */ { NULL, NULL, 0 },
 753 /* 0x98 */ { NULL, NULL, 0 },
 754 /* 0x99 */ { NULL, NULL, 0 },
 755 /* 0x9a */ { NULL, NULL, 0 },
 756 /* 0x9b */ { NULL, NULL, 0 },
 757 /* 0x9c */ { NULL, NULL, 0 },
 758 /* 0x9d */ { NULL, NULL, 0 },
 759 /* 0x9e */ { NULL, NULL, 0 },
 760 /* 0x9f */ { NULL, NULL, 0 },
 761 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
 762 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 763 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
 764 /* 0xa3 */ { NULL, NULL, 0 },
 765 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 766 /* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
 767 /* 0xa6 */ { NULL, NULL, 0 },
 768 /* 0xa7 */ { NULL, NULL, 0 },
 769 /* 0xa8 */ { NULL, NULL, 0 },
 770 /* 0xa9 */ { NULL, NULL, 0 },
 771 /* 0xaa */ { NULL, NULL, 0 },
 772 /* 0xab */ { NULL, NULL, 0 },
 773 /* 0xac */ { NULL, NULL, 0 },
 774 /* 0xad */ { NULL, NULL, 0 },
 775 /* 0xae */ { NULL, NULL, 0 },
 776 /* 0xaf */ { NULL, NULL, 0 },
 777 /* 0xb0 */ { NULL, NULL, 0 },
 778 /* 0xb1 */ { NULL, NULL, 0 },
 779 /* 0xb2 */ { NULL, NULL, 0 },
 780 /* 0xb3 */ { NULL, NULL, 0 },
 781 /* 0xb4 */ { NULL, NULL, 0 },
 782 /* 0xb5 */ { NULL, NULL, 0 },
 783 /* 0xb6 */ { NULL, NULL, 0 },
 784 /* 0xb7 */ { NULL, NULL, 0 },
 785 /* 0xb8 */ { NULL, NULL, 0 },
 786 /* 0xb9 */ { NULL, NULL, 0 },
 787 /* 0xba */ { NULL, NULL, 0 },
 788 /* 0xbb */ { NULL, NULL, 0 },
 789 /* 0xbc */ { NULL, NULL, 0 },
 790 /* 0xbd */ { NULL, NULL, 0 },
 791 /* 0xbe */ { NULL, NULL, 0 },
 792 /* 0xbf */ { NULL, NULL, 0 },
 793 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
 794 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 795 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 796 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 797 /* 0xc4 */ { NULL, NULL, 0 },
 798 /* 0xc5 */ { NULL, NULL, 0 },
 799 /* 0xc6 */ { NULL, NULL, 0 },
 800 /* 0xc7 */ { NULL, NULL, 0 },
 801 /* 0xc8 */ { NULL, NULL, 0 },
 802 /* 0xc9 */ { NULL, NULL, 0 },
 803 /* 0xca */ { NULL, NULL, 0 },
 804 /* 0xcb */ { NULL, NULL, 0 },
 805 /* 0xcc */ { NULL, NULL, 0 },
 806 /* 0xcd */ { NULL, NULL, 0 },
 807 /* 0xce */ { NULL, NULL, 0 },
 808 /* 0xcf */ { NULL, NULL, 0 },
 809 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 810 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 811 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 812 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 813 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 814 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 815 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 816 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 817 /* 0xd8 */ { NULL, NULL, 0 },
 818 /* 0xd9 */ { NULL, NULL, 0 },
 819 /* 0xda */ { NULL, NULL, 0 },
 820 /* 0xdb */ { NULL, NULL, 0 },
 821 /* 0xdc */ { NULL, NULL, 0 },
 822 /* 0xdd */ { NULL, NULL, 0 },
 823 /* 0xde */ { NULL, NULL, 0 },
 824 /* 0xdf */ { NULL, NULL, 0 },
 825 /* 0xe0 */ { NULL, NULL, 0 },
 826 /* 0xe1 */ { NULL, NULL, 0 },
 827 /* 0xe2 */ { NULL, NULL, 0 },
 828 /* 0xe3 */ { NULL, NULL, 0 },
 829 /* 0xe4 */ { NULL, NULL, 0 },
 830 /* 0xe5 */ { NULL, NULL, 0 },
 831 /* 0xe6 */ { NULL, NULL, 0 },
 832 /* 0xe7 */ { NULL, NULL, 0 },
 833 /* 0xe8 */ { NULL, NULL, 0 },
 834 /* 0xe9 */ { NULL, NULL, 0 },
 835 /* 0xea */ { NULL, NULL, 0 },
 836 /* 0xeb */ { NULL, NULL, 0 },
 837 /* 0xec */ { NULL, NULL, 0 },
 838 /* 0xed */ { NULL, NULL, 0 },
 839 /* 0xee */ { NULL, NULL, 0 },
 840 /* 0xef */ { NULL, NULL, 0 },
 841 /* 0xf0 */ { NULL, NULL, 0 },
 842 /* 0xf1 */ { NULL, NULL, 0 },
 843 /* 0xf2 */ { NULL, NULL, 0 },
 844 /* 0xf3 */ { NULL, NULL, 0 },
 845 /* 0xf4 */ { NULL, NULL, 0 },
 846 /* 0xf5 */ { NULL, NULL, 0 },
 847 /* 0xf6 */ { NULL, NULL, 0 },
 848 /* 0xf7 */ { NULL, NULL, 0 },
 849 /* 0xf8 */ { NULL, NULL, 0 },
 850 /* 0xf9 */ { NULL, NULL, 0 },
 851 /* 0xfa */ { NULL, NULL, 0 },
 852 /* 0xfb */ { NULL, NULL, 0 },
 853 /* 0xfc */ { NULL, NULL, 0 },
 854 /* 0xfd */ { NULL, NULL, 0 },
 855 /* 0xfe */ { NULL, NULL, 0 },
 856 /* 0xff */ { NULL, NULL, 0 }
 857
 858 };
 859
 860 /*******************************************************************
 861  Dump a packet to a file.
 862 ********************************************************************/
 863
 864 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 865 {
 866         int fd, i;
 867         pstring fname;
 868         if (DEBUGLEVEL < 50) return;
 869
 870         if (len < 4) len = smb_len(data)+4;
 871         for (i=1;i<100;i++) {
 872                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 873                                 type ? "req" : "resp");
 874                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 875                 if (fd != -1 || errno != EEXIST) break;
 876         }
 877         if (fd != -1) {
 878                 ssize_t ret = write(fd, data, len);
 879                 if (ret != len)
 880                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 881                 close(fd);
 882                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
 883         }
 884 }
 885
 886
 887 /****************************************************************************
 888  Do a switch on the message type, and return the response size
 889 ****************************************************************************/
 890
 891 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 892 {
 893         static pid_t pid= (pid_t)-1;
 894         int outsize = 0;
 895
 896         type &= 0xff;
 897
 898         if (pid == (pid_t)-1)
 899                 pid = sys_getpid();
 900
 901         errno = 0;
 902
 903         last_message = type;
 904
 905         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 906         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 907                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 908                 exit_server_cleanly("Non-SMB packet");
 909                 return(-1);
 910         }
 911
 912         /* yuck! this is an interim measure before we get rid of our
 913                 current inbuf/outbuf system */
 914         global_smbpid = SVAL(inbuf,smb_pid);
 915
 916         if (smb_messages[type].fn == NULL) {
 917                 DEBUG(0,("Unknown message type %d!\n",type));
 918                 smb_dump("Unknown", 1, inbuf, size);
 919                 outsize = reply_unknown(inbuf,outbuf);
 920         } else {
 921                 int flags = smb_messages[type].flags;
 922                 static uint16 last_session_tag = UID_FIELD_INVALID;
 923                 /* In share mode security we must ignore the vuid. */
 924                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 925                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 926
 927                 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
 928
 929                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 930
 931                 /* Ensure this value is replaced in the incoming packet. */
 932                 SSVAL(inbuf,smb_uid,session_tag);
 933
 934                 /*
 935                  * Ensure the correct username is in current_user_info.
 936                  * This is a really ugly bugfix for problems with
 937                  * multiple session_setup_and_X's being done and
 938                  * allowing %U and %G substitutions to work correctly.
 939                  * There is a reason this code is done here, don't
 940                  * move it unless you know what you're doing... :-).
 941                  * JRA.
 942                  */
 943
 944                 if (session_tag != last_session_tag) {
 945                         user_struct *vuser = NULL;
 946
 947                         last_session_tag = session_tag;
 948                         if(session_tag != UID_FIELD_INVALID) {
 949                                 vuser = get_valid_user_struct(session_tag);
 950                                 if (vuser) {
 951                                         set_current_user_info(&vuser->user);
 952                                 }
 953                         }
 954                 }
 955
 956                 /* Does this call need to be run as the connected user? */
 957                 if (flags & AS_USER) {
 958
 959                         /* Does this call need a valid tree connection? */
 960                         if (!conn) {
 961                                 /* Amazingly, the error code depends on the command (from Samba4). */
 962                                 if (type == SMBntcreateX) {
 963                                         return ERROR_NT(NT_STATUS_INVALID_HANDLE);
 964                                 } else {
 965                                         return ERROR_DOS(ERRSRV, ERRinvnid);
 966                                 }
 967                         }
 968
 969                         if (!change_to_user(conn,session_tag)) {
 970                                 remove_deferred_open_smb_message(
 971                                         SVAL(inbuf, smb_mid));
 972                                 return(ERROR_NT(NT_STATUS_DOS(ERRSRV,ERRbaduid)));
 973                         }
 974
 975                         /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
 976
 977                         /* Does it need write permission? */
 978                         if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
 979                                 return ERROR_NT(NT_STATUS_MEDIA_WRITE_PROTECTED);
 980                         }
 981
 982                         /* IPC services are limited */
 983                         if (IS_IPC(conn) && !(flags & CAN_IPC)) {
 984                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 985                         }
 986                 } else {
 987                         /* This call needs to be run as root */
 988                         change_to_root_user();
 989                 }
 990
 991                 /* load service specific parameters */
 992                 if (conn) {
 993                         if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
 994                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 995                         }
 996                         conn->num_smb_operations++;
 997                 }
 998
 999                 /* does this protocol need to be run as guest? */
1000                 if ((flags & AS_GUEST) && (!change_to_guest() ||
1001                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
1002                         return(ERROR_DOS(ERRSRV,ERRaccess));
1003                 }
1004
1005                 current_inbuf = inbuf; /* In case we need to defer this message in open... */
1006                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1007         }
1008
1009         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1010
1011         return(outsize);
1012 }
1013
1014 /****************************************************************************
1015  Construct a reply to the incoming packet.
1016 ****************************************************************************/
1017
1018 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1019 {
1020         int type = CVAL(inbuf,smb_com);
1021         int outsize = 0;
1022         int msg_type = CVAL(inbuf,0);
1023
1024         chain_size = 0;
1025         file_chain_reset();
1026         reset_chain_p();
1027
1028         if (msg_type != 0)
1029                 return(reply_special(inbuf,outbuf));
1030
1031         construct_reply_common(inbuf, outbuf);
1032
1033         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1034
1035         outsize += chain_size;
1036
1037         if(outsize > 4)
1038                 smb_setlen(outbuf,outsize - 4);
1039         return(outsize);
1040 }
1041
1042 /****************************************************************************
1043  Process an smb from the client
1044 ****************************************************************************/
1045
1046 static void process_smb(char *inbuf, char *outbuf)
1047 {
1048         static int trans_num;
1049         int msg_type = CVAL(inbuf,0);
1050         int32 len = smb_len(inbuf);
1051         int nread = len + 4;
1052
1053         DO_PROFILE_INC(smb_count);
1054
1055         if (trans_num == 0) {
1056                 /* on the first packet, check the global hosts allow/ hosts
1057                 deny parameters before doing any parsing of the packet
1058                 passed to us by the client.  This prevents attacks on our
1059                 parsing code from hosts not in the hosts allow list */
1060                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1061                                   lp_hostsdeny(-1))) {
1062                         /* send a negative session response "not listening on calling name" */
1063                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1064                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1065                         (void)send_smb(smbd_server_fd(),(char *)buf);
1066                         exit_server_cleanly("connection denied");
1067                 }
1068         }
1069
1070         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1071         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1072
1073         if (msg_type == 0)
1074                 show_msg(inbuf);
1075         else if(msg_type == SMBkeepalive)
1076                 return; /* Keepalive packet. */
1077
1078         nread = construct_reply(inbuf,outbuf,nread,max_send);
1079
1080         if(nread > 0) {
1081                 if (CVAL(outbuf,0) == 0)
1082                         show_msg(outbuf);
1083
1084                 if (nread != smb_len(outbuf) + 4) {
1085                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1086                                 nread, smb_len(outbuf)));
1087                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1088                         exit_server_cleanly("process_smb: send_smb failed.");
1089                 }
1090         }
1091         trans_num++;
1092 }
1093
1094 /****************************************************************************
1095  Return a string containing the function name of a SMB command.
1096 ****************************************************************************/
1097
1098 const char *smb_fn_name(int type)
1099 {
1100         const char *unknown_name = "SMBunknown";
1101
1102         if (smb_messages[type].name == NULL)
1103                 return(unknown_name);
1104
1105         return(smb_messages[type].name);
1106 }
1107
1108 /****************************************************************************
1109  Helper functions for contruct_reply.
1110 ****************************************************************************/
1111
1112 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1113
1114 void add_to_common_flags2(uint32 v)
1115 {
1116         common_flags2 |= v;
1117 }
1118
1119 void remove_from_common_flags2(uint32 v)
1120 {
1121         common_flags2 &= ~v;
1122 }
1123
1124 void construct_reply_common(const char *inbuf, char *outbuf)
1125 {
1126         set_message(outbuf,0,0,False);
1127
1128         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1129         SIVAL(outbuf,smb_rcls,0);
1130         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1131         SSVAL(outbuf,smb_flg2,
1132                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1133                 common_flags2);
1134         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1135
1136         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1137         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1138         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1139         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1140 }
1141
1142 /****************************************************************************
1143  Construct a chained reply and add it to the already made reply
1144 ****************************************************************************/
1145
1146 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1147 {
1148         static char *orig_inbuf;
1149         static char *orig_outbuf;
1150         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1151         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1152         char *inbuf2, *outbuf2;
1153         int outsize2;
1154         int new_size;
1155         char inbuf_saved[smb_wct];
1156         char outbuf_saved[smb_wct];
1157         int outsize = smb_len(outbuf) + 4;
1158
1159         /* Maybe its not chained, or it's an error packet. */
1160         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1161                 SCVAL(outbuf,smb_vwv0,0xFF);
1162                 return outsize;
1163         }
1164
1165         if (chain_size == 0) {
1166                 /* this is the first part of the chain */
1167                 orig_inbuf = inbuf;
1168                 orig_outbuf = outbuf;
1169         }
1170
1171         /*
1172          * The original Win95 redirector dies on a reply to
1173          * a lockingX and read chain unless the chain reply is
1174          * 4 byte aligned. JRA.
1175          */
1176
1177         outsize = (outsize + 3) & ~3;
1178
1179         /* we need to tell the client where the next part of the reply will be */
1180         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1181         SCVAL(outbuf,smb_vwv0,smb_com2);
1182
1183         /* remember how much the caller added to the chain, only counting stuff
1184                 after the parameter words */
1185         chain_size += outsize - smb_wct;
1186
1187         /* work out pointers into the original packets. The
1188                 headers on these need to be filled in */
1189         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1190         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1191
1192         /* remember the original command type */
1193         smb_com1 = CVAL(orig_inbuf,smb_com);
1194
1195         /* save the data which will be overwritten by the new headers */
1196         memcpy(inbuf_saved,inbuf2,smb_wct);
1197         memcpy(outbuf_saved,outbuf2,smb_wct);
1198
1199         /* give the new packet the same header as the last part of the SMB */
1200         memmove(inbuf2,inbuf,smb_wct);
1201
1202         /* create the in buffer */
1203         SCVAL(inbuf2,smb_com,smb_com2);
1204
1205         /* work out the new size for the in buffer. */
1206         new_size = size - (inbuf2 - inbuf);
1207         if (new_size < 0) {
1208                 DEBUG(0,("chain_reply: chain packet size incorrect (orig size = %d, "
1209                         "offset = %d)\n",
1210                         size,
1211                         (inbuf2 - inbuf) ));
1212                 exit_server_cleanly("Bad chained packet");
1213                 return(-1);
1214         }
1215
1216         /* And set it in the header. */
1217         smb_setlen(inbuf2, new_size);
1218
1219         /* create the out buffer */
1220         construct_reply_common(inbuf2, outbuf2);
1221
1222         DEBUG(3,("Chained message\n"));
1223         show_msg(inbuf2);
1224
1225         /* process the request */
1226         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,new_size,
1227                                 bufsize-chain_size);
1228
1229         /* copy the new reply and request headers over the old ones, but
1230                 preserve the smb_com field */
1231         memmove(orig_outbuf,outbuf2,smb_wct);
1232         SCVAL(orig_outbuf,smb_com,smb_com1);
1233
1234         /* restore the saved data, being careful not to overwrite any
1235                 data from the reply header */
1236         memcpy(inbuf2,inbuf_saved,smb_wct);
1237
1238         {
1239                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1240                 if (ofs < 0) {
1241                         ofs = 0;
1242                 }
1243                 memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1244         }
1245
1246         return outsize2;
1247 }
1248
1249 /****************************************************************************
1250  Setup the needed select timeout in milliseconds.
1251 ****************************************************************************/
1252
1253 static int setup_select_timeout(void)
1254 {
1255         int select_timeout;
1256
1257         select_timeout = blocking_locks_timeout_ms(SMBD_SELECT_TIMEOUT*1000);
1258
1259         if (print_notify_messages_pending()) {
1260                 select_timeout = MIN(select_timeout, 1000);
1261         }
1262
1263         return select_timeout;
1264 }
1265
1266 /****************************************************************************
1267  Check if services need reloading.
1268 ****************************************************************************/
1269
1270 void check_reload(time_t t)
1271 {
1272         static pid_t mypid = 0;
1273         static time_t last_smb_conf_reload_time = 0;
1274         static time_t last_printer_reload_time = 0;
1275         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1276
1277         if(last_smb_conf_reload_time == 0) {
1278                 last_smb_conf_reload_time = t;
1279                 /* Our printing subsystem might not be ready at smbd start up.
1280                    Then no printer is available till the first printers check
1281                    is performed.  A lower initial interval circumvents this. */
1282                 if ( printcap_cache_time > 60 )
1283                         last_printer_reload_time = t - printcap_cache_time + 60;
1284                 else
1285                         last_printer_reload_time = t;
1286         }
1287
1288         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1289                 /* randomize over 60 second the printcap reload to avoid all
1290                  * process hitting cupsd at the same time */
1291                 int time_range = 60;
1292
1293                 last_printer_reload_time += random() % time_range;
1294                 mypid = getpid();
1295         }
1296
1297         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1298                 reload_services(True);
1299                 reload_after_sighup = False;
1300                 last_smb_conf_reload_time = t;
1301         }
1302
1303         /* 'printcap cache time = 0' disable the feature */
1304
1305         if ( printcap_cache_time != 0 )
1306         {
1307                 /* see if it's time to reload or if the clock has been set back */
1308
1309                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1310                         || (t-last_printer_reload_time  < 0) )
1311                 {
1312                         DEBUG( 3,( "Printcap cache time expired.\n"));
1313                         reload_printers();
1314                         last_printer_reload_time = t;
1315                 }
1316         }
1317 }
1318
1319 /****************************************************************************
1320  Process any timeout housekeeping. Return False if the caller should exit.
1321 ****************************************************************************/
1322
1323 static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1324 {
1325         static time_t last_keepalive_sent_time = 0;
1326         static time_t last_idle_closed_check = 0;
1327         time_t t;
1328         BOOL allidle = True;
1329
1330         if (smb_read_error == READ_EOF) {
1331                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1332                 return False;
1333         }
1334
1335         if (smb_read_error == READ_ERROR) {
1336                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1337                         strerror(errno)));
1338                 return False;
1339         }
1340
1341         if (smb_read_error == READ_BAD_SIG) {
1342                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1343                 return False;
1344         }
1345
1346         *last_timeout_processing_time = t = time(NULL);
1347
1348         if(last_keepalive_sent_time == 0)
1349                 last_keepalive_sent_time = t;
1350
1351         if(last_idle_closed_check == 0)
1352                 last_idle_closed_check = t;
1353
1354         /* become root again if waiting */
1355         change_to_root_user();
1356
1357         /* run all registered idle events */
1358         smb_run_idle_events(t);
1359
1360         /* check if we need to reload services */
1361         check_reload(t);
1362
1363         /* automatic timeout if all connections are closed */
1364         if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1365                 DEBUG( 2, ( "Closing idle connection\n" ) );
1366                 return False;
1367         } else {
1368                 last_idle_closed_check = t;
1369         }
1370
1371         if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1372                 if (!send_keepalive(smbd_server_fd())) {
1373                         DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1374                         return False;
1375                 }
1376
1377                 /* send a keepalive for a password server or the like.
1378                         This is attached to the auth_info created in the
1379                 negprot */
1380                 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1381                                 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1382
1383                         negprot_global_auth_context->challenge_set_method->send_keepalive
1384                         (&negprot_global_auth_context->challenge_set_method->private_data);
1385                 }
1386
1387                 last_keepalive_sent_time = t;
1388         }
1389
1390         /* check for connection timeouts */
1391         allidle = conn_idle_all(t, deadtime);
1392
1393         if (allidle && conn_num_open()>0) {
1394                 DEBUG(2,("Closing idle connection 2.\n"));
1395                 return False;
1396         }
1397
1398         if(global_machine_password_needs_changing &&
1399                         /* for ADS we need to do a regular ADS password change, not a domain
1400                                         password change */
1401                         lp_security() == SEC_DOMAIN) {
1402
1403                 unsigned char trust_passwd_hash[16];
1404                 time_t lct;
1405
1406                 /*
1407                  * We're in domain level security, and the code that
1408                  * read the machine password flagged that the machine
1409                  * password needs changing.
1410                  */
1411
1412                 /*
1413                  * First, open the machine password file with an exclusive lock.
1414                  */
1415
1416                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1417                         DEBUG(0,("process: unable to lock the machine account password for \
1418 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1419                         return True;
1420                 }
1421
1422                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1423                         DEBUG(0,("process: unable to read the machine account password for \
1424 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1425                         secrets_lock_trust_account_password(lp_workgroup(), False);
1426                         return True;
1427                 }
1428
1429                 /*
1430                  * Make sure someone else hasn't already done this.
1431                  */
1432
1433                 if(t < lct + lp_machine_password_timeout()) {
1434                         global_machine_password_needs_changing = False;
1435                         secrets_lock_trust_account_password(lp_workgroup(), False);
1436                         return True;
1437                 }
1438
1439                 /* always just contact the PDC here */
1440
1441                 change_trust_account_password( lp_workgroup(), NULL);
1442                 global_machine_password_needs_changing = False;
1443                 secrets_lock_trust_account_password(lp_workgroup(), False);
1444         }
1445
1446         /*
1447          * Check to see if we have any blocking locks
1448          * outstanding on the queue.
1449          */
1450         process_blocking_lock_queue();
1451
1452         /* update printer queue caches if necessary */
1453
1454         update_monitored_printq_cache();
1455
1456         /*
1457          * Now we are root, check if the log files need pruning.
1458          * Force a log file check.
1459          */
1460         force_check_log_size();
1461         check_log_size();
1462
1463         /* Send any queued printer notify message to interested smbd's. */
1464
1465         print_notify_send_messages(0);
1466
1467         /*
1468          * Modify the select timeout depending upon
1469          * what we have remaining in our queues.
1470          */
1471
1472         *select_timeout = setup_select_timeout();
1473
1474         return True;
1475 }
1476
1477 /****************************************************************************
1478  Accessor functions for InBuffer, OutBuffer.
1479 ****************************************************************************/
1480
1481 char *get_InBuffer(void)
1482 {
1483         return InBuffer;
1484 }
1485
1486 char *get_OutBuffer(void)
1487 {
1488         return OutBuffer;
1489 }
1490
1491 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1492
1493 /****************************************************************************
1494  Allocate a new InBuffer. Returns the new and old ones.
1495 ****************************************************************************/
1496
1497 static char *NewInBuffer(char **old_inbuf)
1498 {
1499         char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1500         if (!new_inbuf) {
1501                 return NULL;
1502         }
1503         if (old_inbuf) {
1504                 *old_inbuf = InBuffer;
1505         }
1506         InBuffer = new_inbuf;
1507 #if defined(DEVELOPER)
1508         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1509 #endif
1510         return InBuffer;
1511 }
1512
1513 /****************************************************************************
1514  Allocate a new OutBuffer. Returns the new and old ones.
1515 ****************************************************************************/
1516
1517 static char *NewOutBuffer(char **old_outbuf)
1518 {
1519         char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1520         if (!new_outbuf) {
1521                 return NULL;
1522         }
1523         if (old_outbuf) {
1524                 *old_outbuf = OutBuffer;
1525         }
1526         OutBuffer = new_outbuf;
1527 #if defined(DEVELOPER)
1528         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1529 #endif
1530         return OutBuffer;
1531 }
1532
1533 /****************************************************************************
1534  Process commands from the client
1535 ****************************************************************************/
1536
1537 void smbd_process(void)
1538 {
1539         time_t last_timeout_processing_time = time(NULL);
1540         unsigned int num_smbs = 0;
1541
1542         /* Allocate the primary Inbut/Output buffers. */
1543
1544         if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1545                 return;
1546
1547         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1548
1549         while (True) {
1550                 int deadtime = lp_deadtime()*60;
1551                 int select_timeout = setup_select_timeout();
1552                 int num_echos;
1553
1554                 if (deadtime <= 0)
1555                         deadtime = DEFAULT_SMBD_TIMEOUT;
1556
1557                 errno = 0;
1558
1559                 /* free up temporary memory */
1560                 lp_TALLOC_FREE();
1561                 main_loop_TALLOC_FREE();
1562
1563                 /* Did someone ask for immediate checks on things like blocking locks ? */
1564                 if (select_timeout == 0) {
1565                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1566                                 return;
1567                         num_smbs = 0; /* Reset smb counter. */
1568                 }
1569
1570                 run_events(smbd_event_context(), 0, NULL, NULL);
1571
1572 #if defined(DEVELOPER)
1573                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1574 #endif
1575
1576                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1577                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1578                                 return;
1579                         num_smbs = 0; /* Reset smb counter. */
1580                 }
1581
1582                 /*
1583                  * Ensure we do timeout processing if the SMB we just got was
1584                  * only an echo request. This allows us to set the select
1585                  * timeout in 'receive_message_or_smb()' to any value we like
1586                  * without worrying that the client will send echo requests
1587                  * faster than the select timeout, thus starving out the
1588                  * essential processing (change notify, blocking locks) that
1589                  * the timeout code does. JRA.
1590                  */
1591                 num_echos = smb_echo_count;
1592
1593                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1594
1595                 process_smb(InBuffer, OutBuffer);
1596
1597                 if (smb_echo_count != num_echos) {
1598                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1599                                 return;
1600                         num_smbs = 0; /* Reset smb counter. */
1601                 }
1602
1603                 num_smbs++;
1604
1605                 /*
1606                  * If we are getting smb requests in a constant stream
1607                  * with no echos, make sure we attempt timeout processing
1608                  * every select_timeout milliseconds - but only check for this
1609                  * every 200 smb requests.
1610                  */
1611
1612                 if ((num_smbs % 200) == 0) {
1613                         time_t new_check_time = time(NULL);
1614                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1615                                 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1616                                         return;
1617                                 num_smbs = 0; /* Reset smb counter. */
1618                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1619                         }
1620                 }
1621
1622                 /* The timeout_processing function isn't run nearly
1623                    often enough to implement 'max log size' without
1624                    overrunning the size of the file by many megabytes.
1625                    This is especially true if we are running at debug
1626                    level 10.  Checking every 50 SMBs is a nice
1627                    tradeoff of performance vs log file size overrun. */
1628
1629                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1630                         change_to_root_user();
1631                         check_log_size();
1632                 }
1633         }
1634 }