source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 uint16 global_smbpid;
  25 extern struct auth_context *negprot_global_auth_context;
  26 extern int smb_echo_count;
  27
  28 static char *InBuffer = NULL;
  29 static char *OutBuffer = NULL;
  30 static char *current_inbuf = NULL;
  31
  32 /*
  33  * Size of data we can send to client. Set
  34  *  by the client for all protocols above CORE.
  35  *  Set by us for CORE protocol.
  36  */
  37 int max_send = BUFFER_SIZE;
  38 /*
  39  * Size of the data we can receive. Set by us.
  40  * Can be modified by the max xmit parameter.
  41  */
  42 int max_recv = BUFFER_SIZE;
  43
  44 extern int last_message;
  45 extern int smb_read_error;
  46 SIG_ATOMIC_T reload_after_sighup = 0;
  47 SIG_ATOMIC_T got_sig_term = 0;
  48 extern BOOL global_machine_password_needs_changing;
  49 extern int max_send;
  50
  51 /*
  52  * Initialize a struct smb_request from an inbuf
  53  */
  54
  55 void init_smb_request(struct smb_request *req, const uint8 *inbuf)
  56 {
  57         req->flags2 = SVAL(inbuf, smb_flg2);
  58         req->smbpid = SVAL(inbuf, smb_pid);
  59         req->mid    = SVAL(inbuf, smb_mid);
  60         req->vuid   = SVAL(inbuf, smb_uid);
  61 }
  62
  63 /****************************************************************************
  64  structure to hold a linked list of queued messages.
  65  for processing.
  66 ****************************************************************************/
  67
  68 static struct pending_message_list *deferred_open_queue;
  69
  70 /****************************************************************************
  71  Function to push a message onto the tail of a linked list of smb messages
  72  ready for processing.
  73 ****************************************************************************/
  74
  75 static BOOL push_queued_message(char *buf, int msg_len,
  76                                 struct timeval request_time,
  77                                 struct timeval end_time,
  78                                 char *private_data, size_t private_len)
  79 {
  80         struct pending_message_list *msg;
  81
  82         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
  83
  84         if(msg == NULL) {
  85                 DEBUG(0,("push_message: malloc fail (1)\n"));
  86                 return False;
  87         }
  88
  89         msg->buf = data_blob_talloc(msg, buf, msg_len);
  90         if(msg->buf.data == NULL) {
  91                 DEBUG(0,("push_message: malloc fail (2)\n"));
  92                 TALLOC_FREE(msg);
  93                 return False;
  94         }
  95
  96         msg->request_time = request_time;
  97         msg->end_time = end_time;
  98
  99         if (private_data) {
 100                 msg->private_data = data_blob_talloc(msg, private_data,
 101                                                      private_len);
 102                 if (msg->private_data.data == NULL) {
 103                         DEBUG(0,("push_message: malloc fail (3)\n"));
 104                         TALLOC_FREE(msg);
 105                         return False;
 106                 }
 107         }
 108
 109         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 110
 111         DEBUG(10,("push_message: pushed message length %u on "
 112                   "deferred_open_queue\n", (unsigned int)msg_len));
 113
 114         return True;
 115 }
 116
 117 /****************************************************************************
 118  Function to delete a sharing violation open message by mid.
 119 ****************************************************************************/
 120
 121 void remove_deferred_open_smb_message(uint16 mid)
 122 {
 123         struct pending_message_list *pml;
 124
 125         for (pml = deferred_open_queue; pml; pml = pml->next) {
 126                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 127                         DEBUG(10,("remove_deferred_open_smb_message: "
 128                                   "deleting mid %u len %u\n",
 129                                   (unsigned int)mid,
 130                                   (unsigned int)pml->buf.length ));
 131                         DLIST_REMOVE(deferred_open_queue, pml);
 132                         TALLOC_FREE(pml);
 133                         return;
 134                 }
 135         }
 136 }
 137
 138 /****************************************************************************
 139  Move a sharing violation open retry message to the front of the list and
 140  schedule it for immediate processing.
 141 ****************************************************************************/
 142
 143 void schedule_deferred_open_smb_message(uint16 mid)
 144 {
 145         struct pending_message_list *pml;
 146         int i = 0;
 147
 148         for (pml = deferred_open_queue; pml; pml = pml->next) {
 149                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 150                 DEBUG(10, ("schedule_deferred_open_smb_message: [%d] "
 151                            "msg_mid = %u\n", i++, (unsigned int)msg_mid ));
 152                 if (mid == msg_mid) {
 153                         DEBUG(10, ("schedule_deferred_open_smb_message: "
 154                                    "scheduling mid %u\n", mid));
 155                         pml->end_time.tv_sec = 0;
 156                         pml->end_time.tv_usec = 0;
 157                         DLIST_PROMOTE(deferred_open_queue, pml);
 158                         return;
 159                 }
 160         }
 161
 162         DEBUG(10, ("schedule_deferred_open_smb_message: failed to find "
 163                    "message mid %u\n", mid ));
 164 }
 165
 166 /****************************************************************************
 167  Return true if this mid is on the deferred queue.
 168 ****************************************************************************/
 169
 170 BOOL open_was_deferred(uint16 mid)
 171 {
 172         struct pending_message_list *pml;
 173
 174         for (pml = deferred_open_queue; pml; pml = pml->next) {
 175                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 176                         return True;
 177                 }
 178         }
 179         return False;
 180 }
 181
 182 /****************************************************************************
 183  Return the message queued by this mid.
 184 ****************************************************************************/
 185
 186 struct pending_message_list *get_open_deferred_message(uint16 mid)
 187 {
 188         struct pending_message_list *pml;
 189
 190         for (pml = deferred_open_queue; pml; pml = pml->next) {
 191                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 192                         return pml;
 193                 }
 194         }
 195         return NULL;
 196 }
 197
 198 /****************************************************************************
 199  Function to push a deferred open smb message onto a linked list of local smb
 200  messages ready for processing.
 201 ****************************************************************************/
 202
 203 BOOL push_deferred_smb_message(uint16 mid,
 204                                struct timeval request_time,
 205                                struct timeval timeout,
 206                                char *private_data, size_t priv_len)
 207 {
 208         struct timeval end_time;
 209
 210         end_time = timeval_sum(&request_time, &timeout);
 211
 212         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 213                   "timeout time [%u.%06u]\n",
 214                   (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
 215                   (unsigned int)end_time.tv_sec,
 216                   (unsigned int)end_time.tv_usec));
 217
 218         return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
 219                                    request_time, end_time,
 220                                    private_data, priv_len);
 221 }
 222
 223 struct idle_event {
 224         struct timed_event *te;
 225         struct timeval interval;
 226         char *name;
 227         BOOL (*handler)(const struct timeval *now, void *private_data);
 228         void *private_data;
 229 };
 230
 231 static void idle_event_handler(struct event_context *ctx,
 232                                struct timed_event *te,
 233                                const struct timeval *now,
 234                                void *private_data)
 235 {
 236         struct idle_event *event =
 237                 talloc_get_type_abort(private_data, struct idle_event);
 238
 239         TALLOC_FREE(event->te);
 240
 241         if (!event->handler(now, event->private_data)) {
 242                 /* Don't repeat, delete ourselves */
 243                 TALLOC_FREE(event);
 244                 return;
 245         }
 246
 247         event->te = event_add_timed(ctx, event,
 248                                     timeval_sum(now, &event->interval),
 249                                     event->name,
 250                                     idle_event_handler, event);
 251
 252         /* We can't do much but fail here. */
 253         SMB_ASSERT(event->te != NULL);
 254 }
 255
 256 struct idle_event *event_add_idle(struct event_context *event_ctx,
 257                                   TALLOC_CTX *mem_ctx,
 258                                   struct timeval interval,
 259                                   const char *name,
 260                                   BOOL (*handler)(const struct timeval *now,
 261                                                   void *private_data),
 262                                   void *private_data)
 263 {
 264         struct idle_event *result;
 265         struct timeval now = timeval_current();
 266
 267         result = TALLOC_P(mem_ctx, struct idle_event);
 268         if (result == NULL) {
 269                 DEBUG(0, ("talloc failed\n"));
 270                 return NULL;
 271         }
 272
 273         result->interval = interval;
 274         result->handler = handler;
 275         result->private_data = private_data;
 276
 277         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 278                 DEBUG(0, ("talloc failed\n"));
 279                 TALLOC_FREE(result);
 280                 return NULL;
 281         }
 282
 283         result->te = event_add_timed(event_ctx, result,
 284                                      timeval_sum(&now, &interval),
 285                                      result->name,
 286                                      idle_event_handler, result);
 287         if (result->te == NULL) {
 288                 DEBUG(0, ("event_add_timed failed\n"));
 289                 TALLOC_FREE(result);
 290                 return NULL;
 291         }
 292
 293         return result;
 294 }
 295
 296 /****************************************************************************
 297  Do all async processing in here. This includes kernel oplock messages, change
 298  notify events etc.
 299 ****************************************************************************/
 300
 301 static void async_processing(fd_set *pfds)
 302 {
 303         DEBUG(10,("async_processing: Doing async processing.\n"));
 304
 305         process_aio_queue();
 306
 307         process_kernel_oplocks(smbd_messaging_context(), pfds);
 308
 309         /* Do the aio check again after receive_local_message as it does a
 310            select and may have eaten our signal. */
 311         /* Is this till true? -- vl */
 312         process_aio_queue();
 313
 314         if (got_sig_term) {
 315                 exit_server_cleanly("termination signal");
 316         }
 317
 318         /* check for sighup processing */
 319         if (reload_after_sighup) {
 320                 change_to_root_user();
 321                 DEBUG(1,("Reloading services after SIGHUP\n"));
 322                 reload_services(False);
 323                 reload_after_sighup = 0;
 324         }
 325 }
 326
 327 /****************************************************************************
 328  Add a fd to the set we will be select(2)ing on.
 329 ****************************************************************************/
 330
 331 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 332 {
 333         if (fd != -1) {
 334                 FD_SET(fd, fds);
 335                 maxfd = MAX(maxfd, fd);
 336         }
 337
 338         return maxfd;
 339 }
 340
 341 /****************************************************************************
 342   Do a select on an two fd's - with timeout.
 343
 344   If a local udp message has been pushed onto the
 345   queue (this can only happen during oplock break
 346   processing) call async_processing()
 347
 348   If a pending smb message has been pushed onto the
 349   queue (this can only happen during oplock break
 350   processing) return this next.
 351
 352   If the first smbfd is ready then read an smb from it.
 353   if the second (loopback UDP) fd is ready then read a message
 354   from it and setup the buffer header to identify the length
 355   and from address.
 356   Returns False on timeout or error.
 357   Else returns True.
 358
 359 The timeout is in milliseconds
 360 ****************************************************************************/
 361
 362 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 363 {
 364         fd_set r_fds, w_fds;
 365         int selrtn;
 366         struct timeval to;
 367         int maxfd = 0;
 368
 369         smb_read_error = 0;
 370
 371  again:
 372
 373         if (timeout >= 0) {
 374                 to.tv_sec = timeout / 1000;
 375                 to.tv_usec = (timeout % 1000) * 1000;
 376         } else {
 377                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 378                 to.tv_usec = 0;
 379         }
 380
 381         /*
 382          * Note that this call must be before processing any SMB
 383          * messages as we need to synchronously process any messages
 384          * we may have sent to ourselves from the previous SMB.
 385          */
 386         message_dispatch(smbd_messaging_context());
 387
 388         /*
 389          * Check to see if we already have a message on the deferred open queue
 390          * and it's time to schedule.
 391          */
 392         if(deferred_open_queue != NULL) {
 393                 BOOL pop_message = False;
 394                 struct pending_message_list *msg = deferred_open_queue;
 395
 396                 if (timeval_is_zero(&msg->end_time)) {
 397                         pop_message = True;
 398                 } else {
 399                         struct timeval tv;
 400                         SMB_BIG_INT tdif;
 401
 402                         GetTimeOfDay(&tv);
 403                         tdif = usec_time_diff(&msg->end_time, &tv);
 404                         if (tdif <= 0) {
 405                                 /* Timed out. Schedule...*/
 406                                 pop_message = True;
 407                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 408                         } else {
 409                                 /* Make a more accurate select timeout. */
 410                                 to.tv_sec = tdif / 1000000;
 411                                 to.tv_usec = tdif % 1000000;
 412                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 413                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 414                         }
 415                 }
 416
 417                 if (pop_message) {
 418                         memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 419
 420                         /* We leave this message on the queue so the open code can
 421                            know this is a retry. */
 422                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 423                         return True;
 424                 }
 425         }
 426
 427         /*
 428          * Setup the select fd sets.
 429          */
 430
 431         FD_ZERO(&r_fds);
 432         FD_ZERO(&w_fds);
 433
 434         /*
 435          * Ensure we process oplock break messages by preference.
 436          * We have to do this before the select, after the select
 437          * and if the select returns EINTR. This is due to the fact
 438          * that the selects called from async_processing can eat an EINTR
 439          * caused by a signal (we can't take the break message there).
 440          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 441          */
 442
 443         if (oplock_message_waiting(&r_fds)) {
 444                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 445                 async_processing(&r_fds);
 446                 /*
 447                  * After async processing we must go and do the select again, as
 448                  * the state of the flag in fds for the server file descriptor is
 449                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 450                  */
 451                 goto again;
 452         }
 453
 454         /*
 455          * Are there any timed events waiting ? If so, ensure we don't
 456          * select for longer than it would take to wait for them.
 457          */
 458
 459         {
 460                 struct timeval now;
 461                 GetTimeOfDay(&now);
 462
 463                 event_add_to_select_args(smbd_event_context(), &now,
 464                                          &r_fds, &w_fds, &to, &maxfd);
 465         }
 466
 467         if (timeval_is_zero(&to)) {
 468                 /* Process a timed event now... */
 469                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 470                         goto again;
 471                 }
 472         }
 473
 474         {
 475                 int sav;
 476                 START_PROFILE(smbd_idle);
 477
 478                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 479                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 480
 481                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 482                 sav = errno;
 483
 484                 END_PROFILE(smbd_idle);
 485                 errno = sav;
 486         }
 487
 488         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 489                 goto again;
 490         }
 491
 492         /* if we get EINTR then maybe we have received an oplock
 493            signal - treat this as select returning 1. This is ugly, but
 494            is the best we can do until the oplock code knows more about
 495            signals */
 496         if (selrtn == -1 && errno == EINTR) {
 497                 async_processing(&r_fds);
 498                 /*
 499                  * After async processing we must go and do the select again, as
 500                  * the state of the flag in fds for the server file descriptor is
 501                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 502                  */
 503                 goto again;
 504         }
 505
 506         /* Check if error */
 507         if (selrtn == -1) {
 508                 /* something is wrong. Maybe the socket is dead? */
 509                 smb_read_error = READ_ERROR;
 510                 return False;
 511         }
 512
 513         /* Did we timeout ? */
 514         if (selrtn == 0) {
 515                 smb_read_error = READ_TIMEOUT;
 516                 return False;
 517         }
 518
 519         /*
 520          * Ensure we process oplock break messages by preference.
 521          * This is IMPORTANT ! Otherwise we can starve other processes
 522          * sending us an oplock break message. JRA.
 523          */
 524
 525         if (oplock_message_waiting(&r_fds)) {
 526                 async_processing(&r_fds);
 527                 /*
 528                  * After async processing we must go and do the select again, as
 529                  * the state of the flag in fds for the server file descriptor is
 530                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 531                  */
 532                 goto again;
 533         }
 534
 535         return receive_smb(smbd_server_fd(), buffer, 0);
 536 }
 537
 538 /*
 539  * Only allow 5 outstanding trans requests. We're allocating memory, so
 540  * prevent a DoS.
 541  */
 542
 543 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 544 {
 545         int count = 0;
 546         for (; list != NULL; list = list->next) {
 547
 548                 if (list->mid == mid) {
 549                         return NT_STATUS_INVALID_PARAMETER;
 550                 }
 551
 552                 count += 1;
 553         }
 554         if (count > 5) {
 555                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 556         }
 557
 558         return NT_STATUS_OK;
 559 }
 560
 561 /****************************************************************************
 562  We're terminating and have closed all our files/connections etc.
 563  If there are any pending local messages we need to respond to them
 564  before termination so that other smbds don't think we just died whilst
 565  holding oplocks.
 566 ****************************************************************************/
 567
 568 void respond_to_all_remaining_local_messages(void)
 569 {
 570         /*
 571          * Assert we have no exclusive open oplocks.
 572          */
 573
 574         if(get_number_of_exclusive_open_oplocks()) {
 575                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 576                         get_number_of_exclusive_open_oplocks() ));
 577                 return;
 578         }
 579
 580         process_kernel_oplocks(smbd_messaging_context(), NULL);
 581
 582         return;
 583 }
 584
 585
 586 /*
 587 These flags determine some of the permissions required to do an operation
 588
 589 Note that I don't set NEED_WRITE on some write operations because they
 590 are used by some brain-dead clients when printing, and I don't want to
 591 force write permissions on print services.
 592 */
 593 #define AS_USER (1<<0)
 594 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 595 #define TIME_INIT (1<<2)
 596 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 597 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 598 #define DO_CHDIR (1<<6)
 599
 600 /*
 601    define a list of possible SMB messages and their corresponding
 602    functions. Any message that has a NULL function is unimplemented -
 603    please feel free to contribute implementations!
 604 */
 605 static const struct smb_message_struct {
 606         const char *name;
 607         int (*fn)(connection_struct *conn, char *, char *, int, int);
 608         int flags;
 609 } smb_messages[256] = {
 610
 611 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 612 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 613 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 614 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 615 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 616 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 617 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 618 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 619 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 620 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 621 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 622 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 623 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 624 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 625 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 626 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 627 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 628 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 629 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 630 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 631 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 632 /* 0x15 */ { NULL, NULL, 0 },
 633 /* 0x16 */ { NULL, NULL, 0 },
 634 /* 0x17 */ { NULL, NULL, 0 },
 635 /* 0x18 */ { NULL, NULL, 0 },
 636 /* 0x19 */ { NULL, NULL, 0 },
 637 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 638 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 639 /* 0x1c */ { "SMBreadBs",NULL,0 },
 640 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 641 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 642 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 643 /* 0x20 */ { "SMBwritec",NULL,0},
 644 /* 0x21 */ { NULL, NULL, 0 },
 645 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 646 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 647 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 648 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 649 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 650 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 651 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 652 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 653 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
 654 /* 0x2b */ { "SMBecho",reply_echo,0},
 655 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 656 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 657 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 658 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 659 /* 0x30 */ { NULL, NULL, 0 },
 660 /* 0x31 */ { NULL, NULL, 0 },
 661 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 662 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 663 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 664 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 665 /* 0x36 */ { NULL, NULL, 0 },
 666 /* 0x37 */ { NULL, NULL, 0 },
 667 /* 0x38 */ { NULL, NULL, 0 },
 668 /* 0x39 */ { NULL, NULL, 0 },
 669 /* 0x3a */ { NULL, NULL, 0 },
 670 /* 0x3b */ { NULL, NULL, 0 },
 671 /* 0x3c */ { NULL, NULL, 0 },
 672 /* 0x3d */ { NULL, NULL, 0 },
 673 /* 0x3e */ { NULL, NULL, 0 },
 674 /* 0x3f */ { NULL, NULL, 0 },
 675 /* 0x40 */ { NULL, NULL, 0 },
 676 /* 0x41 */ { NULL, NULL, 0 },
 677 /* 0x42 */ { NULL, NULL, 0 },
 678 /* 0x43 */ { NULL, NULL, 0 },
 679 /* 0x44 */ { NULL, NULL, 0 },
 680 /* 0x45 */ { NULL, NULL, 0 },
 681 /* 0x46 */ { NULL, NULL, 0 },
 682 /* 0x47 */ { NULL, NULL, 0 },
 683 /* 0x48 */ { NULL, NULL, 0 },
 684 /* 0x49 */ { NULL, NULL, 0 },
 685 /* 0x4a */ { NULL, NULL, 0 },
 686 /* 0x4b */ { NULL, NULL, 0 },
 687 /* 0x4c */ { NULL, NULL, 0 },
 688 /* 0x4d */ { NULL, NULL, 0 },
 689 /* 0x4e */ { NULL, NULL, 0 },
 690 /* 0x4f */ { NULL, NULL, 0 },
 691 /* 0x50 */ { NULL, NULL, 0 },
 692 /* 0x51 */ { NULL, NULL, 0 },
 693 /* 0x52 */ { NULL, NULL, 0 },
 694 /* 0x53 */ { NULL, NULL, 0 },
 695 /* 0x54 */ { NULL, NULL, 0 },
 696 /* 0x55 */ { NULL, NULL, 0 },
 697 /* 0x56 */ { NULL, NULL, 0 },
 698 /* 0x57 */ { NULL, NULL, 0 },
 699 /* 0x58 */ { NULL, NULL, 0 },
 700 /* 0x59 */ { NULL, NULL, 0 },
 701 /* 0x5a */ { NULL, NULL, 0 },
 702 /* 0x5b */ { NULL, NULL, 0 },
 703 /* 0x5c */ { NULL, NULL, 0 },
 704 /* 0x5d */ { NULL, NULL, 0 },
 705 /* 0x5e */ { NULL, NULL, 0 },
 706 /* 0x5f */ { NULL, NULL, 0 },
 707 /* 0x60 */ { NULL, NULL, 0 },
 708 /* 0x61 */ { NULL, NULL, 0 },
 709 /* 0x62 */ { NULL, NULL, 0 },
 710 /* 0x63 */ { NULL, NULL, 0 },
 711 /* 0x64 */ { NULL, NULL, 0 },
 712 /* 0x65 */ { NULL, NULL, 0 },
 713 /* 0x66 */ { NULL, NULL, 0 },
 714 /* 0x67 */ { NULL, NULL, 0 },
 715 /* 0x68 */ { NULL, NULL, 0 },
 716 /* 0x69 */ { NULL, NULL, 0 },
 717 /* 0x6a */ { NULL, NULL, 0 },
 718 /* 0x6b */ { NULL, NULL, 0 },
 719 /* 0x6c */ { NULL, NULL, 0 },
 720 /* 0x6d */ { NULL, NULL, 0 },
 721 /* 0x6e */ { NULL, NULL, 0 },
 722 /* 0x6f */ { NULL, NULL, 0 },
 723 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 724 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
 725 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 726 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 727 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 728 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 729 /* 0x76 */ { NULL, NULL, 0 },
 730 /* 0x77 */ { NULL, NULL, 0 },
 731 /* 0x78 */ { NULL, NULL, 0 },
 732 /* 0x79 */ { NULL, NULL, 0 },
 733 /* 0x7a */ { NULL, NULL, 0 },
 734 /* 0x7b */ { NULL, NULL, 0 },
 735 /* 0x7c */ { NULL, NULL, 0 },
 736 /* 0x7d */ { NULL, NULL, 0 },
 737 /* 0x7e */ { NULL, NULL, 0 },
 738 /* 0x7f */ { NULL, NULL, 0 },
 739 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 740 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 741 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 742 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 743 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 744 /* 0x85 */ { NULL, NULL, 0 },
 745 /* 0x86 */ { NULL, NULL, 0 },
 746 /* 0x87 */ { NULL, NULL, 0 },
 747 /* 0x88 */ { NULL, NULL, 0 },
 748 /* 0x89 */ { NULL, NULL, 0 },
 749 /* 0x8a */ { NULL, NULL, 0 },
 750 /* 0x8b */ { NULL, NULL, 0 },
 751 /* 0x8c */ { NULL, NULL, 0 },
 752 /* 0x8d */ { NULL, NULL, 0 },
 753 /* 0x8e */ { NULL, NULL, 0 },
 754 /* 0x8f */ { NULL, NULL, 0 },
 755 /* 0x90 */ { NULL, NULL, 0 },
 756 /* 0x91 */ { NULL, NULL, 0 },
 757 /* 0x92 */ { NULL, NULL, 0 },
 758 /* 0x93 */ { NULL, NULL, 0 },
 759 /* 0x94 */ { NULL, NULL, 0 },
 760 /* 0x95 */ { NULL, NULL, 0 },
 761 /* 0x96 */ { NULL, NULL, 0 },
 762 /* 0x97 */ { NULL, NULL, 0 },
 763 /* 0x98 */ { NULL, NULL, 0 },
 764 /* 0x99 */ { NULL, NULL, 0 },
 765 /* 0x9a */ { NULL, NULL, 0 },
 766 /* 0x9b */ { NULL, NULL, 0 },
 767 /* 0x9c */ { NULL, NULL, 0 },
 768 /* 0x9d */ { NULL, NULL, 0 },
 769 /* 0x9e */ { NULL, NULL, 0 },
 770 /* 0x9f */ { NULL, NULL, 0 },
 771 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
 772 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 773 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
 774 /* 0xa3 */ { NULL, NULL, 0 },
 775 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 776 /* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
 777 /* 0xa6 */ { NULL, NULL, 0 },
 778 /* 0xa7 */ { NULL, NULL, 0 },
 779 /* 0xa8 */ { NULL, NULL, 0 },
 780 /* 0xa9 */ { NULL, NULL, 0 },
 781 /* 0xaa */ { NULL, NULL, 0 },
 782 /* 0xab */ { NULL, NULL, 0 },
 783 /* 0xac */ { NULL, NULL, 0 },
 784 /* 0xad */ { NULL, NULL, 0 },
 785 /* 0xae */ { NULL, NULL, 0 },
 786 /* 0xaf */ { NULL, NULL, 0 },
 787 /* 0xb0 */ { NULL, NULL, 0 },
 788 /* 0xb1 */ { NULL, NULL, 0 },
 789 /* 0xb2 */ { NULL, NULL, 0 },
 790 /* 0xb3 */ { NULL, NULL, 0 },
 791 /* 0xb4 */ { NULL, NULL, 0 },
 792 /* 0xb5 */ { NULL, NULL, 0 },
 793 /* 0xb6 */ { NULL, NULL, 0 },
 794 /* 0xb7 */ { NULL, NULL, 0 },
 795 /* 0xb8 */ { NULL, NULL, 0 },
 796 /* 0xb9 */ { NULL, NULL, 0 },
 797 /* 0xba */ { NULL, NULL, 0 },
 798 /* 0xbb */ { NULL, NULL, 0 },
 799 /* 0xbc */ { NULL, NULL, 0 },
 800 /* 0xbd */ { NULL, NULL, 0 },
 801 /* 0xbe */ { NULL, NULL, 0 },
 802 /* 0xbf */ { NULL, NULL, 0 },
 803 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
 804 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 805 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 806 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 807 /* 0xc4 */ { NULL, NULL, 0 },
 808 /* 0xc5 */ { NULL, NULL, 0 },
 809 /* 0xc6 */ { NULL, NULL, 0 },
 810 /* 0xc7 */ { NULL, NULL, 0 },
 811 /* 0xc8 */ { NULL, NULL, 0 },
 812 /* 0xc9 */ { NULL, NULL, 0 },
 813 /* 0xca */ { NULL, NULL, 0 },
 814 /* 0xcb */ { NULL, NULL, 0 },
 815 /* 0xcc */ { NULL, NULL, 0 },
 816 /* 0xcd */ { NULL, NULL, 0 },
 817 /* 0xce */ { NULL, NULL, 0 },
 818 /* 0xcf */ { NULL, NULL, 0 },
 819 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 820 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 821 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 822 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 823 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 824 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 825 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 826 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 827 /* 0xd8 */ { NULL, NULL, 0 },
 828 /* 0xd9 */ { NULL, NULL, 0 },
 829 /* 0xda */ { NULL, NULL, 0 },
 830 /* 0xdb */ { NULL, NULL, 0 },
 831 /* 0xdc */ { NULL, NULL, 0 },
 832 /* 0xdd */ { NULL, NULL, 0 },
 833 /* 0xde */ { NULL, NULL, 0 },
 834 /* 0xdf */ { NULL, NULL, 0 },
 835 /* 0xe0 */ { NULL, NULL, 0 },
 836 /* 0xe1 */ { NULL, NULL, 0 },
 837 /* 0xe2 */ { NULL, NULL, 0 },
 838 /* 0xe3 */ { NULL, NULL, 0 },
 839 /* 0xe4 */ { NULL, NULL, 0 },
 840 /* 0xe5 */ { NULL, NULL, 0 },
 841 /* 0xe6 */ { NULL, NULL, 0 },
 842 /* 0xe7 */ { NULL, NULL, 0 },
 843 /* 0xe8 */ { NULL, NULL, 0 },
 844 /* 0xe9 */ { NULL, NULL, 0 },
 845 /* 0xea */ { NULL, NULL, 0 },
 846 /* 0xeb */ { NULL, NULL, 0 },
 847 /* 0xec */ { NULL, NULL, 0 },
 848 /* 0xed */ { NULL, NULL, 0 },
 849 /* 0xee */ { NULL, NULL, 0 },
 850 /* 0xef */ { NULL, NULL, 0 },
 851 /* 0xf0 */ { NULL, NULL, 0 },
 852 /* 0xf1 */ { NULL, NULL, 0 },
 853 /* 0xf2 */ { NULL, NULL, 0 },
 854 /* 0xf3 */ { NULL, NULL, 0 },
 855 /* 0xf4 */ { NULL, NULL, 0 },
 856 /* 0xf5 */ { NULL, NULL, 0 },
 857 /* 0xf6 */ { NULL, NULL, 0 },
 858 /* 0xf7 */ { NULL, NULL, 0 },
 859 /* 0xf8 */ { NULL, NULL, 0 },
 860 /* 0xf9 */ { NULL, NULL, 0 },
 861 /* 0xfa */ { NULL, NULL, 0 },
 862 /* 0xfb */ { NULL, NULL, 0 },
 863 /* 0xfc */ { NULL, NULL, 0 },
 864 /* 0xfd */ { NULL, NULL, 0 },
 865 /* 0xfe */ { NULL, NULL, 0 },
 866 /* 0xff */ { NULL, NULL, 0 }
 867
 868 };
 869
 870 /*******************************************************************
 871  Dump a packet to a file.
 872 ********************************************************************/
 873
 874 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 875 {
 876         int fd, i;
 877         pstring fname;
 878         if (DEBUGLEVEL < 50) return;
 879
 880         if (len < 4) len = smb_len(data)+4;
 881         for (i=1;i<100;i++) {
 882                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 883                                 type ? "req" : "resp");
 884                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 885                 if (fd != -1 || errno != EEXIST) break;
 886         }
 887         if (fd != -1) {
 888                 ssize_t ret = write(fd, data, len);
 889                 if (ret != len)
 890                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 891                 close(fd);
 892                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
 893         }
 894 }
 895
 896
 897 /****************************************************************************
 898  Do a switch on the message type, and return the response size
 899 ****************************************************************************/
 900
 901 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 902 {
 903         static pid_t pid= (pid_t)-1;
 904         int outsize = 0;
 905
 906         type &= 0xff;
 907
 908         if (pid == (pid_t)-1)
 909                 pid = sys_getpid();
 910
 911         errno = 0;
 912
 913         last_message = type;
 914
 915         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 916         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 917                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 918                 exit_server_cleanly("Non-SMB packet");
 919                 return(-1);
 920         }
 921
 922         /* yuck! this is an interim measure before we get rid of our
 923                 current inbuf/outbuf system */
 924         global_smbpid = SVAL(inbuf,smb_pid);
 925
 926         if (smb_messages[type].fn == NULL) {
 927                 DEBUG(0,("Unknown message type %d!\n",type));
 928                 smb_dump("Unknown", 1, inbuf, size);
 929                 outsize = reply_unknown(inbuf,outbuf);
 930         } else {
 931                 int flags = smb_messages[type].flags;
 932                 static uint16 last_session_tag = UID_FIELD_INVALID;
 933                 /* In share mode security we must ignore the vuid. */
 934                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 935                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 936
 937                 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
 938
 939                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 940
 941                 /* Ensure this value is replaced in the incoming packet. */
 942                 SSVAL(inbuf,smb_uid,session_tag);
 943
 944                 /*
 945                  * Ensure the correct username is in current_user_info.
 946                  * This is a really ugly bugfix for problems with
 947                  * multiple session_setup_and_X's being done and
 948                  * allowing %U and %G substitutions to work correctly.
 949                  * There is a reason this code is done here, don't
 950                  * move it unless you know what you're doing... :-).
 951                  * JRA.
 952                  */
 953
 954                 if (session_tag != last_session_tag) {
 955                         user_struct *vuser = NULL;
 956
 957                         last_session_tag = session_tag;
 958                         if(session_tag != UID_FIELD_INVALID) {
 959                                 vuser = get_valid_user_struct(session_tag);
 960                                 if (vuser) {
 961                                         set_current_user_info(&vuser->user);
 962                                 }
 963                         }
 964                 }
 965
 966                 /* Does this call need to be run as the connected user? */
 967                 if (flags & AS_USER) {
 968
 969                         /* Does this call need a valid tree connection? */
 970                         if (!conn) {
 971                                 /* Amazingly, the error code depends on the command (from Samba4). */
 972                                 if (type == SMBntcreateX) {
 973                                         return ERROR_NT(NT_STATUS_INVALID_HANDLE);
 974                                 } else {
 975                                         return ERROR_DOS(ERRSRV, ERRinvnid);
 976                                 }
 977                         }
 978
 979                         if (!change_to_user(conn,session_tag)) {
 980                                 return(ERROR_NT(NT_STATUS_DOS(ERRSRV,ERRbaduid)));
 981                         }
 982
 983                         /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
 984
 985                         /* Does it need write permission? */
 986                         if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
 987                                 return ERROR_NT(NT_STATUS_MEDIA_WRITE_PROTECTED);
 988                         }
 989
 990                         /* IPC services are limited */
 991                         if (IS_IPC(conn) && !(flags & CAN_IPC)) {
 992                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 993                         }
 994                 } else {
 995                         /* This call needs to be run as root */
 996                         change_to_root_user();
 997                 }
 998
 999                 /* load service specific parameters */
1000                 if (conn) {
1001                         if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
1002                                 return(ERROR_DOS(ERRSRV,ERRaccess));
1003                         }
1004                         conn->num_smb_operations++;
1005                 }
1006
1007                 /* does this protocol need to be run as guest? */
1008                 if ((flags & AS_GUEST) && (!change_to_guest() ||
1009                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
1010                         return(ERROR_DOS(ERRSRV,ERRaccess));
1011                 }
1012
1013                 current_inbuf = inbuf; /* In case we need to defer this message in open... */
1014                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1015         }
1016
1017         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1018
1019         return(outsize);
1020 }
1021
1022 /****************************************************************************
1023  Construct a reply to the incoming packet.
1024 ****************************************************************************/
1025
1026 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1027 {
1028         int type = CVAL(inbuf,smb_com);
1029         int outsize = 0;
1030         int msg_type = CVAL(inbuf,0);
1031
1032         chain_size = 0;
1033         file_chain_reset();
1034         reset_chain_p();
1035
1036         if (msg_type != 0)
1037                 return(reply_special(inbuf,outbuf));
1038
1039         construct_reply_common(inbuf, outbuf);
1040
1041         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1042
1043         outsize += chain_size;
1044
1045         if(outsize > 4) {
1046                 smb_setlen(inbuf,outbuf,outsize - 4);
1047         }
1048         return(outsize);
1049 }
1050
1051 /****************************************************************************
1052  Process an smb from the client
1053 ****************************************************************************/
1054
1055 static void process_smb(char *inbuf, char *outbuf)
1056 {
1057         static int trans_num;
1058         int msg_type = CVAL(inbuf,0);
1059         int32 len = smb_len(inbuf);
1060         int nread = len + 4;
1061
1062         DO_PROFILE_INC(smb_count);
1063
1064         if (trans_num == 0) {
1065                 /* on the first packet, check the global hosts allow/ hosts
1066                 deny parameters before doing any parsing of the packet
1067                 passed to us by the client.  This prevents attacks on our
1068                 parsing code from hosts not in the hosts allow list */
1069                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1070                                   lp_hostsdeny(-1))) {
1071                         /* send a negative session response "not listening on calling name" */
1072                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1073                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1074                         (void)send_smb(smbd_server_fd(),(char *)buf);
1075                         exit_server_cleanly("connection denied");
1076                 }
1077         }
1078
1079         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1080         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1081
1082         if (msg_type == 0)
1083                 show_msg(inbuf);
1084         else if(msg_type == SMBkeepalive)
1085                 return; /* Keepalive packet. */
1086
1087         nread = construct_reply(inbuf,outbuf,nread,max_send);
1088
1089         if(nread > 0) {
1090                 if (CVAL(outbuf,0) == 0)
1091                         show_msg(outbuf);
1092
1093                 if (nread != smb_len(outbuf) + 4) {
1094                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1095                                 nread, smb_len(outbuf)));
1096                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1097                         exit_server_cleanly("process_smb: send_smb failed.");
1098                 }
1099         }
1100         trans_num++;
1101 }
1102
1103 /****************************************************************************
1104  Return a string containing the function name of a SMB command.
1105 ****************************************************************************/
1106
1107 const char *smb_fn_name(int type)
1108 {
1109         const char *unknown_name = "SMBunknown";
1110
1111         if (smb_messages[type].name == NULL)
1112                 return(unknown_name);
1113
1114         return(smb_messages[type].name);
1115 }
1116
1117 /****************************************************************************
1118  Helper functions for contruct_reply.
1119 ****************************************************************************/
1120
1121 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1122
1123 void add_to_common_flags2(uint32 v)
1124 {
1125         common_flags2 |= v;
1126 }
1127
1128 void remove_from_common_flags2(uint32 v)
1129 {
1130         common_flags2 &= ~v;
1131 }
1132
1133 void construct_reply_common(const char *inbuf, char *outbuf)
1134 {
1135         set_message(inbuf,outbuf,0,0,False);
1136
1137         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1138         SIVAL(outbuf,smb_rcls,0);
1139         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1140         SSVAL(outbuf,smb_flg2,
1141                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1142                 common_flags2);
1143         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1144
1145         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1146         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1147         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1148         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1149 }
1150
1151 /****************************************************************************
1152  Construct a chained reply and add it to the already made reply
1153 ****************************************************************************/
1154
1155 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1156 {
1157         static char *orig_inbuf;
1158         static char *orig_outbuf;
1159         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1160         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1161         char *inbuf2, *outbuf2;
1162         int outsize2;
1163         int new_size;
1164         char inbuf_saved[smb_wct];
1165         char outbuf_saved[smb_wct];
1166         int outsize = smb_len(outbuf) + 4;
1167
1168         /* Maybe its not chained, or it's an error packet. */
1169         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1170                 SCVAL(outbuf,smb_vwv0,0xFF);
1171                 return outsize;
1172         }
1173
1174         if (chain_size == 0) {
1175                 /* this is the first part of the chain */
1176                 orig_inbuf = inbuf;
1177                 orig_outbuf = outbuf;
1178         }
1179
1180         /*
1181          * The original Win95 redirector dies on a reply to
1182          * a lockingX and read chain unless the chain reply is
1183          * 4 byte aligned. JRA.
1184          */
1185
1186         outsize = (outsize + 3) & ~3;
1187
1188         /* we need to tell the client where the next part of the reply will be */
1189         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1190         SCVAL(outbuf,smb_vwv0,smb_com2);
1191
1192         /* remember how much the caller added to the chain, only counting stuff
1193                 after the parameter words */
1194         chain_size += outsize - smb_wct;
1195
1196         /* work out pointers into the original packets. The
1197                 headers on these need to be filled in */
1198         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1199         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1200
1201         /* remember the original command type */
1202         smb_com1 = CVAL(orig_inbuf,smb_com);
1203
1204         /* save the data which will be overwritten by the new headers */
1205         memcpy(inbuf_saved,inbuf2,smb_wct);
1206         memcpy(outbuf_saved,outbuf2,smb_wct);
1207
1208         /* give the new packet the same header as the last part of the SMB */
1209         memmove(inbuf2,inbuf,smb_wct);
1210
1211         /* create the in buffer */
1212         SCVAL(inbuf2,smb_com,smb_com2);
1213
1214         /* work out the new size for the in buffer. */
1215         new_size = size - (inbuf2 - inbuf);
1216         if (new_size < 0) {
1217                 DEBUG(0,("chain_reply: chain packet size incorrect "
1218                          "(orig size = %d, offset = %d)\n",
1219                          size, (int)(inbuf2 - inbuf) ));
1220                 exit_server_cleanly("Bad chained packet");
1221                 return(-1);
1222         }
1223
1224         /* And set it in the header. */
1225         smb_setlen(inbuf, inbuf2, new_size);
1226
1227         /* create the out buffer */
1228         construct_reply_common(inbuf2, outbuf2);
1229
1230         DEBUG(3,("Chained message\n"));
1231         show_msg(inbuf2);
1232
1233         /* process the request */
1234         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,new_size,
1235                                 bufsize-chain_size);
1236
1237         /* copy the new reply and request headers over the old ones, but
1238                 preserve the smb_com field */
1239         memmove(orig_outbuf,outbuf2,smb_wct);
1240         SCVAL(orig_outbuf,smb_com,smb_com1);
1241
1242         /* restore the saved data, being careful not to overwrite any
1243                 data from the reply header */
1244         memcpy(inbuf2,inbuf_saved,smb_wct);
1245
1246         {
1247                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1248                 if (ofs < 0) {
1249                         ofs = 0;
1250                 }
1251                 memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1252         }
1253
1254         return outsize2;
1255 }
1256
1257 /****************************************************************************
1258  Setup the needed select timeout in milliseconds.
1259 ****************************************************************************/
1260
1261 static int setup_select_timeout(void)
1262 {
1263         int select_timeout;
1264
1265         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1266
1267         if (print_notify_messages_pending()) {
1268                 select_timeout = MIN(select_timeout, 1000);
1269         }
1270
1271         return select_timeout;
1272 }
1273
1274 /****************************************************************************
1275  Check if services need reloading.
1276 ****************************************************************************/
1277
1278 void check_reload(time_t t)
1279 {
1280         static pid_t mypid = 0;
1281         static time_t last_smb_conf_reload_time = 0;
1282         static time_t last_printer_reload_time = 0;
1283         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1284
1285         if(last_smb_conf_reload_time == 0) {
1286                 last_smb_conf_reload_time = t;
1287                 /* Our printing subsystem might not be ready at smbd start up.
1288                    Then no printer is available till the first printers check
1289                    is performed.  A lower initial interval circumvents this. */
1290                 if ( printcap_cache_time > 60 )
1291                         last_printer_reload_time = t - printcap_cache_time + 60;
1292                 else
1293                         last_printer_reload_time = t;
1294         }
1295
1296         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1297                 /* randomize over 60 second the printcap reload to avoid all
1298                  * process hitting cupsd at the same time */
1299                 int time_range = 60;
1300
1301                 last_printer_reload_time += random() % time_range;
1302                 mypid = getpid();
1303         }
1304
1305         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1306                 reload_services(True);
1307                 reload_after_sighup = False;
1308                 last_smb_conf_reload_time = t;
1309         }
1310
1311         /* 'printcap cache time = 0' disable the feature */
1312
1313         if ( printcap_cache_time != 0 )
1314         {
1315                 /* see if it's time to reload or if the clock has been set back */
1316
1317                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1318                         || (t-last_printer_reload_time  < 0) )
1319                 {
1320                         DEBUG( 3,( "Printcap cache time expired.\n"));
1321                         reload_printers();
1322                         last_printer_reload_time = t;
1323                 }
1324         }
1325 }
1326
1327 /****************************************************************************
1328  Process any timeout housekeeping. Return False if the caller should exit.
1329 ****************************************************************************/
1330
1331 static BOOL timeout_processing(int *select_timeout,
1332                                time_t *last_timeout_processing_time)
1333 {
1334         time_t t;
1335
1336         if (smb_read_error == READ_EOF) {
1337                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1338                 return False;
1339         }
1340
1341         if (smb_read_error == READ_ERROR) {
1342                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1343                         strerror(errno)));
1344                 return False;
1345         }
1346
1347         if (smb_read_error == READ_BAD_SIG) {
1348                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1349                 return False;
1350         }
1351
1352         *last_timeout_processing_time = t = time(NULL);
1353
1354         /* become root again if waiting */
1355         change_to_root_user();
1356
1357         /* check if we need to reload services */
1358         check_reload(t);
1359
1360         if(global_machine_password_needs_changing &&
1361                         /* for ADS we need to do a regular ADS password change, not a domain
1362                                         password change */
1363                         lp_security() == SEC_DOMAIN) {
1364
1365                 unsigned char trust_passwd_hash[16];
1366                 time_t lct;
1367
1368                 /*
1369                  * We're in domain level security, and the code that
1370                  * read the machine password flagged that the machine
1371                  * password needs changing.
1372                  */
1373
1374                 /*
1375                  * First, open the machine password file with an exclusive lock.
1376                  */
1377
1378                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1379                         DEBUG(0,("process: unable to lock the machine account password for \
1380 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1381                         return True;
1382                 }
1383
1384                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1385                         DEBUG(0,("process: unable to read the machine account password for \
1386 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1387                         secrets_lock_trust_account_password(lp_workgroup(), False);
1388                         return True;
1389                 }
1390
1391                 /*
1392                  * Make sure someone else hasn't already done this.
1393                  */
1394
1395                 if(t < lct + lp_machine_password_timeout()) {
1396                         global_machine_password_needs_changing = False;
1397                         secrets_lock_trust_account_password(lp_workgroup(), False);
1398                         return True;
1399                 }
1400
1401                 /* always just contact the PDC here */
1402
1403                 change_trust_account_password( lp_workgroup(), NULL);
1404                 global_machine_password_needs_changing = False;
1405                 secrets_lock_trust_account_password(lp_workgroup(), False);
1406         }
1407
1408         /* update printer queue caches if necessary */
1409
1410         update_monitored_printq_cache();
1411
1412         /*
1413          * Now we are root, check if the log files need pruning.
1414          * Force a log file check.
1415          */
1416         force_check_log_size();
1417         check_log_size();
1418
1419         /* Send any queued printer notify message to interested smbd's. */
1420
1421         print_notify_send_messages(smbd_messaging_context(), 0);
1422
1423         /*
1424          * Modify the select timeout depending upon
1425          * what we have remaining in our queues.
1426          */
1427
1428         *select_timeout = setup_select_timeout();
1429
1430         return True;
1431 }
1432
1433 /****************************************************************************
1434  Accessor functions for InBuffer, OutBuffer.
1435 ****************************************************************************/
1436
1437 char *get_InBuffer(void)
1438 {
1439         return InBuffer;
1440 }
1441
1442 char *get_OutBuffer(void)
1443 {
1444         return OutBuffer;
1445 }
1446
1447 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1448
1449 /****************************************************************************
1450  Allocate a new InBuffer. Returns the new and old ones.
1451 ****************************************************************************/
1452
1453 static char *NewInBuffer(char **old_inbuf)
1454 {
1455         char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1456         if (!new_inbuf) {
1457                 return NULL;
1458         }
1459         if (old_inbuf) {
1460                 *old_inbuf = InBuffer;
1461         }
1462         InBuffer = new_inbuf;
1463 #if defined(DEVELOPER)
1464         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1465 #endif
1466         return InBuffer;
1467 }
1468
1469 /****************************************************************************
1470  Allocate a new OutBuffer. Returns the new and old ones.
1471 ****************************************************************************/
1472
1473 static char *NewOutBuffer(char **old_outbuf)
1474 {
1475         char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1476         if (!new_outbuf) {
1477                 return NULL;
1478         }
1479         if (old_outbuf) {
1480                 *old_outbuf = OutBuffer;
1481         }
1482         OutBuffer = new_outbuf;
1483 #if defined(DEVELOPER)
1484         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1485 #endif
1486         return OutBuffer;
1487 }
1488
1489 /****************************************************************************
1490  Process commands from the client
1491 ****************************************************************************/
1492
1493 void smbd_process(void)
1494 {
1495         time_t last_timeout_processing_time = time(NULL);
1496         unsigned int num_smbs = 0;
1497
1498         /* Allocate the primary Inbut/Output buffers. */
1499
1500         if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1501                 return;
1502
1503         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1504
1505         while (True) {
1506                 int select_timeout = setup_select_timeout();
1507                 int num_echos;
1508
1509                 errno = 0;
1510
1511                 /* free up temporary memory */
1512                 lp_TALLOC_FREE();
1513                 main_loop_TALLOC_FREE();
1514
1515                 /* Did someone ask for immediate checks on things like blocking locks ? */
1516                 if (select_timeout == 0) {
1517                         if(!timeout_processing(&select_timeout,
1518                                                &last_timeout_processing_time))
1519                                 return;
1520                         num_smbs = 0; /* Reset smb counter. */
1521                 }
1522
1523                 run_events(smbd_event_context(), 0, NULL, NULL);
1524
1525 #if defined(DEVELOPER)
1526                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1527 #endif
1528
1529                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1530                         if(!timeout_processing(&select_timeout,
1531                                                &last_timeout_processing_time))
1532                                 return;
1533                         num_smbs = 0; /* Reset smb counter. */
1534                 }
1535
1536                 /*
1537                  * Ensure we do timeout processing if the SMB we just got was
1538                  * only an echo request. This allows us to set the select
1539                  * timeout in 'receive_message_or_smb()' to any value we like
1540                  * without worrying that the client will send echo requests
1541                  * faster than the select timeout, thus starving out the
1542                  * essential processing (change notify, blocking locks) that
1543                  * the timeout code does. JRA.
1544                  */
1545                 num_echos = smb_echo_count;
1546
1547                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1548
1549                 process_smb(InBuffer, OutBuffer);
1550
1551                 if (smb_echo_count != num_echos) {
1552                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
1553                                 return;
1554                         num_smbs = 0; /* Reset smb counter. */
1555                 }
1556
1557                 num_smbs++;
1558
1559                 /*
1560                  * If we are getting smb requests in a constant stream
1561                  * with no echos, make sure we attempt timeout processing
1562                  * every select_timeout milliseconds - but only check for this
1563                  * every 200 smb requests.
1564                  */
1565
1566                 if ((num_smbs % 200) == 0) {
1567                         time_t new_check_time = time(NULL);
1568                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1569                                 if(!timeout_processing(
1570                                            &select_timeout,
1571                                            &last_timeout_processing_time))
1572                                         return;
1573                                 num_smbs = 0; /* Reset smb counter. */
1574                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1575                         }
1576                 }
1577
1578                 /* The timeout_processing function isn't run nearly
1579                    often enough to implement 'max log size' without
1580                    overrunning the size of the file by many megabytes.
1581                    This is especially true if we are running at debug
1582                    level 10.  Checking every 50 SMBs is a nice
1583                    tradeoff of performance vs log file size overrun. */
1584
1585                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1586                         change_to_root_user();
1587                         check_log_size();
1588                 }
1589         }
1590 }