source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23
  24 extern bool global_machine_password_needs_changing;
  25
  26 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  27                                    char *outbuf);
  28
  29 /* Accessor function for smb_read_error for smbd functions. */
  30
  31 /****************************************************************************
  32  Send an smb to a fd.
  33 ****************************************************************************/
  34
  35 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  36 {
  37         size_t len;
  38         size_t nwritten=0;
  39         ssize_t ret;
  40         char *buf_out = buffer;
  41
  42         /* Sign the outgoing packet if required. */
  43         srv_calculate_sign_mac(buf_out);
  44
  45         if (do_encrypt) {
  46                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  47                 if (!NT_STATUS_IS_OK(status)) {
  48                         DEBUG(0, ("send_smb: SMB encryption failed "
  49                                 "on outgoing packet! Error %s\n",
  50                                 nt_errstr(status) ));
  51                         return false;
  52                 }
  53         }
  54
  55         len = smb_len(buf_out) + 4;
  56
  57         while (nwritten < len) {
  58                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  59                 if (ret <= 0) {
  60                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  61                                 (int)len,(int)ret, strerror(errno) ));
  62                         srv_free_enc_buffer(buf_out);
  63                         return false;
  64                 }
  65                 nwritten += ret;
  66         }
  67
  68         srv_free_enc_buffer(buf_out);
  69         return true;
  70 }
  71
  72 /*******************************************************************
  73  Setup the word count and byte count for a smb message.
  74 ********************************************************************/
  75
  76 int srv_set_message(char *buf,
  77                         int num_words,
  78                         int num_bytes,
  79                         bool zero)
  80 {
  81         if (zero && (num_words || num_bytes)) {
  82                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
  83         }
  84         SCVAL(buf,smb_wct,num_words);
  85         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
  86         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
  87         return (smb_size + num_words*2 + num_bytes);
  88 }
  89
  90 static bool valid_smb_header(const uint8_t *inbuf)
  91 {
  92         if (is_encrypted_packet(inbuf)) {
  93                 return true;
  94         }
  95         /*
  96          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
  97          * but it just looks weird to call strncmp for this one.
  98          */
  99         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 100 }
 101
 102 /* Socket functions for smbd packet processing. */
 103
 104 static bool valid_packet_size(size_t len)
 105 {
 106         /*
 107          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 108          * of header. Don't print the error if this fits.... JRA.
 109          */
 110
 111         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 112                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 113                                         (unsigned long)len));
 114                 return false;
 115         }
 116         return true;
 117 }
 118
 119 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 120                                       unsigned int timeout, ssize_t len)
 121 {
 122         if (len <= 0) {
 123                 return NT_STATUS_OK;
 124         }
 125
 126         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
 127 }
 128
 129 /****************************************************************************
 130  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 131 ****************************************************************************/
 132
 133 /*
 134  * Unfortunately, earlier versions of smbclient/libsmbclient
 135  * don't send this "standard" writeX header. I've fixed this
 136  * for 3.2 but we'll use the old method with earlier versions.
 137  * Windows and CIFSFS at least use this standard size. Not
 138  * sure about MacOSX.
 139  */
 140
 141 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 142                                 (2*14) + /* word count (including bcc) */ \
 143                                 1 /* pad byte */)
 144
 145 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 146                                                     const char lenbuf[4],
 147                                                     int fd, char **buffer,
 148                                                     unsigned int timeout,
 149                                                     size_t *p_unread,
 150                                                     size_t *len_ret)
 151 {
 152         /* Size of a WRITEX call (+4 byte len). */
 153         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 154         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 155         ssize_t toread;
 156         NTSTATUS status;
 157
 158         memcpy(writeX_header, lenbuf, 4);
 159
 160         status = read_socket_with_timeout(
 161                 fd, writeX_header + 4,
 162                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 163                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 164                 timeout, NULL);
 165
 166         if (!NT_STATUS_IS_OK(status)) {
 167                 return status;
 168         }
 169
 170         /*
 171          * Ok - now try and see if this is a possible
 172          * valid writeX call.
 173          */
 174
 175         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 176                 /*
 177                  * If the data offset is beyond what
 178                  * we've read, drain the extra bytes.
 179                  */
 180                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 181                 ssize_t newlen;
 182
 183                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 184                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 185                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 186                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 187                                         " failed to drain pending bytes");
 188                         }
 189                 } else {
 190                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 191                 }
 192
 193                 /* Spoof down the length and null out the bcc. */
 194                 set_message_bcc(writeX_header, 0);
 195                 newlen = smb_len(writeX_header);
 196
 197                 /* Copy the header we've written. */
 198
 199                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 200                                 writeX_header,
 201                                 sizeof(writeX_header));
 202
 203                 if (*buffer == NULL) {
 204                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 205                                   (int)sizeof(writeX_header)));
 206                         return NT_STATUS_NO_MEMORY;
 207                 }
 208
 209                 /* Work out the remaining bytes. */
 210                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 211                 *len_ret = newlen + 4;
 212                 return NT_STATUS_OK;
 213         }
 214
 215         if (!valid_packet_size(len)) {
 216                 return NT_STATUS_INVALID_PARAMETER;
 217         }
 218
 219         /*
 220          * Not a valid writeX call. Just do the standard
 221          * talloc and return.
 222          */
 223
 224         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 225
 226         if (*buffer == NULL) {
 227                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 228                           (int)len+4));
 229                 return NT_STATUS_NO_MEMORY;
 230         }
 231
 232         /* Copy in what we already read. */
 233         memcpy(*buffer,
 234                 writeX_header,
 235                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 236         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 237
 238         if(toread > 0) {
 239                 status = read_packet_remainder(
 240                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 241                         timeout, toread);
 242
 243                 if (!NT_STATUS_IS_OK(status)) {
 244                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 245                                    nt_errstr(status)));
 246                         return status;
 247                 }
 248         }
 249
 250         *len_ret = len + 4;
 251         return NT_STATUS_OK;
 252 }
 253
 254 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 255                                        char **buffer, unsigned int timeout,
 256                                        size_t *p_unread, size_t *plen)
 257 {
 258         char lenbuf[4];
 259         size_t len;
 260         int min_recv_size = lp_min_receive_file_size();
 261         NTSTATUS status;
 262
 263         *p_unread = 0;
 264
 265         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 268                 return status;
 269         }
 270
 271         if (CVAL(lenbuf,0) == 0 &&
 272                         min_recv_size &&
 273                         smb_len_large(lenbuf) > (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE) && /* Could be a UNIX large writeX. */
 274                         !srv_is_signing_active()) {
 275
 276                 return receive_smb_raw_talloc_partial_read(
 277                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 278         }
 279
 280         if (!valid_packet_size(len)) {
 281                 return NT_STATUS_INVALID_PARAMETER;
 282         }
 283
 284         /*
 285          * The +4 here can't wrap, we've checked the length above already.
 286          */
 287
 288         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 289
 290         if (*buffer == NULL) {
 291                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 292                           (int)len+4));
 293                 return NT_STATUS_NO_MEMORY;
 294         }
 295
 296         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 297
 298         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 299         if (!NT_STATUS_IS_OK(status)) {
 300                 return status;
 301         }
 302
 303         *plen = len + 4;
 304         return NT_STATUS_OK;
 305 }
 306
 307 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 308                                    char **buffer, unsigned int timeout,
 309                                    size_t *p_unread, bool *p_encrypted,
 310                                    size_t *p_len)
 311 {
 312         size_t len = 0;
 313         NTSTATUS status;
 314
 315         *p_encrypted = false;
 316
 317         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 318                                         p_unread, &len);
 319         if (!NT_STATUS_IS_OK(status)) {
 320                 return status;
 321         }
 322
 323         if (is_encrypted_packet((uint8_t *)*buffer)) {
 324                 status = srv_decrypt_buffer(*buffer);
 325                 if (!NT_STATUS_IS_OK(status)) {
 326                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 327                                 "incoming packet! Error %s\n",
 328                                 nt_errstr(status) ));
 329                         return status;
 330                 }
 331                 *p_encrypted = true;
 332         }
 333
 334         /* Check the incoming SMB signature. */
 335         if (!srv_check_sign_mac(*buffer, true)) {
 336                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 337                           "incoming packet!\n"));
 338                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 339         }
 340
 341         *p_len = len;
 342         return NT_STATUS_OK;
 343 }
 344
 345 /*
 346  * Initialize a struct smb_request from an inbuf
 347  */
 348
 349 void init_smb_request(struct smb_request *req,
 350                         const uint8 *inbuf,
 351                         size_t unread_bytes,
 352                         bool encrypted)
 353 {
 354         size_t req_size = smb_len(inbuf) + 4;
 355         /* Ensure we have at least smb_size bytes. */
 356         if (req_size < smb_size) {
 357                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 358                         (unsigned int)req_size ));
 359                 exit_server_cleanly("Invalid SMB request");
 360         }
 361         req->cmd    = CVAL(inbuf, smb_com);
 362         req->flags2 = SVAL(inbuf, smb_flg2);
 363         req->smbpid = SVAL(inbuf, smb_pid);
 364         req->mid    = SVAL(inbuf, smb_mid);
 365         req->vuid   = SVAL(inbuf, smb_uid);
 366         req->tid    = SVAL(inbuf, smb_tid);
 367         req->wct    = CVAL(inbuf, smb_wct);
 368         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 369         req->buflen = smb_buflen(inbuf);
 370         req->buf    = (const uint8_t *)smb_buf(inbuf);
 371         req->unread_bytes = unread_bytes;
 372         req->encrypted = encrypted;
 373         req->conn = conn_find(req->tid);
 374         req->chain_fsp = NULL;
 375         req->chain_outbuf = NULL;
 376
 377         /* Ensure we have at least wct words and 2 bytes of bcc. */
 378         if (smb_size + req->wct*2 > req_size) {
 379                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 380                         (unsigned int)req->wct,
 381                         (unsigned int)req_size));
 382                 exit_server_cleanly("Invalid SMB request");
 383         }
 384         /* Ensure bcc is correct. */
 385         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 386                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 387                         "(wct = %u, size %u)\n",
 388                         (unsigned int)req->buflen,
 389                         (unsigned int)req->wct,
 390                         (unsigned int)req_size));
 391                 exit_server_cleanly("Invalid SMB request");
 392         }
 393         req->outbuf = NULL;
 394 }
 395
 396 static void process_smb(struct smbd_server_connection *conn,
 397                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 398                         bool encrypted);
 399
 400 static void smbd_deferred_open_timer(struct event_context *ev,
 401                                      struct timed_event *te,
 402                                      struct timeval _tval,
 403                                      void *private_data)
 404 {
 405         struct pending_message_list *msg = talloc_get_type(private_data,
 406                                            struct pending_message_list);
 407         TALLOC_CTX *mem_ctx = talloc_tos();
 408         uint8_t *inbuf;
 409
 410         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 411                                          msg->buf.length);
 412         if (inbuf == NULL) {
 413                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 414                 return;
 415         }
 416
 417         /* We leave this message on the queue so the open code can
 418            know this is a retry. */
 419         DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
 420                 (unsigned int)SVAL(msg->buf.data,smb_mid)));
 421
 422         process_smb(smbd_server_conn, inbuf,
 423                     msg->buf.length, 0,
 424                     msg->encrypted);
 425 }
 426
 427 /****************************************************************************
 428  Function to push a message onto the tail of a linked list of smb messages ready
 429  for processing.
 430 ****************************************************************************/
 431
 432 static bool push_queued_message(struct smb_request *req,
 433                                 struct timeval request_time,
 434                                 struct timeval end_time,
 435                                 char *private_data, size_t private_len)
 436 {
 437         int msg_len = smb_len(req->inbuf) + 4;
 438         struct pending_message_list *msg;
 439
 440         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 441
 442         if(msg == NULL) {
 443                 DEBUG(0,("push_message: malloc fail (1)\n"));
 444                 return False;
 445         }
 446
 447         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 448         if(msg->buf.data == NULL) {
 449                 DEBUG(0,("push_message: malloc fail (2)\n"));
 450                 TALLOC_FREE(msg);
 451                 return False;
 452         }
 453
 454         msg->request_time = request_time;
 455         msg->encrypted = req->encrypted;
 456
 457         if (private_data) {
 458                 msg->private_data = data_blob_talloc(msg, private_data,
 459                                                      private_len);
 460                 if (msg->private_data.data == NULL) {
 461                         DEBUG(0,("push_message: malloc fail (3)\n"));
 462                         TALLOC_FREE(msg);
 463                         return False;
 464                 }
 465         }
 466
 467         msg->te = event_add_timed(smbd_event_context(),
 468                                   msg,
 469                                   end_time,
 470                                   smbd_deferred_open_timer,
 471                                   msg);
 472         if (!msg->te) {
 473                 DEBUG(0,("push_message: event_add_timed failed\n"));
 474                 TALLOC_FREE(msg);
 475                 return false;
 476         }
 477
 478         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 479
 480         DEBUG(10,("push_message: pushed message length %u on "
 481                   "deferred_open_queue\n", (unsigned int)msg_len));
 482
 483         return True;
 484 }
 485
 486 /****************************************************************************
 487  Function to delete a sharing violation open message by mid.
 488 ****************************************************************************/
 489
 490 void remove_deferred_open_smb_message(uint16 mid)
 491 {
 492         struct pending_message_list *pml;
 493
 494         for (pml = deferred_open_queue; pml; pml = pml->next) {
 495                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 496                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 497                                   "deleting mid %u len %u\n",
 498                                   (unsigned int)mid,
 499                                   (unsigned int)pml->buf.length ));
 500                         DLIST_REMOVE(deferred_open_queue, pml);
 501                         TALLOC_FREE(pml);
 502                         return;
 503                 }
 504         }
 505 }
 506
 507 /****************************************************************************
 508  Move a sharing violation open retry message to the front of the list and
 509  schedule it for immediate processing.
 510 ****************************************************************************/
 511
 512 void schedule_deferred_open_smb_message(uint16 mid)
 513 {
 514         struct pending_message_list *pml;
 515         int i = 0;
 516
 517         for (pml = deferred_open_queue; pml; pml = pml->next) {
 518                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 519
 520                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 521                         (unsigned int)msg_mid ));
 522
 523                 if (mid == msg_mid) {
 524                         struct timed_event *te;
 525
 526                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 527                                 mid ));
 528
 529                         te = event_add_timed(smbd_event_context(),
 530                                              pml,
 531                                              timeval_zero(),
 532                                              smbd_deferred_open_timer,
 533                                              pml);
 534                         if (!te) {
 535                                 DEBUG(10,("schedule_deferred_open_smb_message: "
 536                                           "event_add_timed() failed, skipping mid %u\n",
 537                                           mid ));
 538                         }
 539
 540                         TALLOC_FREE(pml->te);
 541                         pml->te = te;
 542                         DLIST_PROMOTE(deferred_open_queue, pml);
 543                         return;
 544                 }
 545         }
 546
 547         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 548                 mid ));
 549 }
 550
 551 /****************************************************************************
 552  Return true if this mid is on the deferred queue.
 553 ****************************************************************************/
 554
 555 bool open_was_deferred(uint16 mid)
 556 {
 557         struct pending_message_list *pml;
 558
 559         for (pml = deferred_open_queue; pml; pml = pml->next) {
 560                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 561                         return True;
 562                 }
 563         }
 564         return False;
 565 }
 566
 567 /****************************************************************************
 568  Return the message queued by this mid.
 569 ****************************************************************************/
 570
 571 struct pending_message_list *get_open_deferred_message(uint16 mid)
 572 {
 573         struct pending_message_list *pml;
 574
 575         for (pml = deferred_open_queue; pml; pml = pml->next) {
 576                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 577                         return pml;
 578                 }
 579         }
 580         return NULL;
 581 }
 582
 583 /****************************************************************************
 584  Function to push a deferred open smb message onto a linked list of local smb
 585  messages ready for processing.
 586 ****************************************************************************/
 587
 588 bool push_deferred_smb_message(struct smb_request *req,
 589                                struct timeval request_time,
 590                                struct timeval timeout,
 591                                char *private_data, size_t priv_len)
 592 {
 593         struct timeval end_time;
 594
 595         if (req->unread_bytes) {
 596                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 597                         "unread_bytes = %u\n",
 598                         (unsigned int)req->unread_bytes ));
 599                 smb_panic("push_deferred_smb_message: "
 600                         "logic error unread_bytes != 0" );
 601         }
 602
 603         end_time = timeval_sum(&request_time, &timeout);
 604
 605         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 606                   "timeout time [%u.%06u]\n",
 607                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 608                   (unsigned int)end_time.tv_sec,
 609                   (unsigned int)end_time.tv_usec));
 610
 611         return push_queued_message(req, request_time, end_time,
 612                                    private_data, priv_len);
 613 }
 614
 615 struct idle_event {
 616         struct timed_event *te;
 617         struct timeval interval;
 618         char *name;
 619         bool (*handler)(const struct timeval *now, void *private_data);
 620         void *private_data;
 621 };
 622
 623 static void smbd_idle_event_handler(struct event_context *ctx,
 624                                     struct timed_event *te,
 625                                     struct timeval now,
 626                                     void *private_data)
 627 {
 628         struct idle_event *event =
 629                 talloc_get_type_abort(private_data, struct idle_event);
 630
 631         TALLOC_FREE(event->te);
 632
 633         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 634                   event->name, event->te));
 635
 636         if (!event->handler(&now, event->private_data)) {
 637                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 638                           event->name, event->te));
 639                 /* Don't repeat, delete ourselves */
 640                 TALLOC_FREE(event);
 641                 return;
 642         }
 643
 644         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 645                   event->name, event->te));
 646
 647         event->te = event_add_timed(ctx, event,
 648                                     timeval_sum(&now, &event->interval),
 649                                     smbd_idle_event_handler, event);
 650
 651         /* We can't do much but fail here. */
 652         SMB_ASSERT(event->te != NULL);
 653 }
 654
 655 struct idle_event *event_add_idle(struct event_context *event_ctx,
 656                                   TALLOC_CTX *mem_ctx,
 657                                   struct timeval interval,
 658                                   const char *name,
 659                                   bool (*handler)(const struct timeval *now,
 660                                                   void *private_data),
 661                                   void *private_data)
 662 {
 663         struct idle_event *result;
 664         struct timeval now = timeval_current();
 665
 666         result = TALLOC_P(mem_ctx, struct idle_event);
 667         if (result == NULL) {
 668                 DEBUG(0, ("talloc failed\n"));
 669                 return NULL;
 670         }
 671
 672         result->interval = interval;
 673         result->handler = handler;
 674         result->private_data = private_data;
 675
 676         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 677                 DEBUG(0, ("talloc failed\n"));
 678                 TALLOC_FREE(result);
 679                 return NULL;
 680         }
 681
 682         result->te = event_add_timed(event_ctx, result,
 683                                      timeval_sum(&now, &interval),
 684                                      smbd_idle_event_handler, result);
 685         if (result->te == NULL) {
 686                 DEBUG(0, ("event_add_timed failed\n"));
 687                 TALLOC_FREE(result);
 688                 return NULL;
 689         }
 690
 691         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 692         return result;
 693 }
 694
 695 /****************************************************************************
 696  Do all async processing in here. This includes kernel oplock messages, change
 697  notify events etc.
 698 ****************************************************************************/
 699
 700 static void async_processing(fd_set *pfds)
 701 {
 702         DEBUG(10,("async_processing: Doing async processing.\n"));
 703
 704         process_aio_queue();
 705
 706         process_kernel_oplocks(smbd_messaging_context(), pfds);
 707
 708         /* Do the aio check again after receive_local_message as it does a
 709            select and may have eaten our signal. */
 710         /* Is this till true? -- vl */
 711         process_aio_queue();
 712
 713         if (got_sig_term) {
 714                 exit_server_cleanly("termination signal");
 715         }
 716
 717         /* check for sighup processing */
 718         if (reload_after_sighup) {
 719                 change_to_root_user();
 720                 DEBUG(1,("Reloading services after SIGHUP\n"));
 721                 reload_services(False);
 722                 reload_after_sighup = 0;
 723         }
 724 }
 725
 726 /****************************************************************************
 727  Add a fd to the set we will be select(2)ing on.
 728 ****************************************************************************/
 729
 730 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 731 {
 732         if (fd != -1) {
 733                 FD_SET(fd, fds);
 734                 maxfd = MAX(maxfd, fd);
 735         }
 736
 737         return maxfd;
 738 }
 739
 740 /****************************************************************************
 741   Do a select on an two fd's - with timeout.
 742
 743   If a local udp message has been pushed onto the
 744   queue (this can only happen during oplock break
 745   processing) call async_processing()
 746
 747   If a pending smb message has been pushed onto the
 748   queue (this can only happen during oplock break
 749   processing) return this next.
 750
 751   If the first smbfd is ready then read an smb from it.
 752   if the second (loopback UDP) fd is ready then read a message
 753   from it and setup the buffer header to identify the length
 754   and from address.
 755   Returns False on timeout or error.
 756   Else returns True.
 757
 758 The timeout is in milliseconds
 759 ****************************************************************************/
 760
 761 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 762 {
 763         fd_set r_fds, w_fds;
 764         int selrtn;
 765         struct timeval to;
 766         int maxfd = 0;
 767
 768         to.tv_sec = SMBD_SELECT_TIMEOUT;
 769         to.tv_usec = 0;
 770
 771         /*
 772          * Note that this call must be before processing any SMB
 773          * messages as we need to synchronously process any messages
 774          * we may have sent to ourselves from the previous SMB.
 775          */
 776         message_dispatch(smbd_messaging_context());
 777
 778         /*
 779          * Setup the select fd sets.
 780          */
 781
 782         FD_ZERO(&r_fds);
 783         FD_ZERO(&w_fds);
 784
 785         /*
 786          * Ensure we process oplock break messages by preference.
 787          * We have to do this before the select, after the select
 788          * and if the select returns EINTR. This is due to the fact
 789          * that the selects called from async_processing can eat an EINTR
 790          * caused by a signal (we can't take the break message there).
 791          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 792          */
 793
 794         if (oplock_message_waiting(&r_fds)) {
 795                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 796                 async_processing(&r_fds);
 797                 /*
 798                  * After async processing we must go and do the select again, as
 799                  * the state of the flag in fds for the server file descriptor is
 800                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 801                  */
 802                 return NT_STATUS_RETRY;
 803         }
 804
 805         /*
 806          * Are there any timed events waiting ? If so, ensure we don't
 807          * select for longer than it would take to wait for them.
 808          */
 809
 810         {
 811                 struct timeval now;
 812                 GetTimeOfDay(&now);
 813
 814                 event_add_to_select_args(smbd_event_context(), &now,
 815                                          &r_fds, &w_fds, &to, &maxfd);
 816         }
 817
 818         if (timeval_is_zero(&to)) {
 819                 /* Process a timed event now... */
 820                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 821                         return NT_STATUS_RETRY;
 822                 }
 823         }
 824
 825         {
 826                 int sav;
 827                 START_PROFILE(smbd_idle);
 828
 829                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 830
 831                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 832                 sav = errno;
 833
 834                 END_PROFILE(smbd_idle);
 835                 errno = sav;
 836         }
 837
 838         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 839                 return NT_STATUS_RETRY;
 840         }
 841
 842         /* if we get EINTR then maybe we have received an oplock
 843            signal - treat this as select returning 1. This is ugly, but
 844            is the best we can do until the oplock code knows more about
 845            signals */
 846         if (selrtn == -1 && errno == EINTR) {
 847                 async_processing(&r_fds);
 848                 /*
 849                  * After async processing we must go and do the select again, as
 850                  * the state of the flag in fds for the server file descriptor is
 851                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 852                  */
 853                 return NT_STATUS_RETRY;
 854         }
 855
 856         /* Check if error */
 857         if (selrtn == -1) {
 858                 /* something is wrong. Maybe the socket is dead? */
 859                 return map_nt_error_from_unix(errno);
 860         }
 861
 862         /* Did we timeout ? */
 863         if (selrtn == 0) {
 864                 return NT_STATUS_RETRY;
 865         }
 866
 867         /*
 868          * Ensure we process oplock break messages by preference.
 869          * This is IMPORTANT ! Otherwise we can starve other processes
 870          * sending us an oplock break message. JRA.
 871          */
 872
 873         if (oplock_message_waiting(&r_fds)) {
 874                 async_processing(&r_fds);
 875                 /*
 876                  * After async processing we must go and do the select again, as
 877                  * the state of the flag in fds for the server file descriptor is
 878                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 879                  */
 880                 return NT_STATUS_RETRY;
 881         }
 882
 883         /*
 884          * We've just woken up from a protentially long select sleep.
 885          * Ensure we process local messages as we need to synchronously
 886          * process any messages from other smbd's to avoid file rename race
 887          * conditions. This call is cheap if there are no messages waiting.
 888          * JRA.
 889          */
 890         message_dispatch(smbd_messaging_context());
 891
 892         return NT_STATUS_OK;
 893 }
 894
 895 /*
 896  * Only allow 5 outstanding trans requests. We're allocating memory, so
 897  * prevent a DoS.
 898  */
 899
 900 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 901 {
 902         int count = 0;
 903         for (; list != NULL; list = list->next) {
 904
 905                 if (list->mid == mid) {
 906                         return NT_STATUS_INVALID_PARAMETER;
 907                 }
 908
 909                 count += 1;
 910         }
 911         if (count > 5) {
 912                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 913         }
 914
 915         return NT_STATUS_OK;
 916 }
 917
 918 /****************************************************************************
 919  We're terminating and have closed all our files/connections etc.
 920  If there are any pending local messages we need to respond to them
 921  before termination so that other smbds don't think we just died whilst
 922  holding oplocks.
 923 ****************************************************************************/
 924
 925 void respond_to_all_remaining_local_messages(void)
 926 {
 927         /*
 928          * Assert we have no exclusive open oplocks.
 929          */
 930
 931         if(get_number_of_exclusive_open_oplocks()) {
 932                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 933                         get_number_of_exclusive_open_oplocks() ));
 934                 return;
 935         }
 936
 937         process_kernel_oplocks(smbd_messaging_context(), NULL);
 938
 939         return;
 940 }
 941
 942
 943 /*
 944 These flags determine some of the permissions required to do an operation
 945
 946 Note that I don't set NEED_WRITE on some write operations because they
 947 are used by some brain-dead clients when printing, and I don't want to
 948 force write permissions on print services.
 949 */
 950 #define AS_USER (1<<0)
 951 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 952 #define TIME_INIT (1<<2)
 953 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 954 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 955 #define DO_CHDIR (1<<6)
 956
 957 /*
 958    define a list of possible SMB messages and their corresponding
 959    functions. Any message that has a NULL function is unimplemented -
 960    please feel free to contribute implementations!
 961 */
 962 static const struct smb_message_struct {
 963         const char *name;
 964         void (*fn)(struct smb_request *req);
 965         int flags;
 966 } smb_messages[256] = {
 967
 968 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 969 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 970 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 971 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 972 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 973 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 974 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 975 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 976 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 977 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 978 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 979 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 980 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 981 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 982 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 983 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 984 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 985 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 986 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 987 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 988 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 989 /* 0x15 */ { NULL, NULL, 0 },
 990 /* 0x16 */ { NULL, NULL, 0 },
 991 /* 0x17 */ { NULL, NULL, 0 },
 992 /* 0x18 */ { NULL, NULL, 0 },
 993 /* 0x19 */ { NULL, NULL, 0 },
 994 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 995 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 996 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
 997 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 998 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 999 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1000 /* 0x20 */ { "SMBwritec", NULL,0},
1001 /* 0x21 */ { NULL, NULL, 0 },
1002 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1003 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1004 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1005 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1006 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1007 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1008 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1009 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1010 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1011 /* 0x2b */ { "SMBecho",reply_echo,0},
1012 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1013 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1014 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1015 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1016 /* 0x30 */ { NULL, NULL, 0 },
1017 /* 0x31 */ { NULL, NULL, 0 },
1018 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1019 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1020 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1021 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1022 /* 0x36 */ { NULL, NULL, 0 },
1023 /* 0x37 */ { NULL, NULL, 0 },
1024 /* 0x38 */ { NULL, NULL, 0 },
1025 /* 0x39 */ { NULL, NULL, 0 },
1026 /* 0x3a */ { NULL, NULL, 0 },
1027 /* 0x3b */ { NULL, NULL, 0 },
1028 /* 0x3c */ { NULL, NULL, 0 },
1029 /* 0x3d */ { NULL, NULL, 0 },
1030 /* 0x3e */ { NULL, NULL, 0 },
1031 /* 0x3f */ { NULL, NULL, 0 },
1032 /* 0x40 */ { NULL, NULL, 0 },
1033 /* 0x41 */ { NULL, NULL, 0 },
1034 /* 0x42 */ { NULL, NULL, 0 },
1035 /* 0x43 */ { NULL, NULL, 0 },
1036 /* 0x44 */ { NULL, NULL, 0 },
1037 /* 0x45 */ { NULL, NULL, 0 },
1038 /* 0x46 */ { NULL, NULL, 0 },
1039 /* 0x47 */ { NULL, NULL, 0 },
1040 /* 0x48 */ { NULL, NULL, 0 },
1041 /* 0x49 */ { NULL, NULL, 0 },
1042 /* 0x4a */ { NULL, NULL, 0 },
1043 /* 0x4b */ { NULL, NULL, 0 },
1044 /* 0x4c */ { NULL, NULL, 0 },
1045 /* 0x4d */ { NULL, NULL, 0 },
1046 /* 0x4e */ { NULL, NULL, 0 },
1047 /* 0x4f */ { NULL, NULL, 0 },
1048 /* 0x50 */ { NULL, NULL, 0 },
1049 /* 0x51 */ { NULL, NULL, 0 },
1050 /* 0x52 */ { NULL, NULL, 0 },
1051 /* 0x53 */ { NULL, NULL, 0 },
1052 /* 0x54 */ { NULL, NULL, 0 },
1053 /* 0x55 */ { NULL, NULL, 0 },
1054 /* 0x56 */ { NULL, NULL, 0 },
1055 /* 0x57 */ { NULL, NULL, 0 },
1056 /* 0x58 */ { NULL, NULL, 0 },
1057 /* 0x59 */ { NULL, NULL, 0 },
1058 /* 0x5a */ { NULL, NULL, 0 },
1059 /* 0x5b */ { NULL, NULL, 0 },
1060 /* 0x5c */ { NULL, NULL, 0 },
1061 /* 0x5d */ { NULL, NULL, 0 },
1062 /* 0x5e */ { NULL, NULL, 0 },
1063 /* 0x5f */ { NULL, NULL, 0 },
1064 /* 0x60 */ { NULL, NULL, 0 },
1065 /* 0x61 */ { NULL, NULL, 0 },
1066 /* 0x62 */ { NULL, NULL, 0 },
1067 /* 0x63 */ { NULL, NULL, 0 },
1068 /* 0x64 */ { NULL, NULL, 0 },
1069 /* 0x65 */ { NULL, NULL, 0 },
1070 /* 0x66 */ { NULL, NULL, 0 },
1071 /* 0x67 */ { NULL, NULL, 0 },
1072 /* 0x68 */ { NULL, NULL, 0 },
1073 /* 0x69 */ { NULL, NULL, 0 },
1074 /* 0x6a */ { NULL, NULL, 0 },
1075 /* 0x6b */ { NULL, NULL, 0 },
1076 /* 0x6c */ { NULL, NULL, 0 },
1077 /* 0x6d */ { NULL, NULL, 0 },
1078 /* 0x6e */ { NULL, NULL, 0 },
1079 /* 0x6f */ { NULL, NULL, 0 },
1080 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1081 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1082 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1083 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1084 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1085 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1086 /* 0x76 */ { NULL, NULL, 0 },
1087 /* 0x77 */ { NULL, NULL, 0 },
1088 /* 0x78 */ { NULL, NULL, 0 },
1089 /* 0x79 */ { NULL, NULL, 0 },
1090 /* 0x7a */ { NULL, NULL, 0 },
1091 /* 0x7b */ { NULL, NULL, 0 },
1092 /* 0x7c */ { NULL, NULL, 0 },
1093 /* 0x7d */ { NULL, NULL, 0 },
1094 /* 0x7e */ { NULL, NULL, 0 },
1095 /* 0x7f */ { NULL, NULL, 0 },
1096 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1097 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1098 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1099 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1100 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1101 /* 0x85 */ { NULL, NULL, 0 },
1102 /* 0x86 */ { NULL, NULL, 0 },
1103 /* 0x87 */ { NULL, NULL, 0 },
1104 /* 0x88 */ { NULL, NULL, 0 },
1105 /* 0x89 */ { NULL, NULL, 0 },
1106 /* 0x8a */ { NULL, NULL, 0 },
1107 /* 0x8b */ { NULL, NULL, 0 },
1108 /* 0x8c */ { NULL, NULL, 0 },
1109 /* 0x8d */ { NULL, NULL, 0 },
1110 /* 0x8e */ { NULL, NULL, 0 },
1111 /* 0x8f */ { NULL, NULL, 0 },
1112 /* 0x90 */ { NULL, NULL, 0 },
1113 /* 0x91 */ { NULL, NULL, 0 },
1114 /* 0x92 */ { NULL, NULL, 0 },
1115 /* 0x93 */ { NULL, NULL, 0 },
1116 /* 0x94 */ { NULL, NULL, 0 },
1117 /* 0x95 */ { NULL, NULL, 0 },
1118 /* 0x96 */ { NULL, NULL, 0 },
1119 /* 0x97 */ { NULL, NULL, 0 },
1120 /* 0x98 */ { NULL, NULL, 0 },
1121 /* 0x99 */ { NULL, NULL, 0 },
1122 /* 0x9a */ { NULL, NULL, 0 },
1123 /* 0x9b */ { NULL, NULL, 0 },
1124 /* 0x9c */ { NULL, NULL, 0 },
1125 /* 0x9d */ { NULL, NULL, 0 },
1126 /* 0x9e */ { NULL, NULL, 0 },
1127 /* 0x9f */ { NULL, NULL, 0 },
1128 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1129 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1130 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1131 /* 0xa3 */ { NULL, NULL, 0 },
1132 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1133 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1134 /* 0xa6 */ { NULL, NULL, 0 },
1135 /* 0xa7 */ { NULL, NULL, 0 },
1136 /* 0xa8 */ { NULL, NULL, 0 },
1137 /* 0xa9 */ { NULL, NULL, 0 },
1138 /* 0xaa */ { NULL, NULL, 0 },
1139 /* 0xab */ { NULL, NULL, 0 },
1140 /* 0xac */ { NULL, NULL, 0 },
1141 /* 0xad */ { NULL, NULL, 0 },
1142 /* 0xae */ { NULL, NULL, 0 },
1143 /* 0xaf */ { NULL, NULL, 0 },
1144 /* 0xb0 */ { NULL, NULL, 0 },
1145 /* 0xb1 */ { NULL, NULL, 0 },
1146 /* 0xb2 */ { NULL, NULL, 0 },
1147 /* 0xb3 */ { NULL, NULL, 0 },
1148 /* 0xb4 */ { NULL, NULL, 0 },
1149 /* 0xb5 */ { NULL, NULL, 0 },
1150 /* 0xb6 */ { NULL, NULL, 0 },
1151 /* 0xb7 */ { NULL, NULL, 0 },
1152 /* 0xb8 */ { NULL, NULL, 0 },
1153 /* 0xb9 */ { NULL, NULL, 0 },
1154 /* 0xba */ { NULL, NULL, 0 },
1155 /* 0xbb */ { NULL, NULL, 0 },
1156 /* 0xbc */ { NULL, NULL, 0 },
1157 /* 0xbd */ { NULL, NULL, 0 },
1158 /* 0xbe */ { NULL, NULL, 0 },
1159 /* 0xbf */ { NULL, NULL, 0 },
1160 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1161 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1162 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1163 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1164 /* 0xc4 */ { NULL, NULL, 0 },
1165 /* 0xc5 */ { NULL, NULL, 0 },
1166 /* 0xc6 */ { NULL, NULL, 0 },
1167 /* 0xc7 */ { NULL, NULL, 0 },
1168 /* 0xc8 */ { NULL, NULL, 0 },
1169 /* 0xc9 */ { NULL, NULL, 0 },
1170 /* 0xca */ { NULL, NULL, 0 },
1171 /* 0xcb */ { NULL, NULL, 0 },
1172 /* 0xcc */ { NULL, NULL, 0 },
1173 /* 0xcd */ { NULL, NULL, 0 },
1174 /* 0xce */ { NULL, NULL, 0 },
1175 /* 0xcf */ { NULL, NULL, 0 },
1176 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1177 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1178 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1179 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1180 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1181 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1182 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1183 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1184 /* 0xd8 */ { NULL, NULL, 0 },
1185 /* 0xd9 */ { NULL, NULL, 0 },
1186 /* 0xda */ { NULL, NULL, 0 },
1187 /* 0xdb */ { NULL, NULL, 0 },
1188 /* 0xdc */ { NULL, NULL, 0 },
1189 /* 0xdd */ { NULL, NULL, 0 },
1190 /* 0xde */ { NULL, NULL, 0 },
1191 /* 0xdf */ { NULL, NULL, 0 },
1192 /* 0xe0 */ { NULL, NULL, 0 },
1193 /* 0xe1 */ { NULL, NULL, 0 },
1194 /* 0xe2 */ { NULL, NULL, 0 },
1195 /* 0xe3 */ { NULL, NULL, 0 },
1196 /* 0xe4 */ { NULL, NULL, 0 },
1197 /* 0xe5 */ { NULL, NULL, 0 },
1198 /* 0xe6 */ { NULL, NULL, 0 },
1199 /* 0xe7 */ { NULL, NULL, 0 },
1200 /* 0xe8 */ { NULL, NULL, 0 },
1201 /* 0xe9 */ { NULL, NULL, 0 },
1202 /* 0xea */ { NULL, NULL, 0 },
1203 /* 0xeb */ { NULL, NULL, 0 },
1204 /* 0xec */ { NULL, NULL, 0 },
1205 /* 0xed */ { NULL, NULL, 0 },
1206 /* 0xee */ { NULL, NULL, 0 },
1207 /* 0xef */ { NULL, NULL, 0 },
1208 /* 0xf0 */ { NULL, NULL, 0 },
1209 /* 0xf1 */ { NULL, NULL, 0 },
1210 /* 0xf2 */ { NULL, NULL, 0 },
1211 /* 0xf3 */ { NULL, NULL, 0 },
1212 /* 0xf4 */ { NULL, NULL, 0 },
1213 /* 0xf5 */ { NULL, NULL, 0 },
1214 /* 0xf6 */ { NULL, NULL, 0 },
1215 /* 0xf7 */ { NULL, NULL, 0 },
1216 /* 0xf8 */ { NULL, NULL, 0 },
1217 /* 0xf9 */ { NULL, NULL, 0 },
1218 /* 0xfa */ { NULL, NULL, 0 },
1219 /* 0xfb */ { NULL, NULL, 0 },
1220 /* 0xfc */ { NULL, NULL, 0 },
1221 /* 0xfd */ { NULL, NULL, 0 },
1222 /* 0xfe */ { NULL, NULL, 0 },
1223 /* 0xff */ { NULL, NULL, 0 }
1224
1225 };
1226
1227 /*******************************************************************
1228  allocate and initialize a reply packet
1229 ********************************************************************/
1230
1231 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1232                           const char *inbuf, char **outbuf, uint8_t num_words,
1233                           uint32_t num_bytes)
1234 {
1235         /*
1236          * Protect against integer wrap
1237          */
1238         if ((num_bytes > 0xffffff)
1239             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1240                 char *msg;
1241                 if (asprintf(&msg, "num_bytes too large: %u",
1242                              (unsigned)num_bytes) == -1) {
1243                         msg = CONST_DISCARD(char *, "num_bytes too large");
1244                 }
1245                 smb_panic(msg);
1246         }
1247
1248         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1249                                smb_size + num_words*2 + num_bytes);
1250         if (*outbuf == NULL) {
1251                 return false;
1252         }
1253
1254         construct_reply_common(req, inbuf, *outbuf);
1255         srv_set_message(*outbuf, num_words, num_bytes, false);
1256         /*
1257          * Zero out the word area, the caller has to take care of the bcc area
1258          * himself
1259          */
1260         if (num_words != 0) {
1261                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1262         }
1263
1264         return true;
1265 }
1266
1267 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1268 {
1269         char *outbuf;
1270         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1271                            num_bytes)) {
1272                 smb_panic("could not allocate output buffer\n");
1273         }
1274         req->outbuf = (uint8_t *)outbuf;
1275 }
1276
1277
1278 /*******************************************************************
1279  Dump a packet to a file.
1280 ********************************************************************/
1281
1282 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1283 {
1284         int fd, i;
1285         char *fname = NULL;
1286         if (DEBUGLEVEL < 50) {
1287                 return;
1288         }
1289
1290         if (len < 4) len = smb_len(data)+4;
1291         for (i=1;i<100;i++) {
1292                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1293                              type ? "req" : "resp") == -1) {
1294                         return;
1295                 }
1296                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1297                 if (fd != -1 || errno != EEXIST) break;
1298         }
1299         if (fd != -1) {
1300                 ssize_t ret = write(fd, data, len);
1301                 if (ret != len)
1302                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1303                 close(fd);
1304                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1305         }
1306         SAFE_FREE(fname);
1307 }
1308
1309 /****************************************************************************
1310  Prepare everything for calling the actual request function, and potentially
1311  call the request function via the "new" interface.
1312
1313  Return False if the "legacy" function needs to be called, everything is
1314  prepared.
1315
1316  Return True if we're done.
1317
1318  I know this API sucks, but it is the one with the least code change I could
1319  find.
1320 ****************************************************************************/
1321
1322 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1323 {
1324         int flags;
1325         uint16 session_tag;
1326         connection_struct *conn = NULL;
1327
1328         errno = 0;
1329
1330         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1331          * so subtract 4 from it. */
1332         if (!valid_smb_header(req->inbuf)
1333             || (size < (smb_size - 4))) {
1334                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1335                          smb_len(req->inbuf)));
1336                 exit_server_cleanly("Non-SMB packet");
1337         }
1338
1339         if (smb_messages[type].fn == NULL) {
1340                 DEBUG(0,("Unknown message type %d!\n",type));
1341                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1342                 reply_unknown_new(req, type);
1343                 return NULL;
1344         }
1345
1346         flags = smb_messages[type].flags;
1347
1348         /* In share mode security we must ignore the vuid. */
1349         session_tag = (lp_security() == SEC_SHARE)
1350                 ? UID_FIELD_INVALID : req->vuid;
1351         conn = req->conn;
1352
1353         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1354                  (int)sys_getpid(), (unsigned long)conn));
1355
1356         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1357
1358         /* Ensure this value is replaced in the incoming packet. */
1359         SSVAL(req->inbuf,smb_uid,session_tag);
1360
1361         /*
1362          * Ensure the correct username is in current_user_info.  This is a
1363          * really ugly bugfix for problems with multiple session_setup_and_X's
1364          * being done and allowing %U and %G substitutions to work correctly.
1365          * There is a reason this code is done here, don't move it unless you
1366          * know what you're doing... :-).
1367          * JRA.
1368          */
1369
1370         if (session_tag != last_session_tag) {
1371                 user_struct *vuser = NULL;
1372
1373                 last_session_tag = session_tag;
1374                 if(session_tag != UID_FIELD_INVALID) {
1375                         vuser = get_valid_user_struct(session_tag);
1376                         if (vuser) {
1377                                 set_current_user_info(
1378                                         vuser->server_info->sanitized_username,
1379                                         vuser->server_info->unix_name,
1380                                         pdb_get_fullname(vuser->server_info
1381                                                          ->sam_account),
1382                                         pdb_get_domain(vuser->server_info
1383                                                        ->sam_account));
1384                         }
1385                 }
1386         }
1387
1388         /* Does this call need to be run as the connected user? */
1389         if (flags & AS_USER) {
1390
1391                 /* Does this call need a valid tree connection? */
1392                 if (!conn) {
1393                         /*
1394                          * Amazingly, the error code depends on the command
1395                          * (from Samba4).
1396                          */
1397                         if (type == SMBntcreateX) {
1398                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1399                         } else {
1400                                 reply_doserror(req, ERRSRV, ERRinvnid);
1401                         }
1402                         return NULL;
1403                 }
1404
1405                 if (!change_to_user(conn,session_tag)) {
1406                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1407                         remove_deferred_open_smb_message(req->mid);
1408                         return conn;
1409                 }
1410
1411                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1412
1413                 /* Does it need write permission? */
1414                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1415                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1416                         return conn;
1417                 }
1418
1419                 /* IPC services are limited */
1420                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1421                         reply_doserror(req, ERRSRV,ERRaccess);
1422                         return conn;
1423                 }
1424         } else {
1425                 /* This call needs to be run as root */
1426                 change_to_root_user();
1427         }
1428
1429         /* load service specific parameters */
1430         if (conn) {
1431                 if (req->encrypted) {
1432                         conn->encrypted_tid = true;
1433                         /* encrypted required from now on. */
1434                         conn->encrypt_level = Required;
1435                 } else if (ENCRYPTION_REQUIRED(conn)) {
1436                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1437                                 exit_server_cleanly("encryption required "
1438                                         "on connection");
1439                                 return conn;
1440                         }
1441                 }
1442
1443                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1444                                          (flags & (AS_USER|DO_CHDIR)
1445                                           ?True:False))) {
1446                         reply_doserror(req, ERRSRV, ERRaccess);
1447                         return conn;
1448                 }
1449                 conn->num_smb_operations++;
1450         }
1451
1452         /* does this protocol need to be run as guest? */
1453         if ((flags & AS_GUEST)
1454             && (!change_to_guest() ||
1455                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1456                               lp_hostsdeny(-1)))) {
1457                 reply_doserror(req, ERRSRV, ERRaccess);
1458                 return conn;
1459         }
1460
1461         smb_messages[type].fn(req);
1462         return req->conn;
1463 }
1464
1465 /****************************************************************************
1466  Construct a reply to the incoming packet.
1467 ****************************************************************************/
1468
1469 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1470 {
1471         connection_struct *conn;
1472         struct smb_request *req;
1473
1474         chain_size = 0;
1475
1476         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1477                 smb_panic("could not allocate smb_request");
1478         }
1479         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1480         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1481
1482         conn = switch_message(req->cmd, req, size);
1483
1484         if (req->unread_bytes) {
1485                 /* writeX failed. drain socket. */
1486                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1487                                 req->unread_bytes) {
1488                         smb_panic("failed to drain pending bytes");
1489                 }
1490                 req->unread_bytes = 0;
1491         }
1492
1493         if (req->outbuf == NULL) {
1494                 return;
1495         }
1496
1497         if (CVAL(req->outbuf,0) == 0) {
1498                 show_msg((char *)req->outbuf);
1499         }
1500
1501         if (!srv_send_smb(smbd_server_fd(),
1502                         (char *)req->outbuf,
1503                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1504                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1505         }
1506
1507         TALLOC_FREE(req);
1508
1509         return;
1510 }
1511
1512 /****************************************************************************
1513  Process an smb from the client
1514 ****************************************************************************/
1515
1516 static void process_smb(struct smbd_server_connection *conn,
1517                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1518                         bool encrypted)
1519 {
1520         int msg_type = CVAL(inbuf,0);
1521
1522         DO_PROFILE_INC(smb_count);
1523
1524         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1525                     smb_len(inbuf) ) );
1526         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1527                                 (int)nread,
1528                                 (unsigned int)unread_bytes ));
1529
1530         if (msg_type != 0) {
1531                 /*
1532                  * NetBIOS session request, keepalive, etc.
1533                  */
1534                 reply_special((char *)inbuf);
1535                 goto done;
1536         }
1537
1538         show_msg((char *)inbuf);
1539
1540         construct_reply((char *)inbuf,nread,unread_bytes,encrypted);
1541
1542         trans_num++;
1543
1544 done:
1545         conn->num_requests++;
1546
1547         /* The timeout_processing function isn't run nearly
1548            often enough to implement 'max log size' without
1549            overrunning the size of the file by many megabytes.
1550            This is especially true if we are running at debug
1551            level 10.  Checking every 50 SMBs is a nice
1552            tradeoff of performance vs log file size overrun. */
1553
1554         if ((conn->num_requests % 50) == 0 &&
1555             need_to_check_log_size()) {
1556                 change_to_root_user();
1557                 check_log_size();
1558         }
1559 }
1560
1561 /****************************************************************************
1562  Return a string containing the function name of a SMB command.
1563 ****************************************************************************/
1564
1565 const char *smb_fn_name(int type)
1566 {
1567         const char *unknown_name = "SMBunknown";
1568
1569         if (smb_messages[type].name == NULL)
1570                 return(unknown_name);
1571
1572         return(smb_messages[type].name);
1573 }
1574
1575 /****************************************************************************
1576  Helper functions for contruct_reply.
1577 ****************************************************************************/
1578
1579 void add_to_common_flags2(uint32 v)
1580 {
1581         common_flags2 |= v;
1582 }
1583
1584 void remove_from_common_flags2(uint32 v)
1585 {
1586         common_flags2 &= ~v;
1587 }
1588
1589 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1590                                    char *outbuf)
1591 {
1592         srv_set_message(outbuf,0,0,false);
1593
1594         SCVAL(outbuf, smb_com, req->cmd);
1595         SIVAL(outbuf,smb_rcls,0);
1596         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1597         SSVAL(outbuf,smb_flg2,
1598                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1599                 common_flags2);
1600         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1601
1602         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1603         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1604         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1605         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1606 }
1607
1608 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1609 {
1610         construct_reply_common(req, (char *)req->inbuf, outbuf);
1611 }
1612
1613 /****************************************************************************
1614  Construct a chained reply and add it to the already made reply
1615 ****************************************************************************/
1616
1617 #if 0
1618
1619 void chain_reply(struct smb_request *req)
1620 {
1621         /*
1622          * Dirty little const_discard: We mess with req->inbuf, which is
1623          * declared as const. If maybe at some point this routine gets
1624          * rewritten, this const_discard could go away.
1625          */
1626         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1627         int size = smb_len(req->inbuf)+4;
1628
1629         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1630         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1631         char *inbuf2;
1632         int outsize2;
1633         int new_size;
1634         char inbuf_saved[smb_wct];
1635         char *outbuf = (char *)req->outbuf;
1636         size_t outsize = smb_len(outbuf) + 4;
1637         size_t outsize_padded;
1638         size_t padding;
1639         size_t ofs, to_move;
1640
1641         struct smb_request *req2;
1642         size_t caller_outputlen;
1643         char *caller_output;
1644
1645         /* Maybe its not chained, or it's an error packet. */
1646         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1647                 SCVAL(outbuf,smb_vwv0,0xFF);
1648                 return;
1649         }
1650
1651         if (chain_size == 0) {
1652                 /* this is the first part of the chain */
1653                 orig_inbuf = inbuf;
1654         }
1655
1656         /*
1657          * We need to save the output the caller added to the chain so that we
1658          * can splice it into the final output buffer later.
1659          */
1660
1661         caller_outputlen = outsize - smb_wct;
1662
1663         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1664
1665         if (caller_output == NULL) {
1666                 /* TODO: NT_STATUS_NO_MEMORY */
1667                 smb_panic("could not dup outbuf");
1668         }
1669
1670         /*
1671          * The original Win95 redirector dies on a reply to
1672          * a lockingX and read chain unless the chain reply is
1673          * 4 byte aligned. JRA.
1674          */
1675
1676         outsize_padded = (outsize + 3) & ~3;
1677         padding = outsize_padded - outsize;
1678
1679         /*
1680          * remember how much the caller added to the chain, only counting
1681          * stuff after the parameter words
1682          */
1683         chain_size += (outsize_padded - smb_wct);
1684
1685         /*
1686          * work out pointers into the original packets. The
1687          * headers on these need to be filled in
1688          */
1689         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1690
1691         /* remember the original command type */
1692         smb_com1 = CVAL(orig_inbuf,smb_com);
1693
1694         /* save the data which will be overwritten by the new headers */
1695         memcpy(inbuf_saved,inbuf2,smb_wct);
1696
1697         /* give the new packet the same header as the last part of the SMB */
1698         memmove(inbuf2,inbuf,smb_wct);
1699
1700         /* create the in buffer */
1701         SCVAL(inbuf2,smb_com,smb_com2);
1702
1703         /* work out the new size for the in buffer. */
1704         new_size = size - (inbuf2 - inbuf);
1705         if (new_size < 0) {
1706                 DEBUG(0,("chain_reply: chain packet size incorrect "
1707                          "(orig size = %d, offset = %d)\n",
1708                          size, (int)(inbuf2 - inbuf) ));
1709                 exit_server_cleanly("Bad chained packet");
1710                 return;
1711         }
1712
1713         /* And set it in the header. */
1714         smb_setlen(inbuf2, new_size - 4);
1715
1716         DEBUG(3,("Chained message\n"));
1717         show_msg(inbuf2);
1718
1719         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1720                 smb_panic("could not allocate smb_request");
1721         }
1722         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1723         req2->inbuf = (uint8_t *)inbuf2;
1724         req2->chain_fsp = req->chain_fsp;
1725
1726         /* process the request */
1727         switch_message(smb_com2, req2, new_size);
1728
1729         /*
1730          * We don't accept deferred operations in chained requests.
1731          */
1732         SMB_ASSERT(req2->outbuf != NULL);
1733         outsize2 = smb_len(req2->outbuf)+4;
1734
1735         /*
1736          * Move away the new command output so that caller_output fits in,
1737          * copy in the caller_output saved above.
1738          */
1739
1740         SMB_ASSERT(outsize_padded >= smb_wct);
1741
1742         /*
1743          * "ofs" is the space we need for caller_output. Equal to
1744          * caller_outputlen plus the padding.
1745          */
1746
1747         ofs = outsize_padded - smb_wct;
1748
1749         /*
1750          * "to_move" is the amount of bytes the secondary routine gave us
1751          */
1752
1753         to_move = outsize2 - smb_wct;
1754
1755         if (to_move + ofs + smb_wct + chain_size > max_send) {
1756                 smb_panic("replies too large -- would have to cut");
1757         }
1758
1759         /*
1760          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1761          * the first request in the chain. So we have to re-allocate it. In
1762          * the "old" API the only outbuf ever used is the global OutBuffer
1763          * which is always large enough.
1764          */
1765
1766         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1767                                       to_move + ofs + smb_wct);
1768         if (outbuf == NULL) {
1769                 smb_panic("could not realloc outbuf");
1770         }
1771
1772         req->outbuf = (uint8 *)outbuf;
1773
1774         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1775         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1776
1777         /*
1778          * copy the new reply header over the old one but preserve the smb_com
1779          * field
1780          */
1781         memmove(outbuf, req2->outbuf, smb_wct);
1782         SCVAL(outbuf, smb_com, smb_com1);
1783
1784         /*
1785          * We've just copied in the whole "wct" area from the secondary
1786          * function. Fix up the chaining: com2 and the offset need to be
1787          * readjusted.
1788          */
1789
1790         SCVAL(outbuf, smb_vwv0, smb_com2);
1791         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1792
1793         if (padding != 0) {
1794
1795                 /*
1796                  * Due to padding we have some uninitialized bytes after the
1797                  * caller's output
1798                  */
1799
1800                 memset(outbuf + outsize, 0, padding);
1801         }
1802
1803         smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1804
1805         /*
1806          * restore the saved data, being careful not to overwrite any data
1807          * from the reply header
1808          */
1809         memcpy(inbuf2,inbuf_saved,smb_wct);
1810
1811         SAFE_FREE(caller_output);
1812         TALLOC_FREE(req2);
1813
1814         /*
1815          * Reset the chain_size for our caller's offset calculations
1816          */
1817
1818         chain_size -= (outsize_padded - smb_wct);
1819
1820         return;
1821 }
1822
1823 #else
1824
1825 /*
1826  * Hack around reply_nterror & friends not being aware of chained requests,
1827  * generating illegal (i.e. wct==0) chain replies.
1828  */
1829
1830 static void fixup_chain_error_packet(struct smb_request *req)
1831 {
1832         uint8_t *outbuf = req->outbuf;
1833         req->outbuf = NULL;
1834         reply_outbuf(req, 2, 0);
1835         memcpy(req->outbuf, outbuf, smb_wct);
1836         TALLOC_FREE(outbuf);
1837         SCVAL(req->outbuf, smb_vwv0, 0xff);
1838 }
1839
1840 void chain_reply(struct smb_request *req)
1841 {
1842         size_t smblen = smb_len(req->inbuf);
1843         size_t already_used, length_needed;
1844         uint8_t chain_cmd;
1845         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1846
1847         uint8_t wct;
1848         uint16_t *vwv;
1849         uint16_t buflen;
1850         uint8_t *buf;
1851
1852         if (IVAL(req->outbuf, smb_rcls) != 0) {
1853                 fixup_chain_error_packet(req);
1854         }
1855
1856         /*
1857          * Any of the AndX requests and replies have at least a wct of
1858          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1859          * beginning of the SMB header to the next wct field.
1860          *
1861          * None of the AndX requests put anything valuable in vwv[0] and [1],
1862          * so we can overwrite it here to form the chain.
1863          */
1864
1865         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1866                 goto error;
1867         }
1868
1869         /*
1870          * Here we assume that this is the end of the chain. For that we need
1871          * to set "next command" to 0xff and the offset to 0. If we later find
1872          * more commands in the chain, this will be overwritten again.
1873          */
1874
1875         SCVAL(req->outbuf, smb_vwv0, 0xff);
1876         SCVAL(req->outbuf, smb_vwv0+1, 0);
1877         SSVAL(req->outbuf, smb_vwv1, 0);
1878
1879         if (req->chain_outbuf == NULL) {
1880                 /*
1881                  * In req->chain_outbuf we collect all the replies. Start the
1882                  * chain by copying in the first reply.
1883                  */
1884                 req->chain_outbuf = req->outbuf;
1885                 req->outbuf = NULL;
1886         } else {
1887                 if (!smb_splice_chain(&req->chain_outbuf,
1888                                       CVAL(req->outbuf, smb_com),
1889                                       CVAL(req->outbuf, smb_wct),
1890                                       (uint16_t *)(req->outbuf + smb_vwv),
1891                                       0, smb_buflen(req->outbuf),
1892                                       (uint8_t *)smb_buf(req->outbuf))) {
1893                         goto error;
1894                 }
1895                 TALLOC_FREE(req->outbuf);
1896         }
1897
1898         /*
1899          * We use the old request's vwv field to grab the next chained command
1900          * and offset into the chained fields.
1901          */
1902
1903         chain_cmd = CVAL(req->vwv+0, 0);
1904         chain_offset = SVAL(req->vwv+1, 0);
1905
1906         if (chain_cmd == 0xff) {
1907                 /*
1908                  * End of chain, no more requests from the client. So ship the
1909                  * replies.
1910                  */
1911                 smb_setlen((char *)(req->chain_outbuf),
1912                            talloc_get_size(req->chain_outbuf) - 4);
1913                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1914                                   IS_CONN_ENCRYPTED(req->conn)
1915                                   ||req->encrypted)) {
1916                         exit_server_cleanly("chain_reply: srv_send_smb "
1917                                             "failed.");
1918                 }
1919                 return;
1920         }
1921
1922         /*
1923          * Check if the client tries to fool us. The request so far uses the
1924          * space to the end of the byte buffer in the request just
1925          * processed. The chain_offset can't point into that area. If that was
1926          * the case, we could end up with an endless processing of the chain,
1927          * we would always handle the same request.
1928          */
1929
1930         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1931         if (chain_offset < already_used) {
1932                 goto error;
1933         }
1934
1935         /*
1936          * Next check: Make sure the chain offset does not point beyond the
1937          * overall smb request length.
1938          */
1939
1940         length_needed = chain_offset+1; /* wct */
1941         if (length_needed > smblen) {
1942                 goto error;
1943         }
1944
1945         /*
1946          * Now comes the pointer magic. Goal here is to set up req->vwv and
1947          * req->buf correctly again to be able to call the subsequent
1948          * switch_message(). The chain offset (the former vwv[1]) points at
1949          * the new wct field.
1950          */
1951
1952         wct = CVAL(smb_base(req->inbuf), chain_offset);
1953
1954         /*
1955          * Next consistency check: Make the new vwv array fits in the overall
1956          * smb request.
1957          */
1958
1959         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1960         if (length_needed > smblen) {
1961                 goto error;
1962         }
1963         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1964
1965         /*
1966          * Now grab the new byte buffer....
1967          */
1968
1969         buflen = SVAL(vwv+wct, 0);
1970
1971         /*
1972          * .. and check that it fits.
1973          */
1974
1975         length_needed += buflen;
1976         if (length_needed > smblen) {
1977                 goto error;
1978         }
1979         buf = (uint8_t *)(vwv+wct+1);
1980
1981         req->cmd = chain_cmd;
1982         req->wct = wct;
1983         req->vwv = vwv;
1984         req->buflen = buflen;
1985         req->buf = buf;
1986
1987         switch_message(chain_cmd, req, smblen);
1988
1989         if (req->outbuf == NULL) {
1990                 /*
1991                  * This happens if the chained command has suspended itself or
1992                  * if it has called srv_send_smb() itself.
1993                  */
1994                 return;
1995         }
1996
1997         /*
1998          * We end up here if the chained command was not itself chained or
1999          * suspended, but for example a close() command. We now need to splice
2000          * the chained commands' outbuf into the already built up chain_outbuf
2001          * and ship the result.
2002          */
2003         goto done;
2004
2005  error:
2006         /*
2007          * We end up here if there's any error in the chain syntax. Report a
2008          * DOS error, just like Windows does.
2009          */
2010         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
2011         fixup_chain_error_packet(req);
2012
2013  done:
2014         if (!smb_splice_chain(&req->chain_outbuf,
2015                               CVAL(req->outbuf, smb_com),
2016                               CVAL(req->outbuf, smb_wct),
2017                               (uint16_t *)(req->outbuf + smb_vwv),
2018                               0, smb_buflen(req->outbuf),
2019                               (uint8_t *)smb_buf(req->outbuf))) {
2020                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2021         }
2022         TALLOC_FREE(req->outbuf);
2023
2024         smb_setlen((char *)(req->chain_outbuf),
2025                    talloc_get_size(req->chain_outbuf) - 4);
2026
2027         show_msg((char *)(req->chain_outbuf));
2028
2029         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2030                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted)) {
2031                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2032         }
2033 }
2034
2035 #endif
2036
2037 /****************************************************************************
2038  Check if services need reloading.
2039 ****************************************************************************/
2040
2041 void check_reload(time_t t)
2042 {
2043         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2044
2045         if(last_smb_conf_reload_time == 0) {
2046                 last_smb_conf_reload_time = t;
2047                 /* Our printing subsystem might not be ready at smbd start up.
2048                    Then no printer is available till the first printers check
2049                    is performed.  A lower initial interval circumvents this. */
2050                 if ( printcap_cache_time > 60 )
2051                         last_printer_reload_time = t - printcap_cache_time + 60;
2052                 else
2053                         last_printer_reload_time = t;
2054         }
2055
2056         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2057                 /* randomize over 60 second the printcap reload to avoid all
2058                  * process hitting cupsd at the same time */
2059                 int time_range = 60;
2060
2061                 last_printer_reload_time += random() % time_range;
2062                 mypid = getpid();
2063         }
2064
2065         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
2066                 reload_services(True);
2067                 reload_after_sighup = False;
2068                 last_smb_conf_reload_time = t;
2069         }
2070
2071         /* 'printcap cache time = 0' disable the feature */
2072
2073         if ( printcap_cache_time != 0 )
2074         {
2075                 /* see if it's time to reload or if the clock has been set back */
2076
2077                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2078                         || (t-last_printer_reload_time  < 0) )
2079                 {
2080                         DEBUG( 3,( "Printcap cache time expired.\n"));
2081                         reload_printers();
2082                         last_printer_reload_time = t;
2083                 }
2084         }
2085 }
2086
2087 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2088 {
2089         /* TODO: make write nonblocking */
2090 }
2091
2092 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
2093 {
2094         uint8_t *inbuf = NULL;
2095         size_t inbuf_len = 0;
2096         size_t unread_bytes = 0;
2097         bool encrypted = false;
2098         TALLOC_CTX *mem_ctx = talloc_tos();
2099         NTSTATUS status;
2100
2101         /* TODO: make this completely nonblocking */
2102
2103         status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
2104                                     (char **)(void *)&inbuf,
2105                                     0, /* timeout */
2106                                     &unread_bytes,
2107                                     &encrypted,
2108                                     &inbuf_len);
2109         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2110                 goto process;
2111         }
2112         if (NT_STATUS_IS_ERR(status)) {
2113                 exit_server_cleanly("failed to receive smb request");
2114         }
2115         if (!NT_STATUS_IS_OK(status)) {
2116                 return;
2117         }
2118
2119 process:
2120         process_smb(conn, inbuf, inbuf_len, unread_bytes, encrypted);
2121 }
2122
2123 static void smbd_server_connection_handler(struct event_context *ev,
2124                                            struct fd_event *fde,
2125                                            uint16_t flags,
2126                                            void *private_data)
2127 {
2128         struct smbd_server_connection *conn = talloc_get_type(private_data,
2129                                               struct smbd_server_connection);
2130
2131         if (flags & EVENT_FD_WRITE) {
2132                 smbd_server_connection_write_handler(conn);
2133         } else if (flags & EVENT_FD_READ) {
2134                 smbd_server_connection_read_handler(conn);
2135         }
2136 }
2137
2138 /****************************************************************************
2139  Process commands from the client
2140 ****************************************************************************/
2141
2142 void smbd_process(void)
2143 {
2144         /*
2145          * Before the first packet, check the global hosts allow/ hosts deny
2146          * parameters before doing any parsing of packets passed to us by the
2147          * client. This prevents attacks on our parsing code from hosts not in
2148          * the hosts allow list.
2149          */
2150
2151         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2152                           lp_hostsdeny(-1))) {
2153                 char addr[INET6_ADDRSTRLEN];
2154
2155                 /*
2156                  * send a negative session response "not listening on calling
2157                  * name"
2158                  */
2159                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2160                 DEBUG( 1, ("Connection denied from %s\n",
2161                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
2162                 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
2163                 exit_server_cleanly("connection denied");
2164         }
2165
2166         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2167
2168         smbd_server_conn = talloc_zero(smbd_event_context(), struct smbd_server_connection);
2169         if (!smbd_server_conn) {
2170                 exit_server("failed to create smbd_server_connection");
2171         }
2172         smbd_server_conn->fde = event_add_fd(smbd_event_context(),
2173                                              smbd_server_conn,
2174                                              smbd_server_fd(),
2175                                              EVENT_FD_READ,
2176                                              smbd_server_connection_handler,
2177                                              smbd_server_conn);
2178         if (!smbd_server_conn->fde) {
2179                 exit_server("failed to create smbd_server_connection fde");
2180         }
2181
2182         while (True) {
2183                 NTSTATUS status;
2184                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2185
2186                 errno = 0;
2187
2188                 status = smbd_server_connection_loop_once(smbd_server_conn);
2189                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
2190                     !NT_STATUS_IS_OK(status)) {
2191                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2192                                   " exiting\n", nt_errstr(status)));
2193                         return;
2194                 }
2195
2196                 TALLOC_FREE(frame);
2197         }
2198 }