source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43 #include "system/threads.h"
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct tevent_timer *te;
  51         struct smb_perfcount_data pcd;
  52         uint32_t seqnum;
  53         bool encrypted;
  54         bool processed;
  55         DATA_BLOB buf;
  56         struct deferred_open_record *open_rec;
  57 };
  58
  59 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  60                                    char *outbuf);
  61 static struct pending_message_list *get_deferred_open_message_smb(
  62         struct smbd_server_connection *sconn, uint64_t mid);
  63 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  64
  65 void smbd_echo_init(struct smbd_server_connection *sconn)
  66 {
  67         sconn->smb1.echo_handler.trusted_fd = -1;
  68         sconn->smb1.echo_handler.socket_lock_fd = -1;
  69 #ifdef HAVE_ROBUST_MUTEXES
  70         sconn->smb1.echo_handler.socket_mutex = NULL;
  71 #endif
  72 }
  73
  74 static bool smbd_echo_active(struct smbd_server_connection *sconn)
  75 {
  76         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
  77                 return true;
  78         }
  79
  80 #ifdef HAVE_ROBUST_MUTEXES
  81         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
  82                 return true;
  83         }
  84 #endif
  85
  86         return false;
  87 }
  88
  89 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  90 {
  91         if (!smbd_echo_active(sconn)) {
  92                 return true;
  93         }
  94
  95         sconn->smb1.echo_handler.ref_count++;
  96
  97         if (sconn->smb1.echo_handler.ref_count > 1) {
  98                 return true;
  99         }
 100
 101         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 102
 103 #ifdef HAVE_ROBUST_MUTEXES
 104         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
 105                 int ret = EINTR;
 106
 107                 while (ret == EINTR) {
 108                         ret = pthread_mutex_lock(
 109                                 sconn->smb1.echo_handler.socket_mutex);
 110                         if (ret == 0) {
 111                                 break;
 112                         }
 113                 }
 114                 if (ret != 0) {
 115                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 116                                   strerror(ret)));
 117                         return false;
 118                 }
 119         }
 120 #endif
 121
 122         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
 123                 bool ok;
 124
 125                 do {
 126                         ok = fcntl_lock(
 127                                 sconn->smb1.echo_handler.socket_lock_fd,
 128                                 F_SETLKW, 0, 0, F_WRLCK);
 129                 } while (!ok && (errno == EINTR));
 130
 131                 if (!ok) {
 132                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 133                         return false;
 134                 }
 135         }
 136
 137         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 138
 139         return true;
 140 }
 141
 142 void smbd_lock_socket(struct smbd_server_connection *sconn)
 143 {
 144         if (!smbd_lock_socket_internal(sconn)) {
 145                 exit_server_cleanly("failed to lock socket");
 146         }
 147 }
 148
 149 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 150 {
 151         if (!smbd_echo_active(sconn)) {
 152                 return true;
 153         }
 154
 155         sconn->smb1.echo_handler.ref_count--;
 156
 157         if (sconn->smb1.echo_handler.ref_count > 0) {
 158                 return true;
 159         }
 160
 161 #ifdef HAVE_ROBUST_MUTEXES
 162         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
 163                 int ret = EINTR;
 164
 165                 while (ret == EINTR) {
 166                         ret = pthread_mutex_unlock(
 167                                 sconn->smb1.echo_handler.socket_mutex);
 168                         if (ret == 0) {
 169                                 break;
 170                         }
 171                 }
 172                 if (ret != 0) {
 173                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 174                                   strerror(ret)));
 175                         return false;
 176                 }
 177         }
 178 #endif
 179
 180         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
 181                 bool ok;
 182
 183                 do {
 184                         ok = fcntl_lock(
 185                                 sconn->smb1.echo_handler.socket_lock_fd,
 186                                 F_SETLKW, 0, 0, F_UNLCK);
 187                 } while (!ok && (errno == EINTR));
 188
 189                 if (!ok) {
 190                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 191                         return false;
 192                 }
 193         }
 194
 195         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 196
 197         return true;
 198 }
 199
 200 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 201 {
 202         if (!smbd_unlock_socket_internal(sconn)) {
 203                 exit_server_cleanly("failed to unlock socket");
 204         }
 205 }
 206
 207 /* Accessor function for smb_read_error for smbd functions. */
 208
 209 /****************************************************************************
 210  Send an smb to a fd.
 211 ****************************************************************************/
 212
 213 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 214                   bool do_signing, uint32_t seqnum,
 215                   bool do_encrypt,
 216                   struct smb_perfcount_data *pcd)
 217 {
 218         struct smbXsrv_connection *xconn = sconn->conn;
 219         size_t len = 0;
 220         ssize_t ret;
 221         char *buf_out = buffer;
 222
 223         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 224                 /*
 225                  * we're not supposed to do any io
 226                  */
 227                 return true;
 228         }
 229
 230         smbd_lock_socket(sconn);
 231
 232         if (do_signing) {
 233                 /* Sign the outgoing packet if required. */
 234                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 235         }
 236
 237         if (do_encrypt) {
 238                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 239                 if (!NT_STATUS_IS_OK(status)) {
 240                         DEBUG(0, ("send_smb: SMB encryption failed "
 241                                 "on outgoing packet! Error %s\n",
 242                                 nt_errstr(status) ));
 243                         ret = -1;
 244                         goto out;
 245                 }
 246         }
 247
 248         len = smb_len_large(buf_out) + 4;
 249
 250         ret = write_data(xconn->transport.sock, buf_out, len);
 251         if (ret <= 0) {
 252                 int saved_errno = errno;
 253                 /*
 254                  * Try and give an error message saying what
 255                  * client failed.
 256                  */
 257                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 258                          (int)getpid(), (int)len,
 259                          smbXsrv_connection_dbg(xconn),
 260                          (int)ret, strerror(saved_errno)));
 261                 errno = saved_errno;
 262
 263                 srv_free_enc_buffer(sconn, buf_out);
 264                 goto out;
 265         }
 266
 267         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 268         srv_free_enc_buffer(sconn, buf_out);
 269 out:
 270         SMB_PERFCOUNT_END(pcd);
 271
 272         smbd_unlock_socket(sconn);
 273         return (ret > 0);
 274 }
 275
 276 /*******************************************************************
 277  Setup the word count and byte count for a smb message.
 278 ********************************************************************/
 279
 280 int srv_set_message(char *buf,
 281                         int num_words,
 282                         int num_bytes,
 283                         bool zero)
 284 {
 285         if (zero && (num_words || num_bytes)) {
 286                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 287         }
 288         SCVAL(buf,smb_wct,num_words);
 289         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 290         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 291         return (smb_size + num_words*2 + num_bytes);
 292 }
 293
 294 static bool valid_smb_header(struct smbd_server_connection *sconn,
 295                              const uint8_t *inbuf)
 296 {
 297         if (is_encrypted_packet(sconn, inbuf)) {
 298                 return true;
 299         }
 300         /*
 301          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 302          * but it just looks weird to call strncmp for this one.
 303          */
 304         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 305 }
 306
 307 /* Socket functions for smbd packet processing. */
 308
 309 static bool valid_packet_size(size_t len)
 310 {
 311         /*
 312          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 313          * of header. Don't print the error if this fits.... JRA.
 314          */
 315
 316         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 317                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 318                                         (unsigned long)len));
 319                 return false;
 320         }
 321         return true;
 322 }
 323
 324 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 325                                       unsigned int timeout, ssize_t len)
 326 {
 327         NTSTATUS status;
 328
 329         if (len <= 0) {
 330                 return NT_STATUS_OK;
 331         }
 332
 333         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 char addr[INET6_ADDRSTRLEN];
 336                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 337                           "error = %s.\n",
 338                           get_peer_addr(fd, addr, sizeof(addr)),
 339                           nt_errstr(status)));
 340         }
 341         return status;
 342 }
 343
 344 /****************************************************************************
 345  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 346 ****************************************************************************/
 347
 348 /*
 349  * Unfortunately, earlier versions of smbclient/libsmbclient
 350  * don't send this "standard" writeX header. I've fixed this
 351  * for 3.2 but we'll use the old method with earlier versions.
 352  * Windows and CIFSFS at least use this standard size. Not
 353  * sure about MacOSX.
 354  */
 355
 356 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 357                                 (2*14) + /* word count (including bcc) */ \
 358                                 1 /* pad byte */)
 359
 360 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 361                                                     const char lenbuf[4],
 362                                                     struct smbd_server_connection *sconn,
 363                                                     int sock,
 364                                                     char **buffer,
 365                                                     unsigned int timeout,
 366                                                     size_t *p_unread,
 367                                                     size_t *len_ret)
 368 {
 369         /* Size of a WRITEX call (+4 byte len). */
 370         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 371         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 372         ssize_t toread;
 373         NTSTATUS status;
 374
 375         memcpy(writeX_header, lenbuf, 4);
 376
 377         status = read_fd_with_timeout(
 378                 sock, writeX_header + 4,
 379                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 380                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 381                 timeout, NULL);
 382
 383         if (!NT_STATUS_IS_OK(status)) {
 384                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 385                           "error = %s.\n",
 386                           tsocket_address_string(sconn->remote_address,
 387                                                  talloc_tos()),
 388                           nt_errstr(status)));
 389                 return status;
 390         }
 391
 392         /*
 393          * Ok - now try and see if this is a possible
 394          * valid writeX call.
 395          */
 396
 397         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 398                 /*
 399                  * If the data offset is beyond what
 400                  * we've read, drain the extra bytes.
 401                  */
 402                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 403                 ssize_t newlen;
 404
 405                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 406                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 407                         if (drain_socket(sock, drain) != drain) {
 408                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 409                                         " failed to drain pending bytes");
 410                         }
 411                 } else {
 412                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 413                 }
 414
 415                 /* Spoof down the length and null out the bcc. */
 416                 set_message_bcc(writeX_header, 0);
 417                 newlen = smb_len(writeX_header);
 418
 419                 /* Copy the header we've written. */
 420
 421                 *buffer = (char *)talloc_memdup(mem_ctx,
 422                                 writeX_header,
 423                                 sizeof(writeX_header));
 424
 425                 if (*buffer == NULL) {
 426                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 427                                   (int)sizeof(writeX_header)));
 428                         return NT_STATUS_NO_MEMORY;
 429                 }
 430
 431                 /* Work out the remaining bytes. */
 432                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 433                 *len_ret = newlen + 4;
 434                 return NT_STATUS_OK;
 435         }
 436
 437         if (!valid_packet_size(len)) {
 438                 return NT_STATUS_INVALID_PARAMETER;
 439         }
 440
 441         /*
 442          * Not a valid writeX call. Just do the standard
 443          * talloc and return.
 444          */
 445
 446         *buffer = talloc_array(mem_ctx, char, len+4);
 447
 448         if (*buffer == NULL) {
 449                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 450                           (int)len+4));
 451                 return NT_STATUS_NO_MEMORY;
 452         }
 453
 454         /* Copy in what we already read. */
 455         memcpy(*buffer,
 456                 writeX_header,
 457                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 458         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 459
 460         if(toread > 0) {
 461                 status = read_packet_remainder(
 462                         sock,
 463                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 464                         timeout, toread);
 465
 466                 if (!NT_STATUS_IS_OK(status)) {
 467                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 468                                    nt_errstr(status)));
 469                         return status;
 470                 }
 471         }
 472
 473         *len_ret = len + 4;
 474         return NT_STATUS_OK;
 475 }
 476
 477 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 478                                        struct smbd_server_connection *sconn,
 479                                        int sock,
 480                                        char **buffer, unsigned int timeout,
 481                                        size_t *p_unread, size_t *plen)
 482 {
 483         char lenbuf[4];
 484         size_t len;
 485         int min_recv_size = lp_min_receive_file_size();
 486         NTSTATUS status;
 487
 488         *p_unread = 0;
 489
 490         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 491                                                   &len);
 492         if (!NT_STATUS_IS_OK(status)) {
 493                 return status;
 494         }
 495
 496         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 497             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 498                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 499             !srv_is_signing_active(sconn) &&
 500             sconn->smb1.echo_handler.trusted_fde == NULL) {
 501
 502                 return receive_smb_raw_talloc_partial_read(
 503                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 504                         p_unread, plen);
 505         }
 506
 507         if (!valid_packet_size(len)) {
 508                 return NT_STATUS_INVALID_PARAMETER;
 509         }
 510
 511         /*
 512          * The +4 here can't wrap, we've checked the length above already.
 513          */
 514
 515         *buffer = talloc_array(mem_ctx, char, len+4);
 516
 517         if (*buffer == NULL) {
 518                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 519                           (int)len+4));
 520                 return NT_STATUS_NO_MEMORY;
 521         }
 522
 523         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 524
 525         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 526         if (!NT_STATUS_IS_OK(status)) {
 527                 return status;
 528         }
 529
 530         *plen = len + 4;
 531         return NT_STATUS_OK;
 532 }
 533
 534 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 535                                    struct smbd_server_connection *sconn,
 536                                    int sock,
 537                                    char **buffer, unsigned int timeout,
 538                                    size_t *p_unread, bool *p_encrypted,
 539                                    size_t *p_len,
 540                                    uint32_t *seqnum,
 541                                    bool trusted_channel)
 542 {
 543         size_t len = 0;
 544         NTSTATUS status;
 545
 546         *p_encrypted = false;
 547
 548         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 549                                         p_unread, &len);
 550         if (!NT_STATUS_IS_OK(status)) {
 551                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 552                       ("receive_smb_raw_talloc failed for client %s "
 553                        "read error = %s.\n",
 554                        tsocket_address_string(sconn->remote_address,
 555                                               talloc_tos()),
 556                        nt_errstr(status)) );
 557                 return status;
 558         }
 559
 560         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 561                 status = srv_decrypt_buffer(sconn, *buffer);
 562                 if (!NT_STATUS_IS_OK(status)) {
 563                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 564                                 "incoming packet! Error %s\n",
 565                                 nt_errstr(status) ));
 566                         return status;
 567                 }
 568                 *p_encrypted = true;
 569         }
 570
 571         /* Check the incoming SMB signature. */
 572         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 573                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 574                           "incoming packet!\n"));
 575                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 576         }
 577
 578         *p_len = len;
 579         return NT_STATUS_OK;
 580 }
 581
 582 /*
 583  * Initialize a struct smb_request from an inbuf
 584  */
 585
 586 static bool init_smb_request(struct smb_request *req,
 587                              struct smbd_server_connection *sconn,
 588                              const uint8 *inbuf,
 589                              size_t unread_bytes, bool encrypted,
 590                              uint32_t seqnum)
 591 {
 592         struct smbXsrv_tcon *tcon;
 593         NTSTATUS status;
 594         NTTIME now;
 595         size_t req_size = smb_len(inbuf) + 4;
 596
 597         /* Ensure we have at least smb_size bytes. */
 598         if (req_size < smb_size) {
 599                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 600                         (unsigned int)req_size ));
 601                 return false;
 602         }
 603
 604         req->request_time = timeval_current();
 605         now = timeval_to_nttime(&req->request_time);
 606
 607         req->cmd    = CVAL(inbuf, smb_com);
 608         req->flags2 = SVAL(inbuf, smb_flg2);
 609         req->smbpid = SVAL(inbuf, smb_pid);
 610         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 611         req->seqnum = seqnum;
 612         req->vuid   = SVAL(inbuf, smb_uid);
 613         req->tid    = SVAL(inbuf, smb_tid);
 614         req->wct    = CVAL(inbuf, smb_wct);
 615         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 616         req->buflen = smb_buflen(inbuf);
 617         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 618         req->unread_bytes = unread_bytes;
 619         req->encrypted = encrypted;
 620         req->sconn = sconn;
 621         status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
 622         if (NT_STATUS_IS_OK(status)) {
 623                 req->conn = tcon->compat;
 624         } else {
 625                 req->conn = NULL;
 626         }
 627         req->chain_fsp = NULL;
 628         req->smb2req = NULL;
 629         req->priv_paths = NULL;
 630         req->chain = NULL;
 631         smb_init_perfcount_data(&req->pcd);
 632
 633         /* Ensure we have at least wct words and 2 bytes of bcc. */
 634         if (smb_size + req->wct*2 > req_size) {
 635                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 636                         (unsigned int)req->wct,
 637                         (unsigned int)req_size));
 638                 return false;
 639         }
 640         /* Ensure bcc is correct. */
 641         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 642                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 643                         "(wct = %u, size %u)\n",
 644                         (unsigned int)req->buflen,
 645                         (unsigned int)req->wct,
 646                         (unsigned int)req_size));
 647                 return false;
 648         }
 649
 650         req->outbuf = NULL;
 651         return true;
 652 }
 653
 654 static void process_smb(struct smbd_server_connection *conn,
 655                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 656                         uint32_t seqnum, bool encrypted,
 657                         struct smb_perfcount_data *deferred_pcd);
 658
 659 static void smbd_deferred_open_timer(struct tevent_context *ev,
 660                                      struct tevent_timer *te,
 661                                      struct timeval _tval,
 662                                      void *private_data)
 663 {
 664         struct pending_message_list *msg = talloc_get_type(private_data,
 665                                            struct pending_message_list);
 666         struct smbd_server_connection *sconn = msg->sconn;
 667         TALLOC_CTX *mem_ctx = talloc_tos();
 668         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 669         uint8_t *inbuf;
 670
 671         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 672                                          msg->buf.length);
 673         if (inbuf == NULL) {
 674                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 675                 return;
 676         }
 677
 678         /* We leave this message on the queue so the open code can
 679            know this is a retry. */
 680         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 681                 (unsigned long long)mid ));
 682
 683         /* Mark the message as processed so this is not
 684          * re-processed in error. */
 685         msg->processed = true;
 686
 687         process_smb(sconn, inbuf,
 688                     msg->buf.length, 0,
 689                     msg->seqnum, msg->encrypted, &msg->pcd);
 690
 691         /* If it's still there and was processed, remove it. */
 692         msg = get_deferred_open_message_smb(sconn, mid);
 693         if (msg && msg->processed) {
 694                 remove_deferred_open_message_smb(sconn, mid);
 695         }
 696 }
 697
 698 /****************************************************************************
 699  Function to push a message onto the tail of a linked list of smb messages ready
 700  for processing.
 701 ****************************************************************************/
 702
 703 static bool push_queued_message(struct smb_request *req,
 704                                 struct timeval request_time,
 705                                 struct timeval end_time,
 706                                 struct deferred_open_record *open_rec)
 707 {
 708         int msg_len = smb_len(req->inbuf) + 4;
 709         struct pending_message_list *msg;
 710
 711         msg = talloc_zero(NULL, struct pending_message_list);
 712
 713         if(msg == NULL) {
 714                 DEBUG(0,("push_message: malloc fail (1)\n"));
 715                 return False;
 716         }
 717         msg->sconn = req->sconn;
 718
 719         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 720         if(msg->buf.data == NULL) {
 721                 DEBUG(0,("push_message: malloc fail (2)\n"));
 722                 TALLOC_FREE(msg);
 723                 return False;
 724         }
 725
 726         msg->request_time = request_time;
 727         msg->seqnum = req->seqnum;
 728         msg->encrypted = req->encrypted;
 729         msg->processed = false;
 730         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 731
 732         if (open_rec) {
 733                 msg->open_rec = talloc_move(msg, &open_rec);
 734         }
 735
 736 #if 0
 737         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 738                                    msg,
 739                                    end_time,
 740                                    smbd_deferred_open_timer,
 741                                    msg);
 742         if (!msg->te) {
 743                 DEBUG(0,("push_message: event_add_timed failed\n"));
 744                 TALLOC_FREE(msg);
 745                 return false;
 746         }
 747 #endif
 748
 749         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 750                       struct pending_message_list *);
 751
 752         DEBUG(10,("push_message: pushed message length %u on "
 753                   "deferred_open_queue\n", (unsigned int)msg_len));
 754
 755         return True;
 756 }
 757
 758 /****************************************************************************
 759  Function to delete a sharing violation open message by mid.
 760 ****************************************************************************/
 761
 762 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 763                                       uint64_t mid)
 764 {
 765         struct pending_message_list *pml;
 766
 767         if (sconn->using_smb2) {
 768                 remove_deferred_open_message_smb2(sconn, mid);
 769                 return;
 770         }
 771
 772         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 773                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 774                         DEBUG(10,("remove_deferred_open_message_smb: "
 775                                   "deleting mid %llu len %u\n",
 776                                   (unsigned long long)mid,
 777                                   (unsigned int)pml->buf.length ));
 778                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 779                         TALLOC_FREE(pml);
 780                         return;
 781                 }
 782         }
 783 }
 784
 785 /****************************************************************************
 786  Move a sharing violation open retry message to the front of the list and
 787  schedule it for immediate processing.
 788 ****************************************************************************/
 789
 790 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 791                                         uint64_t mid)
 792 {
 793         struct pending_message_list *pml;
 794         int i = 0;
 795
 796         if (sconn->using_smb2) {
 797                 return schedule_deferred_open_message_smb2(sconn, mid);
 798         }
 799
 800         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 801                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 802
 803                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 804                         "msg_mid = %llu\n",
 805                         i++,
 806                         (unsigned long long)msg_mid ));
 807
 808                 if (mid == msg_mid) {
 809                         struct tevent_timer *te;
 810
 811                         if (pml->processed) {
 812                                 /* A processed message should not be
 813                                  * rescheduled. */
 814                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 815                                         "message mid %llu was already processed\n",
 816                                         (unsigned long long)msg_mid ));
 817                                 continue;
 818                         }
 819
 820                         DEBUG(10,("schedule_deferred_open_message_smb: "
 821                                 "scheduling mid %llu\n",
 822                                 (unsigned long long)mid ));
 823
 824                         te = tevent_add_timer(pml->sconn->ev_ctx,
 825                                               pml,
 826                                               timeval_zero(),
 827                                               smbd_deferred_open_timer,
 828                                               pml);
 829                         if (!te) {
 830                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 831                                         "event_add_timed() failed, "
 832                                         "skipping mid %llu\n",
 833                                         (unsigned long long)msg_mid ));
 834                         }
 835
 836                         TALLOC_FREE(pml->te);
 837                         pml->te = te;
 838                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 839                         return true;
 840                 }
 841         }
 842
 843         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 844                 "find message mid %llu\n",
 845                 (unsigned long long)mid ));
 846
 847         return false;
 848 }
 849
 850 /****************************************************************************
 851  Return true if this mid is on the deferred queue and was not yet processed.
 852 ****************************************************************************/
 853
 854 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 855 {
 856         struct pending_message_list *pml;
 857
 858         if (sconn->using_smb2) {
 859                 return open_was_deferred_smb2(sconn, mid);
 860         }
 861
 862         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 863                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 864                         return True;
 865                 }
 866         }
 867         return False;
 868 }
 869
 870 /****************************************************************************
 871  Return the message queued by this mid.
 872 ****************************************************************************/
 873
 874 static struct pending_message_list *get_deferred_open_message_smb(
 875         struct smbd_server_connection *sconn, uint64_t mid)
 876 {
 877         struct pending_message_list *pml;
 878
 879         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 880                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 881                         return pml;
 882                 }
 883         }
 884         return NULL;
 885 }
 886
 887 /****************************************************************************
 888  Get the state data queued by this mid.
 889 ****************************************************************************/
 890
 891 bool get_deferred_open_message_state(struct smb_request *smbreq,
 892                                 struct timeval *p_request_time,
 893                                 struct deferred_open_record **open_rec)
 894 {
 895         struct pending_message_list *pml;
 896
 897         if (smbreq->sconn->using_smb2) {
 898                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 899                                         p_request_time,
 900                                         open_rec);
 901         }
 902
 903         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 904         if (!pml) {
 905                 return false;
 906         }
 907         if (p_request_time) {
 908                 *p_request_time = pml->request_time;
 909         }
 910         if (open_rec != NULL) {
 911                 *open_rec = pml->open_rec;
 912         }
 913         return true;
 914 }
 915
 916 /****************************************************************************
 917  Function to push a deferred open smb message onto a linked list of local smb
 918  messages ready for processing.
 919 ****************************************************************************/
 920
 921 bool push_deferred_open_message_smb(struct smb_request *req,
 922                                struct timeval request_time,
 923                                struct timeval timeout,
 924                                struct file_id id,
 925                                struct deferred_open_record *open_rec)
 926 {
 927         struct timeval end_time;
 928
 929         if (req->smb2req) {
 930                 return push_deferred_open_message_smb2(req->smb2req,
 931                                                 request_time,
 932                                                 timeout,
 933                                                 id,
 934                                                 open_rec);
 935         }
 936
 937         if (req->unread_bytes) {
 938                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 939                         "unread_bytes = %u\n",
 940                         (unsigned int)req->unread_bytes ));
 941                 smb_panic("push_deferred_open_message_smb: "
 942                         "logic error unread_bytes != 0" );
 943         }
 944
 945         end_time = timeval_sum(&request_time, &timeout);
 946
 947         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 948                 "len %u mid %llu timeout time [%u.%06u]\n",
 949                 (unsigned int) smb_len(req->inbuf)+4,
 950                 (unsigned long long)req->mid,
 951                 (unsigned int)end_time.tv_sec,
 952                 (unsigned int)end_time.tv_usec));
 953
 954         return push_queued_message(req, request_time, end_time, open_rec);
 955 }
 956
 957 static void smbd_sig_term_handler(struct tevent_context *ev,
 958                                   struct tevent_signal *se,
 959                                   int signum,
 960                                   int count,
 961                                   void *siginfo,
 962                                   void *private_data)
 963 {
 964         exit_server_cleanly("termination signal");
 965 }
 966
 967 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 968 {
 969         struct tevent_signal *se;
 970
 971         se = tevent_add_signal(sconn->ev_ctx,
 972                                sconn,
 973                                SIGTERM, 0,
 974                                smbd_sig_term_handler,
 975                                sconn);
 976         if (!se) {
 977                 exit_server("failed to setup SIGTERM handler");
 978         }
 979 }
 980
 981 static void smbd_sig_hup_handler(struct tevent_context *ev,
 982                                   struct tevent_signal *se,
 983                                   int signum,
 984                                   int count,
 985                                   void *siginfo,
 986                                   void *private_data)
 987 {
 988         struct smbd_server_connection *sconn =
 989                 talloc_get_type_abort(private_data,
 990                 struct smbd_server_connection);
 991
 992         change_to_root_user();
 993         DEBUG(1,("Reloading services after SIGHUP\n"));
 994         reload_services(sconn, conn_snum_used, false);
 995 }
 996
 997 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
 998 {
 999         struct tevent_signal *se;
1000
1001         se = tevent_add_signal(sconn->ev_ctx,
1002                                sconn,
1003                                SIGHUP, 0,
1004                                smbd_sig_hup_handler,
1005                                sconn);
1006         if (!se) {
1007                 exit_server("failed to setup SIGHUP handler");
1008         }
1009 }
1010
1011 static void smbd_conf_updated(struct messaging_context *msg,
1012                               void *private_data,
1013                               uint32_t msg_type,
1014                               struct server_id server_id,
1015                               DATA_BLOB *data)
1016 {
1017         struct smbd_server_connection *sconn =
1018                 talloc_get_type_abort(private_data,
1019                 struct smbd_server_connection);
1020
1021         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1022                   "updated. Reloading.\n"));
1023         change_to_root_user();
1024         reload_services(sconn, conn_snum_used, false);
1025 }
1026
1027 /*
1028  * Only allow 5 outstanding trans requests. We're allocating memory, so
1029  * prevent a DoS.
1030  */
1031
1032 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1033 {
1034         int count = 0;
1035         for (; list != NULL; list = list->next) {
1036
1037                 if (list->mid == mid) {
1038                         return NT_STATUS_INVALID_PARAMETER;
1039                 }
1040
1041                 count += 1;
1042         }
1043         if (count > 5) {
1044                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1045         }
1046
1047         return NT_STATUS_OK;
1048 }
1049
1050 /*
1051 These flags determine some of the permissions required to do an operation
1052
1053 Note that I don't set NEED_WRITE on some write operations because they
1054 are used by some brain-dead clients when printing, and I don't want to
1055 force write permissions on print services.
1056 */
1057 #define AS_USER (1<<0)
1058 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1059 #define TIME_INIT (1<<2)
1060 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1061 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1062 #define DO_CHDIR (1<<6)
1063
1064 /*
1065    define a list of possible SMB messages and their corresponding
1066    functions. Any message that has a NULL function is unimplemented -
1067    please feel free to contribute implementations!
1068 */
1069 static const struct smb_message_struct {
1070         const char *name;
1071         void (*fn)(struct smb_request *req);
1072         int flags;
1073 } smb_messages[256] = {
1074
1075 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1076 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1077 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1078 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1079 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1080 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1081 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1082 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1083 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1084 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1085 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1086 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1087 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1088 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1089 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1090 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1091 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1092 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1093 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1094 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1095 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1096 /* 0x15 */ { NULL, NULL, 0 },
1097 /* 0x16 */ { NULL, NULL, 0 },
1098 /* 0x17 */ { NULL, NULL, 0 },
1099 /* 0x18 */ { NULL, NULL, 0 },
1100 /* 0x19 */ { NULL, NULL, 0 },
1101 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1102 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1103 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1104 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1105 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1106 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1107 /* 0x20 */ { "SMBwritec", NULL,0},
1108 /* 0x21 */ { NULL, NULL, 0 },
1109 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1110 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1111 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1112 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1113 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1114 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1115 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1116 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1117 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1118 /* 0x2b */ { "SMBecho",reply_echo,0},
1119 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1120 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1121 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1122 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1123 /* 0x30 */ { NULL, NULL, 0 },
1124 /* 0x31 */ { NULL, NULL, 0 },
1125 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1126 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1127 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1128 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1129 /* 0x36 */ { NULL, NULL, 0 },
1130 /* 0x37 */ { NULL, NULL, 0 },
1131 /* 0x38 */ { NULL, NULL, 0 },
1132 /* 0x39 */ { NULL, NULL, 0 },
1133 /* 0x3a */ { NULL, NULL, 0 },
1134 /* 0x3b */ { NULL, NULL, 0 },
1135 /* 0x3c */ { NULL, NULL, 0 },
1136 /* 0x3d */ { NULL, NULL, 0 },
1137 /* 0x3e */ { NULL, NULL, 0 },
1138 /* 0x3f */ { NULL, NULL, 0 },
1139 /* 0x40 */ { NULL, NULL, 0 },
1140 /* 0x41 */ { NULL, NULL, 0 },
1141 /* 0x42 */ { NULL, NULL, 0 },
1142 /* 0x43 */ { NULL, NULL, 0 },
1143 /* 0x44 */ { NULL, NULL, 0 },
1144 /* 0x45 */ { NULL, NULL, 0 },
1145 /* 0x46 */ { NULL, NULL, 0 },
1146 /* 0x47 */ { NULL, NULL, 0 },
1147 /* 0x48 */ { NULL, NULL, 0 },
1148 /* 0x49 */ { NULL, NULL, 0 },
1149 /* 0x4a */ { NULL, NULL, 0 },
1150 /* 0x4b */ { NULL, NULL, 0 },
1151 /* 0x4c */ { NULL, NULL, 0 },
1152 /* 0x4d */ { NULL, NULL, 0 },
1153 /* 0x4e */ { NULL, NULL, 0 },
1154 /* 0x4f */ { NULL, NULL, 0 },
1155 /* 0x50 */ { NULL, NULL, 0 },
1156 /* 0x51 */ { NULL, NULL, 0 },
1157 /* 0x52 */ { NULL, NULL, 0 },
1158 /* 0x53 */ { NULL, NULL, 0 },
1159 /* 0x54 */ { NULL, NULL, 0 },
1160 /* 0x55 */ { NULL, NULL, 0 },
1161 /* 0x56 */ { NULL, NULL, 0 },
1162 /* 0x57 */ { NULL, NULL, 0 },
1163 /* 0x58 */ { NULL, NULL, 0 },
1164 /* 0x59 */ { NULL, NULL, 0 },
1165 /* 0x5a */ { NULL, NULL, 0 },
1166 /* 0x5b */ { NULL, NULL, 0 },
1167 /* 0x5c */ { NULL, NULL, 0 },
1168 /* 0x5d */ { NULL, NULL, 0 },
1169 /* 0x5e */ { NULL, NULL, 0 },
1170 /* 0x5f */ { NULL, NULL, 0 },
1171 /* 0x60 */ { NULL, NULL, 0 },
1172 /* 0x61 */ { NULL, NULL, 0 },
1173 /* 0x62 */ { NULL, NULL, 0 },
1174 /* 0x63 */ { NULL, NULL, 0 },
1175 /* 0x64 */ { NULL, NULL, 0 },
1176 /* 0x65 */ { NULL, NULL, 0 },
1177 /* 0x66 */ { NULL, NULL, 0 },
1178 /* 0x67 */ { NULL, NULL, 0 },
1179 /* 0x68 */ { NULL, NULL, 0 },
1180 /* 0x69 */ { NULL, NULL, 0 },
1181 /* 0x6a */ { NULL, NULL, 0 },
1182 /* 0x6b */ { NULL, NULL, 0 },
1183 /* 0x6c */ { NULL, NULL, 0 },
1184 /* 0x6d */ { NULL, NULL, 0 },
1185 /* 0x6e */ { NULL, NULL, 0 },
1186 /* 0x6f */ { NULL, NULL, 0 },
1187 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1188 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1189 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1190 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1191 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1192 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1193 /* 0x76 */ { NULL, NULL, 0 },
1194 /* 0x77 */ { NULL, NULL, 0 },
1195 /* 0x78 */ { NULL, NULL, 0 },
1196 /* 0x79 */ { NULL, NULL, 0 },
1197 /* 0x7a */ { NULL, NULL, 0 },
1198 /* 0x7b */ { NULL, NULL, 0 },
1199 /* 0x7c */ { NULL, NULL, 0 },
1200 /* 0x7d */ { NULL, NULL, 0 },
1201 /* 0x7e */ { NULL, NULL, 0 },
1202 /* 0x7f */ { NULL, NULL, 0 },
1203 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1204 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1205 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1206 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1207 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1208 /* 0x85 */ { NULL, NULL, 0 },
1209 /* 0x86 */ { NULL, NULL, 0 },
1210 /* 0x87 */ { NULL, NULL, 0 },
1211 /* 0x88 */ { NULL, NULL, 0 },
1212 /* 0x89 */ { NULL, NULL, 0 },
1213 /* 0x8a */ { NULL, NULL, 0 },
1214 /* 0x8b */ { NULL, NULL, 0 },
1215 /* 0x8c */ { NULL, NULL, 0 },
1216 /* 0x8d */ { NULL, NULL, 0 },
1217 /* 0x8e */ { NULL, NULL, 0 },
1218 /* 0x8f */ { NULL, NULL, 0 },
1219 /* 0x90 */ { NULL, NULL, 0 },
1220 /* 0x91 */ { NULL, NULL, 0 },
1221 /* 0x92 */ { NULL, NULL, 0 },
1222 /* 0x93 */ { NULL, NULL, 0 },
1223 /* 0x94 */ { NULL, NULL, 0 },
1224 /* 0x95 */ { NULL, NULL, 0 },
1225 /* 0x96 */ { NULL, NULL, 0 },
1226 /* 0x97 */ { NULL, NULL, 0 },
1227 /* 0x98 */ { NULL, NULL, 0 },
1228 /* 0x99 */ { NULL, NULL, 0 },
1229 /* 0x9a */ { NULL, NULL, 0 },
1230 /* 0x9b */ { NULL, NULL, 0 },
1231 /* 0x9c */ { NULL, NULL, 0 },
1232 /* 0x9d */ { NULL, NULL, 0 },
1233 /* 0x9e */ { NULL, NULL, 0 },
1234 /* 0x9f */ { NULL, NULL, 0 },
1235 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1236 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1237 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1238 /* 0xa3 */ { NULL, NULL, 0 },
1239 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1240 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1241 /* 0xa6 */ { NULL, NULL, 0 },
1242 /* 0xa7 */ { NULL, NULL, 0 },
1243 /* 0xa8 */ { NULL, NULL, 0 },
1244 /* 0xa9 */ { NULL, NULL, 0 },
1245 /* 0xaa */ { NULL, NULL, 0 },
1246 /* 0xab */ { NULL, NULL, 0 },
1247 /* 0xac */ { NULL, NULL, 0 },
1248 /* 0xad */ { NULL, NULL, 0 },
1249 /* 0xae */ { NULL, NULL, 0 },
1250 /* 0xaf */ { NULL, NULL, 0 },
1251 /* 0xb0 */ { NULL, NULL, 0 },
1252 /* 0xb1 */ { NULL, NULL, 0 },
1253 /* 0xb2 */ { NULL, NULL, 0 },
1254 /* 0xb3 */ { NULL, NULL, 0 },
1255 /* 0xb4 */ { NULL, NULL, 0 },
1256 /* 0xb5 */ { NULL, NULL, 0 },
1257 /* 0xb6 */ { NULL, NULL, 0 },
1258 /* 0xb7 */ { NULL, NULL, 0 },
1259 /* 0xb8 */ { NULL, NULL, 0 },
1260 /* 0xb9 */ { NULL, NULL, 0 },
1261 /* 0xba */ { NULL, NULL, 0 },
1262 /* 0xbb */ { NULL, NULL, 0 },
1263 /* 0xbc */ { NULL, NULL, 0 },
1264 /* 0xbd */ { NULL, NULL, 0 },
1265 /* 0xbe */ { NULL, NULL, 0 },
1266 /* 0xbf */ { NULL, NULL, 0 },
1267 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1268 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1269 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1270 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1271 /* 0xc4 */ { NULL, NULL, 0 },
1272 /* 0xc5 */ { NULL, NULL, 0 },
1273 /* 0xc6 */ { NULL, NULL, 0 },
1274 /* 0xc7 */ { NULL, NULL, 0 },
1275 /* 0xc8 */ { NULL, NULL, 0 },
1276 /* 0xc9 */ { NULL, NULL, 0 },
1277 /* 0xca */ { NULL, NULL, 0 },
1278 /* 0xcb */ { NULL, NULL, 0 },
1279 /* 0xcc */ { NULL, NULL, 0 },
1280 /* 0xcd */ { NULL, NULL, 0 },
1281 /* 0xce */ { NULL, NULL, 0 },
1282 /* 0xcf */ { NULL, NULL, 0 },
1283 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1284 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1285 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1286 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1287 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1288 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1289 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1290 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1291 /* 0xd8 */ { NULL, NULL, 0 },
1292 /* 0xd9 */ { NULL, NULL, 0 },
1293 /* 0xda */ { NULL, NULL, 0 },
1294 /* 0xdb */ { NULL, NULL, 0 },
1295 /* 0xdc */ { NULL, NULL, 0 },
1296 /* 0xdd */ { NULL, NULL, 0 },
1297 /* 0xde */ { NULL, NULL, 0 },
1298 /* 0xdf */ { NULL, NULL, 0 },
1299 /* 0xe0 */ { NULL, NULL, 0 },
1300 /* 0xe1 */ { NULL, NULL, 0 },
1301 /* 0xe2 */ { NULL, NULL, 0 },
1302 /* 0xe3 */ { NULL, NULL, 0 },
1303 /* 0xe4 */ { NULL, NULL, 0 },
1304 /* 0xe5 */ { NULL, NULL, 0 },
1305 /* 0xe6 */ { NULL, NULL, 0 },
1306 /* 0xe7 */ { NULL, NULL, 0 },
1307 /* 0xe8 */ { NULL, NULL, 0 },
1308 /* 0xe9 */ { NULL, NULL, 0 },
1309 /* 0xea */ { NULL, NULL, 0 },
1310 /* 0xeb */ { NULL, NULL, 0 },
1311 /* 0xec */ { NULL, NULL, 0 },
1312 /* 0xed */ { NULL, NULL, 0 },
1313 /* 0xee */ { NULL, NULL, 0 },
1314 /* 0xef */ { NULL, NULL, 0 },
1315 /* 0xf0 */ { NULL, NULL, 0 },
1316 /* 0xf1 */ { NULL, NULL, 0 },
1317 /* 0xf2 */ { NULL, NULL, 0 },
1318 /* 0xf3 */ { NULL, NULL, 0 },
1319 /* 0xf4 */ { NULL, NULL, 0 },
1320 /* 0xf5 */ { NULL, NULL, 0 },
1321 /* 0xf6 */ { NULL, NULL, 0 },
1322 /* 0xf7 */ { NULL, NULL, 0 },
1323 /* 0xf8 */ { NULL, NULL, 0 },
1324 /* 0xf9 */ { NULL, NULL, 0 },
1325 /* 0xfa */ { NULL, NULL, 0 },
1326 /* 0xfb */ { NULL, NULL, 0 },
1327 /* 0xfc */ { NULL, NULL, 0 },
1328 /* 0xfd */ { NULL, NULL, 0 },
1329 /* 0xfe */ { NULL, NULL, 0 },
1330 /* 0xff */ { NULL, NULL, 0 }
1331
1332 };
1333
1334 /*******************************************************************
1335  allocate and initialize a reply packet
1336 ********************************************************************/
1337
1338 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1339                           const char *inbuf, char **outbuf, uint8_t num_words,
1340                           uint32_t num_bytes)
1341 {
1342         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1343
1344         /*
1345          * Protect against integer wrap.
1346          * The SMB layer reply can be up to 0xFFFFFF bytes.
1347          */
1348         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1349                 char *msg;
1350                 if (asprintf(&msg, "num_bytes too large: %u",
1351                              (unsigned)num_bytes) == -1) {
1352                         msg = discard_const_p(char, "num_bytes too large");
1353                 }
1354                 smb_panic(msg);
1355         }
1356
1357         /*
1358          * Here we include the NBT header for now.
1359          */
1360         *outbuf = talloc_array(mem_ctx, char,
1361                                NBT_HDR_SIZE + smb_len);
1362         if (*outbuf == NULL) {
1363                 return false;
1364         }
1365
1366         construct_reply_common(req, inbuf, *outbuf);
1367         srv_set_message(*outbuf, num_words, num_bytes, false);
1368         /*
1369          * Zero out the word area, the caller has to take care of the bcc area
1370          * himself
1371          */
1372         if (num_words != 0) {
1373                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1374         }
1375
1376         return true;
1377 }
1378
1379 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1380 {
1381         char *outbuf;
1382         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1383                            num_bytes)) {
1384                 smb_panic("could not allocate output buffer\n");
1385         }
1386         req->outbuf = (uint8_t *)outbuf;
1387 }
1388
1389
1390 /*******************************************************************
1391  Dump a packet to a file.
1392 ********************************************************************/
1393
1394 static void smb_dump(const char *name, int type, const char *data)
1395 {
1396         size_t len;
1397         int fd, i;
1398         char *fname = NULL;
1399         if (DEBUGLEVEL < 50) {
1400                 return;
1401         }
1402
1403         len = smb_len_tcp(data)+4;
1404         for (i=1;i<100;i++) {
1405                 fname = talloc_asprintf(talloc_tos(),
1406                                 "/tmp/%s.%d.%s",
1407                                 name,
1408                                 i,
1409                                 type ? "req" : "resp");
1410                 if (fname == NULL) {
1411                         return;
1412                 }
1413                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1414                 if (fd != -1 || errno != EEXIST) break;
1415                 TALLOC_FREE(fname);
1416         }
1417         if (fd != -1) {
1418                 ssize_t ret = write(fd, data, len);
1419                 if (ret != len)
1420                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1421                 close(fd);
1422                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1423         }
1424         TALLOC_FREE(fname);
1425 }
1426
1427 /****************************************************************************
1428  Prepare everything for calling the actual request function, and potentially
1429  call the request function via the "new" interface.
1430
1431  Return False if the "legacy" function needs to be called, everything is
1432  prepared.
1433
1434  Return True if we're done.
1435
1436  I know this API sucks, but it is the one with the least code change I could
1437  find.
1438 ****************************************************************************/
1439
1440 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1441 {
1442         int flags;
1443         uint64_t session_tag;
1444         connection_struct *conn = NULL;
1445         struct smbd_server_connection *sconn = req->sconn;
1446         NTTIME now = timeval_to_nttime(&req->request_time);
1447         struct smbXsrv_session *session = NULL;
1448         NTSTATUS status;
1449
1450         errno = 0;
1451
1452         if (smb_messages[type].fn == NULL) {
1453                 DEBUG(0,("Unknown message type %d!\n",type));
1454                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1455                 reply_unknown_new(req, type);
1456                 return NULL;
1457         }
1458
1459         flags = smb_messages[type].flags;
1460
1461         /* In share mode security we must ignore the vuid. */
1462         session_tag = req->vuid;
1463         conn = req->conn;
1464
1465         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1466                  (int)getpid(), (unsigned long)conn));
1467
1468         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1469
1470         /* Ensure this value is replaced in the incoming packet. */
1471         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1472
1473         /*
1474          * Ensure the correct username is in current_user_info.  This is a
1475          * really ugly bugfix for problems with multiple session_setup_and_X's
1476          * being done and allowing %U and %G substitutions to work correctly.
1477          * There is a reason this code is done here, don't move it unless you
1478          * know what you're doing... :-).
1479          * JRA.
1480          */
1481
1482         /*
1483          * lookup an existing session
1484          *
1485          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1486          * here, the main check is still in change_to_user()
1487          */
1488         status = smb1srv_session_lookup(sconn->conn,
1489                                         session_tag,
1490                                         now,
1491                                         &session);
1492         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1493                 switch (type) {
1494                 case SMBsesssetupX:
1495                         status = NT_STATUS_OK;
1496                         break;
1497                 default:
1498                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1499                                  (unsigned long long)session_tag,
1500                                  (unsigned long long)req->mid));
1501                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1502                         return conn;
1503                 }
1504         }
1505
1506         if (session_tag != sconn->conn->last_session_id) {
1507                 struct user_struct *vuser = NULL;
1508
1509                 sconn->conn->last_session_id = session_tag;
1510                 if (session) {
1511                         vuser = session->compat;
1512                 }
1513                 if (vuser) {
1514                         set_current_user_info(
1515                                 vuser->session_info->unix_info->sanitized_username,
1516                                 vuser->session_info->unix_info->unix_name,
1517                                 vuser->session_info->info->domain_name);
1518                 }
1519         }
1520
1521         /* Does this call need to be run as the connected user? */
1522         if (flags & AS_USER) {
1523
1524                 /* Does this call need a valid tree connection? */
1525                 if (!conn) {
1526                         /*
1527                          * Amazingly, the error code depends on the command
1528                          * (from Samba4).
1529                          */
1530                         if (type == SMBntcreateX) {
1531                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1532                         } else {
1533                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1534                         }
1535                         return NULL;
1536                 }
1537
1538                 if (!change_to_user(conn,session_tag)) {
1539                         DEBUG(0, ("Error: Could not change to user. Removing "
1540                                 "deferred open, mid=%llu.\n",
1541                                 (unsigned long long)req->mid));
1542                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1543                         return conn;
1544                 }
1545
1546                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1547
1548                 /* Does it need write permission? */
1549                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1550                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1551                         return conn;
1552                 }
1553
1554                 /* IPC services are limited */
1555                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1556                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1557                         return conn;
1558                 }
1559         } else {
1560                 /* This call needs to be run as root */
1561                 change_to_root_user();
1562         }
1563
1564         /* load service specific parameters */
1565         if (conn) {
1566                 if (req->encrypted) {
1567                         conn->encrypted_tid = true;
1568                         /* encrypted required from now on. */
1569                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1570                 } else if (ENCRYPTION_REQUIRED(conn)) {
1571                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1572                                 DEBUG(1,("service[%s] requires encryption"
1573                                         "%s ACCESS_DENIED. mid=%llu\n",
1574                                         lp_servicename(talloc_tos(), SNUM(conn)),
1575                                         smb_fn_name(type),
1576                                         (unsigned long long)req->mid));
1577                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1578                                 return conn;
1579                         }
1580                 }
1581
1582                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1583                                          (flags & (AS_USER|DO_CHDIR)
1584                                           ?True:False))) {
1585                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1586                         return conn;
1587                 }
1588                 conn->num_smb_operations++;
1589         }
1590
1591         /*
1592          * Does this protocol need to be run as guest? (Only archane
1593          * messenger service requests have this...)
1594          */
1595         if (flags & AS_GUEST) {
1596                 char *raddr;
1597                 bool ok;
1598
1599                 if (!change_to_guest()) {
1600                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1601                         return conn;
1602                 }
1603
1604                 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1605                                                          talloc_tos());
1606                 if (raddr == NULL) {
1607                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1608                         return conn;
1609                 }
1610
1611                 /*
1612                  * Haven't we checked this in smbd_process already???
1613                  */
1614
1615                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1616                                   sconn->remote_hostname, raddr);
1617                 TALLOC_FREE(raddr);
1618
1619                 if (!ok) {
1620                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1621                         return conn;
1622                 }
1623         }
1624
1625         smb_messages[type].fn(req);
1626         return req->conn;
1627 }
1628
1629 /****************************************************************************
1630  Construct a reply to the incoming packet.
1631 ****************************************************************************/
1632
1633 static void construct_reply(struct smbd_server_connection *sconn,
1634                             char *inbuf, int size, size_t unread_bytes,
1635                             uint32_t seqnum, bool encrypted,
1636                             struct smb_perfcount_data *deferred_pcd)
1637 {
1638         connection_struct *conn;
1639         struct smb_request *req;
1640
1641         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1642                 smb_panic("could not allocate smb_request");
1643         }
1644
1645         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1646                               encrypted, seqnum)) {
1647                 exit_server_cleanly("Invalid SMB request");
1648         }
1649
1650         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1651
1652         /* we popped this message off the queue - keep original perf data */
1653         if (deferred_pcd)
1654                 req->pcd = *deferred_pcd;
1655         else {
1656                 SMB_PERFCOUNT_START(&req->pcd);
1657                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1658                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1659         }
1660
1661         conn = switch_message(req->cmd, req);
1662
1663         if (req->outbuf == NULL) {
1664                 return;
1665         }
1666
1667         if (CVAL(req->outbuf,0) == 0) {
1668                 show_msg((char *)req->outbuf);
1669         }
1670
1671         if (!srv_send_smb(req->sconn,
1672                         (char *)req->outbuf,
1673                         true, req->seqnum+1,
1674                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1675                         &req->pcd)) {
1676                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1677         }
1678
1679         TALLOC_FREE(req);
1680
1681         return;
1682 }
1683
1684 static void construct_reply_chain(struct smbd_server_connection *sconn,
1685                                   char *inbuf, int size, uint32_t seqnum,
1686                                   bool encrypted,
1687                                   struct smb_perfcount_data *deferred_pcd)
1688 {
1689         struct smb_request **reqs = NULL;
1690         struct smb_request *req;
1691         unsigned num_reqs;
1692         bool ok;
1693
1694         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1695                               seqnum, &reqs, &num_reqs);
1696         if (!ok) {
1697                 char errbuf[smb_size];
1698                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1699                              __LINE__, __FILE__);
1700                 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1701                                   NULL)) {
1702                         exit_server_cleanly("construct_reply_chain: "
1703                                             "srv_send_smb failed.");
1704                 }
1705                 return;
1706         }
1707
1708         req = reqs[0];
1709         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1710
1711         req->conn = switch_message(req->cmd, req);
1712
1713         if (req->outbuf == NULL) {
1714                 /*
1715                  * Request has suspended itself, will come
1716                  * back here.
1717                  */
1718                 return;
1719         }
1720         smb_request_done(req);
1721 }
1722
1723 /*
1724  * To be called from an async SMB handler that is potentially chained
1725  * when it is finished for shipping.
1726  */
1727
1728 void smb_request_done(struct smb_request *req)
1729 {
1730         struct smb_request **reqs = NULL;
1731         struct smb_request *first_req;
1732         size_t i, num_reqs, next_index;
1733         NTSTATUS status;
1734
1735         if (req->chain == NULL) {
1736                 first_req = req;
1737                 goto shipit;
1738         }
1739
1740         reqs = req->chain;
1741         num_reqs = talloc_array_length(reqs);
1742
1743         for (i=0; i<num_reqs; i++) {
1744                 if (reqs[i] == req) {
1745                         break;
1746                 }
1747         }
1748         if (i == num_reqs) {
1749                 /*
1750                  * Invalid chain, should not happen
1751                  */
1752                 status = NT_STATUS_INTERNAL_ERROR;
1753                 goto error;
1754         }
1755         next_index = i+1;
1756
1757         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1758                 struct smb_request *next = reqs[next_index];
1759                 struct smbXsrv_tcon *tcon;
1760                 NTTIME now = timeval_to_nttime(&req->request_time);
1761
1762                 next->vuid = SVAL(req->outbuf, smb_uid);
1763                 next->tid  = SVAL(req->outbuf, smb_tid);
1764                 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1765                                              now, &tcon);
1766                 if (NT_STATUS_IS_OK(status)) {
1767                         req->conn = tcon->compat;
1768                 } else {
1769                         req->conn = NULL;
1770                 }
1771                 next->chain_fsp = req->chain_fsp;
1772                 next->inbuf = req->inbuf;
1773
1774                 req = next;
1775                 req->conn = switch_message(req->cmd, req);
1776
1777                 if (req->outbuf == NULL) {
1778                         /*
1779                          * Request has suspended itself, will come
1780                          * back here.
1781                          */
1782                         return;
1783                 }
1784                 next_index += 1;
1785         }
1786
1787         first_req = reqs[0];
1788
1789         for (i=1; i<next_index; i++) {
1790                 bool ok;
1791
1792                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1793                 if (!ok) {
1794                         status = NT_STATUS_INTERNAL_ERROR;
1795                         goto error;
1796                 }
1797         }
1798
1799         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1800         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1801
1802         /*
1803          * This scary statement intends to set the
1804          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1805          * to the value last_req->outbuf carries
1806          */
1807         SSVAL(first_req->outbuf, smb_flg2,
1808               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1809               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1810
1811         /*
1812          * Transfer the error codes from the subrequest to the main one
1813          */
1814         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1815         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1816
1817         _smb_setlen_large(
1818                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1819
1820 shipit:
1821         if (!srv_send_smb(first_req->sconn,
1822                           (char *)first_req->outbuf,
1823                           true, first_req->seqnum+1,
1824                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1825                           &first_req->pcd)) {
1826                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1827                                     "failed.");
1828         }
1829         TALLOC_FREE(req);       /* non-chained case */
1830         TALLOC_FREE(reqs);      /* chained case */
1831         return;
1832
1833 error:
1834         {
1835                 char errbuf[smb_size];
1836                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1837                 if (!srv_send_smb(req->sconn, errbuf, true,
1838                                   req->seqnum+1, req->encrypted,
1839                                   NULL)) {
1840                         exit_server_cleanly("construct_reply_chain: "
1841                                             "srv_send_smb failed.");
1842                 }
1843         }
1844         TALLOC_FREE(req);       /* non-chained case */
1845         TALLOC_FREE(reqs);      /* chained case */
1846 }
1847
1848 /****************************************************************************
1849  Process an smb from the client
1850 ****************************************************************************/
1851 static void process_smb(struct smbd_server_connection *sconn,
1852                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1853                         uint32_t seqnum, bool encrypted,
1854                         struct smb_perfcount_data *deferred_pcd)
1855 {
1856         int msg_type = CVAL(inbuf,0);
1857
1858         DO_PROFILE_INC(smb_count);
1859
1860         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1861                     smb_len(inbuf) ) );
1862         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1863                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1864
1865         if (msg_type != NBSSmessage) {
1866                 /*
1867                  * NetBIOS session request, keepalive, etc.
1868                  */
1869                 reply_special(sconn, (char *)inbuf, nread);
1870                 goto done;
1871         }
1872
1873         if (sconn->using_smb2) {
1874                 /* At this point we're not really using smb2,
1875                  * we make the decision here.. */
1876                 if (smbd_is_smb2_header(inbuf, nread)) {
1877                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1878                         return;
1879                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1880                                 && CVAL(inbuf, smb_com) != 0x72) {
1881                         /* This is a non-negprot SMB1 packet.
1882                            Disable SMB2 from now on. */
1883                         sconn->using_smb2 = false;
1884                 }
1885         }
1886
1887         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1888          * so subtract 4 from it. */
1889         if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1890                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1891                          smb_len(inbuf)));
1892
1893                 /* special magic for immediate exit */
1894                 if ((nread == 9) &&
1895                     (IVAL(inbuf, 4) == 0x74697865) &&
1896                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1897                         uint8_t exitcode = CVAL(inbuf, 8);
1898                         DEBUG(1, ("Exiting immediately with code %d\n",
1899                                   (int)exitcode));
1900                         exit(exitcode);
1901                 }
1902
1903                 exit_server_cleanly("Non-SMB packet");
1904         }
1905
1906         show_msg((char *)inbuf);
1907
1908         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1909                 construct_reply_chain(sconn, (char *)inbuf, nread,
1910                                       seqnum, encrypted, deferred_pcd);
1911         } else {
1912                 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1913                                 seqnum, encrypted, deferred_pcd);
1914         }
1915
1916         sconn->trans_num++;
1917
1918 done:
1919         sconn->num_requests++;
1920
1921         /* The timeout_processing function isn't run nearly
1922            often enough to implement 'max log size' without
1923            overrunning the size of the file by many megabytes.
1924            This is especially true if we are running at debug
1925            level 10.  Checking every 50 SMBs is a nice
1926            tradeoff of performance vs log file size overrun. */
1927
1928         if ((sconn->num_requests % 50) == 0 &&
1929             need_to_check_log_size()) {
1930                 change_to_root_user();
1931                 check_log_size();
1932         }
1933 }
1934
1935 /****************************************************************************
1936  Return a string containing the function name of a SMB command.
1937 ****************************************************************************/
1938
1939 const char *smb_fn_name(int type)
1940 {
1941         const char *unknown_name = "SMBunknown";
1942
1943         if (smb_messages[type].name == NULL)
1944                 return(unknown_name);
1945
1946         return(smb_messages[type].name);
1947 }
1948
1949 /****************************************************************************
1950  Helper functions for contruct_reply.
1951 ****************************************************************************/
1952
1953 void add_to_common_flags2(uint32 v)
1954 {
1955         common_flags2 |= v;
1956 }
1957
1958 void remove_from_common_flags2(uint32 v)
1959 {
1960         common_flags2 &= ~v;
1961 }
1962
1963 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1964                                    char *outbuf)
1965 {
1966         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1967         uint16_t out_flags2 = common_flags2;
1968
1969         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1970         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1971         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1972
1973         srv_set_message(outbuf,0,0,false);
1974
1975         SCVAL(outbuf, smb_com, req->cmd);
1976         SIVAL(outbuf,smb_rcls,0);
1977         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1978         SSVAL(outbuf,smb_flg2, out_flags2);
1979         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1980         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1981
1982         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1983         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1984         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1985         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1986 }
1987
1988 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1989 {
1990         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1991 }
1992
1993 /**
1994  * @brief Find the smb_cmd offset of the last command pushed
1995  * @param[in] buf       The buffer we're building up
1996  * @retval              Where can we put our next andx cmd?
1997  *
1998  * While chaining requests, the "next" request we're looking at needs to put
1999  * its SMB_Command before the data the previous request already built up added
2000  * to the chain. Find the offset to the place where we have to put our cmd.
2001  */
2002
2003 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2004 {
2005         uint8_t cmd;
2006         size_t ofs;
2007
2008         cmd = CVAL(buf, smb_com);
2009
2010         if (!is_andx_req(cmd)) {
2011                 return false;
2012         }
2013
2014         ofs = smb_vwv0;
2015
2016         while (CVAL(buf, ofs) != 0xff) {
2017
2018                 if (!is_andx_req(CVAL(buf, ofs))) {
2019                         return false;
2020                 }
2021
2022                 /*
2023                  * ofs is from start of smb header, so add the 4 length
2024                  * bytes. The next cmd is right after the wct field.
2025                  */
2026                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2027
2028                 if (ofs+4 >= talloc_get_size(buf)) {
2029                         return false;
2030                 }
2031         }
2032
2033         *pofs = ofs;
2034         return true;
2035 }
2036
2037 /**
2038  * @brief Do the smb chaining at a buffer level
2039  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2040  * @param[in] andx_buf          Buffer to be appended
2041  */
2042
2043 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2044 {
2045         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2046         uint8_t wct             = CVAL(andx_buf, smb_wct);
2047         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2048         uint32_t num_bytes      = smb_buflen(andx_buf);
2049         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2050
2051         uint8_t *outbuf;
2052         size_t old_size, new_size;
2053         size_t ofs;
2054         size_t chain_padding = 0;
2055         size_t andx_cmd_ofs;
2056
2057
2058         old_size = talloc_get_size(*poutbuf);
2059
2060         if ((old_size % 4) != 0) {
2061                 /*
2062                  * Align the wct field of subsequent requests to a 4-byte
2063                  * boundary
2064                  */
2065                 chain_padding = 4 - (old_size % 4);
2066         }
2067
2068         /*
2069          * After the old request comes the new wct field (1 byte), the vwv's
2070          * and the num_bytes field.
2071          */
2072
2073         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2074         new_size += num_bytes;
2075
2076         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2077                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2078                           (unsigned)new_size));
2079                 return false;
2080         }
2081
2082         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2083         if (outbuf == NULL) {
2084                 DEBUG(0, ("talloc failed\n"));
2085                 return false;
2086         }
2087         *poutbuf = outbuf;
2088
2089         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2090                 DEBUG(1, ("invalid command chain\n"));
2091                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2092                 return false;
2093         }
2094
2095         if (chain_padding != 0) {
2096                 memset(outbuf + old_size, 0, chain_padding);
2097                 old_size += chain_padding;
2098         }
2099
2100         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2101         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2102
2103         ofs = old_size;
2104
2105         /*
2106          * Push the chained request:
2107          *
2108          * wct field
2109          */
2110
2111         SCVAL(outbuf, ofs, wct);
2112         ofs += 1;
2113
2114         /*
2115          * vwv array
2116          */
2117
2118         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2119
2120         /*
2121          * HACK ALERT
2122          *
2123          * Read&X has an offset into its data buffer at
2124          * vwv[6]. reply_read_andx has no idea anymore that it's
2125          * running from within a chain, so we have to fix up the
2126          * offset here.
2127          *
2128          * Although it looks disgusting at this place, I want to keep
2129          * it here. The alternative would be to push knowledge about
2130          * the andx chain down into read&x again.
2131          */
2132
2133         if (smb_command == SMBreadX) {
2134                 uint8_t *bytes_addr;
2135
2136                 if (wct < 7) {
2137                         /*
2138                          * Invalid read&x response
2139                          */
2140                         return false;
2141                 }
2142
2143                 bytes_addr = outbuf + ofs        /* vwv start */
2144                         + sizeof(uint16_t) * wct /* vwv array */
2145                         + sizeof(uint16_t);      /* bcc */
2146
2147                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2148                       bytes_addr - outbuf - 4);
2149         }
2150
2151         ofs += sizeof(uint16_t) * wct;
2152
2153         /*
2154          * bcc (byte count)
2155          */
2156
2157         SSVAL(outbuf, ofs, num_bytes);
2158         ofs += sizeof(uint16_t);
2159
2160         /*
2161          * The bytes field
2162          */
2163
2164         memcpy(outbuf + ofs, bytes, num_bytes);
2165
2166         return true;
2167 }
2168
2169 bool smb1_is_chain(const uint8_t *buf)
2170 {
2171         uint8_t cmd, wct, andx_cmd;
2172
2173         cmd = CVAL(buf, smb_com);
2174         if (!is_andx_req(cmd)) {
2175                 return false;
2176         }
2177         wct = CVAL(buf, smb_wct);
2178         if (wct < 2) {
2179                 return false;
2180         }
2181         andx_cmd = CVAL(buf, smb_vwv);
2182         return (andx_cmd != 0xFF);
2183 }
2184
2185 bool smb1_walk_chain(const uint8_t *buf,
2186                      bool (*fn)(uint8_t cmd,
2187                                 uint8_t wct, const uint16_t *vwv,
2188                                 uint16_t num_bytes, const uint8_t *bytes,
2189                                 void *private_data),
2190                      void *private_data)
2191 {
2192         size_t smblen = smb_len(buf);
2193         const char *smb_buf = smb_base(buf);
2194         uint8_t cmd, chain_cmd;
2195         uint8_t wct;
2196         const uint16_t *vwv;
2197         uint16_t num_bytes;
2198         const uint8_t *bytes;
2199
2200         cmd = CVAL(buf, smb_com);
2201         wct = CVAL(buf, smb_wct);
2202         vwv = (const uint16_t *)(buf + smb_vwv);
2203         num_bytes = smb_buflen(buf);
2204         bytes = (const uint8_t *)smb_buf_const(buf);
2205
2206         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2207                 return false;
2208         }
2209
2210         if (!is_andx_req(cmd)) {
2211                 return true;
2212         }
2213         if (wct < 2) {
2214                 return false;
2215         }
2216
2217         chain_cmd = CVAL(vwv, 0);
2218
2219         while (chain_cmd != 0xff) {
2220                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2221                 size_t length_needed;
2222                 ptrdiff_t vwv_offset;
2223
2224                 chain_offset = SVAL(vwv+1, 0);
2225
2226                 /*
2227                  * Check if the client tries to fool us. The chain
2228                  * offset needs to point beyond the current request in
2229                  * the chain, it needs to strictly grow. Otherwise we
2230                  * might be tricked into an endless loop always
2231                  * processing the same request over and over again. We
2232                  * used to assume that vwv and the byte buffer array
2233                  * in a chain are always attached, but OS/2 the
2234                  * Write&X/Read&X chain puts the Read&X vwv array
2235                  * right behind the Write&X vwv chain. The Write&X bcc
2236                  * array is put behind the Read&X vwv array. So now we
2237                  * check whether the chain offset points strictly
2238                  * behind the previous vwv array. req->buf points
2239                  * right after the vwv array of the previous
2240                  * request. See
2241                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2242                  * more information.
2243                  */
2244
2245                 vwv_offset = ((const char *)vwv - smb_buf);
2246                 if (chain_offset <= vwv_offset) {
2247                         return false;
2248                 }
2249
2250                 /*
2251                  * Next check: Make sure the chain offset does not
2252                  * point beyond the overall smb request length.
2253                  */
2254
2255                 length_needed = chain_offset+1; /* wct */
2256                 if (length_needed > smblen) {
2257                         return false;
2258                 }
2259
2260                 /*
2261                  * Now comes the pointer magic. Goal here is to set up
2262                  * vwv and buf correctly again. The chain offset (the
2263                  * former vwv[1]) points at the new wct field.
2264                  */
2265
2266                 wct = CVAL(smb_buf, chain_offset);
2267
2268                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2269                         return false;
2270                 }
2271
2272                 /*
2273                  * Next consistency check: Make the new vwv array fits
2274                  * in the overall smb request.
2275                  */
2276
2277                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2278                 if (length_needed > smblen) {
2279                         return false;
2280                 }
2281                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2282
2283                 /*
2284                  * Now grab the new byte buffer....
2285                  */
2286
2287                 num_bytes = SVAL(vwv+wct, 0);
2288
2289                 /*
2290                  * .. and check that it fits.
2291                  */
2292
2293                 length_needed += num_bytes;
2294                 if (length_needed > smblen) {
2295                         return false;
2296                 }
2297                 bytes = (const uint8_t *)(vwv+wct+1);
2298
2299                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2300                         return false;
2301                 }
2302
2303                 if (!is_andx_req(chain_cmd)) {
2304                         return true;
2305                 }
2306                 chain_cmd = CVAL(vwv, 0);
2307         }
2308         return true;
2309 }
2310
2311 static bool smb1_chain_length_cb(uint8_t cmd,
2312                                  uint8_t wct, const uint16_t *vwv,
2313                                  uint16_t num_bytes, const uint8_t *bytes,
2314                                  void *private_data)
2315 {
2316         unsigned *count = (unsigned *)private_data;
2317         *count += 1;
2318         return true;
2319 }
2320
2321 unsigned smb1_chain_length(const uint8_t *buf)
2322 {
2323         unsigned count = 0;
2324
2325         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2326                 return 0;
2327         }
2328         return count;
2329 }
2330
2331 struct smb1_parse_chain_state {
2332         TALLOC_CTX *mem_ctx;
2333         const uint8_t *buf;
2334         struct smbd_server_connection *sconn;
2335         bool encrypted;
2336         uint32_t seqnum;
2337
2338         struct smb_request **reqs;
2339         unsigned num_reqs;
2340 };
2341
2342 static bool smb1_parse_chain_cb(uint8_t cmd,
2343                                 uint8_t wct, const uint16_t *vwv,
2344                                 uint16_t num_bytes, const uint8_t *bytes,
2345                                 void *private_data)
2346 {
2347         struct smb1_parse_chain_state *state =
2348                 (struct smb1_parse_chain_state *)private_data;
2349         struct smb_request **reqs;
2350         struct smb_request *req;
2351         bool ok;
2352
2353         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2354                               struct smb_request *, state->num_reqs+1);
2355         if (reqs == NULL) {
2356                 return false;
2357         }
2358         state->reqs = reqs;
2359
2360         req = talloc(reqs, struct smb_request);
2361         if (req == NULL) {
2362                 return false;
2363         }
2364
2365         ok = init_smb_request(req, state->sconn, state->buf, 0,
2366                               state->encrypted, state->seqnum);
2367         if (!ok) {
2368                 return false;
2369         }
2370         req->cmd = cmd;
2371         req->wct = wct;
2372         req->vwv = vwv;
2373         req->buflen = num_bytes;
2374         req->buf = bytes;
2375
2376         reqs[state->num_reqs] = req;
2377         state->num_reqs += 1;
2378         return true;
2379 }
2380
2381 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2382                       struct smbd_server_connection *sconn,
2383                       bool encrypted, uint32_t seqnum,
2384                       struct smb_request ***reqs, unsigned *num_reqs)
2385 {
2386         struct smb1_parse_chain_state state;
2387         unsigned i;
2388
2389         state.mem_ctx = mem_ctx;
2390         state.buf = buf;
2391         state.sconn = sconn;
2392         state.encrypted = encrypted;
2393         state.seqnum = seqnum;
2394         state.reqs = NULL;
2395         state.num_reqs = 0;
2396
2397         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2398                 TALLOC_FREE(state.reqs);
2399                 return false;
2400         }
2401         for (i=0; i<state.num_reqs; i++) {
2402                 state.reqs[i]->chain = state.reqs;
2403         }
2404         *reqs = state.reqs;
2405         *num_reqs = state.num_reqs;
2406         return true;
2407 }
2408
2409 /****************************************************************************
2410  Check if services need reloading.
2411 ****************************************************************************/
2412
2413 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2414 {
2415
2416         if (last_smb_conf_reload_time == 0) {
2417                 last_smb_conf_reload_time = t;
2418         }
2419
2420         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2421                 reload_services(sconn, conn_snum_used, true);
2422                 last_smb_conf_reload_time = t;
2423         }
2424 }
2425
2426 static bool fd_is_readable(int fd)
2427 {
2428         int ret, revents;
2429
2430         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2431
2432         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2433
2434 }
2435
2436 static void smbd_server_connection_write_handler(
2437         struct smbd_server_connection *sconn)
2438 {
2439         /* TODO: make write nonblocking */
2440 }
2441
2442 static void smbd_server_connection_read_handler(
2443         struct smbd_server_connection *sconn, int fd)
2444 {
2445         struct smbXsrv_connection *xconn = sconn->conn;
2446         uint8_t *inbuf = NULL;
2447         size_t inbuf_len = 0;
2448         size_t unread_bytes = 0;
2449         bool encrypted = false;
2450         TALLOC_CTX *mem_ctx = talloc_tos();
2451         NTSTATUS status;
2452         uint32_t seqnum;
2453
2454         bool async_echo = lp_async_smb_echo_handler();
2455         bool from_client = false;
2456
2457         if (async_echo) {
2458                 if (fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2459                         /*
2460                          * This is the super-ugly hack to prefer the packets
2461                          * forwarded by the echo handler over the ones by the
2462                          * client directly
2463                          */
2464                         fd = sconn->smb1.echo_handler.trusted_fd;
2465                 }
2466         }
2467
2468         from_client = (xconn->transport.sock == fd);
2469
2470         if (async_echo && from_client) {
2471                 smbd_lock_socket(sconn);
2472
2473                 if (!fd_is_readable(fd)) {
2474                         DEBUG(10,("the echo listener was faster\n"));
2475                         smbd_unlock_socket(sconn);
2476                         return;
2477                 }
2478         }
2479
2480         /* TODO: make this completely nonblocking */
2481         status = receive_smb_talloc(mem_ctx, sconn, fd,
2482                                     (char **)(void *)&inbuf,
2483                                     0, /* timeout */
2484                                     &unread_bytes,
2485                                     &encrypted,
2486                                     &inbuf_len, &seqnum,
2487                                     !from_client /* trusted channel */);
2488
2489         if (async_echo && from_client) {
2490                 smbd_unlock_socket(sconn);
2491         }
2492
2493         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2494                 goto process;
2495         }
2496         if (NT_STATUS_IS_ERR(status)) {
2497                 exit_server_cleanly("failed to receive smb request");
2498         }
2499         if (!NT_STATUS_IS_OK(status)) {
2500                 return;
2501         }
2502
2503 process:
2504         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2505                     seqnum, encrypted, NULL);
2506 }
2507
2508 static void smbd_server_connection_handler(struct tevent_context *ev,
2509                                            struct tevent_fd *fde,
2510                                            uint16_t flags,
2511                                            void *private_data)
2512 {
2513         struct smbd_server_connection *conn = talloc_get_type(private_data,
2514                                               struct smbd_server_connection);
2515         struct smbXsrv_connection *xconn = conn->conn;
2516
2517         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2518                 /*
2519                  * we're not supposed to do any io
2520                  */
2521                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2522                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2523                 return;
2524         }
2525
2526         if (flags & TEVENT_FD_WRITE) {
2527                 smbd_server_connection_write_handler(conn);
2528                 return;
2529         }
2530         if (flags & TEVENT_FD_READ) {
2531                 smbd_server_connection_read_handler(conn, xconn->transport.sock);
2532                 return;
2533         }
2534 }
2535
2536 static void smbd_server_echo_handler(struct tevent_context *ev,
2537                                      struct tevent_fd *fde,
2538                                      uint16_t flags,
2539                                      void *private_data)
2540 {
2541         struct smbd_server_connection *conn = talloc_get_type(private_data,
2542                                               struct smbd_server_connection);
2543         struct smbXsrv_connection *xconn = conn->conn;
2544
2545         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2546                 /*
2547                  * we're not supposed to do any io
2548                  */
2549                 TEVENT_FD_NOT_READABLE(conn->smb1.echo_handler.trusted_fde);
2550                 TEVENT_FD_NOT_WRITEABLE(conn->smb1.echo_handler.trusted_fde);
2551                 return;
2552         }
2553
2554         if (flags & TEVENT_FD_WRITE) {
2555                 smbd_server_connection_write_handler(conn);
2556                 return;
2557         }
2558         if (flags & TEVENT_FD_READ) {
2559                 smbd_server_connection_read_handler(
2560                         conn, conn->smb1.echo_handler.trusted_fd);
2561                 return;
2562         }
2563 }
2564
2565 struct smbd_release_ip_state {
2566         struct smbd_server_connection *sconn;
2567         struct tevent_immediate *im;
2568         char addr[INET6_ADDRSTRLEN];
2569 };
2570
2571 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2572                                       struct tevent_immediate *im,
2573                                       void *private_data)
2574 {
2575         struct smbd_release_ip_state *state =
2576                 talloc_get_type_abort(private_data,
2577                 struct smbd_release_ip_state);
2578         struct smbXsrv_connection *xconn = state->sconn->conn;
2579
2580         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2581                 /*
2582                  * smbd_server_connection_terminate() already triggered ?
2583                  */
2584                 return;
2585         }
2586
2587         smbd_server_connection_terminate(state->sconn, "CTDB_SRVID_RELEASE_IP");
2588 }
2589
2590 /****************************************************************************
2591 received when we should release a specific IP
2592 ****************************************************************************/
2593 static bool release_ip(const char *ip, void *priv)
2594 {
2595         struct smbd_release_ip_state *state =
2596                 talloc_get_type_abort(priv,
2597                 struct smbd_release_ip_state);
2598         struct smbXsrv_connection *xconn = state->sconn->conn;
2599         const char *addr = state->addr;
2600         const char *p = addr;
2601
2602         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2603                 /* avoid recursion */
2604                 return false;
2605         }
2606
2607         if (strncmp("::ffff:", addr, 7) == 0) {
2608                 p = addr + 7;
2609         }
2610
2611         DEBUG(10, ("Got release IP message for %s, "
2612                    "our address is %s\n", ip, p));
2613
2614         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2615                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2616                         ip));
2617                 /*
2618                  * With SMB2 we should do a clean disconnect,
2619                  * the previous_session_id in the session setup
2620                  * will cleanup the old session, tcons and opens.
2621                  *
2622                  * A clean disconnect is needed in order to support
2623                  * durable handles.
2624                  *
2625                  * Note: typically this is never triggered
2626                  *       as we got a TCP RST (triggered by ctdb event scripts)
2627                  *       before we get CTDB_SRVID_RELEASE_IP.
2628                  *
2629                  * We used to call _exit(1) here, but as this was mostly never
2630                  * triggered and has implication on our process model,
2631                  * we can just use smbd_server_connection_terminate()
2632                  * (also for SMB1).
2633                  *
2634                  * We don't call smbd_server_connection_terminate() directly
2635                  * as we might be called from within ctdbd_migrate(),
2636                  * we need to defer our action to the next event loop
2637                  */
2638                 tevent_schedule_immediate(state->im, state->sconn->ev_ctx,
2639                                           smbd_release_ip_immediate, state);
2640
2641                 /*
2642                  * Make sure we don't get any io on the connection.
2643                  */
2644                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2645                 return true;
2646         }
2647
2648         return false;
2649 }
2650
2651 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2652                                   struct sockaddr_storage *srv,
2653                                   struct sockaddr_storage *clnt)
2654 {
2655         struct smbd_release_ip_state *state;
2656         struct ctdbd_connection *cconn;
2657
2658         cconn = messaging_ctdbd_connection();
2659         if (cconn == NULL) {
2660                 return NT_STATUS_NO_MEMORY;
2661         }
2662
2663         state = talloc_zero(sconn, struct smbd_release_ip_state);
2664         if (state == NULL) {
2665                 return NT_STATUS_NO_MEMORY;
2666         }
2667         state->sconn = sconn;
2668         state->im = tevent_create_immediate(state);
2669         if (state->im == NULL) {
2670                 return NT_STATUS_NO_MEMORY;
2671         }
2672         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2673                 return NT_STATUS_NO_MEMORY;
2674         }
2675
2676         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2677 }
2678
2679 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2680                                   void *private_data, uint32_t msg_type,
2681                                   struct server_id server_id, DATA_BLOB *data)
2682 {
2683         struct smbd_server_connection *sconn = talloc_get_type_abort(
2684                 private_data, struct smbd_server_connection);
2685         const char *ip = (char *) data->data;
2686         char *client_ip;
2687
2688         DEBUG(10, ("Got kill request for client IP %s\n", ip));
2689
2690         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2691                                                      talloc_tos());
2692         if (client_ip == NULL) {
2693                 return;
2694         }
2695
2696         if (strequal(ip, client_ip)) {
2697                 DEBUG(1, ("Got kill client message for %s - "
2698                           "exiting immediately\n", ip));
2699                 exit_server_cleanly("Forced disconnect for client");
2700         }
2701
2702         TALLOC_FREE(client_ip);
2703 }
2704
2705 /*
2706  * Send keepalive packets to our client
2707  */
2708 static bool keepalive_fn(const struct timeval *now, void *private_data)
2709 {
2710         struct smbd_server_connection *sconn = talloc_get_type_abort(
2711                 private_data, struct smbd_server_connection);
2712         struct smbXsrv_connection *xconn = sconn->conn;
2713         bool ret;
2714
2715         if (sconn->using_smb2) {
2716                 /* Don't do keepalives on an SMB2 connection. */
2717                 return false;
2718         }
2719
2720         smbd_lock_socket(sconn);
2721         ret = send_keepalive(xconn->transport.sock);
2722         smbd_unlock_socket(sconn);
2723
2724         if (!ret) {
2725                 int saved_errno = errno;
2726                 /*
2727                  * Try and give an error message saying what
2728                  * client failed.
2729                  */
2730                 DEBUG(0, ("send_keepalive failed for client %s. "
2731                           "Error %s - exiting\n",
2732                           smbXsrv_connection_dbg(xconn),
2733                           strerror(saved_errno)));
2734                 errno = saved_errno;
2735                 return False;
2736         }
2737         return True;
2738 }
2739
2740 /*
2741  * Do the recurring check if we're idle
2742  */
2743 static bool deadtime_fn(const struct timeval *now, void *private_data)
2744 {
2745         struct smbd_server_connection *sconn =
2746                 (struct smbd_server_connection *)private_data;
2747
2748         if ((conn_num_open(sconn) == 0)
2749             || (conn_idle_all(sconn, now->tv_sec))) {
2750                 DEBUG( 2, ( "Closing idle connection\n" ) );
2751                 messaging_send(sconn->msg_ctx,
2752                                messaging_server_id(sconn->msg_ctx),
2753                                MSG_SHUTDOWN, &data_blob_null);
2754                 return False;
2755         }
2756
2757         return True;
2758 }
2759
2760 /*
2761  * Do the recurring log file and smb.conf reload checks.
2762  */
2763
2764 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2765 {
2766         struct smbd_server_connection *sconn = talloc_get_type_abort(
2767                 private_data, struct smbd_server_connection);
2768
2769         DEBUG(5, ("housekeeping\n"));
2770
2771         change_to_root_user();
2772
2773         /* update printer queue caches if necessary */
2774         update_monitored_printq_cache(sconn->msg_ctx);
2775
2776         /* check if we need to reload services */
2777         check_reload(sconn, time_mono(NULL));
2778
2779         /*
2780          * Force a log file check.
2781          */
2782         force_check_log_size();
2783         check_log_size();
2784         return true;
2785 }
2786
2787 /*
2788  * Read an smb packet in the echo handler child, giving the parent
2789  * smbd one second to react once the socket becomes readable.
2790  */
2791
2792 struct smbd_echo_read_state {
2793         struct tevent_context *ev;
2794         struct smbd_server_connection *sconn;
2795
2796         char *buf;
2797         size_t buflen;
2798         uint32_t seqnum;
2799 };
2800
2801 static void smbd_echo_read_readable(struct tevent_req *subreq);
2802 static void smbd_echo_read_waited(struct tevent_req *subreq);
2803
2804 static struct tevent_req *smbd_echo_read_send(
2805         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2806         struct smbd_server_connection *sconn)
2807 {
2808         struct tevent_req *req, *subreq;
2809         struct smbd_echo_read_state *state;
2810         struct smbXsrv_connection *xconn = sconn->conn;
2811
2812         req = tevent_req_create(mem_ctx, &state,
2813                                 struct smbd_echo_read_state);
2814         if (req == NULL) {
2815                 return NULL;
2816         }
2817         state->ev = ev;
2818         state->sconn = sconn;
2819
2820         subreq = wait_for_read_send(state, ev, xconn->transport.sock);
2821         if (tevent_req_nomem(subreq, req)) {
2822                 return tevent_req_post(req, ev);
2823         }
2824         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2825         return req;
2826 }
2827
2828 static void smbd_echo_read_readable(struct tevent_req *subreq)
2829 {
2830         struct tevent_req *req = tevent_req_callback_data(
2831                 subreq, struct tevent_req);
2832         struct smbd_echo_read_state *state = tevent_req_data(
2833                 req, struct smbd_echo_read_state);
2834         bool ok;
2835         int err;
2836
2837         ok = wait_for_read_recv(subreq, &err);
2838         TALLOC_FREE(subreq);
2839         if (!ok) {
2840                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2841                 return;
2842         }
2843
2844         /*
2845          * Give the parent smbd one second to step in
2846          */
2847
2848         subreq = tevent_wakeup_send(
2849                 state, state->ev, timeval_current_ofs(1, 0));
2850         if (tevent_req_nomem(subreq, req)) {
2851                 return;
2852         }
2853         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2854 }
2855
2856 static void smbd_echo_read_waited(struct tevent_req *subreq)
2857 {
2858         struct tevent_req *req = tevent_req_callback_data(
2859                 subreq, struct tevent_req);
2860         struct smbd_echo_read_state *state = tevent_req_data(
2861                 req, struct smbd_echo_read_state);
2862         struct smbd_server_connection *sconn = state->sconn;
2863         struct smbXsrv_connection *xconn = sconn->conn;
2864         bool ok;
2865         NTSTATUS status;
2866         size_t unread = 0;
2867         bool encrypted;
2868
2869         ok = tevent_wakeup_recv(subreq);
2870         TALLOC_FREE(subreq);
2871         if (!ok) {
2872                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2873                 return;
2874         }
2875
2876         ok = smbd_lock_socket_internal(sconn);
2877         if (!ok) {
2878                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2879                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2880                 return;
2881         }
2882
2883         if (!fd_is_readable(xconn->transport.sock)) {
2884                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2885                           (int)getpid()));
2886
2887                 ok = smbd_unlock_socket_internal(sconn);
2888                 if (!ok) {
2889                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2890                         DEBUG(1, ("%s: failed to unlock socket\n",
2891                                 __location__));
2892                         return;
2893                 }
2894
2895                 subreq = wait_for_read_send(state, state->ev,
2896                                             xconn->transport.sock);
2897                 if (tevent_req_nomem(subreq, req)) {
2898                         return;
2899                 }
2900                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2901                 return;
2902         }
2903
2904         status = receive_smb_talloc(state, sconn,
2905                                     xconn->transport.sock,
2906                                     &state->buf,
2907                                     0 /* timeout */,
2908                                     &unread,
2909                                     &encrypted,
2910                                     &state->buflen,
2911                                     &state->seqnum,
2912                                     false /* trusted_channel*/);
2913
2914         if (tevent_req_nterror(req, status)) {
2915                 tevent_req_nterror(req, status);
2916                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2917                           (int)getpid(), nt_errstr(status)));
2918                 return;
2919         }
2920
2921         ok = smbd_unlock_socket_internal(sconn);
2922         if (!ok) {
2923                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2924                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2925                 return;
2926         }
2927         tevent_req_done(req);
2928 }
2929
2930 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2931                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2932 {
2933         struct smbd_echo_read_state *state = tevent_req_data(
2934                 req, struct smbd_echo_read_state);
2935         NTSTATUS status;
2936
2937         if (tevent_req_is_nterror(req, &status)) {
2938                 return status;
2939         }
2940         *pbuf = talloc_move(mem_ctx, &state->buf);
2941         *pbuflen = state->buflen;
2942         *pseqnum = state->seqnum;
2943         return NT_STATUS_OK;
2944 }
2945
2946 struct smbd_echo_state {
2947         struct tevent_context *ev;
2948         struct iovec *pending;
2949         struct smbd_server_connection *sconn;
2950         int parent_pipe;
2951
2952         struct tevent_fd *parent_fde;
2953
2954         struct tevent_req *write_req;
2955 };
2956
2957 static void smbd_echo_writer_done(struct tevent_req *req);
2958
2959 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2960 {
2961         int num_pending;
2962
2963         if (state->write_req != NULL) {
2964                 return;
2965         }
2966
2967         num_pending = talloc_array_length(state->pending);
2968         if (num_pending == 0) {
2969                 return;
2970         }
2971
2972         state->write_req = writev_send(state, state->ev, NULL,
2973                                        state->parent_pipe, false,
2974                                        state->pending, num_pending);
2975         if (state->write_req == NULL) {
2976                 DEBUG(1, ("writev_send failed\n"));
2977                 exit(1);
2978         }
2979
2980         talloc_steal(state->write_req, state->pending);
2981         state->pending = NULL;
2982
2983         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2984                                 state);
2985 }
2986
2987 static void smbd_echo_writer_done(struct tevent_req *req)
2988 {
2989         struct smbd_echo_state *state = tevent_req_callback_data(
2990                 req, struct smbd_echo_state);
2991         ssize_t written;
2992         int err;
2993
2994         written = writev_recv(req, &err);
2995         TALLOC_FREE(req);
2996         state->write_req = NULL;
2997         if (written == -1) {
2998                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2999                 exit(1);
3000         }
3001         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3002         smbd_echo_activate_writer(state);
3003 }
3004
3005 static bool smbd_echo_reply(struct smbd_echo_state *state,
3006                             uint8_t *inbuf, size_t inbuf_len,
3007                             uint32_t seqnum)
3008 {
3009         struct smb_request req;
3010         uint16_t num_replies;
3011         char *outbuf;
3012         bool ok;
3013
3014         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3015                 DEBUG(10, ("Got netbios keepalive\n"));
3016                 /*
3017                  * Just swallow it
3018                  */
3019                 return true;
3020         }
3021
3022         if (inbuf_len < smb_size) {
3023                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3024                 return false;
3025         }
3026         if (!valid_smb_header(state->sconn, inbuf)) {
3027                 DEBUG(10, ("Got invalid SMB header\n"));
3028                 return false;
3029         }
3030
3031         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
3032                               seqnum)) {
3033                 return false;
3034         }
3035         req.inbuf = inbuf;
3036
3037         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3038                    smb_messages[req.cmd].name
3039                    ? smb_messages[req.cmd].name : "unknown"));
3040
3041         if (req.cmd != SMBecho) {
3042                 return false;
3043         }
3044         if (req.wct < 1) {
3045                 return false;
3046         }
3047
3048         num_replies = SVAL(req.vwv+0, 0);
3049         if (num_replies != 1) {
3050                 /* Not a Windows "Hey, you're still there?" request */
3051                 return false;
3052         }
3053
3054         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
3055                            1, req.buflen)) {
3056                 DEBUG(10, ("create_outbuf failed\n"));
3057                 return false;
3058         }
3059         req.outbuf = (uint8_t *)outbuf;
3060
3061         SSVAL(req.outbuf, smb_vwv0, num_replies);
3062
3063         if (req.buflen > 0) {
3064                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3065         }
3066
3067         ok = srv_send_smb(req.sconn,
3068                           (char *)outbuf,
3069                           true, seqnum+1,
3070                           false, &req.pcd);
3071         TALLOC_FREE(outbuf);
3072         if (!ok) {
3073                 exit(1);
3074         }
3075
3076         return true;
3077 }
3078
3079 static void smbd_echo_exit(struct tevent_context *ev,
3080                            struct tevent_fd *fde, uint16_t flags,
3081                            void *private_data)
3082 {
3083         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3084         exit(0);
3085 }
3086
3087 static void smbd_echo_got_packet(struct tevent_req *req);
3088
3089 static void smbd_echo_loop(struct smbd_server_connection *sconn,
3090                            int parent_pipe)
3091 {
3092         struct smbd_echo_state *state;
3093         struct tevent_req *read_req;
3094
3095         state = talloc_zero(sconn, struct smbd_echo_state);
3096         if (state == NULL) {
3097                 DEBUG(1, ("talloc failed\n"));
3098                 return;
3099         }
3100         state->sconn = sconn;
3101         state->parent_pipe = parent_pipe;
3102         state->ev = s3_tevent_context_init(state);
3103         if (state->ev == NULL) {
3104                 DEBUG(1, ("tevent_context_init failed\n"));
3105                 TALLOC_FREE(state);
3106                 return;
3107         }
3108         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3109                                         TEVENT_FD_READ, smbd_echo_exit,
3110                                         state);
3111         if (state->parent_fde == NULL) {
3112                 DEBUG(1, ("tevent_add_fd failed\n"));
3113                 TALLOC_FREE(state);
3114                 return;
3115         }
3116
3117         read_req = smbd_echo_read_send(state, state->ev, sconn);
3118         if (read_req == NULL) {
3119                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3120                 TALLOC_FREE(state);
3121                 return;
3122         }
3123         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3124
3125         while (true) {
3126                 if (tevent_loop_once(state->ev) == -1) {
3127                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3128                                   strerror(errno)));
3129                         break;
3130                 }
3131         }
3132         TALLOC_FREE(state);
3133 }
3134
3135 static void smbd_echo_got_packet(struct tevent_req *req)
3136 {
3137         struct smbd_echo_state *state = tevent_req_callback_data(
3138                 req, struct smbd_echo_state);
3139         NTSTATUS status;
3140         char *buf = NULL;
3141         size_t buflen = 0;
3142         uint32_t seqnum = 0;
3143         bool reply;
3144
3145         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3146         TALLOC_FREE(req);
3147         if (!NT_STATUS_IS_OK(status)) {
3148                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3149                           nt_errstr(status)));
3150                 exit(1);
3151         }
3152
3153         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3154         if (!reply) {
3155                 size_t num_pending;
3156                 struct iovec *tmp;
3157                 struct iovec *iov;
3158
3159                 num_pending = talloc_array_length(state->pending);
3160                 tmp = talloc_realloc(state, state->pending, struct iovec,
3161                                      num_pending+1);
3162                 if (tmp == NULL) {
3163                         DEBUG(1, ("talloc_realloc failed\n"));
3164                         exit(1);
3165                 }
3166                 state->pending = tmp;
3167
3168                 if (buflen >= smb_size) {
3169                         /*
3170                          * place the seqnum in the packet so that the main process
3171                          * can reply with signing
3172                          */
3173                         SIVAL(buf, smb_ss_field, seqnum);
3174                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3175                 }
3176
3177                 iov = &state->pending[num_pending];
3178                 iov->iov_base = talloc_move(state->pending, &buf);
3179                 iov->iov_len = buflen;
3180
3181                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3182                           (int)getpid()));
3183                 smbd_echo_activate_writer(state);
3184         }
3185
3186         req = smbd_echo_read_send(state, state->ev, state->sconn);
3187         if (req == NULL) {
3188                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3189                 exit(1);
3190         }
3191         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3192 }
3193
3194
3195 /*
3196  * Handle SMBecho requests in a forked child process
3197  */
3198 bool fork_echo_handler(struct smbd_server_connection *sconn)
3199 {
3200         int listener_pipe[2];
3201         int res;
3202         pid_t child;
3203         bool use_mutex = false;
3204
3205         res = pipe(listener_pipe);
3206         if (res == -1) {
3207                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3208                 return false;
3209         }
3210
3211 #ifdef HAVE_ROBUST_MUTEXES
3212         use_mutex = tdb_runtime_check_for_robust_mutexes();
3213
3214         if (use_mutex) {
3215                 pthread_mutexattr_t a;
3216
3217                 sconn->smb1.echo_handler.socket_mutex =
3218                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3219                 if (sconn->smb1.echo_handler.socket_mutex == NULL) {
3220                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3221                                   strerror(errno)));
3222                         goto fail;
3223                 }
3224
3225                 res = pthread_mutexattr_init(&a);
3226                 if (res != 0) {
3227                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3228                                   strerror(res)));
3229                         goto fail;
3230                 }
3231                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3232                 if (res != 0) {
3233                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3234                                   strerror(res)));
3235                         pthread_mutexattr_destroy(&a);
3236                         goto fail;
3237                 }
3238                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3239                 if (res != 0) {
3240                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3241                                   strerror(res)));
3242                         pthread_mutexattr_destroy(&a);
3243                         goto fail;
3244                 }
3245                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3246                 if (res != 0) {
3247                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3248                                   "%s\n", strerror(res)));
3249                         pthread_mutexattr_destroy(&a);
3250                         goto fail;
3251                 }
3252                 res = pthread_mutex_init(sconn->smb1.echo_handler.socket_mutex,
3253                                          &a);
3254                 pthread_mutexattr_destroy(&a);
3255                 if (res != 0) {
3256                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3257                                   strerror(res)));
3258                         goto fail;
3259                 }
3260         }
3261 #endif
3262
3263         if (!use_mutex) {
3264                 sconn->smb1.echo_handler.socket_lock_fd =
3265                         create_unlink_tmp(lp_lock_directory());
3266                 if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3267                         DEBUG(1, ("Could not create lock fd: %s\n",
3268                                   strerror(errno)));
3269                         goto fail;
3270                 }
3271         }
3272
3273         child = fork();
3274         if (child == 0) {
3275                 NTSTATUS status;
3276
3277                 close(listener_pipe[0]);
3278                 set_blocking(listener_pipe[1], false);
3279
3280                 status = reinit_after_fork(sconn->msg_ctx,
3281                                            sconn->ev_ctx,
3282                                            true);
3283                 if (!NT_STATUS_IS_OK(status)) {
3284                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3285                                   nt_errstr(status)));
3286                         exit(1);
3287                 }
3288                 smbd_echo_loop(sconn, listener_pipe[1]);
3289                 exit(0);
3290         }
3291         close(listener_pipe[1]);
3292         listener_pipe[1] = -1;
3293         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3294
3295         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3296
3297         /*
3298          * Without smb signing this is the same as the normal smbd
3299          * listener. This needs to change once signing comes in.
3300          */
3301         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3302                                         sconn,
3303                                         sconn->smb1.echo_handler.trusted_fd,
3304                                         TEVENT_FD_READ,
3305                                         smbd_server_echo_handler,
3306                                         sconn);
3307         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3308                 DEBUG(1, ("event_add_fd failed\n"));
3309                 goto fail;
3310         }
3311
3312         return true;
3313
3314 fail:
3315         if (listener_pipe[0] != -1) {
3316                 close(listener_pipe[0]);
3317         }
3318         if (listener_pipe[1] != -1) {
3319                 close(listener_pipe[1]);
3320         }
3321         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3322                 close(sconn->smb1.echo_handler.socket_lock_fd);
3323         }
3324
3325 #ifdef HAVE_ROBUST_MUTEXES
3326         if (sconn->smb1.echo_handler.socket_mutex != NULL) {
3327                 pthread_mutex_destroy(sconn->smb1.echo_handler.socket_mutex);
3328                 anonymous_shared_free(sconn->smb1.echo_handler.socket_mutex);
3329         }
3330 #endif
3331         smbd_echo_init(sconn);
3332
3333         return false;
3334 }
3335
3336 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3337 {
3338         while (user) {
3339                 if (user->session_info &&
3340                     (user->session_info->unix_token->uid == uid)) {
3341                         return true;
3342                 }
3343                 user = user->next;
3344         }
3345         return false;
3346 }
3347
3348 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3349 {
3350         while (user) {
3351                 if (user->session_info != NULL) {
3352                         int i;
3353                         struct security_unix_token *utok;
3354
3355                         utok = user->session_info->unix_token;
3356                         if (utok->gid == gid) {
3357                                 return true;
3358                         }
3359                         for(i=0; i<utok->ngroups; i++) {
3360                                 if (utok->groups[i] == gid) {
3361                                         return true;
3362                                 }
3363                         }
3364                 }
3365                 user = user->next;
3366         }
3367         return false;
3368 }
3369
3370 static bool sid_in_use(const struct user_struct *user,
3371                        const struct dom_sid *psid)
3372 {
3373         while (user) {
3374                 struct security_token *tok;
3375
3376                 if (user->session_info == NULL) {
3377                         continue;
3378                 }
3379                 tok = user->session_info->security_token;
3380                 if (tok == NULL) {
3381                         /*
3382                          * Not sure session_info->security_token can
3383                          * ever be NULL. This check might be not
3384                          * necessary.
3385                          */
3386                         continue;
3387                 }
3388                 if (security_token_has_sid(tok, psid)) {
3389                         return true;
3390                 }
3391                 user = user->next;
3392         }
3393         return false;
3394 }
3395
3396 static bool id_in_use(const struct user_struct *user,
3397                       const struct id_cache_ref *id)
3398 {
3399         switch(id->type) {
3400         case UID:
3401                 return uid_in_use(user, id->id.uid);
3402         case GID:
3403                 return gid_in_use(user, id->id.gid);
3404         case SID:
3405                 return sid_in_use(user, &id->id.sid);
3406         default:
3407                 break;
3408         }
3409         return false;
3410 }
3411
3412 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3413                                void *private_data,
3414                                uint32_t msg_type,
3415                                struct server_id server_id,
3416                                DATA_BLOB* data)
3417 {
3418         const char *msg = (data && data->data)
3419                 ? (const char *)data->data : "<NULL>";
3420         struct id_cache_ref id;
3421         struct smbd_server_connection *sconn =
3422                 talloc_get_type_abort(private_data,
3423                 struct smbd_server_connection);
3424
3425         if (!id_cache_ref_parse(msg, &id)) {
3426                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3427                 return;
3428         }
3429
3430         if (id_in_use(sconn->users, &id)) {
3431                 exit_server_cleanly(msg);
3432         }
3433         id_cache_delete_from_cache(&id);
3434 }
3435
3436 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3437                                         enum protocol_types protocol)
3438 {
3439         NTSTATUS status;
3440
3441         set_Protocol(protocol);
3442         conn->protocol = protocol;
3443
3444         if (protocol >= PROTOCOL_SMB2_02) {
3445                 status = smb2srv_session_table_init(conn);
3446                 if (!NT_STATUS_IS_OK(status)) {
3447                         return status;
3448                 }
3449
3450                 status = smb2srv_open_table_init(conn);
3451                 if (!NT_STATUS_IS_OK(status)) {
3452                         return status;
3453                 }
3454         } else {
3455                 status = smb1srv_session_table_init(conn);
3456                 if (!NT_STATUS_IS_OK(status)) {
3457                         return status;
3458                 }
3459
3460                 status = smb1srv_tcon_table_init(conn);
3461                 if (!NT_STATUS_IS_OK(status)) {
3462                         return status;
3463                 }
3464
3465                 status = smb1srv_open_table_init(conn);
3466                 if (!NT_STATUS_IS_OK(status)) {
3467                         return status;
3468                 }
3469         }
3470
3471         return NT_STATUS_OK;
3472 }
3473
3474 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3475                                        void *private_data)
3476 {
3477         struct smbXsrv_connection *conn =
3478                 talloc_get_type_abort(private_data,
3479                 struct smbXsrv_connection);
3480
3481         switch (point) {
3482         case TEVENT_TRACE_BEFORE_WAIT:
3483                 /*
3484                  * This just removes compiler warning
3485                  * without profile support
3486                  */
3487                 conn->smbd_idle_profstamp = 0;
3488                 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3489                 break;
3490         case TEVENT_TRACE_AFTER_WAIT:
3491                 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3492                 break;
3493 #ifdef TEVENT_HAS_LOOP_ONCE_TRACE_POINTS
3494         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3495         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3496                 break;
3497 #endif
3498         }
3499 }
3500
3501 /**
3502  * Create a debug string for the connection
3503  *
3504  * This is allocated to talloc_tos() or a string constant
3505  * in certain corner cases. The returned string should
3506  * hence not be free'd directly but only via the talloc stack.
3507  */
3508 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3509 {
3510         const char *ret;
3511
3512         /*
3513          * TODO: this can be improved later
3514          * maybe including the client guid or more
3515          */
3516         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3517         if (ret == NULL) {
3518                 return "<tsocket_address_string() failed>";
3519         }
3520
3521         return ret;
3522 }
3523
3524 /****************************************************************************
3525  Process commands from the client
3526 ****************************************************************************/
3527
3528 void smbd_process(struct tevent_context *ev_ctx,
3529                   struct messaging_context *msg_ctx,
3530                   int sock_fd,
3531                   bool interactive)
3532 {
3533         TALLOC_CTX *frame = talloc_stackframe();
3534         struct smbXsrv_connection *conn;
3535         struct smbd_server_connection *sconn;
3536         struct sockaddr_storage ss_srv;
3537         void *sp_srv = (void *)&ss_srv;
3538         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3539         struct sockaddr_storage ss_clnt;
3540         void *sp_clnt = (void *)&ss_clnt;
3541         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3542         socklen_t sa_socklen;
3543         struct tsocket_address *local_address = NULL;
3544         struct tsocket_address *remote_address = NULL;
3545         const char *locaddr = NULL;
3546         const char *remaddr = NULL;
3547         char *rhost;
3548         int ret;
3549         int tmp;
3550
3551         conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3552         if (conn == NULL) {
3553                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3554                 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3555         }
3556
3557         conn->ev_ctx = ev_ctx;
3558         conn->msg_ctx = msg_ctx;
3559         conn->transport.sock = sock_fd;
3560
3561         sconn = talloc_zero(conn, struct smbd_server_connection);
3562         if (!sconn) {
3563                 exit_server("failed to create smbd_server_connection");
3564         }
3565
3566         conn->sconn = sconn;
3567         sconn->conn = conn;
3568
3569         /*
3570          * TODO: remove this...:-)
3571          */
3572         global_smbXsrv_connection = conn;
3573
3574         sconn->ev_ctx = ev_ctx;
3575         sconn->msg_ctx = msg_ctx;
3576         smbd_echo_init(sconn);
3577
3578         if (!interactive) {
3579                 smbd_setup_sig_term_handler(sconn);
3580                 smbd_setup_sig_hup_handler(sconn);
3581
3582                 if (!serverid_register(messaging_server_id(msg_ctx),
3583                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3584                                        |FLAG_MSG_DBWRAP
3585                                        |FLAG_MSG_PRINT_GENERAL)) {
3586                         exit_server_cleanly("Could not register myself in "
3587                                             "serverid.tdb");
3588                 }
3589         }
3590
3591         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3592                 /*
3593                  * We're not making the decision here,
3594                  * we're just allowing the client
3595                  * to decide between SMB1 and SMB2
3596                  * with the first negprot
3597                  * packet.
3598                  */
3599                 sconn->using_smb2 = true;
3600         }
3601
3602         /* Ensure child is set to blocking mode */
3603         set_blocking(sock_fd,True);
3604
3605         set_socket_options(sock_fd, "SO_KEEPALIVE");
3606         set_socket_options(sock_fd, lp_socket_options());
3607
3608         sa_socklen = sizeof(ss_clnt);
3609         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3610         if (ret != 0) {
3611                 int level = (errno == ENOTCONN)?2:0;
3612                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3613                 exit_server_cleanly("getpeername() failed.\n");
3614         }
3615         ret = tsocket_address_bsd_from_sockaddr(sconn,
3616                                                 sa_clnt, sa_socklen,
3617                                                 &remote_address);
3618         if (ret != 0) {
3619                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3620                         __location__, strerror(errno)));
3621                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3622         }
3623
3624         sa_socklen = sizeof(ss_srv);
3625         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3626         if (ret != 0) {
3627                 int level = (errno == ENOTCONN)?2:0;
3628                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3629                 exit_server_cleanly("getsockname() failed.\n");
3630         }
3631         ret = tsocket_address_bsd_from_sockaddr(sconn,
3632                                                 sa_srv, sa_socklen,
3633                                                 &local_address);
3634         if (ret != 0) {
3635                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3636                         __location__, strerror(errno)));
3637                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3638         }
3639
3640         sconn->local_address = local_address;
3641         sconn->remote_address = remote_address;
3642
3643         if (tsocket_address_is_inet(local_address, "ip")) {
3644                 locaddr = tsocket_address_inet_addr_string(
3645                                 sconn->local_address,
3646                                 talloc_tos());
3647                 if (locaddr == NULL) {
3648                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3649                                  __location__, strerror(errno)));
3650                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3651                 }
3652         } else {
3653                 locaddr = "0.0.0.0";
3654         }
3655
3656         if (tsocket_address_is_inet(remote_address, "ip")) {
3657                 remaddr = tsocket_address_inet_addr_string(
3658                                 sconn->remote_address,
3659                                 talloc_tos());
3660                 if (remaddr == NULL) {
3661                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3662                                  __location__, strerror(errno)));
3663                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3664                 }
3665         } else {
3666                 remaddr = "0.0.0.0";
3667         }
3668
3669         /* this is needed so that we get decent entries
3670            in smbstatus for port 445 connects */
3671         set_remote_machine_name(remaddr, false);
3672         reload_services(sconn, conn_snum_used, true);
3673
3674         /*
3675          * Before the first packet, check the global hosts allow/ hosts deny
3676          * parameters before doing any parsing of packets passed to us by the
3677          * client. This prevents attacks on our parsing code from hosts not in
3678          * the hosts allow list.
3679          */
3680
3681         ret = get_remote_hostname(remote_address,
3682                                   &rhost,
3683                                   talloc_tos());
3684         if (ret < 0) {
3685                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3686                         __location__, strerror(errno)));
3687                 exit_server_cleanly("get_remote_hostname failed.\n");
3688         }
3689         if (strequal(rhost, "UNKNOWN")) {
3690                 rhost = talloc_strdup(talloc_tos(), remaddr);
3691         }
3692         sconn->remote_hostname = talloc_move(sconn, &rhost);
3693
3694         sub_set_socket_ids(remaddr,
3695                            sconn->remote_hostname,
3696                            locaddr);
3697
3698         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3699                           sconn->remote_hostname,
3700                           remaddr)) {
3701                 /*
3702                  * send a negative session response "not listening on calling
3703                  * name"
3704                  */
3705                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3706                 DEBUG( 1, ("Connection denied from %s to %s\n",
3707                            tsocket_address_string(remote_address, talloc_tos()),
3708                            tsocket_address_string(local_address, talloc_tos())));
3709                 (void)srv_send_smb(sconn,(char *)buf, false,
3710                                    0, false, NULL);
3711                 exit_server_cleanly("connection denied");
3712         }
3713
3714         DEBUG(10, ("Connection allowed from %s to %s\n",
3715                    tsocket_address_string(remote_address, talloc_tos()),
3716                    tsocket_address_string(local_address, talloc_tos())));
3717
3718         if (lp_preload_modules()) {
3719                 smb_load_modules(lp_preload_modules());
3720         }
3721
3722         smb_perfcount_init();
3723
3724         if (!init_account_policy()) {
3725                 exit_server("Could not open account policy tdb.\n");
3726         }
3727
3728         if (*lp_root_directory(talloc_tos())) {
3729                 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3730                         DEBUG(0,("Failed to change root to %s\n",
3731                                  lp_root_directory(talloc_tos())));
3732                         exit_server("Failed to chroot()");
3733                 }
3734                 if (chdir("/") == -1) {
3735                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3736                         exit_server("Failed to chroot()");
3737                 }
3738                 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3739         }
3740
3741         if (!srv_init_signing(sconn)) {
3742                 exit_server("Failed to init smb_signing");
3743         }
3744
3745         if (!file_init(sconn)) {
3746                 exit_server("file_init() failed");
3747         }
3748
3749         /* Setup oplocks */
3750         if (!init_oplocks(sconn))
3751                 exit_server("Failed to init oplocks");
3752
3753         /* register our message handlers */
3754         messaging_register(sconn->msg_ctx, sconn,
3755                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3756         messaging_register(sconn->msg_ctx, sconn,
3757                            MSG_SMB_CLOSE_FILE, msg_close_file);
3758         messaging_register(sconn->msg_ctx, sconn,
3759                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3760
3761         id_cache_register_msgs(sconn->msg_ctx);
3762         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3763         messaging_register(sconn->msg_ctx, sconn,
3764                            ID_CACHE_KILL, smbd_id_cache_kill);
3765
3766         messaging_deregister(sconn->msg_ctx,
3767                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3768         messaging_register(sconn->msg_ctx, sconn,
3769                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3770
3771         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3772                              NULL);
3773         messaging_register(sconn->msg_ctx, sconn,
3774                            MSG_SMB_KILL_CLIENT_IP,
3775                            msg_kill_client_ip);
3776
3777         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3778
3779         /*
3780          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3781          * MSGs to all child processes
3782          */
3783         messaging_deregister(sconn->msg_ctx,
3784                              MSG_DEBUG, NULL);
3785         messaging_register(sconn->msg_ctx, NULL,
3786                            MSG_DEBUG, debug_message);
3787
3788         if ((lp_keepalive() != 0)
3789             && !(event_add_idle(ev_ctx, NULL,
3790                                 timeval_set(lp_keepalive(), 0),
3791                                 "keepalive", keepalive_fn,
3792                                 sconn))) {
3793                 DEBUG(0, ("Could not add keepalive event\n"));
3794                 exit(1);
3795         }
3796
3797         if (!(event_add_idle(ev_ctx, NULL,
3798                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3799                              "deadtime", deadtime_fn, sconn))) {
3800                 DEBUG(0, ("Could not add deadtime event\n"));
3801                 exit(1);
3802         }
3803
3804         if (!(event_add_idle(ev_ctx, NULL,
3805                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3806                              "housekeeping", housekeeping_fn, sconn))) {
3807                 DEBUG(0, ("Could not add housekeeping event\n"));
3808                 exit(1);
3809         }
3810
3811         if (lp_clustering()) {
3812                 /*
3813                  * We need to tell ctdb about our client's TCP
3814                  * connection, so that for failover ctdbd can send
3815                  * tickle acks, triggering a reconnection by the
3816                  * client.
3817                  */
3818                 NTSTATUS status;
3819
3820                 status = smbd_register_ips(sconn, &ss_srv, &ss_clnt);
3821                 if (!NT_STATUS_IS_OK(status)) {
3822                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3823                                   nt_errstr(status)));
3824                 }
3825         }
3826
3827         tmp = lp_max_xmit();
3828         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3829         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3830
3831         conn->smb1.negprot.max_recv = tmp;
3832
3833         sconn->smb1.sessions.done_sesssetup = false;
3834         sconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3835
3836         if (!init_dptrs(sconn)) {
3837                 exit_server("init_dptrs() failed");
3838         }
3839
3840         conn->transport.fde = tevent_add_fd(ev_ctx,
3841                                             sconn,
3842                                             sock_fd,
3843                                             TEVENT_FD_READ,
3844                                             smbd_server_connection_handler,
3845                                             sconn);
3846         if (!conn->transport.fde) {
3847                 exit_server("failed to create smbd_server_connection fde");
3848         }
3849
3850         sconn->conn->local_address = sconn->local_address;
3851         sconn->conn->remote_address = sconn->remote_address;
3852         sconn->conn->remote_hostname = sconn->remote_hostname;
3853         sconn->conn->protocol = PROTOCOL_NONE;
3854
3855         TALLOC_FREE(frame);
3856
3857         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3858
3859         while (True) {
3860                 frame = talloc_stackframe_pool(8192);
3861
3862                 errno = 0;
3863                 if (tevent_loop_once(ev_ctx) == -1) {
3864                         if (errno != EINTR) {
3865                                 DEBUG(3, ("tevent_loop_once failed: %s,"
3866                                           " exiting\n", strerror(errno) ));
3867                                 break;
3868                         }
3869                 }
3870
3871                 TALLOC_FREE(frame);
3872         }
3873
3874         exit_server_cleanly(NULL);
3875 }
3876
3877 bool req_is_in_chain(const struct smb_request *req)
3878 {
3879         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3880                 /*
3881                  * We're right now handling a subsequent request, so we must
3882                  * be in a chain
3883                  */
3884                 return true;
3885         }
3886
3887         if (!is_andx_req(req->cmd)) {
3888                 return false;
3889         }
3890
3891         if (req->wct < 2) {
3892                 /*
3893                  * Okay, an illegal request, but definitely not chained :-)
3894                  */
3895                 return false;
3896         }
3897
3898         return (CVAL(req->vwv+0, 0) != 0xFF);
3899 }