source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../librpc/gen_ndr/srv_dfs.h"
  24 #include "../librpc/gen_ndr/srv_dssetup.h"
  25 #include "../librpc/gen_ndr/srv_echo.h"
  26 #include "../librpc/gen_ndr/srv_eventlog.h"
  27 #include "../librpc/gen_ndr/srv_initshutdown.h"
  28 #include "../librpc/gen_ndr/srv_lsa.h"
  29 #include "../librpc/gen_ndr/srv_netlogon.h"
  30 #include "../librpc/gen_ndr/srv_ntsvcs.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32 #include "../librpc/gen_ndr/srv_spoolss.h"
  33 #include "../librpc/gen_ndr/srv_srvsvc.h"
  34 #include "../librpc/gen_ndr/srv_svcctl.h"
  35 #include "../librpc/gen_ndr/srv_winreg.h"
  36 #include "../librpc/gen_ndr/srv_wkssvc.h"
  37
  38 extern bool global_machine_password_needs_changing;
  39
  40 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  41                                    char *outbuf);
  42
  43 /* Accessor function for smb_read_error for smbd functions. */
  44
  45 /****************************************************************************
  46  Send an smb to a fd.
  47 ****************************************************************************/
  48
  49 bool srv_send_smb(int fd, char *buffer,
  50                   bool do_signing, uint32_t seqnum,
  51                   bool do_encrypt,
  52                   struct smb_perfcount_data *pcd)
  53 {
  54         size_t len = 0;
  55         size_t nwritten=0;
  56         ssize_t ret;
  57         char *buf_out = buffer;
  58
  59         if (do_signing) {
  60                 /* Sign the outgoing packet if required. */
  61                 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
  62         }
  63
  64         if (do_encrypt) {
  65                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  66                 if (!NT_STATUS_IS_OK(status)) {
  67                         DEBUG(0, ("send_smb: SMB encryption failed "
  68                                 "on outgoing packet! Error %s\n",
  69                                 nt_errstr(status) ));
  70                         goto out;
  71                 }
  72         }
  73
  74         len = smb_len(buf_out) + 4;
  75
  76         ret = write_data(fd,buf_out+nwritten,len - nwritten);
  77         if (ret <= 0) {
  78                 DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  79                          (int)len,(int)ret, strerror(errno) ));
  80                 srv_free_enc_buffer(buf_out);
  81                 goto out;
  82         }
  83
  84         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
  85         srv_free_enc_buffer(buf_out);
  86 out:
  87         SMB_PERFCOUNT_END(pcd);
  88         return true;
  89 }
  90
  91 /*******************************************************************
  92  Setup the word count and byte count for a smb message.
  93 ********************************************************************/
  94
  95 int srv_set_message(char *buf,
  96                         int num_words,
  97                         int num_bytes,
  98                         bool zero)
  99 {
 100         if (zero && (num_words || num_bytes)) {
 101                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 102         }
 103         SCVAL(buf,smb_wct,num_words);
 104         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 105         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 106         return (smb_size + num_words*2 + num_bytes);
 107 }
 108
 109 static bool valid_smb_header(const uint8_t *inbuf)
 110 {
 111         if (is_encrypted_packet(inbuf)) {
 112                 return true;
 113         }
 114         /*
 115          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 116          * but it just looks weird to call strncmp for this one.
 117          */
 118         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 119 }
 120
 121 /* Socket functions for smbd packet processing. */
 122
 123 static bool valid_packet_size(size_t len)
 124 {
 125         /*
 126          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 127          * of header. Don't print the error if this fits.... JRA.
 128          */
 129
 130         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 131                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 132                                         (unsigned long)len));
 133                 return false;
 134         }
 135         return true;
 136 }
 137
 138 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 139                                       unsigned int timeout, ssize_t len)
 140 {
 141         if (len <= 0) {
 142                 return NT_STATUS_OK;
 143         }
 144
 145         return read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 146 }
 147
 148 /****************************************************************************
 149  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 150 ****************************************************************************/
 151
 152 /*
 153  * Unfortunately, earlier versions of smbclient/libsmbclient
 154  * don't send this "standard" writeX header. I've fixed this
 155  * for 3.2 but we'll use the old method with earlier versions.
 156  * Windows and CIFSFS at least use this standard size. Not
 157  * sure about MacOSX.
 158  */
 159
 160 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 161                                 (2*14) + /* word count (including bcc) */ \
 162                                 1 /* pad byte */)
 163
 164 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 165                                                     const char lenbuf[4],
 166                                                     int fd, char **buffer,
 167                                                     unsigned int timeout,
 168                                                     size_t *p_unread,
 169                                                     size_t *len_ret)
 170 {
 171         /* Size of a WRITEX call (+4 byte len). */
 172         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 173         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 174         ssize_t toread;
 175         NTSTATUS status;
 176
 177         memcpy(writeX_header, lenbuf, 4);
 178
 179         status = read_fd_with_timeout(
 180                 fd, writeX_header + 4,
 181                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 182                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 183                 timeout, NULL);
 184
 185         if (!NT_STATUS_IS_OK(status)) {
 186                 return status;
 187         }
 188
 189         /*
 190          * Ok - now try and see if this is a possible
 191          * valid writeX call.
 192          */
 193
 194         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 195                 /*
 196                  * If the data offset is beyond what
 197                  * we've read, drain the extra bytes.
 198                  */
 199                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 200                 ssize_t newlen;
 201
 202                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 203                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 204                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 205                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 206                                         " failed to drain pending bytes");
 207                         }
 208                 } else {
 209                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 210                 }
 211
 212                 /* Spoof down the length and null out the bcc. */
 213                 set_message_bcc(writeX_header, 0);
 214                 newlen = smb_len(writeX_header);
 215
 216                 /* Copy the header we've written. */
 217
 218                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 219                                 writeX_header,
 220                                 sizeof(writeX_header));
 221
 222                 if (*buffer == NULL) {
 223                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 224                                   (int)sizeof(writeX_header)));
 225                         return NT_STATUS_NO_MEMORY;
 226                 }
 227
 228                 /* Work out the remaining bytes. */
 229                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 230                 *len_ret = newlen + 4;
 231                 return NT_STATUS_OK;
 232         }
 233
 234         if (!valid_packet_size(len)) {
 235                 return NT_STATUS_INVALID_PARAMETER;
 236         }
 237
 238         /*
 239          * Not a valid writeX call. Just do the standard
 240          * talloc and return.
 241          */
 242
 243         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 244
 245         if (*buffer == NULL) {
 246                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 247                           (int)len+4));
 248                 return NT_STATUS_NO_MEMORY;
 249         }
 250
 251         /* Copy in what we already read. */
 252         memcpy(*buffer,
 253                 writeX_header,
 254                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 255         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 256
 257         if(toread > 0) {
 258                 status = read_packet_remainder(
 259                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 260                         timeout, toread);
 261
 262                 if (!NT_STATUS_IS_OK(status)) {
 263                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 264                                    nt_errstr(status)));
 265                         return status;
 266                 }
 267         }
 268
 269         *len_ret = len + 4;
 270         return NT_STATUS_OK;
 271 }
 272
 273 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 274                                        char **buffer, unsigned int timeout,
 275                                        size_t *p_unread, size_t *plen)
 276 {
 277         char lenbuf[4];
 278         size_t len;
 279         int min_recv_size = lp_min_receive_file_size();
 280         NTSTATUS status;
 281
 282         *p_unread = 0;
 283
 284         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 285         if (!NT_STATUS_IS_OK(status)) {
 286                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 287                 return status;
 288         }
 289
 290         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 291             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 292                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 293             !srv_is_signing_active(smbd_server_conn)) {
 294
 295                 return receive_smb_raw_talloc_partial_read(
 296                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 297         }
 298
 299         if (!valid_packet_size(len)) {
 300                 return NT_STATUS_INVALID_PARAMETER;
 301         }
 302
 303         /*
 304          * The +4 here can't wrap, we've checked the length above already.
 305          */
 306
 307         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 308
 309         if (*buffer == NULL) {
 310                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 311                           (int)len+4));
 312                 return NT_STATUS_NO_MEMORY;
 313         }
 314
 315         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 316
 317         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return status;
 320         }
 321
 322         *plen = len + 4;
 323         return NT_STATUS_OK;
 324 }
 325
 326 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 327                                    char **buffer, unsigned int timeout,
 328                                    size_t *p_unread, bool *p_encrypted,
 329                                    size_t *p_len,
 330                                    uint32_t *seqnum)
 331 {
 332         size_t len = 0;
 333         NTSTATUS status;
 334
 335         *p_encrypted = false;
 336
 337         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 338                                         p_unread, &len);
 339         if (!NT_STATUS_IS_OK(status)) {
 340                 return status;
 341         }
 342
 343         if (is_encrypted_packet((uint8_t *)*buffer)) {
 344                 status = srv_decrypt_buffer(*buffer);
 345                 if (!NT_STATUS_IS_OK(status)) {
 346                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 347                                 "incoming packet! Error %s\n",
 348                                 nt_errstr(status) ));
 349                         return status;
 350                 }
 351                 *p_encrypted = true;
 352         }
 353
 354         /* Check the incoming SMB signature. */
 355         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum)) {
 356                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 357                           "incoming packet!\n"));
 358                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 359         }
 360
 361         *p_len = len;
 362         return NT_STATUS_OK;
 363 }
 364
 365 /*
 366  * Initialize a struct smb_request from an inbuf
 367  */
 368
 369 static void init_smb_request(struct smb_request *req, const uint8 *inbuf,
 370                              size_t unread_bytes, bool encrypted,
 371                              uint32_t seqnum)
 372 {
 373         struct smbd_server_connection *sconn = smbd_server_conn;
 374         size_t req_size = smb_len(inbuf) + 4;
 375         /* Ensure we have at least smb_size bytes. */
 376         if (req_size < smb_size) {
 377                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 378                         (unsigned int)req_size ));
 379                 exit_server_cleanly("Invalid SMB request");
 380         }
 381         req->cmd    = CVAL(inbuf, smb_com);
 382         req->flags2 = SVAL(inbuf, smb_flg2);
 383         req->smbpid = SVAL(inbuf, smb_pid);
 384         req->mid    = SVAL(inbuf, smb_mid);
 385         req->seqnum = seqnum;
 386         req->vuid   = SVAL(inbuf, smb_uid);
 387         req->tid    = SVAL(inbuf, smb_tid);
 388         req->wct    = CVAL(inbuf, smb_wct);
 389         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 390         req->buflen = smb_buflen(inbuf);
 391         req->buf    = (const uint8_t *)smb_buf(inbuf);
 392         req->unread_bytes = unread_bytes;
 393         req->encrypted = encrypted;
 394         req->conn = conn_find(sconn,req->tid);
 395         req->chain_fsp = NULL;
 396         req->chain_outbuf = NULL;
 397         req->done = false;
 398         smb_init_perfcount_data(&req->pcd);
 399
 400         /* Ensure we have at least wct words and 2 bytes of bcc. */
 401         if (smb_size + req->wct*2 > req_size) {
 402                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 403                         (unsigned int)req->wct,
 404                         (unsigned int)req_size));
 405                 exit_server_cleanly("Invalid SMB request");
 406         }
 407         /* Ensure bcc is correct. */
 408         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 409                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 410                         "(wct = %u, size %u)\n",
 411                         (unsigned int)req->buflen,
 412                         (unsigned int)req->wct,
 413                         (unsigned int)req_size));
 414                 exit_server_cleanly("Invalid SMB request");
 415         }
 416
 417         req->outbuf = NULL;
 418 }
 419
 420 static void process_smb(struct smbd_server_connection *conn,
 421                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 422                         uint32_t seqnum, bool encrypted,
 423                         struct smb_perfcount_data *deferred_pcd);
 424
 425 static void smbd_deferred_open_timer(struct event_context *ev,
 426                                      struct timed_event *te,
 427                                      struct timeval _tval,
 428                                      void *private_data)
 429 {
 430         struct pending_message_list *msg = talloc_get_type(private_data,
 431                                            struct pending_message_list);
 432         TALLOC_CTX *mem_ctx = talloc_tos();
 433         uint16_t mid = SVAL(msg->buf.data,smb_mid);
 434         uint8_t *inbuf;
 435
 436         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 437                                          msg->buf.length);
 438         if (inbuf == NULL) {
 439                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 440                 return;
 441         }
 442
 443         /* We leave this message on the queue so the open code can
 444            know this is a retry. */
 445         DEBUG(5,("smbd_deferred_open_timer: trigger mid %u.\n",
 446                 (unsigned int)mid ));
 447
 448         /* Mark the message as processed so this is not
 449          * re-processed in error. */
 450         msg->processed = true;
 451
 452         process_smb(smbd_server_conn, inbuf,
 453                     msg->buf.length, 0,
 454                     msg->seqnum, msg->encrypted, &msg->pcd);
 455
 456         /* If it's still there and was processed, remove it. */
 457         msg = get_open_deferred_message(mid);
 458         if (msg && msg->processed) {
 459                 remove_deferred_open_smb_message(mid);
 460         }
 461 }
 462
 463 /****************************************************************************
 464  Function to push a message onto the tail of a linked list of smb messages ready
 465  for processing.
 466 ****************************************************************************/
 467
 468 static bool push_queued_message(struct smb_request *req,
 469                                 struct timeval request_time,
 470                                 struct timeval end_time,
 471                                 char *private_data, size_t private_len)
 472 {
 473         int msg_len = smb_len(req->inbuf) + 4;
 474         struct pending_message_list *msg;
 475
 476         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 477
 478         if(msg == NULL) {
 479                 DEBUG(0,("push_message: malloc fail (1)\n"));
 480                 return False;
 481         }
 482
 483         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 484         if(msg->buf.data == NULL) {
 485                 DEBUG(0,("push_message: malloc fail (2)\n"));
 486                 TALLOC_FREE(msg);
 487                 return False;
 488         }
 489
 490         msg->request_time = request_time;
 491         msg->seqnum = req->seqnum;
 492         msg->encrypted = req->encrypted;
 493         msg->processed = false;
 494         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 495
 496         if (private_data) {
 497                 msg->private_data = data_blob_talloc(msg, private_data,
 498                                                      private_len);
 499                 if (msg->private_data.data == NULL) {
 500                         DEBUG(0,("push_message: malloc fail (3)\n"));
 501                         TALLOC_FREE(msg);
 502                         return False;
 503                 }
 504         }
 505
 506         msg->te = event_add_timed(smbd_event_context(),
 507                                   msg,
 508                                   end_time,
 509                                   smbd_deferred_open_timer,
 510                                   msg);
 511         if (!msg->te) {
 512                 DEBUG(0,("push_message: event_add_timed failed\n"));
 513                 TALLOC_FREE(msg);
 514                 return false;
 515         }
 516
 517         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 518
 519         DEBUG(10,("push_message: pushed message length %u on "
 520                   "deferred_open_queue\n", (unsigned int)msg_len));
 521
 522         return True;
 523 }
 524
 525 /****************************************************************************
 526  Function to delete a sharing violation open message by mid.
 527 ****************************************************************************/
 528
 529 void remove_deferred_open_smb_message(uint16 mid)
 530 {
 531         struct pending_message_list *pml;
 532
 533         for (pml = deferred_open_queue; pml; pml = pml->next) {
 534                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 535                         DEBUG(10,("remove_deferred_open_smb_message: "
 536                                   "deleting mid %u len %u\n",
 537                                   (unsigned int)mid,
 538                                   (unsigned int)pml->buf.length ));
 539                         DLIST_REMOVE(deferred_open_queue, pml);
 540                         TALLOC_FREE(pml);
 541                         return;
 542                 }
 543         }
 544 }
 545
 546 /****************************************************************************
 547  Move a sharing violation open retry message to the front of the list and
 548  schedule it for immediate processing.
 549 ****************************************************************************/
 550
 551 void schedule_deferred_open_smb_message(uint16 mid)
 552 {
 553         struct pending_message_list *pml;
 554         int i = 0;
 555
 556         for (pml = deferred_open_queue; pml; pml = pml->next) {
 557                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 558
 559                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 560                         (unsigned int)msg_mid ));
 561
 562                 if (mid == msg_mid) {
 563                         struct timed_event *te;
 564
 565                         if (pml->processed) {
 566                                 /* A processed message should not be
 567                                  * rescheduled. */
 568                                 DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR "
 569                                         "message mid %u was already processed\n",
 570                                         msg_mid ));
 571                                 continue;
 572                         }
 573
 574                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 575                                 mid ));
 576
 577                         te = event_add_timed(smbd_event_context(),
 578                                              pml,
 579                                              timeval_zero(),
 580                                              smbd_deferred_open_timer,
 581                                              pml);
 582                         if (!te) {
 583                                 DEBUG(10,("schedule_deferred_open_smb_message: "
 584                                           "event_add_timed() failed, skipping mid %u\n",
 585                                           mid ));
 586                         }
 587
 588                         TALLOC_FREE(pml->te);
 589                         pml->te = te;
 590                         DLIST_PROMOTE(deferred_open_queue, pml);
 591                         return;
 592                 }
 593         }
 594
 595         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 596                 mid ));
 597 }
 598
 599 /****************************************************************************
 600  Return true if this mid is on the deferred queue and was not yet processed.
 601 ****************************************************************************/
 602
 603 bool open_was_deferred(uint16 mid)
 604 {
 605         struct pending_message_list *pml;
 606
 607         for (pml = deferred_open_queue; pml; pml = pml->next) {
 608                 if (SVAL(pml->buf.data,smb_mid) == mid && !pml->processed) {
 609                         return True;
 610                 }
 611         }
 612         return False;
 613 }
 614
 615 /****************************************************************************
 616  Return the message queued by this mid.
 617 ****************************************************************************/
 618
 619 struct pending_message_list *get_open_deferred_message(uint16 mid)
 620 {
 621         struct pending_message_list *pml;
 622
 623         for (pml = deferred_open_queue; pml; pml = pml->next) {
 624                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 625                         return pml;
 626                 }
 627         }
 628         return NULL;
 629 }
 630
 631 /****************************************************************************
 632  Function to push a deferred open smb message onto a linked list of local smb
 633  messages ready for processing.
 634 ****************************************************************************/
 635
 636 bool push_deferred_smb_message(struct smb_request *req,
 637                                struct timeval request_time,
 638                                struct timeval timeout,
 639                                char *private_data, size_t priv_len)
 640 {
 641         struct timeval end_time;
 642
 643         if (req->unread_bytes) {
 644                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 645                         "unread_bytes = %u\n",
 646                         (unsigned int)req->unread_bytes ));
 647                 smb_panic("push_deferred_smb_message: "
 648                         "logic error unread_bytes != 0" );
 649         }
 650
 651         end_time = timeval_sum(&request_time, &timeout);
 652
 653         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 654                   "timeout time [%u.%06u]\n",
 655                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 656                   (unsigned int)end_time.tv_sec,
 657                   (unsigned int)end_time.tv_usec));
 658
 659         return push_queued_message(req, request_time, end_time,
 660                                    private_data, priv_len);
 661 }
 662
 663 struct idle_event {
 664         struct timed_event *te;
 665         struct timeval interval;
 666         char *name;
 667         bool (*handler)(const struct timeval *now, void *private_data);
 668         void *private_data;
 669 };
 670
 671 static void smbd_idle_event_handler(struct event_context *ctx,
 672                                     struct timed_event *te,
 673                                     struct timeval now,
 674                                     void *private_data)
 675 {
 676         struct idle_event *event =
 677                 talloc_get_type_abort(private_data, struct idle_event);
 678
 679         TALLOC_FREE(event->te);
 680
 681         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 682                   event->name, event->te));
 683
 684         if (!event->handler(&now, event->private_data)) {
 685                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 686                           event->name, event->te));
 687                 /* Don't repeat, delete ourselves */
 688                 TALLOC_FREE(event);
 689                 return;
 690         }
 691
 692         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 693                   event->name, event->te));
 694
 695         event->te = event_add_timed(ctx, event,
 696                                     timeval_sum(&now, &event->interval),
 697                                     smbd_idle_event_handler, event);
 698
 699         /* We can't do much but fail here. */
 700         SMB_ASSERT(event->te != NULL);
 701 }
 702
 703 struct idle_event *event_add_idle(struct event_context *event_ctx,
 704                                   TALLOC_CTX *mem_ctx,
 705                                   struct timeval interval,
 706                                   const char *name,
 707                                   bool (*handler)(const struct timeval *now,
 708                                                   void *private_data),
 709                                   void *private_data)
 710 {
 711         struct idle_event *result;
 712         struct timeval now = timeval_current();
 713
 714         result = TALLOC_P(mem_ctx, struct idle_event);
 715         if (result == NULL) {
 716                 DEBUG(0, ("talloc failed\n"));
 717                 return NULL;
 718         }
 719
 720         result->interval = interval;
 721         result->handler = handler;
 722         result->private_data = private_data;
 723
 724         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 725                 DEBUG(0, ("talloc failed\n"));
 726                 TALLOC_FREE(result);
 727                 return NULL;
 728         }
 729
 730         result->te = event_add_timed(event_ctx, result,
 731                                      timeval_sum(&now, &interval),
 732                                      smbd_idle_event_handler, result);
 733         if (result->te == NULL) {
 734                 DEBUG(0, ("event_add_timed failed\n"));
 735                 TALLOC_FREE(result);
 736                 return NULL;
 737         }
 738
 739         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 740         return result;
 741 }
 742
 743 static void smbd_sig_term_handler(struct tevent_context *ev,
 744                                   struct tevent_signal *se,
 745                                   int signum,
 746                                   int count,
 747                                   void *siginfo,
 748                                   void *private_data)
 749 {
 750         exit_server_cleanly("termination signal");
 751 }
 752
 753 void smbd_setup_sig_term_handler(void)
 754 {
 755         struct tevent_signal *se;
 756
 757         se = tevent_add_signal(smbd_event_context(),
 758                                smbd_event_context(),
 759                                SIGTERM, 0,
 760                                smbd_sig_term_handler,
 761                                NULL);
 762         if (!se) {
 763                 exit_server("failed to setup SIGTERM handler");
 764         }
 765 }
 766
 767 static void smbd_sig_hup_handler(struct tevent_context *ev,
 768                                   struct tevent_signal *se,
 769                                   int signum,
 770                                   int count,
 771                                   void *siginfo,
 772                                   void *private_data)
 773 {
 774         change_to_root_user();
 775         DEBUG(1,("Reloading services after SIGHUP\n"));
 776         reload_services(False);
 777 }
 778
 779 void smbd_setup_sig_hup_handler(void)
 780 {
 781         struct tevent_signal *se;
 782
 783         se = tevent_add_signal(smbd_event_context(),
 784                                smbd_event_context(),
 785                                SIGHUP, 0,
 786                                smbd_sig_hup_handler,
 787                                NULL);
 788         if (!se) {
 789                 exit_server("failed to setup SIGHUP handler");
 790         }
 791 }
 792
 793 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 794 {
 795         fd_set r_fds, w_fds;
 796         int selrtn;
 797         struct timeval to;
 798         int maxfd = 0;
 799
 800         to.tv_sec = SMBD_SELECT_TIMEOUT;
 801         to.tv_usec = 0;
 802
 803         /*
 804          * Setup the select fd sets.
 805          */
 806
 807         FD_ZERO(&r_fds);
 808         FD_ZERO(&w_fds);
 809
 810         /*
 811          * Are there any timed events waiting ? If so, ensure we don't
 812          * select for longer than it would take to wait for them.
 813          */
 814
 815         {
 816                 struct timeval now;
 817                 GetTimeOfDay(&now);
 818
 819                 event_add_to_select_args(smbd_event_context(), &now,
 820                                          &r_fds, &w_fds, &to, &maxfd);
 821         }
 822
 823         /* Process a signal and timed events now... */
 824         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 825                 return NT_STATUS_RETRY;
 826         }
 827
 828         {
 829                 int sav;
 830                 START_PROFILE(smbd_idle);
 831
 832                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 833                 sav = errno;
 834
 835                 END_PROFILE(smbd_idle);
 836                 errno = sav;
 837         }
 838
 839         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 840                 return NT_STATUS_RETRY;
 841         }
 842
 843         /* Check if error */
 844         if (selrtn == -1) {
 845                 /* something is wrong. Maybe the socket is dead? */
 846                 return map_nt_error_from_unix(errno);
 847         }
 848
 849         /* Did we timeout ? */
 850         if (selrtn == 0) {
 851                 return NT_STATUS_RETRY;
 852         }
 853
 854         /* should not be reached */
 855         return NT_STATUS_INTERNAL_ERROR;
 856 }
 857
 858 /*
 859  * Only allow 5 outstanding trans requests. We're allocating memory, so
 860  * prevent a DoS.
 861  */
 862
 863 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 864 {
 865         int count = 0;
 866         for (; list != NULL; list = list->next) {
 867
 868                 if (list->mid == mid) {
 869                         return NT_STATUS_INVALID_PARAMETER;
 870                 }
 871
 872                 count += 1;
 873         }
 874         if (count > 5) {
 875                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 876         }
 877
 878         return NT_STATUS_OK;
 879 }
 880
 881 /*
 882 These flags determine some of the permissions required to do an operation
 883
 884 Note that I don't set NEED_WRITE on some write operations because they
 885 are used by some brain-dead clients when printing, and I don't want to
 886 force write permissions on print services.
 887 */
 888 #define AS_USER (1<<0)
 889 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 890 #define TIME_INIT (1<<2)
 891 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 892 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 893 #define DO_CHDIR (1<<6)
 894
 895 /*
 896    define a list of possible SMB messages and their corresponding
 897    functions. Any message that has a NULL function is unimplemented -
 898    please feel free to contribute implementations!
 899 */
 900 static const struct smb_message_struct {
 901         const char *name;
 902         void (*fn)(struct smb_request *req);
 903         int flags;
 904 } smb_messages[256] = {
 905
 906 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 907 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 908 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 909 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 910 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 911 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 912 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 913 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 914 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 915 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 916 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 917 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 918 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 919 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 920 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 921 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 922 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 923 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 924 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 925 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 926 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 927 /* 0x15 */ { NULL, NULL, 0 },
 928 /* 0x16 */ { NULL, NULL, 0 },
 929 /* 0x17 */ { NULL, NULL, 0 },
 930 /* 0x18 */ { NULL, NULL, 0 },
 931 /* 0x19 */ { NULL, NULL, 0 },
 932 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 933 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 934 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
 935 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 936 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 937 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 938 /* 0x20 */ { "SMBwritec", NULL,0},
 939 /* 0x21 */ { NULL, NULL, 0 },
 940 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 941 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 942 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 943 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 944 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 945 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 946 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
 947 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 948 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
 949 /* 0x2b */ { "SMBecho",reply_echo,0},
 950 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 951 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 952 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 953 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 954 /* 0x30 */ { NULL, NULL, 0 },
 955 /* 0x31 */ { NULL, NULL, 0 },
 956 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
 957 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
 958 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
 959 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
 960 /* 0x36 */ { NULL, NULL, 0 },
 961 /* 0x37 */ { NULL, NULL, 0 },
 962 /* 0x38 */ { NULL, NULL, 0 },
 963 /* 0x39 */ { NULL, NULL, 0 },
 964 /* 0x3a */ { NULL, NULL, 0 },
 965 /* 0x3b */ { NULL, NULL, 0 },
 966 /* 0x3c */ { NULL, NULL, 0 },
 967 /* 0x3d */ { NULL, NULL, 0 },
 968 /* 0x3e */ { NULL, NULL, 0 },
 969 /* 0x3f */ { NULL, NULL, 0 },
 970 /* 0x40 */ { NULL, NULL, 0 },
 971 /* 0x41 */ { NULL, NULL, 0 },
 972 /* 0x42 */ { NULL, NULL, 0 },
 973 /* 0x43 */ { NULL, NULL, 0 },
 974 /* 0x44 */ { NULL, NULL, 0 },
 975 /* 0x45 */ { NULL, NULL, 0 },
 976 /* 0x46 */ { NULL, NULL, 0 },
 977 /* 0x47 */ { NULL, NULL, 0 },
 978 /* 0x48 */ { NULL, NULL, 0 },
 979 /* 0x49 */ { NULL, NULL, 0 },
 980 /* 0x4a */ { NULL, NULL, 0 },
 981 /* 0x4b */ { NULL, NULL, 0 },
 982 /* 0x4c */ { NULL, NULL, 0 },
 983 /* 0x4d */ { NULL, NULL, 0 },
 984 /* 0x4e */ { NULL, NULL, 0 },
 985 /* 0x4f */ { NULL, NULL, 0 },
 986 /* 0x50 */ { NULL, NULL, 0 },
 987 /* 0x51 */ { NULL, NULL, 0 },
 988 /* 0x52 */ { NULL, NULL, 0 },
 989 /* 0x53 */ { NULL, NULL, 0 },
 990 /* 0x54 */ { NULL, NULL, 0 },
 991 /* 0x55 */ { NULL, NULL, 0 },
 992 /* 0x56 */ { NULL, NULL, 0 },
 993 /* 0x57 */ { NULL, NULL, 0 },
 994 /* 0x58 */ { NULL, NULL, 0 },
 995 /* 0x59 */ { NULL, NULL, 0 },
 996 /* 0x5a */ { NULL, NULL, 0 },
 997 /* 0x5b */ { NULL, NULL, 0 },
 998 /* 0x5c */ { NULL, NULL, 0 },
 999 /* 0x5d */ { NULL, NULL, 0 },
1000 /* 0x5e */ { NULL, NULL, 0 },
1001 /* 0x5f */ { NULL, NULL, 0 },
1002 /* 0x60 */ { NULL, NULL, 0 },
1003 /* 0x61 */ { NULL, NULL, 0 },
1004 /* 0x62 */ { NULL, NULL, 0 },
1005 /* 0x63 */ { NULL, NULL, 0 },
1006 /* 0x64 */ { NULL, NULL, 0 },
1007 /* 0x65 */ { NULL, NULL, 0 },
1008 /* 0x66 */ { NULL, NULL, 0 },
1009 /* 0x67 */ { NULL, NULL, 0 },
1010 /* 0x68 */ { NULL, NULL, 0 },
1011 /* 0x69 */ { NULL, NULL, 0 },
1012 /* 0x6a */ { NULL, NULL, 0 },
1013 /* 0x6b */ { NULL, NULL, 0 },
1014 /* 0x6c */ { NULL, NULL, 0 },
1015 /* 0x6d */ { NULL, NULL, 0 },
1016 /* 0x6e */ { NULL, NULL, 0 },
1017 /* 0x6f */ { NULL, NULL, 0 },
1018 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1019 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1020 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1021 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1022 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1023 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1024 /* 0x76 */ { NULL, NULL, 0 },
1025 /* 0x77 */ { NULL, NULL, 0 },
1026 /* 0x78 */ { NULL, NULL, 0 },
1027 /* 0x79 */ { NULL, NULL, 0 },
1028 /* 0x7a */ { NULL, NULL, 0 },
1029 /* 0x7b */ { NULL, NULL, 0 },
1030 /* 0x7c */ { NULL, NULL, 0 },
1031 /* 0x7d */ { NULL, NULL, 0 },
1032 /* 0x7e */ { NULL, NULL, 0 },
1033 /* 0x7f */ { NULL, NULL, 0 },
1034 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1035 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1036 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1037 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1038 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1039 /* 0x85 */ { NULL, NULL, 0 },
1040 /* 0x86 */ { NULL, NULL, 0 },
1041 /* 0x87 */ { NULL, NULL, 0 },
1042 /* 0x88 */ { NULL, NULL, 0 },
1043 /* 0x89 */ { NULL, NULL, 0 },
1044 /* 0x8a */ { NULL, NULL, 0 },
1045 /* 0x8b */ { NULL, NULL, 0 },
1046 /* 0x8c */ { NULL, NULL, 0 },
1047 /* 0x8d */ { NULL, NULL, 0 },
1048 /* 0x8e */ { NULL, NULL, 0 },
1049 /* 0x8f */ { NULL, NULL, 0 },
1050 /* 0x90 */ { NULL, NULL, 0 },
1051 /* 0x91 */ { NULL, NULL, 0 },
1052 /* 0x92 */ { NULL, NULL, 0 },
1053 /* 0x93 */ { NULL, NULL, 0 },
1054 /* 0x94 */ { NULL, NULL, 0 },
1055 /* 0x95 */ { NULL, NULL, 0 },
1056 /* 0x96 */ { NULL, NULL, 0 },
1057 /* 0x97 */ { NULL, NULL, 0 },
1058 /* 0x98 */ { NULL, NULL, 0 },
1059 /* 0x99 */ { NULL, NULL, 0 },
1060 /* 0x9a */ { NULL, NULL, 0 },
1061 /* 0x9b */ { NULL, NULL, 0 },
1062 /* 0x9c */ { NULL, NULL, 0 },
1063 /* 0x9d */ { NULL, NULL, 0 },
1064 /* 0x9e */ { NULL, NULL, 0 },
1065 /* 0x9f */ { NULL, NULL, 0 },
1066 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1067 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1068 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1069 /* 0xa3 */ { NULL, NULL, 0 },
1070 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1071 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1072 /* 0xa6 */ { NULL, NULL, 0 },
1073 /* 0xa7 */ { NULL, NULL, 0 },
1074 /* 0xa8 */ { NULL, NULL, 0 },
1075 /* 0xa9 */ { NULL, NULL, 0 },
1076 /* 0xaa */ { NULL, NULL, 0 },
1077 /* 0xab */ { NULL, NULL, 0 },
1078 /* 0xac */ { NULL, NULL, 0 },
1079 /* 0xad */ { NULL, NULL, 0 },
1080 /* 0xae */ { NULL, NULL, 0 },
1081 /* 0xaf */ { NULL, NULL, 0 },
1082 /* 0xb0 */ { NULL, NULL, 0 },
1083 /* 0xb1 */ { NULL, NULL, 0 },
1084 /* 0xb2 */ { NULL, NULL, 0 },
1085 /* 0xb3 */ { NULL, NULL, 0 },
1086 /* 0xb4 */ { NULL, NULL, 0 },
1087 /* 0xb5 */ { NULL, NULL, 0 },
1088 /* 0xb6 */ { NULL, NULL, 0 },
1089 /* 0xb7 */ { NULL, NULL, 0 },
1090 /* 0xb8 */ { NULL, NULL, 0 },
1091 /* 0xb9 */ { NULL, NULL, 0 },
1092 /* 0xba */ { NULL, NULL, 0 },
1093 /* 0xbb */ { NULL, NULL, 0 },
1094 /* 0xbc */ { NULL, NULL, 0 },
1095 /* 0xbd */ { NULL, NULL, 0 },
1096 /* 0xbe */ { NULL, NULL, 0 },
1097 /* 0xbf */ { NULL, NULL, 0 },
1098 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1099 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1100 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1101 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1102 /* 0xc4 */ { NULL, NULL, 0 },
1103 /* 0xc5 */ { NULL, NULL, 0 },
1104 /* 0xc6 */ { NULL, NULL, 0 },
1105 /* 0xc7 */ { NULL, NULL, 0 },
1106 /* 0xc8 */ { NULL, NULL, 0 },
1107 /* 0xc9 */ { NULL, NULL, 0 },
1108 /* 0xca */ { NULL, NULL, 0 },
1109 /* 0xcb */ { NULL, NULL, 0 },
1110 /* 0xcc */ { NULL, NULL, 0 },
1111 /* 0xcd */ { NULL, NULL, 0 },
1112 /* 0xce */ { NULL, NULL, 0 },
1113 /* 0xcf */ { NULL, NULL, 0 },
1114 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1115 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1116 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1117 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1118 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1119 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1120 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1121 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1122 /* 0xd8 */ { NULL, NULL, 0 },
1123 /* 0xd9 */ { NULL, NULL, 0 },
1124 /* 0xda */ { NULL, NULL, 0 },
1125 /* 0xdb */ { NULL, NULL, 0 },
1126 /* 0xdc */ { NULL, NULL, 0 },
1127 /* 0xdd */ { NULL, NULL, 0 },
1128 /* 0xde */ { NULL, NULL, 0 },
1129 /* 0xdf */ { NULL, NULL, 0 },
1130 /* 0xe0 */ { NULL, NULL, 0 },
1131 /* 0xe1 */ { NULL, NULL, 0 },
1132 /* 0xe2 */ { NULL, NULL, 0 },
1133 /* 0xe3 */ { NULL, NULL, 0 },
1134 /* 0xe4 */ { NULL, NULL, 0 },
1135 /* 0xe5 */ { NULL, NULL, 0 },
1136 /* 0xe6 */ { NULL, NULL, 0 },
1137 /* 0xe7 */ { NULL, NULL, 0 },
1138 /* 0xe8 */ { NULL, NULL, 0 },
1139 /* 0xe9 */ { NULL, NULL, 0 },
1140 /* 0xea */ { NULL, NULL, 0 },
1141 /* 0xeb */ { NULL, NULL, 0 },
1142 /* 0xec */ { NULL, NULL, 0 },
1143 /* 0xed */ { NULL, NULL, 0 },
1144 /* 0xee */ { NULL, NULL, 0 },
1145 /* 0xef */ { NULL, NULL, 0 },
1146 /* 0xf0 */ { NULL, NULL, 0 },
1147 /* 0xf1 */ { NULL, NULL, 0 },
1148 /* 0xf2 */ { NULL, NULL, 0 },
1149 /* 0xf3 */ { NULL, NULL, 0 },
1150 /* 0xf4 */ { NULL, NULL, 0 },
1151 /* 0xf5 */ { NULL, NULL, 0 },
1152 /* 0xf6 */ { NULL, NULL, 0 },
1153 /* 0xf7 */ { NULL, NULL, 0 },
1154 /* 0xf8 */ { NULL, NULL, 0 },
1155 /* 0xf9 */ { NULL, NULL, 0 },
1156 /* 0xfa */ { NULL, NULL, 0 },
1157 /* 0xfb */ { NULL, NULL, 0 },
1158 /* 0xfc */ { NULL, NULL, 0 },
1159 /* 0xfd */ { NULL, NULL, 0 },
1160 /* 0xfe */ { NULL, NULL, 0 },
1161 /* 0xff */ { NULL, NULL, 0 }
1162
1163 };
1164
1165 /*******************************************************************
1166  allocate and initialize a reply packet
1167 ********************************************************************/
1168
1169 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1170                           const char *inbuf, char **outbuf, uint8_t num_words,
1171                           uint32_t num_bytes)
1172 {
1173         /*
1174          * Protect against integer wrap
1175          */
1176         if ((num_bytes > 0xffffff)
1177             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1178                 char *msg;
1179                 if (asprintf(&msg, "num_bytes too large: %u",
1180                              (unsigned)num_bytes) == -1) {
1181                         msg = CONST_DISCARD(char *, "num_bytes too large");
1182                 }
1183                 smb_panic(msg);
1184         }
1185
1186         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1187                                smb_size + num_words*2 + num_bytes);
1188         if (*outbuf == NULL) {
1189                 return false;
1190         }
1191
1192         construct_reply_common(req, inbuf, *outbuf);
1193         srv_set_message(*outbuf, num_words, num_bytes, false);
1194         /*
1195          * Zero out the word area, the caller has to take care of the bcc area
1196          * himself
1197          */
1198         if (num_words != 0) {
1199                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1200         }
1201
1202         return true;
1203 }
1204
1205 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1206 {
1207         char *outbuf;
1208         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1209                            num_bytes)) {
1210                 smb_panic("could not allocate output buffer\n");
1211         }
1212         req->outbuf = (uint8_t *)outbuf;
1213 }
1214
1215
1216 /*******************************************************************
1217  Dump a packet to a file.
1218 ********************************************************************/
1219
1220 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1221 {
1222         int fd, i;
1223         char *fname = NULL;
1224         if (DEBUGLEVEL < 50) {
1225                 return;
1226         }
1227
1228         if (len < 4) len = smb_len(data)+4;
1229         for (i=1;i<100;i++) {
1230                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1231                              type ? "req" : "resp") == -1) {
1232                         return;
1233                 }
1234                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1235                 if (fd != -1 || errno != EEXIST) break;
1236         }
1237         if (fd != -1) {
1238                 ssize_t ret = write(fd, data, len);
1239                 if (ret != len)
1240                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1241                 close(fd);
1242                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1243         }
1244         SAFE_FREE(fname);
1245 }
1246
1247 /****************************************************************************
1248  Prepare everything for calling the actual request function, and potentially
1249  call the request function via the "new" interface.
1250
1251  Return False if the "legacy" function needs to be called, everything is
1252  prepared.
1253
1254  Return True if we're done.
1255
1256  I know this API sucks, but it is the one with the least code change I could
1257  find.
1258 ****************************************************************************/
1259
1260 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1261 {
1262         int flags;
1263         uint16 session_tag;
1264         connection_struct *conn = NULL;
1265         struct smbd_server_connection *sconn = smbd_server_conn;
1266
1267         errno = 0;
1268
1269         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1270          * so subtract 4 from it. */
1271         if (!valid_smb_header(req->inbuf)
1272             || (size < (smb_size - 4))) {
1273                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1274                          smb_len(req->inbuf)));
1275                 exit_server_cleanly("Non-SMB packet");
1276         }
1277
1278         if (smb_messages[type].fn == NULL) {
1279                 DEBUG(0,("Unknown message type %d!\n",type));
1280                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1281                 reply_unknown_new(req, type);
1282                 return NULL;
1283         }
1284
1285         flags = smb_messages[type].flags;
1286
1287         /* In share mode security we must ignore the vuid. */
1288         session_tag = (lp_security() == SEC_SHARE)
1289                 ? UID_FIELD_INVALID : req->vuid;
1290         conn = req->conn;
1291
1292         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1293                  (int)sys_getpid(), (unsigned long)conn));
1294
1295         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1296
1297         /* Ensure this value is replaced in the incoming packet. */
1298         SSVAL(req->inbuf,smb_uid,session_tag);
1299
1300         /*
1301          * Ensure the correct username is in current_user_info.  This is a
1302          * really ugly bugfix for problems with multiple session_setup_and_X's
1303          * being done and allowing %U and %G substitutions to work correctly.
1304          * There is a reason this code is done here, don't move it unless you
1305          * know what you're doing... :-).
1306          * JRA.
1307          */
1308
1309         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1310                 user_struct *vuser = NULL;
1311
1312                 sconn->smb1.sessions.last_session_tag = session_tag;
1313                 if(session_tag != UID_FIELD_INVALID) {
1314                         vuser = get_valid_user_struct(sconn, session_tag);
1315                         if (vuser) {
1316                                 set_current_user_info(
1317                                         vuser->server_info->sanitized_username,
1318                                         vuser->server_info->unix_name,
1319                                         pdb_get_domain(vuser->server_info
1320                                                        ->sam_account));
1321                         }
1322                 }
1323         }
1324
1325         /* Does this call need to be run as the connected user? */
1326         if (flags & AS_USER) {
1327
1328                 /* Does this call need a valid tree connection? */
1329                 if (!conn) {
1330                         /*
1331                          * Amazingly, the error code depends on the command
1332                          * (from Samba4).
1333                          */
1334                         if (type == SMBntcreateX) {
1335                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1336                         } else {
1337                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1338                         }
1339                         return NULL;
1340                 }
1341
1342                 if (!change_to_user(conn,session_tag)) {
1343                         DEBUG(0, ("Error: Could not change to user. Removing "
1344                             "deferred open, mid=%d.\n", req->mid));
1345                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1346                         return conn;
1347                 }
1348
1349                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1350
1351                 /* Does it need write permission? */
1352                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1353                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1354                         return conn;
1355                 }
1356
1357                 /* IPC services are limited */
1358                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1359                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1360                         return conn;
1361                 }
1362         } else {
1363                 /* This call needs to be run as root */
1364                 change_to_root_user();
1365         }
1366
1367         /* load service specific parameters */
1368         if (conn) {
1369                 if (req->encrypted) {
1370                         conn->encrypted_tid = true;
1371                         /* encrypted required from now on. */
1372                         conn->encrypt_level = Required;
1373                 } else if (ENCRYPTION_REQUIRED(conn)) {
1374                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1375                                 exit_server_cleanly("encryption required "
1376                                         "on connection");
1377                                 return conn;
1378                         }
1379                 }
1380
1381                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1382                                          (flags & (AS_USER|DO_CHDIR)
1383                                           ?True:False))) {
1384                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1385                         return conn;
1386                 }
1387                 conn->num_smb_operations++;
1388         }
1389
1390         /* does this protocol need to be run as guest? */
1391         if ((flags & AS_GUEST)
1392             && (!change_to_guest() ||
1393                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1394                               lp_hostsdeny(-1)))) {
1395                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1396                 return conn;
1397         }
1398
1399         smb_messages[type].fn(req);
1400         return req->conn;
1401 }
1402
1403 /****************************************************************************
1404  Construct a reply to the incoming packet.
1405 ****************************************************************************/
1406
1407 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1408                             uint32_t seqnum, bool encrypted,
1409                             struct smb_perfcount_data *deferred_pcd)
1410 {
1411         connection_struct *conn;
1412         struct smb_request *req;
1413
1414         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1415                 smb_panic("could not allocate smb_request");
1416         }
1417
1418         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted, seqnum);
1419         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1420
1421         /* we popped this message off the queue - keep original perf data */
1422         if (deferred_pcd)
1423                 req->pcd = *deferred_pcd;
1424         else {
1425                 SMB_PERFCOUNT_START(&req->pcd);
1426                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1427                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1428         }
1429
1430         conn = switch_message(req->cmd, req, size);
1431
1432         if (req->unread_bytes) {
1433                 /* writeX failed. drain socket. */
1434                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1435                                 req->unread_bytes) {
1436                         smb_panic("failed to drain pending bytes");
1437                 }
1438                 req->unread_bytes = 0;
1439         }
1440
1441         if (req->done) {
1442                 TALLOC_FREE(req);
1443                 return;
1444         }
1445
1446         if (req->outbuf == NULL) {
1447                 return;
1448         }
1449
1450         if (CVAL(req->outbuf,0) == 0) {
1451                 show_msg((char *)req->outbuf);
1452         }
1453
1454         if (!srv_send_smb(smbd_server_fd(),
1455                         (char *)req->outbuf,
1456                         true, req->seqnum+1,
1457                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1458                         &req->pcd)) {
1459                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1460         }
1461
1462         TALLOC_FREE(req);
1463
1464         return;
1465 }
1466
1467 /****************************************************************************
1468  Process an smb from the client
1469 ****************************************************************************/
1470 static void process_smb(struct smbd_server_connection *conn,
1471                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1472                         uint32_t seqnum, bool encrypted,
1473                         struct smb_perfcount_data *deferred_pcd)
1474 {
1475         int msg_type = CVAL(inbuf,0);
1476
1477         DO_PROFILE_INC(smb_count);
1478
1479         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1480                     smb_len(inbuf) ) );
1481         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1482                                 (int)nread,
1483                                 (unsigned int)unread_bytes ));
1484
1485         if (msg_type != 0) {
1486                 /*
1487                  * NetBIOS session request, keepalive, etc.
1488                  */
1489                 reply_special((char *)inbuf);
1490                 goto done;
1491         }
1492
1493         if (smbd_server_conn->allow_smb2) {
1494                 if (smbd_is_smb2_header(inbuf, nread)) {
1495                         smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1496                         return;
1497                 }
1498                 smbd_server_conn->allow_smb2 = false;
1499         }
1500
1501         show_msg((char *)inbuf);
1502
1503         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1504         trans_num++;
1505
1506 done:
1507         conn->smb1.num_requests++;
1508
1509         /* The timeout_processing function isn't run nearly
1510            often enough to implement 'max log size' without
1511            overrunning the size of the file by many megabytes.
1512            This is especially true if we are running at debug
1513            level 10.  Checking every 50 SMBs is a nice
1514            tradeoff of performance vs log file size overrun. */
1515
1516         if ((conn->smb1.num_requests % 50) == 0 &&
1517             need_to_check_log_size()) {
1518                 change_to_root_user();
1519                 check_log_size();
1520         }
1521 }
1522
1523 /****************************************************************************
1524  Return a string containing the function name of a SMB command.
1525 ****************************************************************************/
1526
1527 const char *smb_fn_name(int type)
1528 {
1529         const char *unknown_name = "SMBunknown";
1530
1531         if (smb_messages[type].name == NULL)
1532                 return(unknown_name);
1533
1534         return(smb_messages[type].name);
1535 }
1536
1537 /****************************************************************************
1538  Helper functions for contruct_reply.
1539 ****************************************************************************/
1540
1541 void add_to_common_flags2(uint32 v)
1542 {
1543         common_flags2 |= v;
1544 }
1545
1546 void remove_from_common_flags2(uint32 v)
1547 {
1548         common_flags2 &= ~v;
1549 }
1550
1551 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1552                                    char *outbuf)
1553 {
1554         srv_set_message(outbuf,0,0,false);
1555
1556         SCVAL(outbuf, smb_com, req->cmd);
1557         SIVAL(outbuf,smb_rcls,0);
1558         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1559         SSVAL(outbuf,smb_flg2,
1560                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1561                 common_flags2);
1562         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1563
1564         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1565         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1566         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1567         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1568 }
1569
1570 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1571 {
1572         construct_reply_common(req, (char *)req->inbuf, outbuf);
1573 }
1574
1575 /*
1576  * How many bytes have we already accumulated up to the current wct field
1577  * offset?
1578  */
1579
1580 size_t req_wct_ofs(struct smb_request *req)
1581 {
1582         size_t buf_size;
1583
1584         if (req->chain_outbuf == NULL) {
1585                 return smb_wct - 4;
1586         }
1587         buf_size = talloc_get_size(req->chain_outbuf);
1588         if ((buf_size % 4) != 0) {
1589                 buf_size += (4 - (buf_size % 4));
1590         }
1591         return buf_size - 4;
1592 }
1593
1594 /*
1595  * Hack around reply_nterror & friends not being aware of chained requests,
1596  * generating illegal (i.e. wct==0) chain replies.
1597  */
1598
1599 static void fixup_chain_error_packet(struct smb_request *req)
1600 {
1601         uint8_t *outbuf = req->outbuf;
1602         req->outbuf = NULL;
1603         reply_outbuf(req, 2, 0);
1604         memcpy(req->outbuf, outbuf, smb_wct);
1605         TALLOC_FREE(outbuf);
1606         SCVAL(req->outbuf, smb_vwv0, 0xff);
1607 }
1608
1609 /**
1610  * @brief Find the smb_cmd offset of the last command pushed
1611  * @param[in] buf       The buffer we're building up
1612  * @retval              Where can we put our next andx cmd?
1613  *
1614  * While chaining requests, the "next" request we're looking at needs to put
1615  * its SMB_Command before the data the previous request already built up added
1616  * to the chain. Find the offset to the place where we have to put our cmd.
1617  */
1618
1619 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1620 {
1621         uint8_t cmd;
1622         size_t ofs;
1623
1624         cmd = CVAL(buf, smb_com);
1625
1626         SMB_ASSERT(is_andx_req(cmd));
1627
1628         ofs = smb_vwv0;
1629
1630         while (CVAL(buf, ofs) != 0xff) {
1631
1632                 if (!is_andx_req(CVAL(buf, ofs))) {
1633                         return false;
1634                 }
1635
1636                 /*
1637                  * ofs is from start of smb header, so add the 4 length
1638                  * bytes. The next cmd is right after the wct field.
1639                  */
1640                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1641
1642                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1643         }
1644
1645         *pofs = ofs;
1646         return true;
1647 }
1648
1649 /**
1650  * @brief Do the smb chaining at a buffer level
1651  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1652  * @param[in] smb_command       The command that we want to issue
1653  * @param[in] wct               How many words?
1654  * @param[in] vwv               The words, already in network order
1655  * @param[in] bytes_alignment   How shall we align "bytes"?
1656  * @param[in] num_bytes         How many bytes?
1657  * @param[in] bytes             The data the request ships
1658  *
1659  * smb_splice_chain() adds the vwv and bytes to the request already present in
1660  * *poutbuf.
1661  */
1662
1663 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1664                              uint8_t wct, const uint16_t *vwv,
1665                              size_t bytes_alignment,
1666                              uint32_t num_bytes, const uint8_t *bytes)
1667 {
1668         uint8_t *outbuf;
1669         size_t old_size, new_size;
1670         size_t ofs;
1671         size_t chain_padding = 0;
1672         size_t bytes_padding = 0;
1673         bool first_request;
1674
1675         old_size = talloc_get_size(*poutbuf);
1676
1677         /*
1678          * old_size == smb_wct means we're pushing the first request in for
1679          * libsmb/
1680          */
1681
1682         first_request = (old_size == smb_wct);
1683
1684         if (!first_request && ((old_size % 4) != 0)) {
1685                 /*
1686                  * Align the wct field of subsequent requests to a 4-byte
1687                  * boundary
1688                  */
1689                 chain_padding = 4 - (old_size % 4);
1690         }
1691
1692         /*
1693          * After the old request comes the new wct field (1 byte), the vwv's
1694          * and the num_bytes field. After at we might need to align the bytes
1695          * given to us to "bytes_alignment", increasing the num_bytes value.
1696          */
1697
1698         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1699
1700         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1701                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1702         }
1703
1704         new_size += bytes_padding + num_bytes;
1705
1706         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1707                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1708                           (unsigned)new_size));
1709                 return false;
1710         }
1711
1712         outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1713         if (outbuf == NULL) {
1714                 DEBUG(0, ("talloc failed\n"));
1715                 return false;
1716         }
1717         *poutbuf = outbuf;
1718
1719         if (first_request) {
1720                 SCVAL(outbuf, smb_com, smb_command);
1721         } else {
1722                 size_t andx_cmd_ofs;
1723
1724                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1725                         DEBUG(1, ("invalid command chain\n"));
1726                         *poutbuf = TALLOC_REALLOC_ARRAY(
1727                                 NULL, *poutbuf, uint8_t, old_size);
1728                         return false;
1729                 }
1730
1731                 if (chain_padding != 0) {
1732                         memset(outbuf + old_size, 0, chain_padding);
1733                         old_size += chain_padding;
1734                 }
1735
1736                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1737                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1738         }
1739
1740         ofs = old_size;
1741
1742         /*
1743          * Push the chained request:
1744          *
1745          * wct field
1746          */
1747
1748         SCVAL(outbuf, ofs, wct);
1749         ofs += 1;
1750
1751         /*
1752          * vwv array
1753          */
1754
1755         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1756         ofs += sizeof(uint16_t) * wct;
1757
1758         /*
1759          * bcc (byte count)
1760          */
1761
1762         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1763         ofs += sizeof(uint16_t);
1764
1765         /*
1766          * padding
1767          */
1768
1769         if (bytes_padding != 0) {
1770                 memset(outbuf + ofs, 0, bytes_padding);
1771                 ofs += bytes_padding;
1772         }
1773
1774         /*
1775          * The bytes field
1776          */
1777
1778         memcpy(outbuf + ofs, bytes, num_bytes);
1779
1780         return true;
1781 }
1782
1783 /****************************************************************************
1784  Construct a chained reply and add it to the already made reply
1785 ****************************************************************************/
1786
1787 void chain_reply(struct smb_request *req)
1788 {
1789         size_t smblen = smb_len(req->inbuf);
1790         size_t already_used, length_needed;
1791         uint8_t chain_cmd;
1792         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1793
1794         uint8_t wct;
1795         uint16_t *vwv;
1796         uint16_t buflen;
1797         uint8_t *buf;
1798
1799         if (IVAL(req->outbuf, smb_rcls) != 0) {
1800                 fixup_chain_error_packet(req);
1801         }
1802
1803         /*
1804          * Any of the AndX requests and replies have at least a wct of
1805          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1806          * beginning of the SMB header to the next wct field.
1807          *
1808          * None of the AndX requests put anything valuable in vwv[0] and [1],
1809          * so we can overwrite it here to form the chain.
1810          */
1811
1812         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1813                 if (req->chain_outbuf == NULL) {
1814                         req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1815                                 req, req->outbuf, uint8_t,
1816                                 smb_len(req->outbuf) + 4);
1817                         if (req->chain_outbuf == NULL) {
1818                                 smb_panic("talloc failed");
1819                         }
1820                 }
1821                 req->outbuf = NULL;
1822                 goto error;
1823         }
1824
1825         /*
1826          * Here we assume that this is the end of the chain. For that we need
1827          * to set "next command" to 0xff and the offset to 0. If we later find
1828          * more commands in the chain, this will be overwritten again.
1829          */
1830
1831         SCVAL(req->outbuf, smb_vwv0, 0xff);
1832         SCVAL(req->outbuf, smb_vwv0+1, 0);
1833         SSVAL(req->outbuf, smb_vwv1, 0);
1834
1835         if (req->chain_outbuf == NULL) {
1836                 /*
1837                  * In req->chain_outbuf we collect all the replies. Start the
1838                  * chain by copying in the first reply.
1839                  *
1840                  * We do the realloc because later on we depend on
1841                  * talloc_get_size to determine the length of
1842                  * chain_outbuf. The reply_xxx routines might have
1843                  * over-allocated (reply_pipe_read_and_X used to be such an
1844                  * example).
1845                  */
1846                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1847                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1848                 if (req->chain_outbuf == NULL) {
1849                         smb_panic("talloc failed");
1850                 }
1851                 req->outbuf = NULL;
1852         } else {
1853                 /*
1854                  * Update smb headers where subsequent chained commands
1855                  * may have updated them.
1856                  */
1857                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
1858                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
1859
1860                 if (!smb_splice_chain(&req->chain_outbuf,
1861                                       CVAL(req->outbuf, smb_com),
1862                                       CVAL(req->outbuf, smb_wct),
1863                                       (uint16_t *)(req->outbuf + smb_vwv),
1864                                       0, smb_buflen(req->outbuf),
1865                                       (uint8_t *)smb_buf(req->outbuf))) {
1866                         goto error;
1867                 }
1868                 TALLOC_FREE(req->outbuf);
1869         }
1870
1871         /*
1872          * We use the old request's vwv field to grab the next chained command
1873          * and offset into the chained fields.
1874          */
1875
1876         chain_cmd = CVAL(req->vwv+0, 0);
1877         chain_offset = SVAL(req->vwv+1, 0);
1878
1879         if (chain_cmd == 0xff) {
1880                 /*
1881                  * End of chain, no more requests from the client. So ship the
1882                  * replies.
1883                  */
1884                 smb_setlen((char *)(req->chain_outbuf),
1885                            talloc_get_size(req->chain_outbuf) - 4);
1886
1887                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
1888                                   true, req->seqnum+1,
1889                                   IS_CONN_ENCRYPTED(req->conn)
1890                                   ||req->encrypted,
1891                                   &req->pcd)) {
1892                         exit_server_cleanly("chain_reply: srv_send_smb "
1893                                             "failed.");
1894                 }
1895                 TALLOC_FREE(req->chain_outbuf);
1896                 req->done = true;
1897                 return;
1898         }
1899
1900         /* add a new perfcounter for this element of chain */
1901         SMB_PERFCOUNT_ADD(&req->pcd);
1902         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
1903         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
1904
1905         /*
1906          * Check if the client tries to fool us. The request so far uses the
1907          * space to the end of the byte buffer in the request just
1908          * processed. The chain_offset can't point into that area. If that was
1909          * the case, we could end up with an endless processing of the chain,
1910          * we would always handle the same request.
1911          */
1912
1913         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
1914         if (chain_offset < already_used) {
1915                 goto error;
1916         }
1917
1918         /*
1919          * Next check: Make sure the chain offset does not point beyond the
1920          * overall smb request length.
1921          */
1922
1923         length_needed = chain_offset+1; /* wct */
1924         if (length_needed > smblen) {
1925                 goto error;
1926         }
1927
1928         /*
1929          * Now comes the pointer magic. Goal here is to set up req->vwv and
1930          * req->buf correctly again to be able to call the subsequent
1931          * switch_message(). The chain offset (the former vwv[1]) points at
1932          * the new wct field.
1933          */
1934
1935         wct = CVAL(smb_base(req->inbuf), chain_offset);
1936
1937         /*
1938          * Next consistency check: Make the new vwv array fits in the overall
1939          * smb request.
1940          */
1941
1942         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
1943         if (length_needed > smblen) {
1944                 goto error;
1945         }
1946         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
1947
1948         /*
1949          * Now grab the new byte buffer....
1950          */
1951
1952         buflen = SVAL(vwv+wct, 0);
1953
1954         /*
1955          * .. and check that it fits.
1956          */
1957
1958         length_needed += buflen;
1959         if (length_needed > smblen) {
1960                 goto error;
1961         }
1962         buf = (uint8_t *)(vwv+wct+1);
1963
1964         req->cmd = chain_cmd;
1965         req->wct = wct;
1966         req->vwv = vwv;
1967         req->buflen = buflen;
1968         req->buf = buf;
1969
1970         switch_message(chain_cmd, req, smblen);
1971
1972         if (req->outbuf == NULL) {
1973                 /*
1974                  * This happens if the chained command has suspended itself or
1975                  * if it has called srv_send_smb() itself.
1976                  */
1977                 return;
1978         }
1979
1980         /*
1981          * We end up here if the chained command was not itself chained or
1982          * suspended, but for example a close() command. We now need to splice
1983          * the chained commands' outbuf into the already built up chain_outbuf
1984          * and ship the result.
1985          */
1986         goto done;
1987
1988  error:
1989         /*
1990          * We end up here if there's any error in the chain syntax. Report a
1991          * DOS error, just like Windows does.
1992          */
1993         reply_force_doserror(req, ERRSRV, ERRerror);
1994         fixup_chain_error_packet(req);
1995
1996  done:
1997         /*
1998          * This scary statement intends to set the
1999          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2000          * to the value req->outbuf carries
2001          */
2002         SSVAL(req->chain_outbuf, smb_flg2,
2003               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2004               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2005
2006         /*
2007          * Transfer the error codes from the subrequest to the main one
2008          */
2009         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2010         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2011
2012         if (!smb_splice_chain(&req->chain_outbuf,
2013                               CVAL(req->outbuf, smb_com),
2014                               CVAL(req->outbuf, smb_wct),
2015                               (uint16_t *)(req->outbuf + smb_vwv),
2016                               0, smb_buflen(req->outbuf),
2017                               (uint8_t *)smb_buf(req->outbuf))) {
2018                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2019         }
2020         TALLOC_FREE(req->outbuf);
2021
2022         smb_setlen((char *)(req->chain_outbuf),
2023                    talloc_get_size(req->chain_outbuf) - 4);
2024
2025         show_msg((char *)(req->chain_outbuf));
2026
2027         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2028                           true, req->seqnum+1,
2029                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2030                           &req->pcd)) {
2031                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2032         }
2033         TALLOC_FREE(req->chain_outbuf);
2034         req->done = true;
2035 }
2036
2037 /****************************************************************************
2038  Check if services need reloading.
2039 ****************************************************************************/
2040
2041 void check_reload(time_t t)
2042 {
2043         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2044
2045         if(last_smb_conf_reload_time == 0) {
2046                 last_smb_conf_reload_time = t;
2047                 /* Our printing subsystem might not be ready at smbd start up.
2048                    Then no printer is available till the first printers check
2049                    is performed.  A lower initial interval circumvents this. */
2050                 if ( printcap_cache_time > 60 )
2051                         last_printer_reload_time = t - printcap_cache_time + 60;
2052                 else
2053                         last_printer_reload_time = t;
2054         }
2055
2056         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2057                 /* randomize over 60 second the printcap reload to avoid all
2058                  * process hitting cupsd at the same time */
2059                 int time_range = 60;
2060
2061                 last_printer_reload_time += random() % time_range;
2062                 mypid = getpid();
2063         }
2064
2065         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2066                 reload_services(True);
2067                 last_smb_conf_reload_time = t;
2068         }
2069
2070         /* 'printcap cache time = 0' disable the feature */
2071
2072         if ( printcap_cache_time != 0 )
2073         {
2074                 /* see if it's time to reload or if the clock has been set back */
2075
2076                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2077                         || (t-last_printer_reload_time  < 0) )
2078                 {
2079                         DEBUG( 3,( "Printcap cache time expired.\n"));
2080                         reload_printers();
2081                         last_printer_reload_time = t;
2082                 }
2083         }
2084 }
2085
2086 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2087 {
2088         /* TODO: make write nonblocking */
2089 }
2090
2091 static void smbd_server_connection_read_handler(struct smbd_server_connection *conn)
2092 {
2093         uint8_t *inbuf = NULL;
2094         size_t inbuf_len = 0;
2095         size_t unread_bytes = 0;
2096         bool encrypted = false;
2097         TALLOC_CTX *mem_ctx = talloc_tos();
2098         NTSTATUS status;
2099         uint32_t seqnum;
2100
2101         /* TODO: make this completely nonblocking */
2102
2103         status = receive_smb_talloc(mem_ctx, smbd_server_fd(),
2104                                     (char **)(void *)&inbuf,
2105                                     0, /* timeout */
2106                                     &unread_bytes,
2107                                     &encrypted,
2108                                     &inbuf_len, &seqnum);
2109         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2110                 goto process;
2111         }
2112         if (NT_STATUS_IS_ERR(status)) {
2113                 exit_server_cleanly("failed to receive smb request");
2114         }
2115         if (!NT_STATUS_IS_OK(status)) {
2116                 return;
2117         }
2118
2119 process:
2120         process_smb(conn, inbuf, inbuf_len, unread_bytes,
2121                     seqnum, encrypted, NULL);
2122 }
2123
2124 static void smbd_server_connection_handler(struct event_context *ev,
2125                                            struct fd_event *fde,
2126                                            uint16_t flags,
2127                                            void *private_data)
2128 {
2129         struct smbd_server_connection *conn = talloc_get_type(private_data,
2130                                               struct smbd_server_connection);
2131
2132         if (flags & EVENT_FD_WRITE) {
2133                 smbd_server_connection_write_handler(conn);
2134         } else if (flags & EVENT_FD_READ) {
2135                 smbd_server_connection_read_handler(conn);
2136         }
2137 }
2138
2139
2140 /****************************************************************************
2141 received when we should release a specific IP
2142 ****************************************************************************/
2143 static void release_ip(const char *ip, void *priv)
2144 {
2145         char addr[INET6_ADDRSTRLEN];
2146         char *p = addr;
2147
2148         client_socket_addr(get_client_fd(),addr,sizeof(addr));
2149
2150         if (strncmp("::ffff:", addr, 7) == 0) {
2151                 p = addr + 7;
2152         }
2153
2154         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2155                 /* we can't afford to do a clean exit - that involves
2156                    database writes, which would potentially mean we
2157                    are still running after the failover has finished -
2158                    we have to get rid of this process ID straight
2159                    away */
2160                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2161                         ip));
2162                 /* note we must exit with non-zero status so the unclean handler gets
2163                    called in the parent, so that the brl database is tickled */
2164                 _exit(1);
2165         }
2166 }
2167
2168 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2169                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2170 {
2171         release_ip((char *)data->data, NULL);
2172 }
2173
2174 #ifdef CLUSTER_SUPPORT
2175 static int client_get_tcp_info(struct sockaddr_storage *server,
2176                                struct sockaddr_storage *client)
2177 {
2178         socklen_t length;
2179         if (server_fd == -1) {
2180                 return -1;
2181         }
2182         length = sizeof(*server);
2183         if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
2184                 return -1;
2185         }
2186         length = sizeof(*client);
2187         if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
2188                 return -1;
2189         }
2190         return 0;
2191 }
2192 #endif
2193
2194 /*
2195  * Send keepalive packets to our client
2196  */
2197 static bool keepalive_fn(const struct timeval *now, void *private_data)
2198 {
2199         if (!send_keepalive(smbd_server_fd())) {
2200                 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2201                 return False;
2202         }
2203         return True;
2204 }
2205
2206 /*
2207  * Do the recurring check if we're idle
2208  */
2209 static bool deadtime_fn(const struct timeval *now, void *private_data)
2210 {
2211         struct smbd_server_connection *sconn = smbd_server_conn;
2212         if ((conn_num_open(sconn) == 0)
2213             || (conn_idle_all(sconn, now->tv_sec))) {
2214                 DEBUG( 2, ( "Closing idle connection\n" ) );
2215                 messaging_send(smbd_messaging_context(), procid_self(),
2216                                MSG_SHUTDOWN, &data_blob_null);
2217                 return False;
2218         }
2219
2220         return True;
2221 }
2222
2223 /*
2224  * Do the recurring log file and smb.conf reload checks.
2225  */
2226
2227 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2228 {
2229         change_to_root_user();
2230
2231         /* update printer queue caches if necessary */
2232         update_monitored_printq_cache();
2233
2234         /* check if we need to reload services */
2235         check_reload(time(NULL));
2236
2237         /* Change machine password if neccessary. */
2238         attempt_machine_password_change();
2239
2240         /*
2241          * Force a log file check.
2242          */
2243         force_check_log_size();
2244         check_log_size();
2245         return true;
2246 }
2247
2248 /****************************************************************************
2249  Process commands from the client
2250 ****************************************************************************/
2251
2252 void smbd_process(void)
2253 {
2254         TALLOC_CTX *frame = talloc_stackframe();
2255         char remaddr[INET6_ADDRSTRLEN];
2256
2257         if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2258             lp_security() != SEC_SHARE) {
2259                 smbd_server_conn->allow_smb2 = true;
2260         }
2261
2262         /* Ensure child is set to blocking mode */
2263         set_blocking(smbd_server_fd(),True);
2264
2265         set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2266         set_socket_options(smbd_server_fd(), lp_socket_options());
2267
2268         /* this is needed so that we get decent entries
2269            in smbstatus for port 445 connects */
2270         set_remote_machine_name(get_peer_addr(smbd_server_fd(),
2271                                               remaddr,
2272                                               sizeof(remaddr)),
2273                                               false);
2274         reload_services(true);
2275
2276         /*
2277          * Before the first packet, check the global hosts allow/ hosts deny
2278          * parameters before doing any parsing of packets passed to us by the
2279          * client. This prevents attacks on our parsing code from hosts not in
2280          * the hosts allow list.
2281          */
2282
2283         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2284                           lp_hostsdeny(-1))) {
2285                 char addr[INET6_ADDRSTRLEN];
2286
2287                 /*
2288                  * send a negative session response "not listening on calling
2289                  * name"
2290                  */
2291                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2292                 DEBUG( 1, ("Connection denied from %s\n",
2293                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
2294                 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2295                                    0, false, NULL);
2296                 exit_server_cleanly("connection denied");
2297         }
2298
2299         static_init_rpc;
2300
2301         init_modules();
2302
2303         smb_perfcount_init();
2304
2305         if (!init_account_policy()) {
2306                 exit_server("Could not open account policy tdb.\n");
2307         }
2308
2309         if (*lp_rootdir()) {
2310                 if (chroot(lp_rootdir()) != 0) {
2311                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2312                         exit_server("Failed to chroot()");
2313                 }
2314                 if (chdir("/") == -1) {
2315                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2316                         exit_server("Failed to chroot()");
2317                 }
2318                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2319         }
2320
2321         if (!srv_init_signing(smbd_server_conn)) {
2322                 exit_server("Failed to init smb_signing");
2323         }
2324
2325         /* Setup oplocks */
2326         if (!init_oplocks(smbd_messaging_context()))
2327                 exit_server("Failed to init oplocks");
2328
2329         /* Setup aio signal handler. */
2330         initialize_async_io_handler();
2331
2332         /* register our message handlers */
2333         messaging_register(smbd_messaging_context(), NULL,
2334                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
2335         messaging_register(smbd_messaging_context(), NULL,
2336                            MSG_SMB_RELEASE_IP, msg_release_ip);
2337         messaging_register(smbd_messaging_context(), NULL,
2338                            MSG_SMB_CLOSE_FILE, msg_close_file);
2339
2340         /*
2341          * Use the default MSG_DEBUG handler to avoid rebroadcasting
2342          * MSGs to all child processes
2343          */
2344         messaging_deregister(smbd_messaging_context(),
2345                              MSG_DEBUG, NULL);
2346         messaging_register(smbd_messaging_context(), NULL,
2347                            MSG_DEBUG, debug_message);
2348
2349         if ((lp_keepalive() != 0)
2350             && !(event_add_idle(smbd_event_context(), NULL,
2351                                 timeval_set(lp_keepalive(), 0),
2352                                 "keepalive", keepalive_fn,
2353                                 NULL))) {
2354                 DEBUG(0, ("Could not add keepalive event\n"));
2355                 exit(1);
2356         }
2357
2358         if (!(event_add_idle(smbd_event_context(), NULL,
2359                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
2360                              "deadtime", deadtime_fn, NULL))) {
2361                 DEBUG(0, ("Could not add deadtime event\n"));
2362                 exit(1);
2363         }
2364
2365         if (!(event_add_idle(smbd_event_context(), NULL,
2366                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
2367                              "housekeeping", housekeeping_fn, NULL))) {
2368                 DEBUG(0, ("Could not add housekeeping event\n"));
2369                 exit(1);
2370         }
2371
2372 #ifdef CLUSTER_SUPPORT
2373
2374         if (lp_clustering()) {
2375                 /*
2376                  * We need to tell ctdb about our client's TCP
2377                  * connection, so that for failover ctdbd can send
2378                  * tickle acks, triggering a reconnection by the
2379                  * client.
2380                  */
2381
2382                 struct sockaddr_storage srv, clnt;
2383
2384                 if (client_get_tcp_info(&srv, &clnt) == 0) {
2385
2386                         NTSTATUS status;
2387
2388                         status = ctdbd_register_ips(
2389                                 messaging_ctdbd_connection(),
2390                                 &srv, &clnt, release_ip, NULL);
2391
2392                         if (!NT_STATUS_IS_OK(status)) {
2393                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
2394                                           nt_errstr(status)));
2395                         }
2396                 } else
2397                 {
2398                         DEBUG(0,("Unable to get tcp info for "
2399                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
2400                                  strerror(errno)));
2401                 }
2402         }
2403
2404 #endif
2405
2406         smbd_server_conn->nbt.got_session = false;
2407
2408         smbd_server_conn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2409
2410         smbd_server_conn->smb1.sessions.done_sesssetup = false;
2411         smbd_server_conn->smb1.sessions.max_send = BUFFER_SIZE;
2412         smbd_server_conn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
2413         /* users from session setup */
2414         smbd_server_conn->smb1.sessions.session_userlist = NULL;
2415         /* workgroup from session setup. */
2416         smbd_server_conn->smb1.sessions.session_workgroup = NULL;
2417         /* this holds info on user ids that are already validated for this VC */
2418         smbd_server_conn->smb1.sessions.validated_users = NULL;
2419         smbd_server_conn->smb1.sessions.next_vuid = VUID_OFFSET;
2420         smbd_server_conn->smb1.sessions.num_validated_vuids = 0;
2421 #ifdef HAVE_NETGROUP
2422         smbd_server_conn->smb1.sessions.my_yp_domain = NULL;
2423 #endif
2424
2425         conn_init(smbd_server_conn);
2426         if (!init_dptrs(smbd_server_conn)) {
2427                 exit_server("init_dptrs() failed");
2428         }
2429
2430         smbd_server_conn->smb1.fde = event_add_fd(smbd_event_context(),
2431                                                   smbd_server_conn,
2432                                                   smbd_server_fd(),
2433                                                   EVENT_FD_READ,
2434                                                   smbd_server_connection_handler,
2435                                                   smbd_server_conn);
2436         if (!smbd_server_conn->smb1.fde) {
2437                 exit_server("failed to create smbd_server_connection fde");
2438         }
2439
2440         TALLOC_FREE(frame);
2441
2442         while (True) {
2443                 NTSTATUS status;
2444
2445                 frame = talloc_stackframe_pool(8192);
2446
2447                 errno = 0;
2448
2449                 status = smbd_server_connection_loop_once(smbd_server_conn);
2450                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
2451                     !NT_STATUS_IS_OK(status)) {
2452                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
2453                                   " exiting\n", nt_errstr(status)));
2454                         break;
2455                 }
2456
2457                 TALLOC_FREE(frame);
2458         }
2459
2460         exit_server_cleanly(NULL);
2461 }
2462
2463 bool req_is_in_chain(struct smb_request *req)
2464 {
2465         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
2466                 /*
2467                  * We're right now handling a subsequent request, so we must
2468                  * be in a chain
2469                  */
2470                 return true;
2471         }
2472
2473         if (!is_andx_req(req->cmd)) {
2474                 return false;
2475         }
2476
2477         if (req->wct < 2) {
2478                 /*
2479                  * Okay, an illegal request, but definitely not chained :-)
2480                  */
2481                 return false;
2482         }
2483
2484         return (CVAL(req->vwv+0, 0) != 0xFF);
2485 }