source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 /*
  24  * Size of data we can send to client. Set
  25  *  by the client for all protocols above CORE.
  26  *  Set by us for CORE protocol.
  27  */
  28 int max_send = BUFFER_SIZE;
  29 /*
  30  * Size of the data we can receive. Set by us.
  31  * Can be modified by the max xmit parameter.
  32  */
  33 int max_recv = BUFFER_SIZE;
  34
  35 SIG_ATOMIC_T reload_after_sighup = 0;
  36 SIG_ATOMIC_T got_sig_term = 0;
  37 extern bool global_machine_password_needs_changing;
  38 extern int max_send;
  39
  40 /* Accessor function for smb_read_error for smbd functions. */
  41
  42 /****************************************************************************
  43  Send an smb to a fd.
  44 ****************************************************************************/
  45
  46 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  47 {
  48         size_t len;
  49         size_t nwritten=0;
  50         ssize_t ret;
  51         char *buf_out = buffer;
  52
  53         /* Sign the outgoing packet if required. */
  54         srv_calculate_sign_mac(buf_out);
  55
  56         if (do_encrypt) {
  57                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  58                 if (!NT_STATUS_IS_OK(status)) {
  59                         DEBUG(0, ("send_smb: SMB encryption failed "
  60                                 "on outgoing packet! Error %s\n",
  61                                 nt_errstr(status) ));
  62                         return false;
  63                 }
  64         }
  65
  66         len = smb_len(buf_out) + 4;
  67
  68         while (nwritten < len) {
  69                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  70                 if (ret <= 0) {
  71                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  72                                 (int)len,(int)ret, strerror(errno) ));
  73                         srv_free_enc_buffer(buf_out);
  74                         return false;
  75                 }
  76                 nwritten += ret;
  77         }
  78
  79         srv_free_enc_buffer(buf_out);
  80         return true;
  81 }
  82
  83 /*******************************************************************
  84  Setup the word count and byte count for a smb message.
  85 ********************************************************************/
  86
  87 int srv_set_message(char *buf,
  88                         int num_words,
  89                         int num_bytes,
  90                         bool zero)
  91 {
  92         if (zero && (num_words || num_bytes)) {
  93                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
  94         }
  95         SCVAL(buf,smb_wct,num_words);
  96         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
  97         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
  98         return (smb_size + num_words*2 + num_bytes);
  99 }
 100
 101 static bool valid_smb_header(const uint8_t *inbuf)
 102 {
 103         if (is_encrypted_packet(inbuf)) {
 104                 return true;
 105         }
 106         /*
 107          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 108          * but it just looks weird to call strncmp for this one.
 109          */
 110         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 111 }
 112
 113 /* Socket functions for smbd packet processing. */
 114
 115 static bool valid_packet_size(size_t len)
 116 {
 117         /*
 118          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 119          * of header. Don't print the error if this fits.... JRA.
 120          */
 121
 122         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 123                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 124                                         (unsigned long)len));
 125                 return false;
 126         }
 127         return true;
 128 }
 129
 130 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 131                                       unsigned int timeout, ssize_t len)
 132 {
 133         if (len <= 0) {
 134                 return NT_STATUS_OK;
 135         }
 136
 137         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
 138 }
 139
 140 /****************************************************************************
 141  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 142 ****************************************************************************/
 143
 144 /*
 145  * Unfortunately, earlier versions of smbclient/libsmbclient
 146  * don't send this "standard" writeX header. I've fixed this
 147  * for 3.2 but we'll use the old method with earlier versions.
 148  * Windows and CIFSFS at least use this standard size. Not
 149  * sure about MacOSX.
 150  */
 151
 152 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 153                                 (2*14) + /* word count (including bcc) */ \
 154                                 1 /* pad byte */)
 155
 156 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 157                                                     const char lenbuf[4],
 158                                                     int fd, char **buffer,
 159                                                     unsigned int timeout,
 160                                                     size_t *p_unread,
 161                                                     size_t *len_ret)
 162 {
 163         /* Size of a WRITEX call (+4 byte len). */
 164         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 165         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 166         ssize_t toread;
 167         NTSTATUS status;
 168
 169         memcpy(writeX_header, lenbuf, 4);
 170
 171         status = read_socket_with_timeout(
 172                 fd, writeX_header + 4,
 173                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 174                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 175                 timeout, NULL);
 176
 177         if (!NT_STATUS_IS_OK(status)) {
 178                 return status;
 179         }
 180
 181         /*
 182          * Ok - now try and see if this is a possible
 183          * valid writeX call.
 184          */
 185
 186         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 187                 /*
 188                  * If the data offset is beyond what
 189                  * we've read, drain the extra bytes.
 190                  */
 191                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 192                 ssize_t newlen;
 193
 194                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 195                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 196                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 197                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 198                                         " failed to drain pending bytes");
 199                         }
 200                 } else {
 201                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 202                 }
 203
 204                 /* Spoof down the length and null out the bcc. */
 205                 set_message_bcc(writeX_header, 0);
 206                 newlen = smb_len(writeX_header);
 207
 208                 /* Copy the header we've written. */
 209
 210                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 211                                 writeX_header,
 212                                 sizeof(writeX_header));
 213
 214                 if (*buffer == NULL) {
 215                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 216                                   (int)sizeof(writeX_header)));
 217                         return NT_STATUS_NO_MEMORY;
 218                 }
 219
 220                 /* Work out the remaining bytes. */
 221                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 222                 *len_ret = newlen + 4;
 223                 return NT_STATUS_OK;
 224         }
 225
 226         if (!valid_packet_size(len)) {
 227                 return NT_STATUS_INVALID_PARAMETER;
 228         }
 229
 230         /*
 231          * Not a valid writeX call. Just do the standard
 232          * talloc and return.
 233          */
 234
 235         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 236
 237         if (*buffer == NULL) {
 238                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 239                           (int)len+4));
 240                 return NT_STATUS_NO_MEMORY;
 241         }
 242
 243         /* Copy in what we already read. */
 244         memcpy(*buffer,
 245                 writeX_header,
 246                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 247         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 248
 249         if(toread > 0) {
 250                 status = read_packet_remainder(
 251                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 252                         timeout, toread);
 253
 254                 if (!NT_STATUS_IS_OK(status)) {
 255                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 256                                    nt_errstr(status)));
 257                         return status;
 258                 }
 259         }
 260
 261         *len_ret = len + 4;
 262         return NT_STATUS_OK;
 263 }
 264
 265 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 266                                        char **buffer, unsigned int timeout,
 267                                        size_t *p_unread, size_t *plen)
 268 {
 269         char lenbuf[4];
 270         size_t len;
 271         int min_recv_size = lp_min_receive_file_size();
 272         NTSTATUS status;
 273
 274         *p_unread = 0;
 275
 276         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 277         if (!NT_STATUS_IS_OK(status)) {
 278                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 279                 return status;
 280         }
 281
 282         if (CVAL(lenbuf,0) == 0 &&
 283                         min_recv_size &&
 284                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 285                         !srv_is_signing_active()) {
 286
 287                 return receive_smb_raw_talloc_partial_read(
 288                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 289         }
 290
 291         if (!valid_packet_size(len)) {
 292                 return NT_STATUS_INVALID_PARAMETER;
 293         }
 294
 295         /*
 296          * The +4 here can't wrap, we've checked the length above already.
 297          */
 298
 299         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 300
 301         if (*buffer == NULL) {
 302                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 303                           (int)len+4));
 304                 return NT_STATUS_NO_MEMORY;
 305         }
 306
 307         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 308
 309         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 310         if (!NT_STATUS_IS_OK(status)) {
 311                 return status;
 312         }
 313
 314         *plen = len + 4;
 315         return NT_STATUS_OK;
 316 }
 317
 318 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 319                                    char **buffer, unsigned int timeout,
 320                                    size_t *p_unread, bool *p_encrypted,
 321                                    size_t *p_len)
 322 {
 323         size_t len = 0;
 324         NTSTATUS status;
 325
 326         *p_encrypted = false;
 327
 328         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 329                                         p_unread, &len);
 330         if (!NT_STATUS_IS_OK(status)) {
 331                 return status;
 332         }
 333
 334         if (is_encrypted_packet((uint8_t *)*buffer)) {
 335                 status = srv_decrypt_buffer(*buffer);
 336                 if (!NT_STATUS_IS_OK(status)) {
 337                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 338                                 "incoming packet! Error %s\n",
 339                                 nt_errstr(status) ));
 340                         return status;
 341                 }
 342                 *p_encrypted = true;
 343         }
 344
 345         /* Check the incoming SMB signature. */
 346         if (!srv_check_sign_mac(*buffer, true)) {
 347                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 348                           "incoming packet!\n"));
 349                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 350         }
 351
 352         *p_len = len;
 353         return NT_STATUS_OK;
 354 }
 355
 356 /*
 357  * Initialize a struct smb_request from an inbuf
 358  */
 359
 360 void init_smb_request(struct smb_request *req,
 361                         const uint8 *inbuf,
 362                         size_t unread_bytes,
 363                         bool encrypted)
 364 {
 365         size_t req_size = smb_len(inbuf) + 4;
 366         /* Ensure we have at least smb_size bytes. */
 367         if (req_size < smb_size) {
 368                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 369                         (unsigned int)req_size ));
 370                 exit_server_cleanly("Invalid SMB request");
 371         }
 372         req->flags2 = SVAL(inbuf, smb_flg2);
 373         req->smbpid = SVAL(inbuf, smb_pid);
 374         req->mid    = SVAL(inbuf, smb_mid);
 375         req->vuid   = SVAL(inbuf, smb_uid);
 376         req->tid    = SVAL(inbuf, smb_tid);
 377         req->wct    = CVAL(inbuf, smb_wct);
 378         req->unread_bytes = unread_bytes;
 379         req->encrypted = encrypted;
 380         req->conn = conn_find(req->tid);
 381         req->chain_fsp = NULL;
 382
 383         /* Ensure we have at least wct words and 2 bytes of bcc. */
 384         if (smb_size + req->wct*2 > req_size) {
 385                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 386                         (unsigned int)req->wct,
 387                         (unsigned int)req_size));
 388                 exit_server_cleanly("Invalid SMB request");
 389         }
 390         /* Ensure bcc is correct. */
 391         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 392                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 393                         "(wct = %u, size %u)\n",
 394                         (unsigned int)smb_buflen(inbuf),
 395                         (unsigned int)req->wct,
 396                         (unsigned int)req_size));
 397                 exit_server_cleanly("Invalid SMB request");
 398         }
 399         req->inbuf  = inbuf;
 400         req->outbuf = NULL;
 401 }
 402
 403 /****************************************************************************
 404  structure to hold a linked list of queued messages.
 405  for processing.
 406 ****************************************************************************/
 407
 408 static struct pending_message_list *deferred_open_queue;
 409
 410 /****************************************************************************
 411  Function to push a message onto the tail of a linked list of smb messages ready
 412  for processing.
 413 ****************************************************************************/
 414
 415 static bool push_queued_message(struct smb_request *req,
 416                                 struct timeval request_time,
 417                                 struct timeval end_time,
 418                                 char *private_data, size_t private_len)
 419 {
 420         int msg_len = smb_len(req->inbuf) + 4;
 421         struct pending_message_list *msg;
 422
 423         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 424
 425         if(msg == NULL) {
 426                 DEBUG(0,("push_message: malloc fail (1)\n"));
 427                 return False;
 428         }
 429
 430         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 431         if(msg->buf.data == NULL) {
 432                 DEBUG(0,("push_message: malloc fail (2)\n"));
 433                 TALLOC_FREE(msg);
 434                 return False;
 435         }
 436
 437         msg->request_time = request_time;
 438         msg->end_time = end_time;
 439         msg->encrypted = req->encrypted;
 440
 441         if (private_data) {
 442                 msg->private_data = data_blob_talloc(msg, private_data,
 443                                                      private_len);
 444                 if (msg->private_data.data == NULL) {
 445                         DEBUG(0,("push_message: malloc fail (3)\n"));
 446                         TALLOC_FREE(msg);
 447                         return False;
 448                 }
 449         }
 450
 451         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 452
 453         DEBUG(10,("push_message: pushed message length %u on "
 454                   "deferred_open_queue\n", (unsigned int)msg_len));
 455
 456         return True;
 457 }
 458
 459 /****************************************************************************
 460  Function to delete a sharing violation open message by mid.
 461 ****************************************************************************/
 462
 463 void remove_deferred_open_smb_message(uint16 mid)
 464 {
 465         struct pending_message_list *pml;
 466
 467         for (pml = deferred_open_queue; pml; pml = pml->next) {
 468                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 469                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 470                                   "deleting mid %u len %u\n",
 471                                   (unsigned int)mid,
 472                                   (unsigned int)pml->buf.length ));
 473                         DLIST_REMOVE(deferred_open_queue, pml);
 474                         TALLOC_FREE(pml);
 475                         return;
 476                 }
 477         }
 478 }
 479
 480 /****************************************************************************
 481  Move a sharing violation open retry message to the front of the list and
 482  schedule it for immediate processing.
 483 ****************************************************************************/
 484
 485 void schedule_deferred_open_smb_message(uint16 mid)
 486 {
 487         struct pending_message_list *pml;
 488         int i = 0;
 489
 490         for (pml = deferred_open_queue; pml; pml = pml->next) {
 491                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 492                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 493                         (unsigned int)msg_mid ));
 494                 if (mid == msg_mid) {
 495                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 496                                 mid ));
 497                         pml->end_time.tv_sec = 0;
 498                         pml->end_time.tv_usec = 0;
 499                         DLIST_PROMOTE(deferred_open_queue, pml);
 500                         return;
 501                 }
 502         }
 503
 504         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 505                 mid ));
 506 }
 507
 508 /****************************************************************************
 509  Return true if this mid is on the deferred queue.
 510 ****************************************************************************/
 511
 512 bool open_was_deferred(uint16 mid)
 513 {
 514         struct pending_message_list *pml;
 515
 516         for (pml = deferred_open_queue; pml; pml = pml->next) {
 517                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 518                         return True;
 519                 }
 520         }
 521         return False;
 522 }
 523
 524 /****************************************************************************
 525  Return the message queued by this mid.
 526 ****************************************************************************/
 527
 528 struct pending_message_list *get_open_deferred_message(uint16 mid)
 529 {
 530         struct pending_message_list *pml;
 531
 532         for (pml = deferred_open_queue; pml; pml = pml->next) {
 533                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 534                         return pml;
 535                 }
 536         }
 537         return NULL;
 538 }
 539
 540 /****************************************************************************
 541  Function to push a deferred open smb message onto a linked list of local smb
 542  messages ready for processing.
 543 ****************************************************************************/
 544
 545 bool push_deferred_smb_message(struct smb_request *req,
 546                                struct timeval request_time,
 547                                struct timeval timeout,
 548                                char *private_data, size_t priv_len)
 549 {
 550         struct timeval end_time;
 551
 552         if (req->unread_bytes) {
 553                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 554                         "unread_bytes = %u\n",
 555                         (unsigned int)req->unread_bytes ));
 556                 smb_panic("push_deferred_smb_message: "
 557                         "logic error unread_bytes != 0" );
 558         }
 559
 560         end_time = timeval_sum(&request_time, &timeout);
 561
 562         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 563                   "timeout time [%u.%06u]\n",
 564                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 565                   (unsigned int)end_time.tv_sec,
 566                   (unsigned int)end_time.tv_usec));
 567
 568         return push_queued_message(req, request_time, end_time,
 569                                    private_data, priv_len);
 570 }
 571
 572 struct idle_event {
 573         struct timed_event *te;
 574         struct timeval interval;
 575         char *name;
 576         bool (*handler)(const struct timeval *now, void *private_data);
 577         void *private_data;
 578 };
 579
 580 static void idle_event_handler(struct event_context *ctx,
 581                                struct timed_event *te,
 582                                const struct timeval *now,
 583                                void *private_data)
 584 {
 585         struct idle_event *event =
 586                 talloc_get_type_abort(private_data, struct idle_event);
 587
 588         TALLOC_FREE(event->te);
 589
 590         if (!event->handler(now, event->private_data)) {
 591                 /* Don't repeat, delete ourselves */
 592                 TALLOC_FREE(event);
 593                 return;
 594         }
 595
 596         event->te = event_add_timed(ctx, event,
 597                                     timeval_sum(now, &event->interval),
 598                                     event->name,
 599                                     idle_event_handler, event);
 600
 601         /* We can't do much but fail here. */
 602         SMB_ASSERT(event->te != NULL);
 603 }
 604
 605 struct idle_event *event_add_idle(struct event_context *event_ctx,
 606                                   TALLOC_CTX *mem_ctx,
 607                                   struct timeval interval,
 608                                   const char *name,
 609                                   bool (*handler)(const struct timeval *now,
 610                                                   void *private_data),
 611                                   void *private_data)
 612 {
 613         struct idle_event *result;
 614         struct timeval now = timeval_current();
 615
 616         result = TALLOC_P(mem_ctx, struct idle_event);
 617         if (result == NULL) {
 618                 DEBUG(0, ("talloc failed\n"));
 619                 return NULL;
 620         }
 621
 622         result->interval = interval;
 623         result->handler = handler;
 624         result->private_data = private_data;
 625
 626         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 627                 DEBUG(0, ("talloc failed\n"));
 628                 TALLOC_FREE(result);
 629                 return NULL;
 630         }
 631
 632         result->te = event_add_timed(event_ctx, result,
 633                                      timeval_sum(&now, &interval),
 634                                      result->name,
 635                                      idle_event_handler, result);
 636         if (result->te == NULL) {
 637                 DEBUG(0, ("event_add_timed failed\n"));
 638                 TALLOC_FREE(result);
 639                 return NULL;
 640         }
 641
 642         return result;
 643 }
 644
 645 /****************************************************************************
 646  Do all async processing in here. This includes kernel oplock messages, change
 647  notify events etc.
 648 ****************************************************************************/
 649
 650 static void async_processing(fd_set *pfds)
 651 {
 652         DEBUG(10,("async_processing: Doing async processing.\n"));
 653
 654         process_aio_queue();
 655
 656         process_kernel_oplocks(smbd_messaging_context(), pfds);
 657
 658         /* Do the aio check again after receive_local_message as it does a
 659            select and may have eaten our signal. */
 660         /* Is this till true? -- vl */
 661         process_aio_queue();
 662
 663         if (got_sig_term) {
 664                 exit_server_cleanly("termination signal");
 665         }
 666
 667         /* check for sighup processing */
 668         if (reload_after_sighup) {
 669                 change_to_root_user();
 670                 DEBUG(1,("Reloading services after SIGHUP\n"));
 671                 reload_services(False);
 672                 reload_after_sighup = 0;
 673         }
 674 }
 675
 676 /****************************************************************************
 677  Add a fd to the set we will be select(2)ing on.
 678 ****************************************************************************/
 679
 680 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 681 {
 682         if (fd != -1) {
 683                 FD_SET(fd, fds);
 684                 maxfd = MAX(maxfd, fd);
 685         }
 686
 687         return maxfd;
 688 }
 689
 690 /****************************************************************************
 691   Do a select on an two fd's - with timeout.
 692
 693   If a local udp message has been pushed onto the
 694   queue (this can only happen during oplock break
 695   processing) call async_processing()
 696
 697   If a pending smb message has been pushed onto the
 698   queue (this can only happen during oplock break
 699   processing) return this next.
 700
 701   If the first smbfd is ready then read an smb from it.
 702   if the second (loopback UDP) fd is ready then read a message
 703   from it and setup the buffer header to identify the length
 704   and from address.
 705   Returns False on timeout or error.
 706   Else returns True.
 707
 708 The timeout is in milliseconds
 709 ****************************************************************************/
 710
 711 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
 712                                        size_t *buffer_len,
 713                                        size_t *p_unread, bool *p_encrypted)
 714 {
 715         fd_set r_fds, w_fds;
 716         int selrtn;
 717         struct timeval to;
 718         int maxfd = 0;
 719         size_t len = 0;
 720         NTSTATUS status;
 721
 722         *p_unread = 0;
 723
 724  again:
 725
 726         to.tv_sec = SMBD_SELECT_TIMEOUT;
 727         to.tv_usec = 0;
 728
 729         /*
 730          * Note that this call must be before processing any SMB
 731          * messages as we need to synchronously process any messages
 732          * we may have sent to ourselves from the previous SMB.
 733          */
 734         message_dispatch(smbd_messaging_context());
 735
 736         /*
 737          * Check to see if we already have a message on the deferred open queue
 738          * and it's time to schedule.
 739          */
 740         if(deferred_open_queue != NULL) {
 741                 bool pop_message = False;
 742                 struct pending_message_list *msg = deferred_open_queue;
 743
 744                 if (timeval_is_zero(&msg->end_time)) {
 745                         pop_message = True;
 746                 } else {
 747                         struct timeval tv;
 748                         int64_t tdif;
 749
 750                         GetTimeOfDay(&tv);
 751                         tdif = usec_time_diff(&msg->end_time, &tv);
 752                         if (tdif <= 0) {
 753                                 /* Timed out. Schedule...*/
 754                                 pop_message = True;
 755                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 756                         } else {
 757                                 /* Make a more accurate select timeout. */
 758                                 to.tv_sec = tdif / 1000000;
 759                                 to.tv_usec = tdif % 1000000;
 760                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 761                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 762                         }
 763                 }
 764
 765                 if (pop_message) {
 766
 767                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 768                                                         msg->buf.length);
 769                         if (*buffer == NULL) {
 770                                 DEBUG(0, ("talloc failed\n"));
 771                                 return NT_STATUS_NO_MEMORY;
 772                         }
 773                         *buffer_len = msg->buf.length;
 774                         *p_encrypted = msg->encrypted;
 775
 776                         /* We leave this message on the queue so the open code can
 777                            know this is a retry. */
 778                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 779                         return NT_STATUS_OK;
 780                 }
 781         }
 782
 783         /*
 784          * Setup the select fd sets.
 785          */
 786
 787         FD_ZERO(&r_fds);
 788         FD_ZERO(&w_fds);
 789
 790         /*
 791          * Ensure we process oplock break messages by preference.
 792          * We have to do this before the select, after the select
 793          * and if the select returns EINTR. This is due to the fact
 794          * that the selects called from async_processing can eat an EINTR
 795          * caused by a signal (we can't take the break message there).
 796          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 797          */
 798
 799         if (oplock_message_waiting(&r_fds)) {
 800                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 801                 async_processing(&r_fds);
 802                 /*
 803                  * After async processing we must go and do the select again, as
 804                  * the state of the flag in fds for the server file descriptor is
 805                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 806                  */
 807                 goto again;
 808         }
 809
 810         /*
 811          * Are there any timed events waiting ? If so, ensure we don't
 812          * select for longer than it would take to wait for them.
 813          */
 814
 815         {
 816                 struct timeval now;
 817                 GetTimeOfDay(&now);
 818
 819                 event_add_to_select_args(smbd_event_context(), &now,
 820                                          &r_fds, &w_fds, &to, &maxfd);
 821         }
 822
 823         if (timeval_is_zero(&to)) {
 824                 /* Process a timed event now... */
 825                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 826                         goto again;
 827                 }
 828         }
 829
 830         {
 831                 int sav;
 832                 START_PROFILE(smbd_idle);
 833
 834                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 835                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 836
 837                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 838                 sav = errno;
 839
 840                 END_PROFILE(smbd_idle);
 841                 errno = sav;
 842         }
 843
 844         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 845                 goto again;
 846         }
 847
 848         /* if we get EINTR then maybe we have received an oplock
 849            signal - treat this as select returning 1. This is ugly, but
 850            is the best we can do until the oplock code knows more about
 851            signals */
 852         if (selrtn == -1 && errno == EINTR) {
 853                 async_processing(&r_fds);
 854                 /*
 855                  * After async processing we must go and do the select again, as
 856                  * the state of the flag in fds for the server file descriptor is
 857                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 858                  */
 859                 goto again;
 860         }
 861
 862         /* Check if error */
 863         if (selrtn == -1) {
 864                 /* something is wrong. Maybe the socket is dead? */
 865                 return map_nt_error_from_unix(errno);
 866         }
 867
 868         /* Did we timeout ? */
 869         if (selrtn == 0) {
 870                 goto again;
 871         }
 872
 873         /*
 874          * Ensure we process oplock break messages by preference.
 875          * This is IMPORTANT ! Otherwise we can starve other processes
 876          * sending us an oplock break message. JRA.
 877          */
 878
 879         if (oplock_message_waiting(&r_fds)) {
 880                 async_processing(&r_fds);
 881                 /*
 882                  * After async processing we must go and do the select again, as
 883                  * the state of the flag in fds for the server file descriptor is
 884                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 885                  */
 886                 goto again;
 887         }
 888
 889         /*
 890          * We've just woken up from a protentially long select sleep.
 891          * Ensure we process local messages as we need to synchronously
 892          * process any messages from other smbd's to avoid file rename race
 893          * conditions. This call is cheap if there are no messages waiting.
 894          * JRA.
 895          */
 896         message_dispatch(smbd_messaging_context());
 897
 898         status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
 899                                     p_unread, p_encrypted, &len);
 900
 901         if (!NT_STATUS_IS_OK(status)) {
 902                 return status;
 903         }
 904
 905         *buffer_len = len;
 906
 907         return NT_STATUS_OK;
 908 }
 909
 910 /*
 911  * Only allow 5 outstanding trans requests. We're allocating memory, so
 912  * prevent a DoS.
 913  */
 914
 915 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 916 {
 917         int count = 0;
 918         for (; list != NULL; list = list->next) {
 919
 920                 if (list->mid == mid) {
 921                         return NT_STATUS_INVALID_PARAMETER;
 922                 }
 923
 924                 count += 1;
 925         }
 926         if (count > 5) {
 927                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 928         }
 929
 930         return NT_STATUS_OK;
 931 }
 932
 933 /****************************************************************************
 934  We're terminating and have closed all our files/connections etc.
 935  If there are any pending local messages we need to respond to them
 936  before termination so that other smbds don't think we just died whilst
 937  holding oplocks.
 938 ****************************************************************************/
 939
 940 void respond_to_all_remaining_local_messages(void)
 941 {
 942         /*
 943          * Assert we have no exclusive open oplocks.
 944          */
 945
 946         if(get_number_of_exclusive_open_oplocks()) {
 947                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 948                         get_number_of_exclusive_open_oplocks() ));
 949                 return;
 950         }
 951
 952         process_kernel_oplocks(smbd_messaging_context(), NULL);
 953
 954         return;
 955 }
 956
 957
 958 /*
 959 These flags determine some of the permissions required to do an operation
 960
 961 Note that I don't set NEED_WRITE on some write operations because they
 962 are used by some brain-dead clients when printing, and I don't want to
 963 force write permissions on print services.
 964 */
 965 #define AS_USER (1<<0)
 966 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 967 #define TIME_INIT (1<<2)
 968 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 969 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 970 #define DO_CHDIR (1<<6)
 971
 972 /*
 973    define a list of possible SMB messages and their corresponding
 974    functions. Any message that has a NULL function is unimplemented -
 975    please feel free to contribute implementations!
 976 */
 977 static const struct smb_message_struct {
 978         const char *name;
 979         void (*fn)(struct smb_request *req);
 980         int flags;
 981 } smb_messages[256] = {
 982
 983 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 984 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 985 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 986 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 987 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 988 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 989 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 990 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 991 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 992 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 993 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 994 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 995 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 996 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 997 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 998 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 999 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1000 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1001 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1002 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1003 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1004 /* 0x15 */ { NULL, NULL, 0 },
1005 /* 0x16 */ { NULL, NULL, 0 },
1006 /* 0x17 */ { NULL, NULL, 0 },
1007 /* 0x18 */ { NULL, NULL, 0 },
1008 /* 0x19 */ { NULL, NULL, 0 },
1009 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1010 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1011 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1012 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1013 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1014 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1015 /* 0x20 */ { "SMBwritec", NULL,0},
1016 /* 0x21 */ { NULL, NULL, 0 },
1017 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1018 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1019 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1020 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1021 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1022 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1023 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1024 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1025 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1026 /* 0x2b */ { "SMBecho",reply_echo,0},
1027 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1028 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1029 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1030 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1031 /* 0x30 */ { NULL, NULL, 0 },
1032 /* 0x31 */ { NULL, NULL, 0 },
1033 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1034 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1035 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1036 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1037 /* 0x36 */ { NULL, NULL, 0 },
1038 /* 0x37 */ { NULL, NULL, 0 },
1039 /* 0x38 */ { NULL, NULL, 0 },
1040 /* 0x39 */ { NULL, NULL, 0 },
1041 /* 0x3a */ { NULL, NULL, 0 },
1042 /* 0x3b */ { NULL, NULL, 0 },
1043 /* 0x3c */ { NULL, NULL, 0 },
1044 /* 0x3d */ { NULL, NULL, 0 },
1045 /* 0x3e */ { NULL, NULL, 0 },
1046 /* 0x3f */ { NULL, NULL, 0 },
1047 /* 0x40 */ { NULL, NULL, 0 },
1048 /* 0x41 */ { NULL, NULL, 0 },
1049 /* 0x42 */ { NULL, NULL, 0 },
1050 /* 0x43 */ { NULL, NULL, 0 },
1051 /* 0x44 */ { NULL, NULL, 0 },
1052 /* 0x45 */ { NULL, NULL, 0 },
1053 /* 0x46 */ { NULL, NULL, 0 },
1054 /* 0x47 */ { NULL, NULL, 0 },
1055 /* 0x48 */ { NULL, NULL, 0 },
1056 /* 0x49 */ { NULL, NULL, 0 },
1057 /* 0x4a */ { NULL, NULL, 0 },
1058 /* 0x4b */ { NULL, NULL, 0 },
1059 /* 0x4c */ { NULL, NULL, 0 },
1060 /* 0x4d */ { NULL, NULL, 0 },
1061 /* 0x4e */ { NULL, NULL, 0 },
1062 /* 0x4f */ { NULL, NULL, 0 },
1063 /* 0x50 */ { NULL, NULL, 0 },
1064 /* 0x51 */ { NULL, NULL, 0 },
1065 /* 0x52 */ { NULL, NULL, 0 },
1066 /* 0x53 */ { NULL, NULL, 0 },
1067 /* 0x54 */ { NULL, NULL, 0 },
1068 /* 0x55 */ { NULL, NULL, 0 },
1069 /* 0x56 */ { NULL, NULL, 0 },
1070 /* 0x57 */ { NULL, NULL, 0 },
1071 /* 0x58 */ { NULL, NULL, 0 },
1072 /* 0x59 */ { NULL, NULL, 0 },
1073 /* 0x5a */ { NULL, NULL, 0 },
1074 /* 0x5b */ { NULL, NULL, 0 },
1075 /* 0x5c */ { NULL, NULL, 0 },
1076 /* 0x5d */ { NULL, NULL, 0 },
1077 /* 0x5e */ { NULL, NULL, 0 },
1078 /* 0x5f */ { NULL, NULL, 0 },
1079 /* 0x60 */ { NULL, NULL, 0 },
1080 /* 0x61 */ { NULL, NULL, 0 },
1081 /* 0x62 */ { NULL, NULL, 0 },
1082 /* 0x63 */ { NULL, NULL, 0 },
1083 /* 0x64 */ { NULL, NULL, 0 },
1084 /* 0x65 */ { NULL, NULL, 0 },
1085 /* 0x66 */ { NULL, NULL, 0 },
1086 /* 0x67 */ { NULL, NULL, 0 },
1087 /* 0x68 */ { NULL, NULL, 0 },
1088 /* 0x69 */ { NULL, NULL, 0 },
1089 /* 0x6a */ { NULL, NULL, 0 },
1090 /* 0x6b */ { NULL, NULL, 0 },
1091 /* 0x6c */ { NULL, NULL, 0 },
1092 /* 0x6d */ { NULL, NULL, 0 },
1093 /* 0x6e */ { NULL, NULL, 0 },
1094 /* 0x6f */ { NULL, NULL, 0 },
1095 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1096 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1097 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1098 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1099 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1100 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1101 /* 0x76 */ { NULL, NULL, 0 },
1102 /* 0x77 */ { NULL, NULL, 0 },
1103 /* 0x78 */ { NULL, NULL, 0 },
1104 /* 0x79 */ { NULL, NULL, 0 },
1105 /* 0x7a */ { NULL, NULL, 0 },
1106 /* 0x7b */ { NULL, NULL, 0 },
1107 /* 0x7c */ { NULL, NULL, 0 },
1108 /* 0x7d */ { NULL, NULL, 0 },
1109 /* 0x7e */ { NULL, NULL, 0 },
1110 /* 0x7f */ { NULL, NULL, 0 },
1111 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1112 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1113 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1114 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1115 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1116 /* 0x85 */ { NULL, NULL, 0 },
1117 /* 0x86 */ { NULL, NULL, 0 },
1118 /* 0x87 */ { NULL, NULL, 0 },
1119 /* 0x88 */ { NULL, NULL, 0 },
1120 /* 0x89 */ { NULL, NULL, 0 },
1121 /* 0x8a */ { NULL, NULL, 0 },
1122 /* 0x8b */ { NULL, NULL, 0 },
1123 /* 0x8c */ { NULL, NULL, 0 },
1124 /* 0x8d */ { NULL, NULL, 0 },
1125 /* 0x8e */ { NULL, NULL, 0 },
1126 /* 0x8f */ { NULL, NULL, 0 },
1127 /* 0x90 */ { NULL, NULL, 0 },
1128 /* 0x91 */ { NULL, NULL, 0 },
1129 /* 0x92 */ { NULL, NULL, 0 },
1130 /* 0x93 */ { NULL, NULL, 0 },
1131 /* 0x94 */ { NULL, NULL, 0 },
1132 /* 0x95 */ { NULL, NULL, 0 },
1133 /* 0x96 */ { NULL, NULL, 0 },
1134 /* 0x97 */ { NULL, NULL, 0 },
1135 /* 0x98 */ { NULL, NULL, 0 },
1136 /* 0x99 */ { NULL, NULL, 0 },
1137 /* 0x9a */ { NULL, NULL, 0 },
1138 /* 0x9b */ { NULL, NULL, 0 },
1139 /* 0x9c */ { NULL, NULL, 0 },
1140 /* 0x9d */ { NULL, NULL, 0 },
1141 /* 0x9e */ { NULL, NULL, 0 },
1142 /* 0x9f */ { NULL, NULL, 0 },
1143 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1144 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1145 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1146 /* 0xa3 */ { NULL, NULL, 0 },
1147 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1148 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1149 /* 0xa6 */ { NULL, NULL, 0 },
1150 /* 0xa7 */ { NULL, NULL, 0 },
1151 /* 0xa8 */ { NULL, NULL, 0 },
1152 /* 0xa9 */ { NULL, NULL, 0 },
1153 /* 0xaa */ { NULL, NULL, 0 },
1154 /* 0xab */ { NULL, NULL, 0 },
1155 /* 0xac */ { NULL, NULL, 0 },
1156 /* 0xad */ { NULL, NULL, 0 },
1157 /* 0xae */ { NULL, NULL, 0 },
1158 /* 0xaf */ { NULL, NULL, 0 },
1159 /* 0xb0 */ { NULL, NULL, 0 },
1160 /* 0xb1 */ { NULL, NULL, 0 },
1161 /* 0xb2 */ { NULL, NULL, 0 },
1162 /* 0xb3 */ { NULL, NULL, 0 },
1163 /* 0xb4 */ { NULL, NULL, 0 },
1164 /* 0xb5 */ { NULL, NULL, 0 },
1165 /* 0xb6 */ { NULL, NULL, 0 },
1166 /* 0xb7 */ { NULL, NULL, 0 },
1167 /* 0xb8 */ { NULL, NULL, 0 },
1168 /* 0xb9 */ { NULL, NULL, 0 },
1169 /* 0xba */ { NULL, NULL, 0 },
1170 /* 0xbb */ { NULL, NULL, 0 },
1171 /* 0xbc */ { NULL, NULL, 0 },
1172 /* 0xbd */ { NULL, NULL, 0 },
1173 /* 0xbe */ { NULL, NULL, 0 },
1174 /* 0xbf */ { NULL, NULL, 0 },
1175 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1176 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1177 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1178 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1179 /* 0xc4 */ { NULL, NULL, 0 },
1180 /* 0xc5 */ { NULL, NULL, 0 },
1181 /* 0xc6 */ { NULL, NULL, 0 },
1182 /* 0xc7 */ { NULL, NULL, 0 },
1183 /* 0xc8 */ { NULL, NULL, 0 },
1184 /* 0xc9 */ { NULL, NULL, 0 },
1185 /* 0xca */ { NULL, NULL, 0 },
1186 /* 0xcb */ { NULL, NULL, 0 },
1187 /* 0xcc */ { NULL, NULL, 0 },
1188 /* 0xcd */ { NULL, NULL, 0 },
1189 /* 0xce */ { NULL, NULL, 0 },
1190 /* 0xcf */ { NULL, NULL, 0 },
1191 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1192 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1193 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1194 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1195 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1196 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1197 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1198 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1199 /* 0xd8 */ { NULL, NULL, 0 },
1200 /* 0xd9 */ { NULL, NULL, 0 },
1201 /* 0xda */ { NULL, NULL, 0 },
1202 /* 0xdb */ { NULL, NULL, 0 },
1203 /* 0xdc */ { NULL, NULL, 0 },
1204 /* 0xdd */ { NULL, NULL, 0 },
1205 /* 0xde */ { NULL, NULL, 0 },
1206 /* 0xdf */ { NULL, NULL, 0 },
1207 /* 0xe0 */ { NULL, NULL, 0 },
1208 /* 0xe1 */ { NULL, NULL, 0 },
1209 /* 0xe2 */ { NULL, NULL, 0 },
1210 /* 0xe3 */ { NULL, NULL, 0 },
1211 /* 0xe4 */ { NULL, NULL, 0 },
1212 /* 0xe5 */ { NULL, NULL, 0 },
1213 /* 0xe6 */ { NULL, NULL, 0 },
1214 /* 0xe7 */ { NULL, NULL, 0 },
1215 /* 0xe8 */ { NULL, NULL, 0 },
1216 /* 0xe9 */ { NULL, NULL, 0 },
1217 /* 0xea */ { NULL, NULL, 0 },
1218 /* 0xeb */ { NULL, NULL, 0 },
1219 /* 0xec */ { NULL, NULL, 0 },
1220 /* 0xed */ { NULL, NULL, 0 },
1221 /* 0xee */ { NULL, NULL, 0 },
1222 /* 0xef */ { NULL, NULL, 0 },
1223 /* 0xf0 */ { NULL, NULL, 0 },
1224 /* 0xf1 */ { NULL, NULL, 0 },
1225 /* 0xf2 */ { NULL, NULL, 0 },
1226 /* 0xf3 */ { NULL, NULL, 0 },
1227 /* 0xf4 */ { NULL, NULL, 0 },
1228 /* 0xf5 */ { NULL, NULL, 0 },
1229 /* 0xf6 */ { NULL, NULL, 0 },
1230 /* 0xf7 */ { NULL, NULL, 0 },
1231 /* 0xf8 */ { NULL, NULL, 0 },
1232 /* 0xf9 */ { NULL, NULL, 0 },
1233 /* 0xfa */ { NULL, NULL, 0 },
1234 /* 0xfb */ { NULL, NULL, 0 },
1235 /* 0xfc */ { NULL, NULL, 0 },
1236 /* 0xfd */ { NULL, NULL, 0 },
1237 /* 0xfe */ { NULL, NULL, 0 },
1238 /* 0xff */ { NULL, NULL, 0 }
1239
1240 };
1241
1242 /*******************************************************************
1243  allocate and initialize a reply packet
1244 ********************************************************************/
1245
1246 bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
1247                    uint8_t num_words, uint32_t num_bytes)
1248 {
1249         /*
1250          * Protect against integer wrap
1251          */
1252         if ((num_bytes > 0xffffff)
1253             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1254                 char *msg;
1255                 if (asprintf(&msg, "num_bytes too large: %u",
1256                              (unsigned)num_bytes) == -1) {
1257                         msg = CONST_DISCARD(char *, "num_bytes too large");
1258                 }
1259                 smb_panic(msg);
1260         }
1261
1262         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1263                                smb_size + num_words*2 + num_bytes);
1264         if (*outbuf == NULL) {
1265                 return false;
1266         }
1267
1268         construct_reply_common(inbuf, *outbuf);
1269         srv_set_message(*outbuf, num_words, num_bytes, false);
1270         /*
1271          * Zero out the word area, the caller has to take care of the bcc area
1272          * himself
1273          */
1274         if (num_words != 0) {
1275                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1276         }
1277
1278         return true;
1279 }
1280
1281 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1282 {
1283         char *outbuf;
1284         if (!create_outbuf(req, (char *)req->inbuf, &outbuf, num_words,
1285                            num_bytes)) {
1286                 smb_panic("could not allocate output buffer\n");
1287         }
1288         req->outbuf = (uint8_t *)outbuf;
1289 }
1290
1291
1292 /*******************************************************************
1293  Dump a packet to a file.
1294 ********************************************************************/
1295
1296 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1297 {
1298         int fd, i;
1299         char *fname = NULL;
1300         if (DEBUGLEVEL < 50) {
1301                 return;
1302         }
1303
1304         if (len < 4) len = smb_len(data)+4;
1305         for (i=1;i<100;i++) {
1306                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1307                              type ? "req" : "resp") == -1) {
1308                         return;
1309                 }
1310                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1311                 if (fd != -1 || errno != EEXIST) break;
1312         }
1313         if (fd != -1) {
1314                 ssize_t ret = write(fd, data, len);
1315                 if (ret != len)
1316                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1317                 close(fd);
1318                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1319         }
1320         SAFE_FREE(fname);
1321 }
1322
1323 /****************************************************************************
1324  Prepare everything for calling the actual request function, and potentially
1325  call the request function via the "new" interface.
1326
1327  Return False if the "legacy" function needs to be called, everything is
1328  prepared.
1329
1330  Return True if we're done.
1331
1332  I know this API sucks, but it is the one with the least code change I could
1333  find.
1334 ****************************************************************************/
1335
1336 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1337 {
1338         int flags;
1339         uint16 session_tag;
1340         connection_struct *conn = NULL;
1341
1342         static uint16 last_session_tag = UID_FIELD_INVALID;
1343
1344         errno = 0;
1345
1346         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1347          * so subtract 4 from it. */
1348         if (!valid_smb_header(req->inbuf)
1349             || (size < (smb_size - 4))) {
1350                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1351                          smb_len(req->inbuf)));
1352                 exit_server_cleanly("Non-SMB packet");
1353         }
1354
1355         if (smb_messages[type].fn == NULL) {
1356                 DEBUG(0,("Unknown message type %d!\n",type));
1357                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1358                 reply_unknown_new(req, type);
1359                 return NULL;
1360         }
1361
1362         flags = smb_messages[type].flags;
1363
1364         /* In share mode security we must ignore the vuid. */
1365         session_tag = (lp_security() == SEC_SHARE)
1366                 ? UID_FIELD_INVALID : req->vuid;
1367         conn = req->conn;
1368
1369         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1370                  (int)sys_getpid(), (unsigned long)conn));
1371
1372         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1373
1374         /* Ensure this value is replaced in the incoming packet. */
1375         SSVAL(req->inbuf,smb_uid,session_tag);
1376
1377         /*
1378          * Ensure the correct username is in current_user_info.  This is a
1379          * really ugly bugfix for problems with multiple session_setup_and_X's
1380          * being done and allowing %U and %G substitutions to work correctly.
1381          * There is a reason this code is done here, don't move it unless you
1382          * know what you're doing... :-).
1383          * JRA.
1384          */
1385
1386         if (session_tag != last_session_tag) {
1387                 user_struct *vuser = NULL;
1388
1389                 last_session_tag = session_tag;
1390                 if(session_tag != UID_FIELD_INVALID) {
1391                         vuser = get_valid_user_struct(session_tag);
1392                         if (vuser) {
1393                                 set_current_user_info(
1394                                         vuser->server_info->sanitized_username,
1395                                         vuser->server_info->unix_name,
1396                                         pdb_get_fullname(vuser->server_info
1397                                                          ->sam_account),
1398                                         pdb_get_domain(vuser->server_info
1399                                                        ->sam_account));
1400                         }
1401                 }
1402         }
1403
1404         /* Does this call need to be run as the connected user? */
1405         if (flags & AS_USER) {
1406
1407                 /* Does this call need a valid tree connection? */
1408                 if (!conn) {
1409                         /*
1410                          * Amazingly, the error code depends on the command
1411                          * (from Samba4).
1412                          */
1413                         if (type == SMBntcreateX) {
1414                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1415                         } else {
1416                                 reply_doserror(req, ERRSRV, ERRinvnid);
1417                         }
1418                         return NULL;
1419                 }
1420
1421                 if (!change_to_user(conn,session_tag)) {
1422                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1423                         return conn;
1424                 }
1425
1426                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1427
1428                 /* Does it need write permission? */
1429                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1430                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1431                         return conn;
1432                 }
1433
1434                 /* IPC services are limited */
1435                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1436                         reply_doserror(req, ERRSRV,ERRaccess);
1437                         return conn;
1438                 }
1439         } else {
1440                 /* This call needs to be run as root */
1441                 change_to_root_user();
1442         }
1443
1444         /* load service specific parameters */
1445         if (conn) {
1446                 if (req->encrypted) {
1447                         conn->encrypted_tid = true;
1448                         /* encrypted required from now on. */
1449                         conn->encrypt_level = Required;
1450                 } else if (ENCRYPTION_REQUIRED(conn)) {
1451                         uint8 com = CVAL(req->inbuf,smb_com);
1452                         if (com != SMBtrans2 && com != SMBtranss2) {
1453                                 exit_server_cleanly("encryption required "
1454                                         "on connection");
1455                                 return conn;
1456                         }
1457                 }
1458
1459                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1460                                          (flags & (AS_USER|DO_CHDIR)
1461                                           ?True:False))) {
1462                         reply_doserror(req, ERRSRV, ERRaccess);
1463                         return conn;
1464                 }
1465                 conn->num_smb_operations++;
1466         }
1467
1468         /* does this protocol need to be run as guest? */
1469         if ((flags & AS_GUEST)
1470             && (!change_to_guest() ||
1471                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1472                               lp_hostsdeny(-1)))) {
1473                 reply_doserror(req, ERRSRV, ERRaccess);
1474                 return conn;
1475         }
1476
1477         smb_messages[type].fn(req);
1478         return req->conn;
1479 }
1480
1481 /****************************************************************************
1482  Construct a reply to the incoming packet.
1483 ****************************************************************************/
1484
1485 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1486 {
1487         uint8 type = CVAL(inbuf,smb_com);
1488         connection_struct *conn;
1489         struct smb_request *req;
1490
1491         chain_size = 0;
1492
1493         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1494                 smb_panic("could not allocate smb_request");
1495         }
1496         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1497
1498         conn = switch_message(type, req, size);
1499
1500         if (req->unread_bytes) {
1501                 /* writeX failed. drain socket. */
1502                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1503                                 req->unread_bytes) {
1504                         smb_panic("failed to drain pending bytes");
1505                 }
1506                 req->unread_bytes = 0;
1507         }
1508
1509         if (req->outbuf == NULL) {
1510                 return;
1511         }
1512
1513         if (CVAL(req->outbuf,0) == 0) {
1514                 show_msg((char *)req->outbuf);
1515         }
1516
1517         if (!srv_send_smb(smbd_server_fd(),
1518                         (char *)req->outbuf,
1519                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1520                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1521         }
1522
1523         TALLOC_FREE(req);
1524
1525         return;
1526 }
1527
1528 /****************************************************************************
1529  Process an smb from the client
1530 ****************************************************************************/
1531
1532 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1533 {
1534         static int trans_num;
1535         int msg_type = CVAL(inbuf,0);
1536
1537         DO_PROFILE_INC(smb_count);
1538
1539         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1540                     smb_len(inbuf) ) );
1541         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1542                                 (int)nread,
1543                                 (unsigned int)unread_bytes ));
1544
1545         if (msg_type != 0) {
1546                 /*
1547                  * NetBIOS session request, keepalive, etc.
1548                  */
1549                 reply_special(inbuf);
1550                 return;
1551         }
1552
1553         show_msg(inbuf);
1554
1555         construct_reply(inbuf,nread,unread_bytes,encrypted);
1556
1557         trans_num++;
1558 }
1559
1560 /****************************************************************************
1561  Return a string containing the function name of a SMB command.
1562 ****************************************************************************/
1563
1564 const char *smb_fn_name(int type)
1565 {
1566         const char *unknown_name = "SMBunknown";
1567
1568         if (smb_messages[type].name == NULL)
1569                 return(unknown_name);
1570
1571         return(smb_messages[type].name);
1572 }
1573
1574 /****************************************************************************
1575  Helper functions for contruct_reply.
1576 ****************************************************************************/
1577
1578 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1579
1580 void add_to_common_flags2(uint32 v)
1581 {
1582         common_flags2 |= v;
1583 }
1584
1585 void remove_from_common_flags2(uint32 v)
1586 {
1587         common_flags2 &= ~v;
1588 }
1589
1590 void construct_reply_common(const char *inbuf, char *outbuf)
1591 {
1592         srv_set_message(outbuf,0,0,false);
1593
1594         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1595         SIVAL(outbuf,smb_rcls,0);
1596         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1597         SSVAL(outbuf,smb_flg2,
1598                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1599                 common_flags2);
1600         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1601
1602         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1603         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1604         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1605         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1606 }
1607
1608 /****************************************************************************
1609  Construct a chained reply and add it to the already made reply
1610 ****************************************************************************/
1611
1612 void chain_reply(struct smb_request *req)
1613 {
1614         static char *orig_inbuf;
1615
1616         /*
1617          * Dirty little const_discard: We mess with req->inbuf, which is
1618          * declared as const. If maybe at some point this routine gets
1619          * rewritten, this const_discard could go away.
1620          */
1621         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1622         int size = smb_len(req->inbuf)+4;
1623
1624         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1625         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1626         char *inbuf2;
1627         int outsize2;
1628         int new_size;
1629         char inbuf_saved[smb_wct];
1630         char *outbuf = (char *)req->outbuf;
1631         size_t outsize = smb_len(outbuf) + 4;
1632         size_t outsize_padded;
1633         size_t padding;
1634         size_t ofs, to_move;
1635
1636         struct smb_request *req2;
1637         size_t caller_outputlen;
1638         char *caller_output;
1639
1640         /* Maybe its not chained, or it's an error packet. */
1641         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1642                 SCVAL(outbuf,smb_vwv0,0xFF);
1643                 return;
1644         }
1645
1646         if (chain_size == 0) {
1647                 /* this is the first part of the chain */
1648                 orig_inbuf = inbuf;
1649         }
1650
1651         /*
1652          * We need to save the output the caller added to the chain so that we
1653          * can splice it into the final output buffer later.
1654          */
1655
1656         caller_outputlen = outsize - smb_wct;
1657
1658         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1659
1660         if (caller_output == NULL) {
1661                 /* TODO: NT_STATUS_NO_MEMORY */
1662                 smb_panic("could not dup outbuf");
1663         }
1664
1665         /*
1666          * The original Win95 redirector dies on a reply to
1667          * a lockingX and read chain unless the chain reply is
1668          * 4 byte aligned. JRA.
1669          */
1670
1671         outsize_padded = (outsize + 3) & ~3;
1672         padding = outsize_padded - outsize;
1673
1674         /*
1675          * remember how much the caller added to the chain, only counting
1676          * stuff after the parameter words
1677          */
1678         chain_size += (outsize_padded - smb_wct);
1679
1680         /*
1681          * work out pointers into the original packets. The
1682          * headers on these need to be filled in
1683          */
1684         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1685
1686         /* remember the original command type */
1687         smb_com1 = CVAL(orig_inbuf,smb_com);
1688
1689         /* save the data which will be overwritten by the new headers */
1690         memcpy(inbuf_saved,inbuf2,smb_wct);
1691
1692         /* give the new packet the same header as the last part of the SMB */
1693         memmove(inbuf2,inbuf,smb_wct);
1694
1695         /* create the in buffer */
1696         SCVAL(inbuf2,smb_com,smb_com2);
1697
1698         /* work out the new size for the in buffer. */
1699         new_size = size - (inbuf2 - inbuf);
1700         if (new_size < 0) {
1701                 DEBUG(0,("chain_reply: chain packet size incorrect "
1702                          "(orig size = %d, offset = %d)\n",
1703                          size, (int)(inbuf2 - inbuf) ));
1704                 exit_server_cleanly("Bad chained packet");
1705                 return;
1706         }
1707
1708         /* And set it in the header. */
1709         smb_setlen(inbuf2, new_size - 4);
1710
1711         DEBUG(3,("Chained message\n"));
1712         show_msg(inbuf2);
1713
1714         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1715                 smb_panic("could not allocate smb_request");
1716         }
1717         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1718         req2->chain_fsp = req->chain_fsp;
1719
1720         /* process the request */
1721         switch_message(smb_com2, req2, new_size);
1722
1723         /*
1724          * We don't accept deferred operations in chained requests.
1725          */
1726         SMB_ASSERT(req2->outbuf != NULL);
1727         outsize2 = smb_len(req2->outbuf)+4;
1728
1729         /*
1730          * Move away the new command output so that caller_output fits in,
1731          * copy in the caller_output saved above.
1732          */
1733
1734         SMB_ASSERT(outsize_padded >= smb_wct);
1735
1736         /*
1737          * "ofs" is the space we need for caller_output. Equal to
1738          * caller_outputlen plus the padding.
1739          */
1740
1741         ofs = outsize_padded - smb_wct;
1742
1743         /*
1744          * "to_move" is the amount of bytes the secondary routine gave us
1745          */
1746
1747         to_move = outsize2 - smb_wct;
1748
1749         if (to_move + ofs + smb_wct + chain_size > max_send) {
1750                 smb_panic("replies too large -- would have to cut");
1751         }
1752
1753         /*
1754          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1755          * the first request in the chain. So we have to re-allocate it. In
1756          * the "old" API the only outbuf ever used is the global OutBuffer
1757          * which is always large enough.
1758          */
1759
1760         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1761                                       to_move + ofs + smb_wct);
1762         if (outbuf == NULL) {
1763                 smb_panic("could not realloc outbuf");
1764         }
1765
1766         req->outbuf = (uint8 *)outbuf;
1767
1768         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1769         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1770
1771         /*
1772          * copy the new reply header over the old one but preserve the smb_com
1773          * field
1774          */
1775         memmove(outbuf, req2->outbuf, smb_wct);
1776         SCVAL(outbuf, smb_com, smb_com1);
1777
1778         /*
1779          * We've just copied in the whole "wct" area from the secondary
1780          * function. Fix up the chaining: com2 and the offset need to be
1781          * readjusted.
1782          */
1783
1784         SCVAL(outbuf, smb_vwv0, smb_com2);
1785         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1786
1787         if (padding != 0) {
1788
1789                 /*
1790                  * Due to padding we have some uninitialized bytes after the
1791                  * caller's output
1792                  */
1793
1794                 memset(outbuf + outsize, 0, padding);
1795         }
1796
1797         smb_setlen(outbuf, outsize2 + caller_outputlen + padding - 4);
1798
1799         /*
1800          * restore the saved data, being careful not to overwrite any data
1801          * from the reply header
1802          */
1803         memcpy(inbuf2,inbuf_saved,smb_wct);
1804
1805         SAFE_FREE(caller_output);
1806         TALLOC_FREE(req2);
1807
1808         /*
1809          * Reset the chain_size for our caller's offset calculations
1810          */
1811
1812         chain_size -= (outsize_padded - smb_wct);
1813
1814         return;
1815 }
1816
1817 /****************************************************************************
1818  Check if services need reloading.
1819 ****************************************************************************/
1820
1821 void check_reload(time_t t)
1822 {
1823         static pid_t mypid = 0;
1824         static time_t last_smb_conf_reload_time = 0;
1825         static time_t last_printer_reload_time = 0;
1826         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1827
1828         if(last_smb_conf_reload_time == 0) {
1829                 last_smb_conf_reload_time = t;
1830                 /* Our printing subsystem might not be ready at smbd start up.
1831                    Then no printer is available till the first printers check
1832                    is performed.  A lower initial interval circumvents this. */
1833                 if ( printcap_cache_time > 60 )
1834                         last_printer_reload_time = t - printcap_cache_time + 60;
1835                 else
1836                         last_printer_reload_time = t;
1837         }
1838
1839         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1840                 /* randomize over 60 second the printcap reload to avoid all
1841                  * process hitting cupsd at the same time */
1842                 int time_range = 60;
1843
1844                 last_printer_reload_time += random() % time_range;
1845                 mypid = getpid();
1846         }
1847
1848         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1849                 reload_services(True);
1850                 reload_after_sighup = False;
1851                 last_smb_conf_reload_time = t;
1852         }
1853
1854         /* 'printcap cache time = 0' disable the feature */
1855
1856         if ( printcap_cache_time != 0 )
1857         {
1858                 /* see if it's time to reload or if the clock has been set back */
1859
1860                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1861                         || (t-last_printer_reload_time  < 0) )
1862                 {
1863                         DEBUG( 3,( "Printcap cache time expired.\n"));
1864                         reload_printers();
1865                         last_printer_reload_time = t;
1866                 }
1867         }
1868 }
1869
1870 /****************************************************************************
1871  Process commands from the client
1872 ****************************************************************************/
1873
1874 void smbd_process(void)
1875 {
1876         unsigned int num_smbs = 0;
1877         size_t unread_bytes = 0;
1878
1879         char addr[INET6_ADDRSTRLEN];
1880
1881         /*
1882          * Before the first packet, check the global hosts allow/ hosts deny
1883          * parameters before doing any parsing of packets passed to us by the
1884          * client. This prevents attacks on our parsing code from hosts not in
1885          * the hosts allow list.
1886          */
1887
1888         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1889                           lp_hostsdeny(-1))) {
1890                 /*
1891                  * send a negative session response "not listening on calling
1892                  * name"
1893                  */
1894                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1895                 DEBUG( 1, ("Connection denied from %s\n",
1896                            client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1897                 (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1898                 exit_server_cleanly("connection denied");
1899         }
1900
1901         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1902
1903         while (True) {
1904                 NTSTATUS status;
1905                 char *inbuf = NULL;
1906                 size_t inbuf_len = 0;
1907                 bool encrypted = false;
1908                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
1909
1910                 errno = 0;
1911
1912                 run_events(smbd_event_context(), 0, NULL, NULL);
1913
1914                 status = receive_message_or_smb(
1915                         talloc_tos(), &inbuf, &inbuf_len,
1916                         &unread_bytes, &encrypted);
1917
1918                 if (!NT_STATUS_IS_OK(status)) {
1919                         DEBUG(3, ("receive_message_or_smb failed: %s, "
1920                                   "exiting\n", nt_errstr(status)));
1921                         return;
1922                 }
1923
1924                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
1925
1926                 TALLOC_FREE(inbuf);
1927
1928                 num_smbs++;
1929
1930                 /* The timeout_processing function isn't run nearly
1931                    often enough to implement 'max log size' without
1932                    overrunning the size of the file by many megabytes.
1933                    This is especially true if we are running at debug
1934                    level 10.  Checking every 50 SMBs is a nice
1935                    tradeoff of performance vs log file size overrun. */
1936
1937                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1938                         change_to_root_user();
1939                         check_log_size();
1940                 }
1941                 TALLOC_FREE(frame);
1942         }
1943 }