source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/pcap.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39
  40 extern bool global_machine_password_needs_changing;
  41
  42 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  43                                    char *outbuf);
  44 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
  45
  46 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  47 {
  48         bool ok;
  49
  50         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  51                 return true;
  52         }
  53
  54         sconn->smb1.echo_handler.ref_count++;
  55
  56         if (sconn->smb1.echo_handler.ref_count > 1) {
  57                 return true;
  58         }
  59
  60         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  61
  62         do {
  63                 ok = fcntl_lock(
  64                         sconn->smb1.echo_handler.socket_lock_fd,
  65                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  66         } while (!ok && (errno == EINTR));
  67
  68         if (!ok) {
  69                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  70                 return false;
  71         }
  72
  73         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  74
  75         return true;
  76 }
  77
  78 void smbd_lock_socket(struct smbd_server_connection *sconn)
  79 {
  80         if (!smbd_lock_socket_internal(sconn)) {
  81                 exit_server_cleanly("failed to lock socket");
  82         }
  83 }
  84
  85 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  86 {
  87         bool ok;
  88
  89         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  90                 return true;
  91         }
  92
  93         sconn->smb1.echo_handler.ref_count--;
  94
  95         if (sconn->smb1.echo_handler.ref_count > 0) {
  96                 return true;
  97         }
  98
  99         do {
 100                 ok = fcntl_lock(
 101                         sconn->smb1.echo_handler.socket_lock_fd,
 102                         SMB_F_SETLKW, 0, 0, F_UNLCK);
 103         } while (!ok && (errno == EINTR));
 104
 105         if (!ok) {
 106                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 107                 return false;
 108         }
 109
 110         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 111
 112         return true;
 113 }
 114
 115 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 116 {
 117         if (!smbd_unlock_socket_internal(sconn)) {
 118                 exit_server_cleanly("failed to unlock socket");
 119         }
 120 }
 121
 122 /* Accessor function for smb_read_error for smbd functions. */
 123
 124 /****************************************************************************
 125  Send an smb to a fd.
 126 ****************************************************************************/
 127
 128 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 129                   bool do_signing, uint32_t seqnum,
 130                   bool do_encrypt,
 131                   struct smb_perfcount_data *pcd)
 132 {
 133         size_t len = 0;
 134         size_t nwritten=0;
 135         ssize_t ret;
 136         char *buf_out = buffer;
 137
 138         smbd_lock_socket(sconn);
 139
 140         if (do_signing) {
 141                 /* Sign the outgoing packet if required. */
 142                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 143         }
 144
 145         if (do_encrypt) {
 146                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 147                 if (!NT_STATUS_IS_OK(status)) {
 148                         DEBUG(0, ("send_smb: SMB encryption failed "
 149                                 "on outgoing packet! Error %s\n",
 150                                 nt_errstr(status) ));
 151                         goto out;
 152                 }
 153         }
 154
 155         len = smb_len(buf_out) + 4;
 156
 157         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
 158         if (ret <= 0) {
 159
 160                 char addr[INET6_ADDRSTRLEN];
 161                 /*
 162                  * Try and give an error message saying what
 163                  * client failed.
 164                  */
 165                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 166                          (int)sys_getpid(), (int)len,
 167                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 168                          (int)ret, strerror(errno) ));
 169
 170                 srv_free_enc_buffer(buf_out);
 171                 goto out;
 172         }
 173
 174         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 175         srv_free_enc_buffer(buf_out);
 176 out:
 177         SMB_PERFCOUNT_END(pcd);
 178
 179         smbd_unlock_socket(sconn);
 180         return true;
 181 }
 182
 183 /*******************************************************************
 184  Setup the word count and byte count for a smb message.
 185 ********************************************************************/
 186
 187 int srv_set_message(char *buf,
 188                         int num_words,
 189                         int num_bytes,
 190                         bool zero)
 191 {
 192         if (zero && (num_words || num_bytes)) {
 193                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 194         }
 195         SCVAL(buf,smb_wct,num_words);
 196         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 197         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 198         return (smb_size + num_words*2 + num_bytes);
 199 }
 200
 201 static bool valid_smb_header(const uint8_t *inbuf)
 202 {
 203         if (is_encrypted_packet(inbuf)) {
 204                 return true;
 205         }
 206         /*
 207          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 208          * but it just looks weird to call strncmp for this one.
 209          */
 210         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 211 }
 212
 213 /* Socket functions for smbd packet processing. */
 214
 215 static bool valid_packet_size(size_t len)
 216 {
 217         /*
 218          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 219          * of header. Don't print the error if this fits.... JRA.
 220          */
 221
 222         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 223                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 224                                         (unsigned long)len));
 225                 return false;
 226         }
 227         return true;
 228 }
 229
 230 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 231                                       unsigned int timeout, ssize_t len)
 232 {
 233         NTSTATUS status;
 234
 235         if (len <= 0) {
 236                 return NT_STATUS_OK;
 237         }
 238
 239         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 240         if (!NT_STATUS_IS_OK(status)) {
 241                 char addr[INET6_ADDRSTRLEN];
 242                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 243                           "error = %s.\n",
 244                           get_peer_addr(fd, addr, sizeof(addr)),
 245                           nt_errstr(status)));
 246         }
 247         return status;
 248 }
 249
 250 /****************************************************************************
 251  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 252 ****************************************************************************/
 253
 254 /*
 255  * Unfortunately, earlier versions of smbclient/libsmbclient
 256  * don't send this "standard" writeX header. I've fixed this
 257  * for 3.2 but we'll use the old method with earlier versions.
 258  * Windows and CIFSFS at least use this standard size. Not
 259  * sure about MacOSX.
 260  */
 261
 262 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 263                                 (2*14) + /* word count (including bcc) */ \
 264                                 1 /* pad byte */)
 265
 266 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 267                                                     const char lenbuf[4],
 268                                                     struct smbd_server_connection *sconn,
 269                                                     int sock,
 270                                                     char **buffer,
 271                                                     unsigned int timeout,
 272                                                     size_t *p_unread,
 273                                                     size_t *len_ret)
 274 {
 275         /* Size of a WRITEX call (+4 byte len). */
 276         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 277         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 278         ssize_t toread;
 279         NTSTATUS status;
 280
 281         memcpy(writeX_header, lenbuf, 4);
 282
 283         status = read_fd_with_timeout(
 284                 sock, writeX_header + 4,
 285                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 286                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 287                 timeout, NULL);
 288
 289         if (!NT_STATUS_IS_OK(status)) {
 290                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 291                           "error = %s.\n",
 292                           tsocket_address_string(sconn->remote_address,
 293                                                  talloc_tos()),
 294                           nt_errstr(status)));
 295                 return status;
 296         }
 297
 298         /*
 299          * Ok - now try and see if this is a possible
 300          * valid writeX call.
 301          */
 302
 303         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 304                 /*
 305                  * If the data offset is beyond what
 306                  * we've read, drain the extra bytes.
 307                  */
 308                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 309                 ssize_t newlen;
 310
 311                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 312                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 313                         if (drain_socket(sock, drain) != drain) {
 314                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 315                                         " failed to drain pending bytes");
 316                         }
 317                 } else {
 318                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 319                 }
 320
 321                 /* Spoof down the length and null out the bcc. */
 322                 set_message_bcc(writeX_header, 0);
 323                 newlen = smb_len(writeX_header);
 324
 325                 /* Copy the header we've written. */
 326
 327                 *buffer = (char *)talloc_memdup(mem_ctx,
 328                                 writeX_header,
 329                                 sizeof(writeX_header));
 330
 331                 if (*buffer == NULL) {
 332                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 333                                   (int)sizeof(writeX_header)));
 334                         return NT_STATUS_NO_MEMORY;
 335                 }
 336
 337                 /* Work out the remaining bytes. */
 338                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 339                 *len_ret = newlen + 4;
 340                 return NT_STATUS_OK;
 341         }
 342
 343         if (!valid_packet_size(len)) {
 344                 return NT_STATUS_INVALID_PARAMETER;
 345         }
 346
 347         /*
 348          * Not a valid writeX call. Just do the standard
 349          * talloc and return.
 350          */
 351
 352         *buffer = talloc_array(mem_ctx, char, len+4);
 353
 354         if (*buffer == NULL) {
 355                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 356                           (int)len+4));
 357                 return NT_STATUS_NO_MEMORY;
 358         }
 359
 360         /* Copy in what we already read. */
 361         memcpy(*buffer,
 362                 writeX_header,
 363                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 364         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 365
 366         if(toread > 0) {
 367                 status = read_packet_remainder(
 368                         sock,
 369                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 370                         timeout, toread);
 371
 372                 if (!NT_STATUS_IS_OK(status)) {
 373                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 374                                    nt_errstr(status)));
 375                         return status;
 376                 }
 377         }
 378
 379         *len_ret = len + 4;
 380         return NT_STATUS_OK;
 381 }
 382
 383 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 384                                        struct smbd_server_connection *sconn,
 385                                        int sock,
 386                                        char **buffer, unsigned int timeout,
 387                                        size_t *p_unread, size_t *plen)
 388 {
 389         char lenbuf[4];
 390         size_t len;
 391         int min_recv_size = lp_min_receive_file_size();
 392         NTSTATUS status;
 393
 394         *p_unread = 0;
 395
 396         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 397                                                   &len);
 398         if (!NT_STATUS_IS_OK(status)) {
 399                 return status;
 400         }
 401
 402         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 403             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 404                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 405             !srv_is_signing_active(sconn) &&
 406             sconn->smb1.echo_handler.trusted_fde == NULL) {
 407
 408                 return receive_smb_raw_talloc_partial_read(
 409                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 410                         p_unread, plen);
 411         }
 412
 413         if (!valid_packet_size(len)) {
 414                 return NT_STATUS_INVALID_PARAMETER;
 415         }
 416
 417         /*
 418          * The +4 here can't wrap, we've checked the length above already.
 419          */
 420
 421         *buffer = talloc_array(mem_ctx, char, len+4);
 422
 423         if (*buffer == NULL) {
 424                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 425                           (int)len+4));
 426                 return NT_STATUS_NO_MEMORY;
 427         }
 428
 429         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 430
 431         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 432         if (!NT_STATUS_IS_OK(status)) {
 433                 return status;
 434         }
 435
 436         *plen = len + 4;
 437         return NT_STATUS_OK;
 438 }
 439
 440 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 441                                    struct smbd_server_connection *sconn,
 442                                    int sock,
 443                                    char **buffer, unsigned int timeout,
 444                                    size_t *p_unread, bool *p_encrypted,
 445                                    size_t *p_len,
 446                                    uint32_t *seqnum,
 447                                    bool trusted_channel)
 448 {
 449         size_t len = 0;
 450         NTSTATUS status;
 451
 452         *p_encrypted = false;
 453
 454         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 455                                         p_unread, &len);
 456         if (!NT_STATUS_IS_OK(status)) {
 457                 DEBUG(1, ("read_smb_length_return_keepalive failed for "
 458                           "client %s read error = %s.\n",
 459                           tsocket_address_string(sconn->remote_address,
 460                                                  talloc_tos()),
 461                           nt_errstr(status)));
 462                 return status;
 463         }
 464
 465         if (is_encrypted_packet((uint8_t *)*buffer)) {
 466                 status = srv_decrypt_buffer(*buffer);
 467                 if (!NT_STATUS_IS_OK(status)) {
 468                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 469                                 "incoming packet! Error %s\n",
 470                                 nt_errstr(status) ));
 471                         return status;
 472                 }
 473                 *p_encrypted = true;
 474         }
 475
 476         /* Check the incoming SMB signature. */
 477         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 478                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 479                           "incoming packet!\n"));
 480                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 481         }
 482
 483         *p_len = len;
 484         return NT_STATUS_OK;
 485 }
 486
 487 /*
 488  * Initialize a struct smb_request from an inbuf
 489  */
 490
 491 static bool init_smb_request(struct smb_request *req,
 492                              struct smbd_server_connection *sconn,
 493                              const uint8 *inbuf,
 494                              size_t unread_bytes, bool encrypted,
 495                              uint32_t seqnum)
 496 {
 497         size_t req_size = smb_len(inbuf) + 4;
 498         /* Ensure we have at least smb_size bytes. */
 499         if (req_size < smb_size) {
 500                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 501                         (unsigned int)req_size ));
 502                 return false;
 503         }
 504         req->cmd    = CVAL(inbuf, smb_com);
 505         req->flags2 = SVAL(inbuf, smb_flg2);
 506         req->smbpid = SVAL(inbuf, smb_pid);
 507         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 508         req->seqnum = seqnum;
 509         req->vuid   = SVAL(inbuf, smb_uid);
 510         req->tid    = SVAL(inbuf, smb_tid);
 511         req->wct    = CVAL(inbuf, smb_wct);
 512         req->vwv    = discard_const_p(uint16_t, (inbuf+smb_vwv));
 513         req->buflen = smb_buflen(inbuf);
 514         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 515         req->unread_bytes = unread_bytes;
 516         req->encrypted = encrypted;
 517         req->sconn = sconn;
 518         req->conn = conn_find(sconn,req->tid);
 519         req->chain_fsp = NULL;
 520         req->chain_outbuf = NULL;
 521         req->done = false;
 522         req->smb2req = NULL;
 523         smb_init_perfcount_data(&req->pcd);
 524
 525         /* Ensure we have at least wct words and 2 bytes of bcc. */
 526         if (smb_size + req->wct*2 > req_size) {
 527                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 528                         (unsigned int)req->wct,
 529                         (unsigned int)req_size));
 530                 return false;
 531         }
 532         /* Ensure bcc is correct. */
 533         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 534                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 535                         "(wct = %u, size %u)\n",
 536                         (unsigned int)req->buflen,
 537                         (unsigned int)req->wct,
 538                         (unsigned int)req_size));
 539                 return false;
 540         }
 541
 542         req->outbuf = NULL;
 543         return true;
 544 }
 545
 546 static void process_smb(struct smbd_server_connection *conn,
 547                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 548                         uint32_t seqnum, bool encrypted,
 549                         struct smb_perfcount_data *deferred_pcd);
 550
 551 static void smbd_deferred_open_timer(struct event_context *ev,
 552                                      struct timed_event *te,
 553                                      struct timeval _tval,
 554                                      void *private_data)
 555 {
 556         struct pending_message_list *msg = talloc_get_type(private_data,
 557                                            struct pending_message_list);
 558         TALLOC_CTX *mem_ctx = talloc_tos();
 559         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 560         uint8_t *inbuf;
 561
 562         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 563                                          msg->buf.length);
 564         if (inbuf == NULL) {
 565                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 566                 return;
 567         }
 568
 569         /* We leave this message on the queue so the open code can
 570            know this is a retry. */
 571         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 572                 (unsigned long long)mid ));
 573
 574         /* Mark the message as processed so this is not
 575          * re-processed in error. */
 576         msg->processed = true;
 577
 578         process_smb(smbd_server_conn, inbuf,
 579                     msg->buf.length, 0,
 580                     msg->seqnum, msg->encrypted, &msg->pcd);
 581
 582         /* If it's still there and was processed, remove it. */
 583         msg = get_deferred_open_message_smb(mid);
 584         if (msg && msg->processed) {
 585                 remove_deferred_open_message_smb(mid);
 586         }
 587 }
 588
 589 /****************************************************************************
 590  Function to push a message onto the tail of a linked list of smb messages ready
 591  for processing.
 592 ****************************************************************************/
 593
 594 static bool push_queued_message(struct smb_request *req,
 595                                 struct timeval request_time,
 596                                 struct timeval end_time,
 597                                 char *private_data, size_t private_len)
 598 {
 599         int msg_len = smb_len(req->inbuf) + 4;
 600         struct pending_message_list *msg;
 601
 602         msg = talloc_zero(NULL, struct pending_message_list);
 603
 604         if(msg == NULL) {
 605                 DEBUG(0,("push_message: malloc fail (1)\n"));
 606                 return False;
 607         }
 608
 609         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 610         if(msg->buf.data == NULL) {
 611                 DEBUG(0,("push_message: malloc fail (2)\n"));
 612                 TALLOC_FREE(msg);
 613                 return False;
 614         }
 615
 616         msg->request_time = request_time;
 617         msg->seqnum = req->seqnum;
 618         msg->encrypted = req->encrypted;
 619         msg->processed = false;
 620         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 621
 622         if (private_data) {
 623                 msg->private_data = data_blob_talloc(msg, private_data,
 624                                                      private_len);
 625                 if (msg->private_data.data == NULL) {
 626                         DEBUG(0,("push_message: malloc fail (3)\n"));
 627                         TALLOC_FREE(msg);
 628                         return False;
 629                 }
 630         }
 631
 632         msg->te = event_add_timed(server_event_context(),
 633                                   msg,
 634                                   end_time,
 635                                   smbd_deferred_open_timer,
 636                                   msg);
 637         if (!msg->te) {
 638                 DEBUG(0,("push_message: event_add_timed failed\n"));
 639                 TALLOC_FREE(msg);
 640                 return false;
 641         }
 642
 643         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 644
 645         DEBUG(10,("push_message: pushed message length %u on "
 646                   "deferred_open_queue\n", (unsigned int)msg_len));
 647
 648         return True;
 649 }
 650
 651 /****************************************************************************
 652  Function to delete a sharing violation open message by mid.
 653 ****************************************************************************/
 654
 655 void remove_deferred_open_message_smb(uint64_t mid)
 656 {
 657         struct pending_message_list *pml;
 658
 659         if (smbd_server_conn->using_smb2) {
 660                 remove_deferred_open_message_smb2(smbd_server_conn, mid);
 661                 return;
 662         }
 663
 664         for (pml = deferred_open_queue; pml; pml = pml->next) {
 665                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 666                         DEBUG(10,("remove_deferred_open_message_smb: "
 667                                   "deleting mid %llu len %u\n",
 668                                   (unsigned long long)mid,
 669                                   (unsigned int)pml->buf.length ));
 670                         DLIST_REMOVE(deferred_open_queue, pml);
 671                         TALLOC_FREE(pml);
 672                         return;
 673                 }
 674         }
 675 }
 676
 677 /****************************************************************************
 678  Move a sharing violation open retry message to the front of the list and
 679  schedule it for immediate processing.
 680 ****************************************************************************/
 681
 682 void schedule_deferred_open_message_smb(uint64_t mid)
 683 {
 684         struct pending_message_list *pml;
 685         int i = 0;
 686
 687         if (smbd_server_conn->using_smb2) {
 688                 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
 689                 return;
 690         }
 691
 692         for (pml = deferred_open_queue; pml; pml = pml->next) {
 693                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 694
 695                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 696                         "msg_mid = %llu\n",
 697                         i++,
 698                         (unsigned long long)msg_mid ));
 699
 700                 if (mid == msg_mid) {
 701                         struct timed_event *te;
 702
 703                         if (pml->processed) {
 704                                 /* A processed message should not be
 705                                  * rescheduled. */
 706                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 707                                         "message mid %llu was already processed\n",
 708                                         (unsigned long long)msg_mid ));
 709                                 continue;
 710                         }
 711
 712                         DEBUG(10,("schedule_deferred_open_message_smb: "
 713                                 "scheduling mid %llu\n",
 714                                 (unsigned long long)mid ));
 715
 716                         te = event_add_timed(server_event_context(),
 717                                              pml,
 718                                              timeval_zero(),
 719                                              smbd_deferred_open_timer,
 720                                              pml);
 721                         if (!te) {
 722                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 723                                         "event_add_timed() failed, "
 724                                         "skipping mid %llu\n",
 725                                         (unsigned long long)msg_mid ));
 726                         }
 727
 728                         TALLOC_FREE(pml->te);
 729                         pml->te = te;
 730                         DLIST_PROMOTE(deferred_open_queue, pml);
 731                         return;
 732                 }
 733         }
 734
 735         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 736                 "find message mid %llu\n",
 737                 (unsigned long long)mid ));
 738 }
 739
 740 /****************************************************************************
 741  Return true if this mid is on the deferred queue and was not yet processed.
 742 ****************************************************************************/
 743
 744 bool open_was_deferred(uint64_t mid)
 745 {
 746         struct pending_message_list *pml;
 747
 748         if (smbd_server_conn->using_smb2) {
 749                 return open_was_deferred_smb2(smbd_server_conn, mid);
 750         }
 751
 752         for (pml = deferred_open_queue; pml; pml = pml->next) {
 753                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 754                         return True;
 755                 }
 756         }
 757         return False;
 758 }
 759
 760 /****************************************************************************
 761  Return the message queued by this mid.
 762 ****************************************************************************/
 763
 764 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
 765 {
 766         struct pending_message_list *pml;
 767
 768         for (pml = deferred_open_queue; pml; pml = pml->next) {
 769                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 770                         return pml;
 771                 }
 772         }
 773         return NULL;
 774 }
 775
 776 /****************************************************************************
 777  Get the state data queued by this mid.
 778 ****************************************************************************/
 779
 780 bool get_deferred_open_message_state(struct smb_request *smbreq,
 781                                 struct timeval *p_request_time,
 782                                 void **pp_state)
 783 {
 784         struct pending_message_list *pml;
 785
 786         if (smbd_server_conn->using_smb2) {
 787                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 788                                         p_request_time,
 789                                         pp_state);
 790         }
 791
 792         pml = get_deferred_open_message_smb(smbreq->mid);
 793         if (!pml) {
 794                 return false;
 795         }
 796         if (p_request_time) {
 797                 *p_request_time = pml->request_time;
 798         }
 799         if (pp_state) {
 800                 *pp_state = (void *)pml->private_data.data;
 801         }
 802         return true;
 803 }
 804
 805 /****************************************************************************
 806  Function to push a deferred open smb message onto a linked list of local smb
 807  messages ready for processing.
 808 ****************************************************************************/
 809
 810 bool push_deferred_open_message_smb(struct smb_request *req,
 811                                struct timeval request_time,
 812                                struct timeval timeout,
 813                                struct file_id id,
 814                                char *private_data, size_t priv_len)
 815 {
 816         struct timeval end_time;
 817
 818         if (req->smb2req) {
 819                 return push_deferred_open_message_smb2(req->smb2req,
 820                                                 request_time,
 821                                                 timeout,
 822                                                 id,
 823                                                 private_data,
 824                                                 priv_len);
 825         }
 826
 827         if (req->unread_bytes) {
 828                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 829                         "unread_bytes = %u\n",
 830                         (unsigned int)req->unread_bytes ));
 831                 smb_panic("push_deferred_open_message_smb: "
 832                         "logic error unread_bytes != 0" );
 833         }
 834
 835         end_time = timeval_sum(&request_time, &timeout);
 836
 837         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 838                 "len %u mid %llu timeout time [%u.%06u]\n",
 839                 (unsigned int) smb_len(req->inbuf)+4,
 840                 (unsigned long long)req->mid,
 841                 (unsigned int)end_time.tv_sec,
 842                 (unsigned int)end_time.tv_usec));
 843
 844         return push_queued_message(req, request_time, end_time,
 845                                    private_data, priv_len);
 846 }
 847
 848 static void smbd_sig_term_handler(struct tevent_context *ev,
 849                                   struct tevent_signal *se,
 850                                   int signum,
 851                                   int count,
 852                                   void *siginfo,
 853                                   void *private_data)
 854 {
 855         exit_server_cleanly("termination signal");
 856 }
 857
 858 void smbd_setup_sig_term_handler(void)
 859 {
 860         struct tevent_signal *se;
 861
 862         se = tevent_add_signal(server_event_context(),
 863                                server_event_context(),
 864                                SIGTERM, 0,
 865                                smbd_sig_term_handler,
 866                                NULL);
 867         if (!se) {
 868                 exit_server("failed to setup SIGTERM handler");
 869         }
 870 }
 871
 872 static void smbd_sig_hup_handler(struct tevent_context *ev,
 873                                   struct tevent_signal *se,
 874                                   int signum,
 875                                   int count,
 876                                   void *siginfo,
 877                                   void *private_data)
 878 {
 879         struct messaging_context *msg_ctx = talloc_get_type_abort(
 880                 private_data, struct messaging_context);
 881         change_to_root_user();
 882         DEBUG(1,("Reloading services after SIGHUP\n"));
 883         reload_services(msg_ctx, smbd_server_conn->sock, False);
 884         if (am_parent) {
 885                 pcap_cache_reload(ev, msg_ctx, &reload_pcap_change_notify);
 886         }
 887 }
 888
 889 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
 890                                 struct messaging_context *msg_ctx)
 891 {
 892         struct tevent_signal *se;
 893
 894         se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
 895                                msg_ctx);
 896         if (!se) {
 897                 exit_server("failed to setup SIGHUP handler");
 898         }
 899 }
 900
 901 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 902 {
 903         int timeout;
 904         int num_pfds = 0;
 905         int ret;
 906         bool retry;
 907
 908         timeout = SMBD_SELECT_TIMEOUT * 1000;
 909
 910         /*
 911          * Are there any timed events waiting ? If so, ensure we don't
 912          * select for longer than it would take to wait for them.
 913          */
 914
 915         event_add_to_poll_args(server_event_context(), conn,
 916                                &conn->pfds, &num_pfds, &timeout);
 917
 918         /* Process a signal and timed events now... */
 919         if (run_events_poll(server_event_context(), 0, NULL, 0)) {
 920                 return NT_STATUS_RETRY;
 921         }
 922
 923         {
 924                 int sav;
 925                 START_PROFILE(smbd_idle);
 926
 927                 ret = sys_poll(conn->pfds, num_pfds, timeout);
 928                 sav = errno;
 929
 930                 END_PROFILE(smbd_idle);
 931                 errno = sav;
 932         }
 933
 934         if (ret == -1) {
 935                 if (errno == EINTR) {
 936                         return NT_STATUS_RETRY;
 937                 }
 938                 return map_nt_error_from_unix(errno);
 939         }
 940
 941         retry = run_events_poll(server_event_context(), ret, conn->pfds,
 942                                 num_pfds);
 943         if (retry) {
 944                 return NT_STATUS_RETRY;
 945         }
 946
 947         /* Did we timeout ? */
 948         if (ret == 0) {
 949                 return NT_STATUS_RETRY;
 950         }
 951
 952         /* should not be reached */
 953         return NT_STATUS_INTERNAL_ERROR;
 954 }
 955
 956 /*
 957  * Only allow 5 outstanding trans requests. We're allocating memory, so
 958  * prevent a DoS.
 959  */
 960
 961 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 962 {
 963         int count = 0;
 964         for (; list != NULL; list = list->next) {
 965
 966                 if (list->mid == mid) {
 967                         return NT_STATUS_INVALID_PARAMETER;
 968                 }
 969
 970                 count += 1;
 971         }
 972         if (count > 5) {
 973                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 974         }
 975
 976         return NT_STATUS_OK;
 977 }
 978
 979 /*
 980 These flags determine some of the permissions required to do an operation
 981
 982 Note that I don't set NEED_WRITE on some write operations because they
 983 are used by some brain-dead clients when printing, and I don't want to
 984 force write permissions on print services.
 985 */
 986 #define AS_USER (1<<0)
 987 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 988 #define TIME_INIT (1<<2)
 989 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 990 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 991 #define DO_CHDIR (1<<6)
 992
 993 /*
 994    define a list of possible SMB messages and their corresponding
 995    functions. Any message that has a NULL function is unimplemented -
 996    please feel free to contribute implementations!
 997 */
 998 static const struct smb_message_struct {
 999         const char *name;
1000         void (*fn)(struct smb_request *req);
1001         int flags;
1002 } smb_messages[256] = {
1003
1004 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1005 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1006 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1007 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1008 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1009 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1010 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1011 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1012 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1013 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1014 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1015 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1016 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1017 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1018 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1019 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1020 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1021 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1022 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1023 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1024 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1025 /* 0x15 */ { NULL, NULL, 0 },
1026 /* 0x16 */ { NULL, NULL, 0 },
1027 /* 0x17 */ { NULL, NULL, 0 },
1028 /* 0x18 */ { NULL, NULL, 0 },
1029 /* 0x19 */ { NULL, NULL, 0 },
1030 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1031 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1032 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1033 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1034 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1035 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1036 /* 0x20 */ { "SMBwritec", NULL,0},
1037 /* 0x21 */ { NULL, NULL, 0 },
1038 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1039 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1040 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1041 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1042 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1043 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1044 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1045 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1046 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1047 /* 0x2b */ { "SMBecho",reply_echo,0},
1048 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1049 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1050 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1051 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1052 /* 0x30 */ { NULL, NULL, 0 },
1053 /* 0x31 */ { NULL, NULL, 0 },
1054 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1055 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1056 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1057 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1058 /* 0x36 */ { NULL, NULL, 0 },
1059 /* 0x37 */ { NULL, NULL, 0 },
1060 /* 0x38 */ { NULL, NULL, 0 },
1061 /* 0x39 */ { NULL, NULL, 0 },
1062 /* 0x3a */ { NULL, NULL, 0 },
1063 /* 0x3b */ { NULL, NULL, 0 },
1064 /* 0x3c */ { NULL, NULL, 0 },
1065 /* 0x3d */ { NULL, NULL, 0 },
1066 /* 0x3e */ { NULL, NULL, 0 },
1067 /* 0x3f */ { NULL, NULL, 0 },
1068 /* 0x40 */ { NULL, NULL, 0 },
1069 /* 0x41 */ { NULL, NULL, 0 },
1070 /* 0x42 */ { NULL, NULL, 0 },
1071 /* 0x43 */ { NULL, NULL, 0 },
1072 /* 0x44 */ { NULL, NULL, 0 },
1073 /* 0x45 */ { NULL, NULL, 0 },
1074 /* 0x46 */ { NULL, NULL, 0 },
1075 /* 0x47 */ { NULL, NULL, 0 },
1076 /* 0x48 */ { NULL, NULL, 0 },
1077 /* 0x49 */ { NULL, NULL, 0 },
1078 /* 0x4a */ { NULL, NULL, 0 },
1079 /* 0x4b */ { NULL, NULL, 0 },
1080 /* 0x4c */ { NULL, NULL, 0 },
1081 /* 0x4d */ { NULL, NULL, 0 },
1082 /* 0x4e */ { NULL, NULL, 0 },
1083 /* 0x4f */ { NULL, NULL, 0 },
1084 /* 0x50 */ { NULL, NULL, 0 },
1085 /* 0x51 */ { NULL, NULL, 0 },
1086 /* 0x52 */ { NULL, NULL, 0 },
1087 /* 0x53 */ { NULL, NULL, 0 },
1088 /* 0x54 */ { NULL, NULL, 0 },
1089 /* 0x55 */ { NULL, NULL, 0 },
1090 /* 0x56 */ { NULL, NULL, 0 },
1091 /* 0x57 */ { NULL, NULL, 0 },
1092 /* 0x58 */ { NULL, NULL, 0 },
1093 /* 0x59 */ { NULL, NULL, 0 },
1094 /* 0x5a */ { NULL, NULL, 0 },
1095 /* 0x5b */ { NULL, NULL, 0 },
1096 /* 0x5c */ { NULL, NULL, 0 },
1097 /* 0x5d */ { NULL, NULL, 0 },
1098 /* 0x5e */ { NULL, NULL, 0 },
1099 /* 0x5f */ { NULL, NULL, 0 },
1100 /* 0x60 */ { NULL, NULL, 0 },
1101 /* 0x61 */ { NULL, NULL, 0 },
1102 /* 0x62 */ { NULL, NULL, 0 },
1103 /* 0x63 */ { NULL, NULL, 0 },
1104 /* 0x64 */ { NULL, NULL, 0 },
1105 /* 0x65 */ { NULL, NULL, 0 },
1106 /* 0x66 */ { NULL, NULL, 0 },
1107 /* 0x67 */ { NULL, NULL, 0 },
1108 /* 0x68 */ { NULL, NULL, 0 },
1109 /* 0x69 */ { NULL, NULL, 0 },
1110 /* 0x6a */ { NULL, NULL, 0 },
1111 /* 0x6b */ { NULL, NULL, 0 },
1112 /* 0x6c */ { NULL, NULL, 0 },
1113 /* 0x6d */ { NULL, NULL, 0 },
1114 /* 0x6e */ { NULL, NULL, 0 },
1115 /* 0x6f */ { NULL, NULL, 0 },
1116 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1117 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1118 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1119 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1120 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1121 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1122 /* 0x76 */ { NULL, NULL, 0 },
1123 /* 0x77 */ { NULL, NULL, 0 },
1124 /* 0x78 */ { NULL, NULL, 0 },
1125 /* 0x79 */ { NULL, NULL, 0 },
1126 /* 0x7a */ { NULL, NULL, 0 },
1127 /* 0x7b */ { NULL, NULL, 0 },
1128 /* 0x7c */ { NULL, NULL, 0 },
1129 /* 0x7d */ { NULL, NULL, 0 },
1130 /* 0x7e */ { NULL, NULL, 0 },
1131 /* 0x7f */ { NULL, NULL, 0 },
1132 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1133 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1134 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1135 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1136 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1137 /* 0x85 */ { NULL, NULL, 0 },
1138 /* 0x86 */ { NULL, NULL, 0 },
1139 /* 0x87 */ { NULL, NULL, 0 },
1140 /* 0x88 */ { NULL, NULL, 0 },
1141 /* 0x89 */ { NULL, NULL, 0 },
1142 /* 0x8a */ { NULL, NULL, 0 },
1143 /* 0x8b */ { NULL, NULL, 0 },
1144 /* 0x8c */ { NULL, NULL, 0 },
1145 /* 0x8d */ { NULL, NULL, 0 },
1146 /* 0x8e */ { NULL, NULL, 0 },
1147 /* 0x8f */ { NULL, NULL, 0 },
1148 /* 0x90 */ { NULL, NULL, 0 },
1149 /* 0x91 */ { NULL, NULL, 0 },
1150 /* 0x92 */ { NULL, NULL, 0 },
1151 /* 0x93 */ { NULL, NULL, 0 },
1152 /* 0x94 */ { NULL, NULL, 0 },
1153 /* 0x95 */ { NULL, NULL, 0 },
1154 /* 0x96 */ { NULL, NULL, 0 },
1155 /* 0x97 */ { NULL, NULL, 0 },
1156 /* 0x98 */ { NULL, NULL, 0 },
1157 /* 0x99 */ { NULL, NULL, 0 },
1158 /* 0x9a */ { NULL, NULL, 0 },
1159 /* 0x9b */ { NULL, NULL, 0 },
1160 /* 0x9c */ { NULL, NULL, 0 },
1161 /* 0x9d */ { NULL, NULL, 0 },
1162 /* 0x9e */ { NULL, NULL, 0 },
1163 /* 0x9f */ { NULL, NULL, 0 },
1164 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1165 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1166 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1167 /* 0xa3 */ { NULL, NULL, 0 },
1168 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1169 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1170 /* 0xa6 */ { NULL, NULL, 0 },
1171 /* 0xa7 */ { NULL, NULL, 0 },
1172 /* 0xa8 */ { NULL, NULL, 0 },
1173 /* 0xa9 */ { NULL, NULL, 0 },
1174 /* 0xaa */ { NULL, NULL, 0 },
1175 /* 0xab */ { NULL, NULL, 0 },
1176 /* 0xac */ { NULL, NULL, 0 },
1177 /* 0xad */ { NULL, NULL, 0 },
1178 /* 0xae */ { NULL, NULL, 0 },
1179 /* 0xaf */ { NULL, NULL, 0 },
1180 /* 0xb0 */ { NULL, NULL, 0 },
1181 /* 0xb1 */ { NULL, NULL, 0 },
1182 /* 0xb2 */ { NULL, NULL, 0 },
1183 /* 0xb3 */ { NULL, NULL, 0 },
1184 /* 0xb4 */ { NULL, NULL, 0 },
1185 /* 0xb5 */ { NULL, NULL, 0 },
1186 /* 0xb6 */ { NULL, NULL, 0 },
1187 /* 0xb7 */ { NULL, NULL, 0 },
1188 /* 0xb8 */ { NULL, NULL, 0 },
1189 /* 0xb9 */ { NULL, NULL, 0 },
1190 /* 0xba */ { NULL, NULL, 0 },
1191 /* 0xbb */ { NULL, NULL, 0 },
1192 /* 0xbc */ { NULL, NULL, 0 },
1193 /* 0xbd */ { NULL, NULL, 0 },
1194 /* 0xbe */ { NULL, NULL, 0 },
1195 /* 0xbf */ { NULL, NULL, 0 },
1196 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1197 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1198 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1199 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1200 /* 0xc4 */ { NULL, NULL, 0 },
1201 /* 0xc5 */ { NULL, NULL, 0 },
1202 /* 0xc6 */ { NULL, NULL, 0 },
1203 /* 0xc7 */ { NULL, NULL, 0 },
1204 /* 0xc8 */ { NULL, NULL, 0 },
1205 /* 0xc9 */ { NULL, NULL, 0 },
1206 /* 0xca */ { NULL, NULL, 0 },
1207 /* 0xcb */ { NULL, NULL, 0 },
1208 /* 0xcc */ { NULL, NULL, 0 },
1209 /* 0xcd */ { NULL, NULL, 0 },
1210 /* 0xce */ { NULL, NULL, 0 },
1211 /* 0xcf */ { NULL, NULL, 0 },
1212 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1213 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1214 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1215 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1216 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1217 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1218 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1219 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1220 /* 0xd8 */ { NULL, NULL, 0 },
1221 /* 0xd9 */ { NULL, NULL, 0 },
1222 /* 0xda */ { NULL, NULL, 0 },
1223 /* 0xdb */ { NULL, NULL, 0 },
1224 /* 0xdc */ { NULL, NULL, 0 },
1225 /* 0xdd */ { NULL, NULL, 0 },
1226 /* 0xde */ { NULL, NULL, 0 },
1227 /* 0xdf */ { NULL, NULL, 0 },
1228 /* 0xe0 */ { NULL, NULL, 0 },
1229 /* 0xe1 */ { NULL, NULL, 0 },
1230 /* 0xe2 */ { NULL, NULL, 0 },
1231 /* 0xe3 */ { NULL, NULL, 0 },
1232 /* 0xe4 */ { NULL, NULL, 0 },
1233 /* 0xe5 */ { NULL, NULL, 0 },
1234 /* 0xe6 */ { NULL, NULL, 0 },
1235 /* 0xe7 */ { NULL, NULL, 0 },
1236 /* 0xe8 */ { NULL, NULL, 0 },
1237 /* 0xe9 */ { NULL, NULL, 0 },
1238 /* 0xea */ { NULL, NULL, 0 },
1239 /* 0xeb */ { NULL, NULL, 0 },
1240 /* 0xec */ { NULL, NULL, 0 },
1241 /* 0xed */ { NULL, NULL, 0 },
1242 /* 0xee */ { NULL, NULL, 0 },
1243 /* 0xef */ { NULL, NULL, 0 },
1244 /* 0xf0 */ { NULL, NULL, 0 },
1245 /* 0xf1 */ { NULL, NULL, 0 },
1246 /* 0xf2 */ { NULL, NULL, 0 },
1247 /* 0xf3 */ { NULL, NULL, 0 },
1248 /* 0xf4 */ { NULL, NULL, 0 },
1249 /* 0xf5 */ { NULL, NULL, 0 },
1250 /* 0xf6 */ { NULL, NULL, 0 },
1251 /* 0xf7 */ { NULL, NULL, 0 },
1252 /* 0xf8 */ { NULL, NULL, 0 },
1253 /* 0xf9 */ { NULL, NULL, 0 },
1254 /* 0xfa */ { NULL, NULL, 0 },
1255 /* 0xfb */ { NULL, NULL, 0 },
1256 /* 0xfc */ { NULL, NULL, 0 },
1257 /* 0xfd */ { NULL, NULL, 0 },
1258 /* 0xfe */ { NULL, NULL, 0 },
1259 /* 0xff */ { NULL, NULL, 0 }
1260
1261 };
1262
1263 /*******************************************************************
1264  allocate and initialize a reply packet
1265 ********************************************************************/
1266
1267 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1268                           const char *inbuf, char **outbuf, uint8_t num_words,
1269                           uint32_t num_bytes)
1270 {
1271         /*
1272          * Protect against integer wrap
1273          */
1274         if ((num_bytes > 0xffffff)
1275             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1276                 char *msg;
1277                 if (asprintf(&msg, "num_bytes too large: %u",
1278                              (unsigned)num_bytes) == -1) {
1279                         msg = discard_const_p(char, "num_bytes too large");
1280                 }
1281                 smb_panic(msg);
1282         }
1283
1284         *outbuf = talloc_array(mem_ctx, char,
1285                                smb_size + num_words*2 + num_bytes);
1286         if (*outbuf == NULL) {
1287                 return false;
1288         }
1289
1290         construct_reply_common(req, inbuf, *outbuf);
1291         srv_set_message(*outbuf, num_words, num_bytes, false);
1292         /*
1293          * Zero out the word area, the caller has to take care of the bcc area
1294          * himself
1295          */
1296         if (num_words != 0) {
1297                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1298         }
1299
1300         return true;
1301 }
1302
1303 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1304 {
1305         char *outbuf;
1306         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1307                            num_bytes)) {
1308                 smb_panic("could not allocate output buffer\n");
1309         }
1310         req->outbuf = (uint8_t *)outbuf;
1311 }
1312
1313
1314 /*******************************************************************
1315  Dump a packet to a file.
1316 ********************************************************************/
1317
1318 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1319 {
1320         int fd, i;
1321         char *fname = NULL;
1322         if (DEBUGLEVEL < 50) {
1323                 return;
1324         }
1325
1326         if (len < 4) len = smb_len(data)+4;
1327         for (i=1;i<100;i++) {
1328                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1329                              type ? "req" : "resp") == -1) {
1330                         return;
1331                 }
1332                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1333                 if (fd != -1 || errno != EEXIST) break;
1334         }
1335         if (fd != -1) {
1336                 ssize_t ret = write(fd, data, len);
1337                 if (ret != len)
1338                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1339                 close(fd);
1340                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1341         }
1342         SAFE_FREE(fname);
1343 }
1344
1345 /****************************************************************************
1346  Prepare everything for calling the actual request function, and potentially
1347  call the request function via the "new" interface.
1348
1349  Return False if the "legacy" function needs to be called, everything is
1350  prepared.
1351
1352  Return True if we're done.
1353
1354  I know this API sucks, but it is the one with the least code change I could
1355  find.
1356 ****************************************************************************/
1357
1358 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1359 {
1360         int flags;
1361         uint16 session_tag;
1362         connection_struct *conn = NULL;
1363         struct smbd_server_connection *sconn = req->sconn;
1364         char *raddr;
1365
1366         errno = 0;
1367
1368         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1369          * so subtract 4 from it. */
1370         if (!valid_smb_header(req->inbuf)
1371             || (size < (smb_size - 4))) {
1372                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1373                          smb_len(req->inbuf)));
1374                 exit_server_cleanly("Non-SMB packet");
1375         }
1376
1377         if (smb_messages[type].fn == NULL) {
1378                 DEBUG(0,("Unknown message type %d!\n",type));
1379                 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1380                 reply_unknown_new(req, type);
1381                 return NULL;
1382         }
1383
1384         flags = smb_messages[type].flags;
1385
1386         /* In share mode security we must ignore the vuid. */
1387         session_tag = (lp_security() == SEC_SHARE)
1388                 ? UID_FIELD_INVALID : req->vuid;
1389         conn = req->conn;
1390
1391         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1392                  (int)sys_getpid(), (unsigned long)conn));
1393
1394         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1395
1396         /* Ensure this value is replaced in the incoming packet. */
1397         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1398
1399         /*
1400          * Ensure the correct username is in current_user_info.  This is a
1401          * really ugly bugfix for problems with multiple session_setup_and_X's
1402          * being done and allowing %U and %G substitutions to work correctly.
1403          * There is a reason this code is done here, don't move it unless you
1404          * know what you're doing... :-).
1405          * JRA.
1406          */
1407
1408         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1409                 user_struct *vuser = NULL;
1410
1411                 sconn->smb1.sessions.last_session_tag = session_tag;
1412                 if(session_tag != UID_FIELD_INVALID) {
1413                         vuser = get_valid_user_struct(sconn, session_tag);
1414                         if (vuser) {
1415                                 set_current_user_info(
1416                                         vuser->session_info->unix_info->sanitized_username,
1417                                         vuser->session_info->unix_info->unix_name,
1418                                         vuser->session_info->info->domain_name);
1419                         }
1420                 }
1421         }
1422
1423         /* Does this call need to be run as the connected user? */
1424         if (flags & AS_USER) {
1425
1426                 /* Does this call need a valid tree connection? */
1427                 if (!conn) {
1428                         /*
1429                          * Amazingly, the error code depends on the command
1430                          * (from Samba4).
1431                          */
1432                         if (type == SMBntcreateX) {
1433                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1434                         } else {
1435                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1436                         }
1437                         return NULL;
1438                 }
1439
1440                 if (!change_to_user(conn,session_tag)) {
1441                         DEBUG(0, ("Error: Could not change to user. Removing "
1442                                 "deferred open, mid=%llu.\n",
1443                                 (unsigned long long)req->mid));
1444                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1445                         return conn;
1446                 }
1447
1448                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1449
1450                 /* Does it need write permission? */
1451                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1452                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1453                         return conn;
1454                 }
1455
1456                 /* IPC services are limited */
1457                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1458                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1459                         return conn;
1460                 }
1461         } else {
1462                 /* This call needs to be run as root */
1463                 change_to_root_user();
1464         }
1465
1466         /* load service specific parameters */
1467         if (conn) {
1468                 if (req->encrypted) {
1469                         conn->encrypted_tid = true;
1470                         /* encrypted required from now on. */
1471                         conn->encrypt_level = Required;
1472                 } else if (ENCRYPTION_REQUIRED(conn)) {
1473                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1474                                 exit_server_cleanly("encryption required "
1475                                         "on connection");
1476                                 return conn;
1477                         }
1478                 }
1479
1480                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1481                                          (flags & (AS_USER|DO_CHDIR)
1482                                           ?True:False))) {
1483                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1484                         return conn;
1485                 }
1486                 conn->num_smb_operations++;
1487         }
1488
1489         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1490                                                  talloc_tos());
1491         if (raddr == NULL) {
1492                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1493                 return conn;
1494         }
1495
1496         /* does this protocol need to be run as guest? */
1497         if ((flags & AS_GUEST)
1498             && (!change_to_guest() ||
1499                 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1500                               sconn->remote_hostname,
1501                               raddr))) {
1502                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1503                 return conn;
1504         }
1505
1506         smb_messages[type].fn(req);
1507         return req->conn;
1508 }
1509
1510 /****************************************************************************
1511  Construct a reply to the incoming packet.
1512 ****************************************************************************/
1513
1514 static void construct_reply(struct smbd_server_connection *sconn,
1515                             char *inbuf, int size, size_t unread_bytes,
1516                             uint32_t seqnum, bool encrypted,
1517                             struct smb_perfcount_data *deferred_pcd)
1518 {
1519         connection_struct *conn;
1520         struct smb_request *req;
1521
1522         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1523                 smb_panic("could not allocate smb_request");
1524         }
1525
1526         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1527                               encrypted, seqnum)) {
1528                 exit_server_cleanly("Invalid SMB request");
1529         }
1530
1531         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1532
1533         /* we popped this message off the queue - keep original perf data */
1534         if (deferred_pcd)
1535                 req->pcd = *deferred_pcd;
1536         else {
1537                 SMB_PERFCOUNT_START(&req->pcd);
1538                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1539                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1540         }
1541
1542         conn = switch_message(req->cmd, req, size);
1543
1544         if (req->unread_bytes) {
1545                 /* writeX failed. drain socket. */
1546                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1547                                 req->unread_bytes) {
1548                         smb_panic("failed to drain pending bytes");
1549                 }
1550                 req->unread_bytes = 0;
1551         }
1552
1553         if (req->done) {
1554                 TALLOC_FREE(req);
1555                 return;
1556         }
1557
1558         if (req->outbuf == NULL) {
1559                 return;
1560         }
1561
1562         if (CVAL(req->outbuf,0) == 0) {
1563                 show_msg((char *)req->outbuf);
1564         }
1565
1566         if (!srv_send_smb(req->sconn,
1567                         (char *)req->outbuf,
1568                         true, req->seqnum+1,
1569                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1570                         &req->pcd)) {
1571                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1572         }
1573
1574         TALLOC_FREE(req);
1575
1576         return;
1577 }
1578
1579 /****************************************************************************
1580  Process an smb from the client
1581 ****************************************************************************/
1582 static void process_smb(struct smbd_server_connection *sconn,
1583                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1584                         uint32_t seqnum, bool encrypted,
1585                         struct smb_perfcount_data *deferred_pcd)
1586 {
1587         int msg_type = CVAL(inbuf,0);
1588
1589         DO_PROFILE_INC(smb_count);
1590
1591         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1592                     smb_len(inbuf) ) );
1593         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1594                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1595
1596         if (msg_type != NBSSmessage) {
1597                 /*
1598                  * NetBIOS session request, keepalive, etc.
1599                  */
1600                 reply_special(sconn, (char *)inbuf, nread);
1601                 goto done;
1602         }
1603
1604         if (sconn->using_smb2) {
1605                 /* At this point we're not really using smb2,
1606                  * we make the decision here.. */
1607                 if (smbd_is_smb2_header(inbuf, nread)) {
1608                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1609                         return;
1610                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1611                                 && CVAL(inbuf, smb_com) != 0x72) {
1612                         /* This is a non-negprot SMB1 packet.
1613                            Disable SMB2 from now on. */
1614                         sconn->using_smb2 = false;
1615                 }
1616         }
1617
1618         show_msg((char *)inbuf);
1619
1620         construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1621                         encrypted, deferred_pcd);
1622         sconn->trans_num++;
1623
1624 done:
1625         sconn->num_requests++;
1626
1627         /* The timeout_processing function isn't run nearly
1628            often enough to implement 'max log size' without
1629            overrunning the size of the file by many megabytes.
1630            This is especially true if we are running at debug
1631            level 10.  Checking every 50 SMBs is a nice
1632            tradeoff of performance vs log file size overrun. */
1633
1634         if ((sconn->num_requests % 50) == 0 &&
1635             need_to_check_log_size()) {
1636                 change_to_root_user();
1637                 check_log_size();
1638         }
1639 }
1640
1641 /****************************************************************************
1642  Return a string containing the function name of a SMB command.
1643 ****************************************************************************/
1644
1645 const char *smb_fn_name(int type)
1646 {
1647         const char *unknown_name = "SMBunknown";
1648
1649         if (smb_messages[type].name == NULL)
1650                 return(unknown_name);
1651
1652         return(smb_messages[type].name);
1653 }
1654
1655 /****************************************************************************
1656  Helper functions for contruct_reply.
1657 ****************************************************************************/
1658
1659 void add_to_common_flags2(uint32 v)
1660 {
1661         common_flags2 |= v;
1662 }
1663
1664 void remove_from_common_flags2(uint32 v)
1665 {
1666         common_flags2 &= ~v;
1667 }
1668
1669 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1670                                    char *outbuf)
1671 {
1672         srv_set_message(outbuf,0,0,false);
1673
1674         SCVAL(outbuf, smb_com, req->cmd);
1675         SIVAL(outbuf,smb_rcls,0);
1676         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1677         SSVAL(outbuf,smb_flg2,
1678                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1679                 common_flags2);
1680         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1681
1682         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1683         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1684         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1685         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1686 }
1687
1688 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1689 {
1690         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1691 }
1692
1693 /*
1694  * How many bytes have we already accumulated up to the current wct field
1695  * offset?
1696  */
1697
1698 size_t req_wct_ofs(struct smb_request *req)
1699 {
1700         size_t buf_size;
1701
1702         if (req->chain_outbuf == NULL) {
1703                 return smb_wct - 4;
1704         }
1705         buf_size = talloc_get_size(req->chain_outbuf);
1706         if ((buf_size % 4) != 0) {
1707                 buf_size += (4 - (buf_size % 4));
1708         }
1709         return buf_size - 4;
1710 }
1711
1712 /*
1713  * Hack around reply_nterror & friends not being aware of chained requests,
1714  * generating illegal (i.e. wct==0) chain replies.
1715  */
1716
1717 static void fixup_chain_error_packet(struct smb_request *req)
1718 {
1719         uint8_t *outbuf = req->outbuf;
1720         req->outbuf = NULL;
1721         reply_outbuf(req, 2, 0);
1722         memcpy(req->outbuf, outbuf, smb_wct);
1723         TALLOC_FREE(outbuf);
1724         SCVAL(req->outbuf, smb_vwv0, 0xff);
1725 }
1726
1727 /**
1728  * @brief Find the smb_cmd offset of the last command pushed
1729  * @param[in] buf       The buffer we're building up
1730  * @retval              Where can we put our next andx cmd?
1731  *
1732  * While chaining requests, the "next" request we're looking at needs to put
1733  * its SMB_Command before the data the previous request already built up added
1734  * to the chain. Find the offset to the place where we have to put our cmd.
1735  */
1736
1737 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1738 {
1739         uint8_t cmd;
1740         size_t ofs;
1741
1742         cmd = CVAL(buf, smb_com);
1743
1744         SMB_ASSERT(is_andx_req(cmd));
1745
1746         ofs = smb_vwv0;
1747
1748         while (CVAL(buf, ofs) != 0xff) {
1749
1750                 if (!is_andx_req(CVAL(buf, ofs))) {
1751                         return false;
1752                 }
1753
1754                 /*
1755                  * ofs is from start of smb header, so add the 4 length
1756                  * bytes. The next cmd is right after the wct field.
1757                  */
1758                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1759
1760                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1761         }
1762
1763         *pofs = ofs;
1764         return true;
1765 }
1766
1767 /**
1768  * @brief Do the smb chaining at a buffer level
1769  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1770  * @param[in] smb_command       The command that we want to issue
1771  * @param[in] wct               How many words?
1772  * @param[in] vwv               The words, already in network order
1773  * @param[in] bytes_alignment   How shall we align "bytes"?
1774  * @param[in] num_bytes         How many bytes?
1775  * @param[in] bytes             The data the request ships
1776  *
1777  * smb_splice_chain() adds the vwv and bytes to the request already present in
1778  * *poutbuf.
1779  */
1780
1781 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1782                              uint8_t wct, const uint16_t *vwv,
1783                              size_t bytes_alignment,
1784                              uint32_t num_bytes, const uint8_t *bytes)
1785 {
1786         uint8_t *outbuf;
1787         size_t old_size, new_size;
1788         size_t ofs;
1789         size_t chain_padding = 0;
1790         size_t bytes_padding = 0;
1791         bool first_request;
1792
1793         old_size = talloc_get_size(*poutbuf);
1794
1795         /*
1796          * old_size == smb_wct means we're pushing the first request in for
1797          * libsmb/
1798          */
1799
1800         first_request = (old_size == smb_wct);
1801
1802         if (!first_request && ((old_size % 4) != 0)) {
1803                 /*
1804                  * Align the wct field of subsequent requests to a 4-byte
1805                  * boundary
1806                  */
1807                 chain_padding = 4 - (old_size % 4);
1808         }
1809
1810         /*
1811          * After the old request comes the new wct field (1 byte), the vwv's
1812          * and the num_bytes field. After at we might need to align the bytes
1813          * given to us to "bytes_alignment", increasing the num_bytes value.
1814          */
1815
1816         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1817
1818         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1819                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1820         }
1821
1822         new_size += bytes_padding + num_bytes;
1823
1824         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1825                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1826                           (unsigned)new_size));
1827                 return false;
1828         }
1829
1830         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1831         if (outbuf == NULL) {
1832                 DEBUG(0, ("talloc failed\n"));
1833                 return false;
1834         }
1835         *poutbuf = outbuf;
1836
1837         if (first_request) {
1838                 SCVAL(outbuf, smb_com, smb_command);
1839         } else {
1840                 size_t andx_cmd_ofs;
1841
1842                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1843                         DEBUG(1, ("invalid command chain\n"));
1844                         *poutbuf = talloc_realloc(
1845                                 NULL, *poutbuf, uint8_t, old_size);
1846                         return false;
1847                 }
1848
1849                 if (chain_padding != 0) {
1850                         memset(outbuf + old_size, 0, chain_padding);
1851                         old_size += chain_padding;
1852                 }
1853
1854                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1855                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1856         }
1857
1858         ofs = old_size;
1859
1860         /*
1861          * Push the chained request:
1862          *
1863          * wct field
1864          */
1865
1866         SCVAL(outbuf, ofs, wct);
1867         ofs += 1;
1868
1869         /*
1870          * vwv array
1871          */
1872
1873         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1874         ofs += sizeof(uint16_t) * wct;
1875
1876         /*
1877          * bcc (byte count)
1878          */
1879
1880         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1881         ofs += sizeof(uint16_t);
1882
1883         /*
1884          * padding
1885          */
1886
1887         if (bytes_padding != 0) {
1888                 memset(outbuf + ofs, 0, bytes_padding);
1889                 ofs += bytes_padding;
1890         }
1891
1892         /*
1893          * The bytes field
1894          */
1895
1896         memcpy(outbuf + ofs, bytes, num_bytes);
1897
1898         return true;
1899 }
1900
1901 /****************************************************************************
1902  Construct a chained reply and add it to the already made reply
1903 ****************************************************************************/
1904
1905 void chain_reply(struct smb_request *req)
1906 {
1907         size_t smblen = smb_len(req->inbuf);
1908         size_t already_used, length_needed;
1909         uint8_t chain_cmd;
1910         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1911
1912         uint8_t wct;
1913         const uint16_t *vwv;
1914         uint16_t buflen;
1915         const uint8_t *buf;
1916
1917         if (IVAL(req->outbuf, smb_rcls) != 0) {
1918                 fixup_chain_error_packet(req);
1919         }
1920
1921         /*
1922          * Any of the AndX requests and replies have at least a wct of
1923          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1924          * beginning of the SMB header to the next wct field.
1925          *
1926          * None of the AndX requests put anything valuable in vwv[0] and [1],
1927          * so we can overwrite it here to form the chain.
1928          */
1929
1930         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1931                 if (req->chain_outbuf == NULL) {
1932                         req->chain_outbuf = talloc_realloc(
1933                                 req, req->outbuf, uint8_t,
1934                                 smb_len(req->outbuf) + 4);
1935                         if (req->chain_outbuf == NULL) {
1936                                 smb_panic("talloc failed");
1937                         }
1938                 }
1939                 req->outbuf = NULL;
1940                 goto error;
1941         }
1942
1943         /*
1944          * Here we assume that this is the end of the chain. For that we need
1945          * to set "next command" to 0xff and the offset to 0. If we later find
1946          * more commands in the chain, this will be overwritten again.
1947          */
1948
1949         SCVAL(req->outbuf, smb_vwv0, 0xff);
1950         SCVAL(req->outbuf, smb_vwv0+1, 0);
1951         SSVAL(req->outbuf, smb_vwv1, 0);
1952
1953         if (req->chain_outbuf == NULL) {
1954                 /*
1955                  * In req->chain_outbuf we collect all the replies. Start the
1956                  * chain by copying in the first reply.
1957                  *
1958                  * We do the realloc because later on we depend on
1959                  * talloc_get_size to determine the length of
1960                  * chain_outbuf. The reply_xxx routines might have
1961                  * over-allocated (reply_pipe_read_and_X used to be such an
1962                  * example).
1963                  */
1964                 req->chain_outbuf = talloc_realloc(
1965                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1966                 if (req->chain_outbuf == NULL) {
1967                         smb_panic("talloc failed");
1968                 }
1969                 req->outbuf = NULL;
1970         } else {
1971                 /*
1972                  * Update smb headers where subsequent chained commands
1973                  * may have updated them.
1974                  */
1975                 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1976                 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1977
1978                 if (!smb_splice_chain(&req->chain_outbuf,
1979                                       CVAL(req->outbuf, smb_com),
1980                                       CVAL(req->outbuf, smb_wct),
1981                                       (uint16_t *)(req->outbuf + smb_vwv),
1982                                       0, smb_buflen(req->outbuf),
1983                                       (uint8_t *)smb_buf(req->outbuf))) {
1984                         goto error;
1985                 }
1986                 TALLOC_FREE(req->outbuf);
1987         }
1988
1989         /*
1990          * We use the old request's vwv field to grab the next chained command
1991          * and offset into the chained fields.
1992          */
1993
1994         chain_cmd = CVAL(req->vwv+0, 0);
1995         chain_offset = SVAL(req->vwv+1, 0);
1996
1997         if (chain_cmd == 0xff) {
1998                 /*
1999                  * End of chain, no more requests from the client. So ship the
2000                  * replies.
2001                  */
2002                 smb_setlen((char *)(req->chain_outbuf),
2003                            talloc_get_size(req->chain_outbuf) - 4);
2004
2005                 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2006                                   true, req->seqnum+1,
2007                                   IS_CONN_ENCRYPTED(req->conn)
2008                                   ||req->encrypted,
2009                                   &req->pcd)) {
2010                         exit_server_cleanly("chain_reply: srv_send_smb "
2011                                             "failed.");
2012                 }
2013                 TALLOC_FREE(req->chain_outbuf);
2014                 req->done = true;
2015                 return;
2016         }
2017
2018         /* add a new perfcounter for this element of chain */
2019         SMB_PERFCOUNT_ADD(&req->pcd);
2020         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2021         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2022
2023         /*
2024          * Check if the client tries to fool us. The request so far uses the
2025          * space to the end of the byte buffer in the request just
2026          * processed. The chain_offset can't point into that area. If that was
2027          * the case, we could end up with an endless processing of the chain,
2028          * we would always handle the same request.
2029          */
2030
2031         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2032         if (chain_offset < already_used) {
2033                 goto error;
2034         }
2035
2036         /*
2037          * Next check: Make sure the chain offset does not point beyond the
2038          * overall smb request length.
2039          */
2040
2041         length_needed = chain_offset+1; /* wct */
2042         if (length_needed > smblen) {
2043                 goto error;
2044         }
2045
2046         /*
2047          * Now comes the pointer magic. Goal here is to set up req->vwv and
2048          * req->buf correctly again to be able to call the subsequent
2049          * switch_message(). The chain offset (the former vwv[1]) points at
2050          * the new wct field.
2051          */
2052
2053         wct = CVAL(smb_base(req->inbuf), chain_offset);
2054
2055         /*
2056          * Next consistency check: Make the new vwv array fits in the overall
2057          * smb request.
2058          */
2059
2060         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2061         if (length_needed > smblen) {
2062                 goto error;
2063         }
2064         vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2065
2066         /*
2067          * Now grab the new byte buffer....
2068          */
2069
2070         buflen = SVAL(vwv+wct, 0);
2071
2072         /*
2073          * .. and check that it fits.
2074          */
2075
2076         length_needed += buflen;
2077         if (length_needed > smblen) {
2078                 goto error;
2079         }
2080         buf = (const uint8_t *)(vwv+wct+1);
2081
2082         req->cmd = chain_cmd;
2083         req->wct = wct;
2084         req->vwv = discard_const_p(uint16_t, vwv);
2085         req->buflen = buflen;
2086         req->buf = buf;
2087
2088         switch_message(chain_cmd, req, smblen);
2089
2090         if (req->outbuf == NULL) {
2091                 /*
2092                  * This happens if the chained command has suspended itself or
2093                  * if it has called srv_send_smb() itself.
2094                  */
2095                 return;
2096         }
2097
2098         /*
2099          * We end up here if the chained command was not itself chained or
2100          * suspended, but for example a close() command. We now need to splice
2101          * the chained commands' outbuf into the already built up chain_outbuf
2102          * and ship the result.
2103          */
2104         goto done;
2105
2106  error:
2107         /*
2108          * We end up here if there's any error in the chain syntax. Report a
2109          * DOS error, just like Windows does.
2110          */
2111         reply_force_doserror(req, ERRSRV, ERRerror);
2112         fixup_chain_error_packet(req);
2113
2114  done:
2115         /*
2116          * This scary statement intends to set the
2117          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2118          * to the value req->outbuf carries
2119          */
2120         SSVAL(req->chain_outbuf, smb_flg2,
2121               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2122               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2123
2124         /*
2125          * Transfer the error codes from the subrequest to the main one
2126          */
2127         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2128         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2129
2130         if (!smb_splice_chain(&req->chain_outbuf,
2131                               CVAL(req->outbuf, smb_com),
2132                               CVAL(req->outbuf, smb_wct),
2133                               (uint16_t *)(req->outbuf + smb_vwv),
2134                               0, smb_buflen(req->outbuf),
2135                               (uint8_t *)smb_buf(req->outbuf))) {
2136                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2137         }
2138         TALLOC_FREE(req->outbuf);
2139
2140         smb_setlen((char *)(req->chain_outbuf),
2141                    talloc_get_size(req->chain_outbuf) - 4);
2142
2143         show_msg((char *)(req->chain_outbuf));
2144
2145         if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2146                           true, req->seqnum+1,
2147                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2148                           &req->pcd)) {
2149                 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2150         }
2151         TALLOC_FREE(req->chain_outbuf);
2152         req->done = true;
2153 }
2154
2155 /****************************************************************************
2156  Check if services need reloading.
2157 ****************************************************************************/
2158
2159 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2160 {
2161
2162         if (last_smb_conf_reload_time == 0) {
2163                 last_smb_conf_reload_time = t;
2164         }
2165
2166         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2167                 reload_services(sconn->msg_ctx, sconn->sock, True);
2168                 last_smb_conf_reload_time = t;
2169         }
2170 }
2171
2172 static bool fd_is_readable(int fd)
2173 {
2174         int ret, revents;
2175
2176         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2177
2178         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2179
2180 }
2181
2182 static void smbd_server_connection_write_handler(
2183         struct smbd_server_connection *sconn)
2184 {
2185         /* TODO: make write nonblocking */
2186 }
2187
2188 static void smbd_server_connection_read_handler(
2189         struct smbd_server_connection *sconn, int fd)
2190 {
2191         uint8_t *inbuf = NULL;
2192         size_t inbuf_len = 0;
2193         size_t unread_bytes = 0;
2194         bool encrypted = false;
2195         TALLOC_CTX *mem_ctx = talloc_tos();
2196         NTSTATUS status;
2197         uint32_t seqnum;
2198
2199         bool from_client = (sconn->sock == fd);
2200
2201         if (from_client) {
2202                 smbd_lock_socket(sconn);
2203
2204                 if (lp_async_smb_echo_handler() && !fd_is_readable(fd)) {
2205                         DEBUG(10,("the echo listener was faster\n"));
2206                         smbd_unlock_socket(sconn);
2207                         return;
2208                 }
2209
2210                 /* TODO: make this completely nonblocking */
2211                 status = receive_smb_talloc(mem_ctx, sconn, fd,
2212                                             (char **)(void *)&inbuf,
2213                                             0, /* timeout */
2214                                             &unread_bytes,
2215                                             &encrypted,
2216                                             &inbuf_len, &seqnum,
2217                                             false /* trusted channel */);
2218                 smbd_unlock_socket(sconn);
2219         } else {
2220                 /* TODO: make this completely nonblocking */
2221                 status = receive_smb_talloc(mem_ctx, sconn, fd,
2222                                             (char **)(void *)&inbuf,
2223                                             0, /* timeout */
2224                                             &unread_bytes,
2225                                             &encrypted,
2226                                             &inbuf_len, &seqnum,
2227                                             true /* trusted channel */);
2228         }
2229
2230         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2231                 goto process;
2232         }
2233         if (NT_STATUS_IS_ERR(status)) {
2234                 exit_server_cleanly("failed to receive smb request");
2235         }
2236         if (!NT_STATUS_IS_OK(status)) {
2237                 return;
2238         }
2239
2240 process:
2241         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2242                     seqnum, encrypted, NULL);
2243 }
2244
2245 static void smbd_server_connection_handler(struct event_context *ev,
2246                                            struct fd_event *fde,
2247                                            uint16_t flags,
2248                                            void *private_data)
2249 {
2250         struct smbd_server_connection *conn = talloc_get_type(private_data,
2251                                               struct smbd_server_connection);
2252
2253         if (flags & EVENT_FD_WRITE) {
2254                 smbd_server_connection_write_handler(conn);
2255                 return;
2256         }
2257         if (flags & EVENT_FD_READ) {
2258                 smbd_server_connection_read_handler(conn, conn->sock);
2259                 return;
2260         }
2261 }
2262
2263 static void smbd_server_echo_handler(struct event_context *ev,
2264                                      struct fd_event *fde,
2265                                      uint16_t flags,
2266                                      void *private_data)
2267 {
2268         struct smbd_server_connection *conn = talloc_get_type(private_data,
2269                                               struct smbd_server_connection);
2270
2271         if (flags & EVENT_FD_WRITE) {
2272                 smbd_server_connection_write_handler(conn);
2273                 return;
2274         }
2275         if (flags & EVENT_FD_READ) {
2276                 smbd_server_connection_read_handler(
2277                         conn, conn->smb1.echo_handler.trusted_fd);
2278                 return;
2279         }
2280 }
2281
2282 #ifdef CLUSTER_SUPPORT
2283 /****************************************************************************
2284 received when we should release a specific IP
2285 ****************************************************************************/
2286 static void release_ip(const char *ip, void *priv)
2287 {
2288         const char *addr = (const char *)priv;
2289         const char *p = addr;
2290
2291         if (strncmp("::ffff:", addr, 7) == 0) {
2292                 p = addr + 7;
2293         }
2294
2295         DEBUG(10, ("Got release IP message for %s, "
2296                    "our address is %s\n", ip, p));
2297
2298         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2299                 /* we can't afford to do a clean exit - that involves
2300                    database writes, which would potentially mean we
2301                    are still running after the failover has finished -
2302                    we have to get rid of this process ID straight
2303                    away */
2304                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2305                         ip));
2306                 /* note we must exit with non-zero status so the unclean handler gets
2307                    called in the parent, so that the brl database is tickled */
2308                 _exit(1);
2309         }
2310 }
2311
2312 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2313                                struct sockaddr_storage *client)
2314 {
2315         socklen_t length;
2316         length = sizeof(*server);
2317         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2318                 return -1;
2319         }
2320         length = sizeof(*client);
2321         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2322                 return -1;
2323         }
2324         return 0;
2325 }
2326 #endif
2327
2328 /*
2329  * Send keepalive packets to our client
2330  */
2331 static bool keepalive_fn(const struct timeval *now, void *private_data)
2332 {
2333         struct smbd_server_connection *sconn = smbd_server_conn;
2334         bool ret;
2335
2336         if (sconn->using_smb2) {
2337                 /* Don't do keepalives on an SMB2 connection. */
2338                 return false;
2339         }
2340
2341         smbd_lock_socket(smbd_server_conn);
2342         ret = send_keepalive(sconn->sock);
2343         smbd_unlock_socket(smbd_server_conn);
2344
2345         if (!ret) {
2346                 char addr[INET6_ADDRSTRLEN];
2347                 /*
2348                  * Try and give an error message saying what
2349                  * client failed.
2350                  */
2351                 DEBUG(0, ("send_keepalive failed for client %s. "
2352                           "Error %s - exiting\n",
2353                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2354                           strerror(errno)));
2355                 return False;
2356         }
2357         return True;
2358 }
2359
2360 /*
2361  * Do the recurring check if we're idle
2362  */
2363 static bool deadtime_fn(const struct timeval *now, void *private_data)
2364 {
2365         struct smbd_server_connection *sconn =
2366                 (struct smbd_server_connection *)private_data;
2367
2368         if ((conn_num_open(sconn) == 0)
2369             || (conn_idle_all(sconn, now->tv_sec))) {
2370                 DEBUG( 2, ( "Closing idle connection\n" ) );
2371                 messaging_send(sconn->msg_ctx,
2372                                messaging_server_id(sconn->msg_ctx),
2373                                MSG_SHUTDOWN, &data_blob_null);
2374                 return False;
2375         }
2376
2377         return True;
2378 }
2379
2380 /*
2381  * Do the recurring log file and smb.conf reload checks.
2382  */
2383
2384 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2385 {
2386         struct smbd_server_connection *sconn = talloc_get_type_abort(
2387                 private_data, struct smbd_server_connection);
2388
2389         DEBUG(5, ("housekeeping\n"));
2390
2391         change_to_root_user();
2392
2393         /* update printer queue caches if necessary */
2394         update_monitored_printq_cache(sconn->msg_ctx);
2395
2396         /* check if we need to reload services */
2397         check_reload(sconn, time_mono(NULL));
2398
2399         /* Change machine password if neccessary. */
2400         attempt_machine_password_change();
2401
2402         /*
2403          * Force a log file check.
2404          */
2405         force_check_log_size();
2406         check_log_size();
2407         return true;
2408 }
2409
2410 static int create_unlink_tmp(const char *dir)
2411 {
2412         char *fname;
2413         int fd;
2414
2415         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2416         if (fname == NULL) {
2417                 errno = ENOMEM;
2418                 return -1;
2419         }
2420         fd = mkstemp(fname);
2421         if (fd == -1) {
2422                 TALLOC_FREE(fname);
2423                 return -1;
2424         }
2425         if (unlink(fname) == -1) {
2426                 int sys_errno = errno;
2427                 close(fd);
2428                 TALLOC_FREE(fname);
2429                 errno = sys_errno;
2430                 return -1;
2431         }
2432         TALLOC_FREE(fname);
2433         return fd;
2434 }
2435
2436 /*
2437  * Read an smb packet in the echo handler child, giving the parent
2438  * smbd one second to react once the socket becomes readable.
2439  */
2440
2441 struct smbd_echo_read_state {
2442         struct tevent_context *ev;
2443         struct smbd_server_connection *sconn;
2444
2445         char *buf;
2446         size_t buflen;
2447         uint32_t seqnum;
2448 };
2449
2450 static void smbd_echo_read_readable(struct tevent_req *subreq);
2451 static void smbd_echo_read_waited(struct tevent_req *subreq);
2452
2453 static struct tevent_req *smbd_echo_read_send(
2454         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2455         struct smbd_server_connection *sconn)
2456 {
2457         struct tevent_req *req, *subreq;
2458         struct smbd_echo_read_state *state;
2459
2460         req = tevent_req_create(mem_ctx, &state,
2461                                 struct smbd_echo_read_state);
2462         if (req == NULL) {
2463                 return NULL;
2464         }
2465         state->ev = ev;
2466         state->sconn = sconn;
2467
2468         subreq = wait_for_read_send(state, ev, sconn->sock);
2469         if (tevent_req_nomem(subreq, req)) {
2470                 return tevent_req_post(req, ev);
2471         }
2472         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2473         return req;
2474 }
2475
2476 static void smbd_echo_read_readable(struct tevent_req *subreq)
2477 {
2478         struct tevent_req *req = tevent_req_callback_data(
2479                 subreq, struct tevent_req);
2480         struct smbd_echo_read_state *state = tevent_req_data(
2481                 req, struct smbd_echo_read_state);
2482         bool ok;
2483         int err;
2484
2485         ok = wait_for_read_recv(subreq, &err);
2486         TALLOC_FREE(subreq);
2487         if (!ok) {
2488                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2489                 return;
2490         }
2491
2492         /*
2493          * Give the parent smbd one second to step in
2494          */
2495
2496         subreq = tevent_wakeup_send(
2497                 state, state->ev, timeval_current_ofs(1, 0));
2498         if (tevent_req_nomem(subreq, req)) {
2499                 return;
2500         }
2501         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2502 }
2503
2504 static void smbd_echo_read_waited(struct tevent_req *subreq)
2505 {
2506         struct tevent_req *req = tevent_req_callback_data(
2507                 subreq, struct tevent_req);
2508         struct smbd_echo_read_state *state = tevent_req_data(
2509                 req, struct smbd_echo_read_state);
2510         struct smbd_server_connection *sconn = state->sconn;
2511         bool ok;
2512         NTSTATUS status;
2513         size_t unread = 0;
2514         bool encrypted;
2515
2516         ok = tevent_wakeup_recv(subreq);
2517         TALLOC_FREE(subreq);
2518         if (!ok) {
2519                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2520                 return;
2521         }
2522
2523         ok = smbd_lock_socket_internal(sconn);
2524         if (!ok) {
2525                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2526                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2527                 return;
2528         }
2529
2530         if (!fd_is_readable(sconn->sock)) {
2531                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2532                           (int)sys_getpid()));
2533
2534                 ok = smbd_unlock_socket_internal(sconn);
2535                 if (!ok) {
2536                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2537                         DEBUG(1, ("%s: failed to unlock socket\n",
2538                                 __location__));
2539                         return;
2540                 }
2541
2542                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2543                 if (tevent_req_nomem(subreq, req)) {
2544                         return;
2545                 }
2546                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2547                 return;
2548         }
2549
2550         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2551                                     0 /* timeout */,
2552                                     &unread,
2553                                     &encrypted,
2554                                     &state->buflen,
2555                                     &state->seqnum,
2556                                     false /* trusted_channel*/);
2557
2558         if (tevent_req_nterror(req, status)) {
2559                 tevent_req_nterror(req, status);
2560                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2561                           (int)sys_getpid(), nt_errstr(status)));
2562                 return;
2563         }
2564
2565         ok = smbd_unlock_socket_internal(sconn);
2566         if (!ok) {
2567                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2568                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2569                 return;
2570         }
2571         tevent_req_done(req);
2572 }
2573
2574 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2575                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2576 {
2577         struct smbd_echo_read_state *state = tevent_req_data(
2578                 req, struct smbd_echo_read_state);
2579         NTSTATUS status;
2580
2581         if (tevent_req_is_nterror(req, &status)) {
2582                 return status;
2583         }
2584         *pbuf = talloc_move(mem_ctx, &state->buf);
2585         *pbuflen = state->buflen;
2586         *pseqnum = state->seqnum;
2587         return NT_STATUS_OK;
2588 }
2589
2590 struct smbd_echo_state {
2591         struct tevent_context *ev;
2592         struct iovec *pending;
2593         struct smbd_server_connection *sconn;
2594         int parent_pipe;
2595
2596         struct tevent_fd *parent_fde;
2597
2598         struct tevent_req *write_req;
2599 };
2600
2601 static void smbd_echo_writer_done(struct tevent_req *req);
2602
2603 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2604 {
2605         int num_pending;
2606
2607         if (state->write_req != NULL) {
2608                 return;
2609         }
2610
2611         num_pending = talloc_array_length(state->pending);
2612         if (num_pending == 0) {
2613                 return;
2614         }
2615
2616         state->write_req = writev_send(state, state->ev, NULL,
2617                                        state->parent_pipe, false,
2618                                        state->pending, num_pending);
2619         if (state->write_req == NULL) {
2620                 DEBUG(1, ("writev_send failed\n"));
2621                 exit(1);
2622         }
2623
2624         talloc_steal(state->write_req, state->pending);
2625         state->pending = NULL;
2626
2627         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2628                                 state);
2629 }
2630
2631 static void smbd_echo_writer_done(struct tevent_req *req)
2632 {
2633         struct smbd_echo_state *state = tevent_req_callback_data(
2634                 req, struct smbd_echo_state);
2635         ssize_t written;
2636         int err;
2637
2638         written = writev_recv(req, &err);
2639         TALLOC_FREE(req);
2640         state->write_req = NULL;
2641         if (written == -1) {
2642                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2643                 exit(1);
2644         }
2645         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2646         smbd_echo_activate_writer(state);
2647 }
2648
2649 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2650                             uint32_t seqnum)
2651 {
2652         struct smb_request req;
2653         uint16_t num_replies;
2654         size_t out_len;
2655         char *outbuf;
2656         bool ok;
2657
2658         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2659                 DEBUG(10, ("Got netbios keepalive\n"));
2660                 /*
2661                  * Just swallow it
2662                  */
2663                 return true;
2664         }
2665
2666         if (inbuf_len < smb_size) {
2667                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2668                 return false;
2669         }
2670         if (!valid_smb_header(inbuf)) {
2671                 DEBUG(10, ("Got invalid SMB header\n"));
2672                 return false;
2673         }
2674
2675         if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2676                               seqnum)) {
2677                 return false;
2678         }
2679         req.inbuf = inbuf;
2680
2681         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2682                    smb_messages[req.cmd].name
2683                    ? smb_messages[req.cmd].name : "unknown"));
2684
2685         if (req.cmd != SMBecho) {
2686                 return false;
2687         }
2688         if (req.wct < 1) {
2689                 return false;
2690         }
2691
2692         num_replies = SVAL(req.vwv+0, 0);
2693         if (num_replies != 1) {
2694                 /* Not a Windows "Hey, you're still there?" request */
2695                 return false;
2696         }
2697
2698         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2699                            1, req.buflen)) {
2700                 DEBUG(10, ("create_outbuf failed\n"));
2701                 return false;
2702         }
2703         req.outbuf = (uint8_t *)outbuf;
2704
2705         SSVAL(req.outbuf, smb_vwv0, num_replies);
2706
2707         if (req.buflen > 0) {
2708                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2709         }
2710
2711         out_len = smb_len(req.outbuf) + 4;
2712
2713         ok = srv_send_smb(req.sconn,
2714                           (char *)outbuf,
2715                           true, seqnum+1,
2716                           false, &req.pcd);
2717         TALLOC_FREE(outbuf);
2718         if (!ok) {
2719                 exit(1);
2720         }
2721
2722         return true;
2723 }
2724
2725 static void smbd_echo_exit(struct tevent_context *ev,
2726                            struct tevent_fd *fde, uint16_t flags,
2727                            void *private_data)
2728 {
2729         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2730         exit(0);
2731 }
2732
2733 static void smbd_echo_reader(struct tevent_context *ev,
2734                              struct tevent_fd *fde, uint16_t flags,
2735                              void *private_data)
2736 {
2737         struct smbd_echo_state *state = talloc_get_type_abort(
2738                 private_data, struct smbd_echo_state);
2739         struct smbd_server_connection *sconn = state->sconn;
2740         size_t unread, num_pending;
2741         NTSTATUS status;
2742         struct iovec *tmp;
2743         size_t iov_len;
2744         uint32_t seqnum = 0;
2745         bool reply;
2746         bool ok;
2747         bool encrypted = false;
2748
2749         smb_msleep(1000);
2750
2751         ok = smbd_lock_socket_internal(sconn);
2752         if (!ok) {
2753                 DEBUG(0, ("%s: failed to lock socket\n",
2754                         __location__));
2755                 exit(1);
2756         }
2757
2758         if (!fd_is_readable(sconn->sock)) {
2759                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2760                           (int)sys_getpid()));
2761                 ok = smbd_unlock_socket_internal(sconn);
2762                 if (!ok) {
2763                         DEBUG(1, ("%s: failed to unlock socket in\n",
2764                                 __location__));
2765                         exit(1);
2766                 }
2767                 return;
2768         }
2769
2770         num_pending = talloc_array_length(state->pending);
2771         tmp = talloc_realloc(state, state->pending, struct iovec,
2772                              num_pending+1);
2773         if (tmp == NULL) {
2774                 DEBUG(1, ("talloc_realloc failed\n"));
2775                 exit(1);
2776         }
2777         state->pending = tmp;
2778
2779         DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2780
2781         status = receive_smb_talloc(state->pending, sconn, sconn->sock,
2782                                     (char **)(void *)&state->pending[num_pending].iov_base,
2783                                     0 /* timeout */,
2784                                     &unread,
2785                                     &encrypted,
2786                                     &iov_len,
2787                                     &seqnum,
2788                                     false /* trusted_channel*/);
2789         if (!NT_STATUS_IS_OK(status)) {
2790                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2791                           (int)sys_getpid(), nt_errstr(status)));
2792                 exit(1);
2793         }
2794         state->pending[num_pending].iov_len = iov_len;
2795
2796         ok = smbd_unlock_socket_internal(sconn);
2797         if (!ok) {
2798                 DEBUG(1, ("%s: failed to unlock socket in\n",
2799                         __location__));
2800                 exit(1);
2801         }
2802
2803         reply = smbd_echo_reply((uint8_t *)state->pending[num_pending].iov_base,
2804                                 state->pending[num_pending].iov_len,
2805                                 seqnum);
2806         if (reply) {
2807                 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2808                 /* no check, shrinking by some bytes does not fail */
2809                 state->pending = talloc_realloc(state, state->pending,
2810                                                 struct iovec,
2811                                                 num_pending);
2812                 return;
2813         }
2814
2815         if (state->pending[num_pending].iov_len >= smb_size) {
2816                 /*
2817                  * place the seqnum in the packet so that the main process
2818                  * can reply with signing
2819                  */
2820                 SIVAL((uint8_t *)state->pending[num_pending].iov_base,
2821                       smb_ss_field, seqnum);
2822                 SIVAL((uint8_t *)state->pending[num_pending].iov_base,
2823                       smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2824         }
2825
2826         DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2827         smbd_echo_activate_writer(state);
2828 }
2829
2830 static void smbd_echo_got_packet(struct tevent_req *req);
2831
2832 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2833                            int parent_pipe)
2834 {
2835         struct smbd_echo_state *state;
2836         struct tevent_req *read_req;
2837
2838         state = talloc_zero(sconn, struct smbd_echo_state);
2839         if (state == NULL) {
2840                 DEBUG(1, ("talloc failed\n"));
2841                 return;
2842         }
2843         state->sconn = sconn;
2844         state->parent_pipe = parent_pipe;
2845         state->ev = s3_tevent_context_init(state);
2846         if (state->ev == NULL) {
2847                 DEBUG(1, ("tevent_context_init failed\n"));
2848                 TALLOC_FREE(state);
2849                 return;
2850         }
2851         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2852                                         TEVENT_FD_READ, smbd_echo_exit,
2853                                         state);
2854         if (state->parent_fde == NULL) {
2855                 DEBUG(1, ("tevent_add_fd failed\n"));
2856                 TALLOC_FREE(state);
2857                 return;
2858         }
2859
2860         read_req = smbd_echo_read_send(state, state->ev, sconn);
2861         if (read_req == NULL) {
2862                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2863                 TALLOC_FREE(state);
2864                 return;
2865         }
2866         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2867
2868         while (true) {
2869                 if (tevent_loop_once(state->ev) == -1) {
2870                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2871                                   strerror(errno)));
2872                         break;
2873                 }
2874         }
2875         TALLOC_FREE(state);
2876 }
2877
2878 static void smbd_echo_got_packet(struct tevent_req *req)
2879 {
2880         struct smbd_echo_state *state = tevent_req_callback_data(
2881                 req, struct smbd_echo_state);
2882         NTSTATUS status;
2883         char *buf = NULL;
2884         size_t buflen = 0;
2885         uint32_t seqnum = 0;
2886         bool reply;
2887
2888         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2889         TALLOC_FREE(req);
2890         if (!NT_STATUS_IS_OK(status)) {
2891                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2892                           nt_errstr(status)));
2893                 exit(1);
2894         }
2895
2896         reply = smbd_echo_reply((uint8_t *)buf, buflen, seqnum);
2897         if (!reply) {
2898                 size_t num_pending;
2899                 struct iovec *tmp;
2900                 struct iovec *iov;
2901
2902                 num_pending = talloc_array_length(state->pending);
2903                 tmp = talloc_realloc(state, state->pending, struct iovec,
2904                                      num_pending+1);
2905                 if (tmp == NULL) {
2906                         DEBUG(1, ("talloc_realloc failed\n"));
2907                         exit(1);
2908                 }
2909                 state->pending = tmp;
2910
2911                 if (buflen >= smb_size) {
2912                         /*
2913                          * place the seqnum in the packet so that the main process
2914                          * can reply with signing
2915                          */
2916                         SIVAL(buf, smb_ss_field, seqnum);
2917                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2918                 }
2919
2920                 iov = &state->pending[num_pending];
2921                 iov->iov_base = buf;
2922                 iov->iov_len = buflen;
2923
2924                 DEBUG(10,("echo_handler[%d]: forward to main\n",
2925                           (int)sys_getpid()));
2926                 smbd_echo_activate_writer(state);
2927         }
2928
2929         req = smbd_echo_read_send(state, state->ev, state->sconn);
2930         if (req == NULL) {
2931                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2932                 exit(1);
2933         }
2934         tevent_req_set_callback(req, smbd_echo_got_packet, state);
2935 }
2936
2937
2938 /*
2939  * Handle SMBecho requests in a forked child process
2940  */
2941 bool fork_echo_handler(struct smbd_server_connection *sconn)
2942 {
2943         int listener_pipe[2];
2944         int res;
2945         pid_t child;
2946
2947         res = pipe(listener_pipe);
2948         if (res == -1) {
2949                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2950                 return false;
2951         }
2952         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2953         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2954                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2955                 goto fail;
2956         }
2957
2958         child = sys_fork();
2959         if (child == 0) {
2960                 NTSTATUS status;
2961
2962                 close(listener_pipe[0]);
2963                 set_blocking(listener_pipe[1], false);
2964
2965                 status = reinit_after_fork(sconn->msg_ctx,
2966                                            server_event_context(),
2967                                            procid_self(), false);
2968                 if (!NT_STATUS_IS_OK(status)) {
2969                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2970                                   nt_errstr(status)));
2971                         exit(1);
2972                 }
2973                 smbd_echo_loop(sconn, listener_pipe[1]);
2974                 exit(0);
2975         }
2976         close(listener_pipe[1]);
2977         listener_pipe[1] = -1;
2978         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2979
2980         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2981
2982         /*
2983          * Without smb signing this is the same as the normal smbd
2984          * listener. This needs to change once signing comes in.
2985          */
2986         sconn->smb1.echo_handler.trusted_fde = event_add_fd(server_event_context(),
2987                                         sconn,
2988                                         sconn->smb1.echo_handler.trusted_fd,
2989                                         EVENT_FD_READ,
2990                                         smbd_server_echo_handler,
2991                                         sconn);
2992         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2993                 DEBUG(1, ("event_add_fd failed\n"));
2994                 goto fail;
2995         }
2996
2997         return true;
2998
2999 fail:
3000         if (listener_pipe[0] != -1) {
3001                 close(listener_pipe[0]);
3002         }
3003         if (listener_pipe[1] != -1) {
3004                 close(listener_pipe[1]);
3005         }
3006         sconn->smb1.echo_handler.trusted_fd = -1;
3007         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3008                 close(sconn->smb1.echo_handler.socket_lock_fd);
3009         }
3010         sconn->smb1.echo_handler.trusted_fd = -1;
3011         sconn->smb1.echo_handler.socket_lock_fd = -1;
3012         return false;
3013 }
3014
3015 #if CLUSTER_SUPPORT
3016
3017 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
3018                                   struct sockaddr_storage *srv,
3019                                   struct sockaddr_storage *clnt)
3020 {
3021         struct ctdbd_connection *cconn;
3022         char tmp_addr[INET6_ADDRSTRLEN];
3023         char *addr;
3024
3025         cconn = messaging_ctdbd_connection();
3026         if (cconn == NULL) {
3027                 return NT_STATUS_NO_MEMORY;
3028         }
3029
3030         client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
3031         addr = talloc_strdup(cconn, tmp_addr);
3032         if (addr == NULL) {
3033                 return NT_STATUS_NO_MEMORY;
3034         }
3035         return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
3036 }
3037
3038 #endif
3039
3040 /****************************************************************************
3041  Process commands from the client
3042 ****************************************************************************/
3043
3044 void smbd_process(struct smbd_server_connection *sconn)
3045 {
3046         TALLOC_CTX *frame = talloc_stackframe();
3047         struct sockaddr_storage ss;
3048         struct sockaddr *sa = NULL;
3049         socklen_t sa_socklen;
3050         struct tsocket_address *local_address = NULL;
3051         struct tsocket_address *remote_address = NULL;
3052         const char *remaddr = NULL;
3053         char *rhost;
3054         int ret;
3055
3056         if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
3057                 /*
3058                  * We're not making the decision here,
3059                  * we're just allowing the client
3060                  * to decide between SMB1 and SMB2
3061                  * with the first negprot
3062                  * packet.
3063                  */
3064                 sconn->using_smb2 = true;
3065         }
3066
3067         /* Ensure child is set to blocking mode */
3068         set_blocking(sconn->sock,True);
3069
3070         set_socket_options(sconn->sock, "SO_KEEPALIVE");
3071         set_socket_options(sconn->sock, lp_socket_options());
3072
3073         sa = (struct sockaddr *)(void *)&ss;
3074         sa_socklen = sizeof(ss);
3075         ret = getpeername(sconn->sock, sa, &sa_socklen);
3076         if (ret != 0) {
3077                 int level = (errno == ENOTCONN)?2:0;
3078                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3079                 exit_server_cleanly("getpeername() failed.\n");
3080         }
3081         ret = tsocket_address_bsd_from_sockaddr(sconn,
3082                                                 sa, sa_socklen,
3083                                                 &remote_address);
3084         if (ret != 0) {
3085                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3086                         __location__, strerror(errno)));
3087                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3088         }
3089
3090         sa = (struct sockaddr *)(void *)&ss;
3091         sa_socklen = sizeof(ss);
3092         ret = getsockname(sconn->sock, sa, &sa_socklen);
3093         if (ret != 0) {
3094                 int level = (errno == ENOTCONN)?2:0;
3095                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3096                 exit_server_cleanly("getsockname() failed.\n");
3097         }
3098         ret = tsocket_address_bsd_from_sockaddr(sconn,
3099                                                 sa, sa_socklen,
3100                                                 &local_address);
3101         if (ret != 0) {
3102                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3103                         __location__, strerror(errno)));
3104                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3105         }
3106
3107         sconn->local_address = local_address;
3108         sconn->remote_address = remote_address;
3109
3110         if (tsocket_address_is_inet(remote_address, "ip")) {
3111                 remaddr = tsocket_address_inet_addr_string(
3112                                 sconn->remote_address,
3113                                 talloc_tos());
3114                 if (remaddr == NULL) {
3115                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3116                                  __location__, strerror(errno)));
3117                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3118                 }
3119         } else {
3120                 remaddr = "0.0.0.0";
3121         }
3122
3123         /* this is needed so that we get decent entries
3124            in smbstatus for port 445 connects */
3125         set_remote_machine_name(remaddr, false);
3126         reload_services(sconn->msg_ctx, sconn->sock, true);
3127
3128         /*
3129          * Before the first packet, check the global hosts allow/ hosts deny
3130          * parameters before doing any parsing of packets passed to us by the
3131          * client. This prevents attacks on our parsing code from hosts not in
3132          * the hosts allow list.
3133          */
3134
3135         ret = get_remote_hostname(remote_address,
3136                                   &rhost,
3137                                   talloc_tos());
3138         if (ret < 0) {
3139                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3140                         __location__, strerror(errno)));
3141                 exit_server_cleanly("get_remote_hostname failed.\n");
3142         }
3143         if (strequal(rhost, "UNKNOWN")) {
3144                 rhost = talloc_strdup(talloc_tos(), remaddr);
3145         }
3146         sconn->remote_hostname = talloc_move(sconn, &rhost);
3147
3148         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3149                           sconn->remote_hostname,
3150                           remaddr)) {
3151                 /*
3152                  * send a negative session response "not listening on calling
3153                  * name"
3154                  */
3155                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3156                 DEBUG( 1, ("Connection denied from %s to %s\n",
3157                            tsocket_address_string(remote_address, talloc_tos()),
3158                            tsocket_address_string(local_address, talloc_tos())));
3159                 (void)srv_send_smb(sconn,(char *)buf, false,
3160                                    0, false, NULL);
3161                 exit_server_cleanly("connection denied");
3162         }
3163
3164         DEBUG(10, ("Connection allowed from %s to %s\n",
3165                    tsocket_address_string(remote_address, talloc_tos()),
3166                    tsocket_address_string(local_address, talloc_tos())));
3167
3168         init_modules();
3169
3170         smb_perfcount_init();
3171
3172         if (!init_account_policy()) {
3173                 exit_server("Could not open account policy tdb.\n");
3174         }
3175
3176         if (*lp_rootdir()) {
3177                 if (chroot(lp_rootdir()) != 0) {
3178                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3179                         exit_server("Failed to chroot()");
3180                 }
3181                 if (chdir("/") == -1) {
3182                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3183                         exit_server("Failed to chroot()");
3184                 }
3185                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3186         }
3187
3188         if (!srv_init_signing(sconn)) {
3189                 exit_server("Failed to init smb_signing");
3190         }
3191
3192         /* Setup oplocks */
3193         if (!init_oplocks(sconn->msg_ctx))
3194                 exit_server("Failed to init oplocks");
3195
3196         /* register our message handlers */
3197         messaging_register(sconn->msg_ctx, NULL,
3198                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3199         messaging_register(sconn->msg_ctx, NULL,
3200                            MSG_SMB_CLOSE_FILE, msg_close_file);
3201
3202         /*
3203          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3204          * MSGs to all child processes
3205          */
3206         messaging_deregister(sconn->msg_ctx,
3207                              MSG_DEBUG, NULL);
3208         messaging_register(sconn->msg_ctx, NULL,
3209                            MSG_DEBUG, debug_message);
3210
3211         if ((lp_keepalive() != 0)
3212             && !(event_add_idle(server_event_context(), NULL,
3213                                 timeval_set(lp_keepalive(), 0),
3214                                 "keepalive", keepalive_fn,
3215                                 NULL))) {
3216                 DEBUG(0, ("Could not add keepalive event\n"));
3217                 exit(1);
3218         }
3219
3220         if (!(event_add_idle(server_event_context(), NULL,
3221                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3222                              "deadtime", deadtime_fn, sconn))) {
3223                 DEBUG(0, ("Could not add deadtime event\n"));
3224                 exit(1);
3225         }
3226
3227         if (!(event_add_idle(server_event_context(), NULL,
3228                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3229                              "housekeeping", housekeeping_fn, sconn))) {
3230                 DEBUG(0, ("Could not add housekeeping event\n"));
3231                 exit(1);
3232         }
3233
3234 #ifdef CLUSTER_SUPPORT
3235
3236         if (lp_clustering()) {
3237                 /*
3238                  * We need to tell ctdb about our client's TCP
3239                  * connection, so that for failover ctdbd can send
3240                  * tickle acks, triggering a reconnection by the
3241                  * client.
3242                  */
3243
3244                 struct sockaddr_storage srv, clnt;
3245
3246                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3247                         NTSTATUS status;
3248                         status = smbd_register_ips(sconn, &srv, &clnt);
3249                         if (!NT_STATUS_IS_OK(status)) {
3250                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3251                                           nt_errstr(status)));
3252                         }
3253                 } else
3254                 {
3255                         DEBUG(0,("Unable to get tcp info for "
3256                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3257                                  strerror(errno)));
3258                 }
3259         }
3260
3261 #endif
3262
3263         sconn->nbt.got_session = false;
3264
3265         sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3266
3267         sconn->smb1.sessions.done_sesssetup = false;
3268         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3269         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3270         /* users from session setup */
3271         sconn->smb1.sessions.session_userlist = NULL;
3272         /* workgroup from session setup. */
3273         sconn->smb1.sessions.session_workgroup = NULL;
3274         /* this holds info on user ids that are already validated for this VC */
3275         sconn->smb1.sessions.validated_users = NULL;
3276         sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3277         sconn->smb1.sessions.num_validated_vuids = 0;
3278
3279         conn_init(sconn);
3280         if (!init_dptrs(sconn)) {
3281                 exit_server("init_dptrs() failed");
3282         }
3283
3284         sconn->smb1.fde = event_add_fd(server_event_context(),
3285                                                   sconn,
3286                                                   sconn->sock,
3287                                                   EVENT_FD_READ,
3288                                                   smbd_server_connection_handler,
3289                                                   sconn);
3290         if (!sconn->smb1.fde) {
3291                 exit_server("failed to create smbd_server_connection fde");
3292         }
3293
3294         TALLOC_FREE(frame);
3295
3296         while (True) {
3297                 NTSTATUS status;
3298
3299                 frame = talloc_stackframe_pool(8192);
3300
3301                 errno = 0;
3302
3303                 status = smbd_server_connection_loop_once(sconn);
3304                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3305                     !NT_STATUS_IS_OK(status)) {
3306                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3307                                   " exiting\n", nt_errstr(status)));
3308                         break;
3309                 }
3310
3311                 TALLOC_FREE(frame);
3312         }
3313
3314         exit_server_cleanly(NULL);
3315 }
3316
3317 bool req_is_in_chain(struct smb_request *req)
3318 {
3319         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3320                 /*
3321                  * We're right now handling a subsequent request, so we must
3322                  * be in a chain
3323                  */
3324                 return true;
3325         }
3326
3327         if (!is_andx_req(req->cmd)) {
3328                 return false;
3329         }
3330
3331         if (req->wct < 2) {
3332                 /*
3333                  * Okay, an illegal request, but definitely not chained :-)
3334                  */
3335                 return false;
3336         }
3337
3338         return (CVAL(req->vwv+0, 0) != 0xFF);
3339 }