source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern uint16 global_smbpid;
  24 extern int keepalive;
  25 extern struct auth_context *negprot_global_auth_context;
  26 extern int smb_echo_count;
  27
  28 struct timeval smb_last_time;
  29
  30 static char *InBuffer = NULL;
  31 static char *OutBuffer = NULL;
  32 static char *current_inbuf = NULL;
  33
  34 /*
  35  * Size of data we can send to client. Set
  36  *  by the client for all protocols above CORE.
  37  *  Set by us for CORE protocol.
  38  */
  39 int max_send = BUFFER_SIZE;
  40 /*
  41  * Size of the data we can receive. Set by us.
  42  * Can be modified by the max xmit parameter.
  43  */
  44 int max_recv = BUFFER_SIZE;
  45
  46 extern int last_message;
  47 extern int global_oplock_break;
  48 extern userdom_struct current_user_info;
  49 extern int smb_read_error;
  50 SIG_ATOMIC_T reload_after_sighup = 0;
  51 SIG_ATOMIC_T got_sig_term = 0;
  52 BOOL global_machine_password_needs_changing = False;
  53 extern int max_send;
  54
  55 /****************************************************************************
  56  Function to return the current request mid from Inbuffer.
  57 ****************************************************************************/
  58
  59 uint16 get_current_mid(void)
  60 {
  61         return SVAL(InBuffer,smb_mid);
  62 }
  63
  64 /****************************************************************************
  65  structure to hold a linked list of queued messages.
  66  for processing.
  67 ****************************************************************************/
  68
  69 static struct pending_message_list *smb_oplock_queue;
  70 static struct pending_message_list *smb_sharing_violation_queue;
  71
  72 enum q_type { OPLOCK_QUEUE, SHARE_VIOLATION_QUEUE };
  73
  74 /****************************************************************************
  75  Free up a message.
  76 ****************************************************************************/
  77
  78 static void free_queued_message(struct pending_message_list *msg)
  79 {
  80         data_blob_free(&msg->buf);
  81         data_blob_free(&msg->private_data);
  82         SAFE_FREE(msg);
  83 }
  84
  85 /****************************************************************************
  86  Function to push a message onto the tail of a linked list of smb messages ready
  87  for processing.
  88 ****************************************************************************/
  89
  90 static BOOL push_queued_message(enum q_type qt, char *buf, int msg_len, struct timeval *ptv, char *private_data, size_t private_len)
  91 {
  92         struct pending_message_list *tmp_msg;
  93         struct pending_message_list *msg = SMB_MALLOC_P(struct pending_message_list);
  94
  95         if(msg == NULL) {
  96                 DEBUG(0,("push_message: malloc fail (1)\n"));
  97                 return False;
  98         }
  99
 100         memset(msg,'\0',sizeof(*msg));
 101
 102         msg->buf = data_blob(buf, msg_len);
 103         if(msg->buf.data == NULL) {
 104                 DEBUG(0,("push_message: malloc fail (2)\n"));
 105                 SAFE_FREE(msg);
 106                 return False;
 107         }
 108
 109         if (ptv) {
 110                 msg->msg_time = *ptv;
 111         }
 112
 113         if (private_data) {
 114                 msg->private_data = data_blob(private_data, private_len);
 115                 if (msg->private_data.data == NULL) {
 116                         DEBUG(0,("push_message: malloc fail (3)\n"));
 117                         data_blob_free(&msg->buf);
 118                         SAFE_FREE(msg);
 119                         return False;
 120                 }
 121         }
 122
 123         if (qt == OPLOCK_QUEUE) {
 124                 DLIST_ADD_END(smb_oplock_queue, msg, tmp_msg);
 125         } else {
 126                 DLIST_ADD_END(smb_sharing_violation_queue, msg, tmp_msg);
 127         }
 128
 129         DEBUG(10,("push_message: pushed message length %u on queue %s\n",
 130                 (unsigned int)msg_len,
 131                 qt == OPLOCK_QUEUE ? "smb_oplock_queue" : "smb_sharing_violation_queue" ));
 132
 133         return True;
 134 }
 135
 136 /****************************************************************************
 137  Function to push an oplock smb message onto a linked list of local smb messages ready
 138  for processing.
 139 ****************************************************************************/
 140
 141 BOOL push_oplock_pending_smb_message(char *buf, int msg_len)
 142 {
 143         BOOL ret = push_queued_message(OPLOCK_QUEUE, buf, msg_len, NULL, NULL, 0);
 144         if (ret) {
 145                 /* Push the MID of this packet on the signing queue. */
 146                 srv_defer_sign_response(SVAL(buf,smb_mid));
 147         }
 148         return ret;
 149 }
 150
 151 /****************************************************************************
 152  Function to delete a sharing violation open message by mid.
 153 ****************************************************************************/
 154
 155 void remove_sharing_violation_open_smb_message(uint16 mid)
 156 {
 157         struct pending_message_list *pml;
 158
 159         if (!lp_defer_sharing_violations()) {
 160                 return;
 161         }
 162
 163         for (pml = smb_sharing_violation_queue; pml; pml = pml->next) {
 164                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 165                         DEBUG(10,("remove_sharing_violation_open_smb_message: deleting mid %u len %u\n",
 166                                 (unsigned int)mid, (unsigned int)pml->buf.length ));
 167                         DLIST_REMOVE(smb_sharing_violation_queue, pml);
 168                         free_queued_message(pml);
 169                         return;
 170                 }
 171         }
 172 }
 173
 174 /****************************************************************************
 175  Move a sharing violation open retry message to the front of the list and
 176  schedule it for immediate processing.
 177 ****************************************************************************/
 178
 179 void schedule_sharing_violation_open_smb_message(uint16 mid)
 180 {
 181         struct pending_message_list *pml;
 182         int i = 0;
 183
 184         if (!lp_defer_sharing_violations()) {
 185                 return;
 186         }
 187
 188         for (pml = smb_sharing_violation_queue; pml; pml = pml->next) {
 189                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 190                 DEBUG(10,("schedule_sharing_violation_open_smb_message: [%d] msg_mid = %u\n", i++,
 191                         (unsigned int)msg_mid ));
 192                 if (mid == msg_mid) {
 193                         DEBUG(10,("schedule_sharing_violation_open_smb_message: scheduling mid %u\n",
 194                                 mid ));
 195                         pml->msg_time.tv_sec = 0;
 196                         pml->msg_time.tv_usec = 0;
 197                         DLIST_PROMOTE(smb_sharing_violation_queue, pml);
 198                         return;
 199                 }
 200         }
 201
 202         DEBUG(10,("schedule_sharing_violation_open_smb_message: failed to find message mid %u\n",
 203                 mid ));
 204 }
 205
 206 /****************************************************************************
 207  Return true if this mid is on the deferred queue.
 208 ****************************************************************************/
 209
 210 BOOL open_was_deferred(uint16 mid)
 211 {
 212         struct pending_message_list *pml;
 213
 214         if (!lp_defer_sharing_violations()) {
 215                 return False;
 216         }
 217
 218         for (pml = smb_sharing_violation_queue; pml; pml = pml->next) {
 219                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 220                         set_saved_error_triple(SMB_SUCCESS, 0, NT_STATUS_OK);
 221                         return True;
 222                 }
 223         }
 224         return False;
 225 }
 226
 227 /****************************************************************************
 228  Return the message queued by this mid.
 229 ****************************************************************************/
 230
 231 struct pending_message_list *get_open_deferred_message(uint16 mid)
 232 {
 233         struct pending_message_list *pml;
 234
 235         if (!lp_defer_sharing_violations()) {
 236                 return NULL;
 237         }
 238
 239         for (pml = smb_sharing_violation_queue; pml; pml = pml->next) {
 240                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 241                         return pml;
 242                 }
 243         }
 244         return NULL;
 245 }
 246
 247 /****************************************************************************
 248  Function to push a sharing violation open smb message onto a linked list of local smb messages ready
 249  for processing. We must use current_inbuf here not Inbuf in case we're in a chained message set.
 250 ****************************************************************************/
 251
 252 BOOL push_sharing_violation_open_smb_message(struct timeval *ptv, char *private_data, size_t priv_len)
 253 {
 254         uint16 mid = SVAL(current_inbuf,smb_mid);
 255         struct timeval tv;
 256         SMB_BIG_INT tdif;
 257
 258         if (!lp_defer_sharing_violations()) {
 259                 return True;
 260         }
 261
 262         tv = *ptv;
 263         tdif = tv.tv_sec;
 264         tdif *= 1000000;
 265         tdif += tv.tv_usec;
 266
 267         /* Add on the timeout. */
 268         tdif += SHARING_VIOLATION_USEC_WAIT;
 269
 270         tv.tv_sec = tdif / 1000000;
 271         tv.tv_usec = tdif % 1000000;
 272
 273         DEBUG(10,("push_sharing_violation_open_smb_message: pushing message len %u mid %u\
 274  timeout time [%u.%06u]\n", (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
 275                 (unsigned int)tv.tv_sec, (unsigned int)tv.tv_usec));
 276
 277         return push_queued_message(SHARE_VIOLATION_QUEUE, current_inbuf,
 278                         smb_len(current_inbuf)+4, &tv, private_data, priv_len);
 279 }
 280
 281 /****************************************************************************
 282  Do all async processing in here. This includes UDB oplock messages, kernel
 283  oplock messages, change notify events etc.
 284 ****************************************************************************/
 285
 286 static void async_processing(char *buffer, int buffer_len)
 287 {
 288         DEBUG(10,("async_processing: Doing async processing.\n"));
 289
 290         process_aio_queue();
 291
 292         /* check for oplock messages (both UDP and kernel) */
 293         if (receive_local_message(buffer, buffer_len, 1)) {
 294                 process_local_message(buffer, buffer_len);
 295         }
 296
 297         /* Do the aio check again after receive_local_message as it does a select
 298            and may have eaten our signal. */
 299         process_aio_queue();
 300
 301         if (got_sig_term) {
 302                 exit_server("Caught TERM signal");
 303         }
 304
 305         /* check for async change notify events */
 306         process_pending_change_notify_queue(0);
 307
 308         /* check for sighup processing */
 309         if (reload_after_sighup) {
 310                 change_to_root_user();
 311                 DEBUG(1,("Reloading services after SIGHUP\n"));
 312                 reload_services(False);
 313                 reload_after_sighup = 0;
 314         }
 315 }
 316
 317 /****************************************************************************
 318   Do a select on an two fd's - with timeout.
 319
 320   If a local udp message has been pushed onto the
 321   queue (this can only happen during oplock break
 322   processing) call async_processing()
 323
 324   If a pending smb message has been pushed onto the
 325   queue (this can only happen during oplock break
 326   processing) return this next.
 327
 328   If the first smbfd is ready then read an smb from it.
 329   if the second (loopback UDP) fd is ready then read a message
 330   from it and setup the buffer header to identify the length
 331   and from address.
 332   Returns False on timeout or error.
 333   Else returns True.
 334
 335 The timeout is in milliseconds
 336 ****************************************************************************/
 337
 338 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 339 {
 340         fd_set fds;
 341         int selrtn;
 342         struct timeval to;
 343         struct timeval *pto;
 344         int maxfd;
 345
 346         smb_read_error = 0;
 347
 348  again:
 349
 350         to.tv_sec = timeout / 1000;
 351         to.tv_usec = (timeout % 1000) * 1000;
 352         pto = timeout > 0 ? &to : NULL;
 353
 354         /*
 355          * Note that this call must be before processing any SMB
 356          * messages as we need to synchronously process any messages
 357          * we may have sent to ourselves from the previous SMB.
 358          */
 359         message_dispatch();
 360
 361         /*
 362          * Check to see if we already have a message on the smb queue.
 363          * If so - copy and return it.
 364          */
 365         if(smb_oplock_queue != NULL) {
 366                 struct pending_message_list *msg = smb_oplock_queue;
 367                 memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 368
 369                 /* Free the message we just copied. */
 370                 DLIST_REMOVE(smb_oplock_queue, msg);
 371                 free_queued_message(msg);
 372
 373                 DEBUG(5,("receive_message_or_smb: returning queued smb message.\n"));
 374                 return True;
 375         }
 376
 377         /*
 378          * Check to see if we already have a message on the deferred open queue
 379          * and it's time to schedule.
 380          */
 381         if(smb_sharing_violation_queue != NULL) {
 382                 BOOL pop_message = False;
 383                 struct pending_message_list *msg = smb_sharing_violation_queue;
 384
 385                 if (msg->msg_time.tv_sec == 0 && msg->msg_time.tv_usec == 0) {
 386                         pop_message = True;
 387                 } else {
 388                         struct timeval tv;
 389                         SMB_BIG_INT tdif;
 390
 391                         GetTimeOfDay(&tv);
 392                         tdif = usec_time_diff(&msg->msg_time, &tv);
 393                         if (tdif <= 0) {
 394                                 /* Timed out. Schedule...*/
 395                                 pop_message = True;
 396                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 397                         } else {
 398                                 /* Make a more accurate select timeout. */
 399                                 to.tv_sec = tdif / 1000000;
 400                                 to.tv_usec = tdif % 1000000;
 401                                 pto = &to;
 402                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 403                                         (unsigned int)pto->tv_sec, (unsigned int)pto->tv_usec ));
 404                         }
 405                 }
 406
 407                 if (pop_message) {
 408                         memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 409
 410                         /* We leave this message on the queue so the open code can
 411                            know this is a retry. */
 412                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 413                         return True;
 414                 }
 415         }
 416
 417         /*
 418          * Setup the select read fd set.
 419          */
 420
 421         FD_ZERO(&fds);
 422
 423         /*
 424          * Ensure we process oplock break messages by preference.
 425          * We have to do this before the select, after the select
 426          * and if the select returns EINTR. This is due to the fact
 427          * that the selects called from async_processing can eat an EINTR
 428          * caused by a signal (we can't take the break message there).
 429          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 430          */
 431
 432         if (oplock_message_waiting(&fds)) {
 433                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 434                 async_processing(buffer, buffer_len);
 435                 /*
 436                  * After async processing we must go and do the select again, as
 437                  * the state of the flag in fds for the server file descriptor is
 438                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 439                  */
 440                 goto again;
 441         }
 442
 443         FD_SET(smbd_server_fd(),&fds);
 444         maxfd = setup_oplock_select_set(&fds);
 445
 446         selrtn = sys_select(MAX(maxfd,smbd_server_fd())+1,&fds,NULL,NULL,pto);
 447
 448         /* if we get EINTR then maybe we have received an oplock
 449            signal - treat this as select returning 1. This is ugly, but
 450            is the best we can do until the oplock code knows more about
 451            signals */
 452         if (selrtn == -1 && errno == EINTR) {
 453                 async_processing(buffer, buffer_len);
 454                 /*
 455                  * After async processing we must go and do the select again, as
 456                  * the state of the flag in fds for the server file descriptor is
 457                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 458                  */
 459                 goto again;
 460         }
 461
 462         /* Check if error */
 463         if (selrtn == -1) {
 464                 /* something is wrong. Maybe the socket is dead? */
 465                 smb_read_error = READ_ERROR;
 466                 return False;
 467         }
 468
 469         /* Did we timeout ? */
 470         if (selrtn == 0) {
 471                 smb_read_error = READ_TIMEOUT;
 472                 return False;
 473         }
 474
 475         /*
 476          * Ensure we process oplock break messages by preference.
 477          * This is IMPORTANT ! Otherwise we can starve other processes
 478          * sending us an oplock break message. JRA.
 479          */
 480
 481         if (oplock_message_waiting(&fds)) {
 482                 async_processing(buffer, buffer_len);
 483                 /*
 484                  * After async processing we must go and do the select again, as
 485                  * the state of the flag in fds for the server file descriptor is
 486                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 487                  */
 488                 goto again;
 489         }
 490
 491         return receive_smb(smbd_server_fd(), buffer, 0);
 492 }
 493
 494 /****************************************************************************
 495 Get the next SMB packet, doing the local message processing automatically.
 496 ****************************************************************************/
 497
 498 BOOL receive_next_smb(char *inbuf, int bufsize, int timeout)
 499 {
 500         BOOL got_keepalive;
 501         BOOL ret;
 502
 503         do {
 504                 ret = receive_message_or_smb(inbuf,bufsize,timeout);
 505
 506                 got_keepalive = (ret && (CVAL(inbuf,0) == SMBkeepalive));
 507         } while (ret && got_keepalive);
 508
 509         return ret;
 510 }
 511
 512 /****************************************************************************
 513  We're terminating and have closed all our files/connections etc.
 514  If there are any pending local messages we need to respond to them
 515  before termination so that other smbds don't think we just died whilst
 516  holding oplocks.
 517 ****************************************************************************/
 518
 519 void respond_to_all_remaining_local_messages(void)
 520 {
 521         char buffer[1024];
 522
 523         /*
 524          * Assert we have no exclusive open oplocks.
 525          */
 526
 527         if(get_number_of_exclusive_open_oplocks()) {
 528                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 529                         get_number_of_exclusive_open_oplocks() ));
 530                 return;
 531         }
 532
 533         /*
 534          * Keep doing receive_local_message with a 1 ms timeout until
 535          * we have no more messages.
 536          */
 537
 538         while(receive_local_message(buffer, sizeof(buffer), 1)) {
 539                 /* Deal with oplock break requests from other smbd's. */
 540                 process_local_message(buffer, sizeof(buffer));
 541         }
 542
 543         return;
 544 }
 545
 546
 547 /*
 548 These flags determine some of the permissions required to do an operation
 549
 550 Note that I don't set NEED_WRITE on some write operations because they
 551 are used by some brain-dead clients when printing, and I don't want to
 552 force write permissions on print services.
 553 */
 554 #define AS_USER (1<<0)
 555 #define NEED_WRITE (1<<1)
 556 #define TIME_INIT (1<<2)
 557 #define CAN_IPC (1<<3)
 558 #define AS_GUEST (1<<5)
 559 #define QUEUE_IN_OPLOCK (1<<6)
 560 #define DO_CHDIR (1<<7)
 561
 562 /*
 563    define a list of possible SMB messages and their corresponding
 564    functions. Any message that has a NULL function is unimplemented -
 565    please feel free to contribute implementations!
 566 */
 567 static const struct smb_message_struct {
 568         const char *name;
 569         int (*fn)(connection_struct *conn, char *, char *, int, int);
 570         int flags;
 571 } smb_messages[256] = {
 572
 573 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 574 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 575 /* 0x02 */ { "SMBopen",reply_open,AS_USER | QUEUE_IN_OPLOCK },
 576 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 577 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 578 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 579 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK},
 580 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK},
 581 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 582 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 583 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 584 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 585 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 586 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 587 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER | QUEUE_IN_OPLOCK },
 588 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 589 /* 0x10 */ { "SMBchkpth",reply_chkpth,AS_USER},
 590 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 591 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 592 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 593 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 594 /* 0x15 */ { NULL, NULL, 0 },
 595 /* 0x16 */ { NULL, NULL, 0 },
 596 /* 0x17 */ { NULL, NULL, 0 },
 597 /* 0x18 */ { NULL, NULL, 0 },
 598 /* 0x19 */ { NULL, NULL, 0 },
 599 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 600 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 601 /* 0x1c */ { "SMBreadBs",NULL,0 },
 602 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 603 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 604 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 605 /* 0x20 */ { "SMBwritec",NULL,0},
 606 /* 0x21 */ { NULL, NULL, 0 },
 607 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 608 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 609 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 610 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 611 /* 0x26 */ { "SMBtranss",NULL,AS_USER | CAN_IPC},
 612 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 613 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 614 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK },
 615 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK },
 616 /* 0x2b */ { "SMBecho",reply_echo,0},
 617 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 618 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC | QUEUE_IN_OPLOCK },
 619 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 620 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 621 /* 0x30 */ { NULL, NULL, 0 },
 622 /* 0x31 */ { NULL, NULL, 0 },
 623 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 624 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 625 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 626 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 627 /* 0x36 */ { NULL, NULL, 0 },
 628 /* 0x37 */ { NULL, NULL, 0 },
 629 /* 0x38 */ { NULL, NULL, 0 },
 630 /* 0x39 */ { NULL, NULL, 0 },
 631 /* 0x3a */ { NULL, NULL, 0 },
 632 /* 0x3b */ { NULL, NULL, 0 },
 633 /* 0x3c */ { NULL, NULL, 0 },
 634 /* 0x3d */ { NULL, NULL, 0 },
 635 /* 0x3e */ { NULL, NULL, 0 },
 636 /* 0x3f */ { NULL, NULL, 0 },
 637 /* 0x40 */ { NULL, NULL, 0 },
 638 /* 0x41 */ { NULL, NULL, 0 },
 639 /* 0x42 */ { NULL, NULL, 0 },
 640 /* 0x43 */ { NULL, NULL, 0 },
 641 /* 0x44 */ { NULL, NULL, 0 },
 642 /* 0x45 */ { NULL, NULL, 0 },
 643 /* 0x46 */ { NULL, NULL, 0 },
 644 /* 0x47 */ { NULL, NULL, 0 },
 645 /* 0x48 */ { NULL, NULL, 0 },
 646 /* 0x49 */ { NULL, NULL, 0 },
 647 /* 0x4a */ { NULL, NULL, 0 },
 648 /* 0x4b */ { NULL, NULL, 0 },
 649 /* 0x4c */ { NULL, NULL, 0 },
 650 /* 0x4d */ { NULL, NULL, 0 },
 651 /* 0x4e */ { NULL, NULL, 0 },
 652 /* 0x4f */ { NULL, NULL, 0 },
 653 /* 0x50 */ { NULL, NULL, 0 },
 654 /* 0x51 */ { NULL, NULL, 0 },
 655 /* 0x52 */ { NULL, NULL, 0 },
 656 /* 0x53 */ { NULL, NULL, 0 },
 657 /* 0x54 */ { NULL, NULL, 0 },
 658 /* 0x55 */ { NULL, NULL, 0 },
 659 /* 0x56 */ { NULL, NULL, 0 },
 660 /* 0x57 */ { NULL, NULL, 0 },
 661 /* 0x58 */ { NULL, NULL, 0 },
 662 /* 0x59 */ { NULL, NULL, 0 },
 663 /* 0x5a */ { NULL, NULL, 0 },
 664 /* 0x5b */ { NULL, NULL, 0 },
 665 /* 0x5c */ { NULL, NULL, 0 },
 666 /* 0x5d */ { NULL, NULL, 0 },
 667 /* 0x5e */ { NULL, NULL, 0 },
 668 /* 0x5f */ { NULL, NULL, 0 },
 669 /* 0x60 */ { NULL, NULL, 0 },
 670 /* 0x61 */ { NULL, NULL, 0 },
 671 /* 0x62 */ { NULL, NULL, 0 },
 672 /* 0x63 */ { NULL, NULL, 0 },
 673 /* 0x64 */ { NULL, NULL, 0 },
 674 /* 0x65 */ { NULL, NULL, 0 },
 675 /* 0x66 */ { NULL, NULL, 0 },
 676 /* 0x67 */ { NULL, NULL, 0 },
 677 /* 0x68 */ { NULL, NULL, 0 },
 678 /* 0x69 */ { NULL, NULL, 0 },
 679 /* 0x6a */ { NULL, NULL, 0 },
 680 /* 0x6b */ { NULL, NULL, 0 },
 681 /* 0x6c */ { NULL, NULL, 0 },
 682 /* 0x6d */ { NULL, NULL, 0 },
 683 /* 0x6e */ { NULL, NULL, 0 },
 684 /* 0x6f */ { NULL, NULL, 0 },
 685 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 686 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
 687 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 688 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 689 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 690 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 691 /* 0x76 */ { NULL, NULL, 0 },
 692 /* 0x77 */ { NULL, NULL, 0 },
 693 /* 0x78 */ { NULL, NULL, 0 },
 694 /* 0x79 */ { NULL, NULL, 0 },
 695 /* 0x7a */ { NULL, NULL, 0 },
 696 /* 0x7b */ { NULL, NULL, 0 },
 697 /* 0x7c */ { NULL, NULL, 0 },
 698 /* 0x7d */ { NULL, NULL, 0 },
 699 /* 0x7e */ { NULL, NULL, 0 },
 700 /* 0x7f */ { NULL, NULL, 0 },
 701 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 702 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 703 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 704 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 705 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 706 /* 0x85 */ { NULL, NULL, 0 },
 707 /* 0x86 */ { NULL, NULL, 0 },
 708 /* 0x87 */ { NULL, NULL, 0 },
 709 /* 0x88 */ { NULL, NULL, 0 },
 710 /* 0x89 */ { NULL, NULL, 0 },
 711 /* 0x8a */ { NULL, NULL, 0 },
 712 /* 0x8b */ { NULL, NULL, 0 },
 713 /* 0x8c */ { NULL, NULL, 0 },
 714 /* 0x8d */ { NULL, NULL, 0 },
 715 /* 0x8e */ { NULL, NULL, 0 },
 716 /* 0x8f */ { NULL, NULL, 0 },
 717 /* 0x90 */ { NULL, NULL, 0 },
 718 /* 0x91 */ { NULL, NULL, 0 },
 719 /* 0x92 */ { NULL, NULL, 0 },
 720 /* 0x93 */ { NULL, NULL, 0 },
 721 /* 0x94 */ { NULL, NULL, 0 },
 722 /* 0x95 */ { NULL, NULL, 0 },
 723 /* 0x96 */ { NULL, NULL, 0 },
 724 /* 0x97 */ { NULL, NULL, 0 },
 725 /* 0x98 */ { NULL, NULL, 0 },
 726 /* 0x99 */ { NULL, NULL, 0 },
 727 /* 0x9a */ { NULL, NULL, 0 },
 728 /* 0x9b */ { NULL, NULL, 0 },
 729 /* 0x9c */ { NULL, NULL, 0 },
 730 /* 0x9d */ { NULL, NULL, 0 },
 731 /* 0x9e */ { NULL, NULL, 0 },
 732 /* 0x9f */ { NULL, NULL, 0 },
 733 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC | QUEUE_IN_OPLOCK},
 734 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 735 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC | QUEUE_IN_OPLOCK },
 736 /* 0xa3 */ { NULL, NULL, 0 },
 737 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 738 /* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK },
 739 /* 0xa6 */ { NULL, NULL, 0 },
 740 /* 0xa7 */ { NULL, NULL, 0 },
 741 /* 0xa8 */ { NULL, NULL, 0 },
 742 /* 0xa9 */ { NULL, NULL, 0 },
 743 /* 0xaa */ { NULL, NULL, 0 },
 744 /* 0xab */ { NULL, NULL, 0 },
 745 /* 0xac */ { NULL, NULL, 0 },
 746 /* 0xad */ { NULL, NULL, 0 },
 747 /* 0xae */ { NULL, NULL, 0 },
 748 /* 0xaf */ { NULL, NULL, 0 },
 749 /* 0xb0 */ { NULL, NULL, 0 },
 750 /* 0xb1 */ { NULL, NULL, 0 },
 751 /* 0xb2 */ { NULL, NULL, 0 },
 752 /* 0xb3 */ { NULL, NULL, 0 },
 753 /* 0xb4 */ { NULL, NULL, 0 },
 754 /* 0xb5 */ { NULL, NULL, 0 },
 755 /* 0xb6 */ { NULL, NULL, 0 },
 756 /* 0xb7 */ { NULL, NULL, 0 },
 757 /* 0xb8 */ { NULL, NULL, 0 },
 758 /* 0xb9 */ { NULL, NULL, 0 },
 759 /* 0xba */ { NULL, NULL, 0 },
 760 /* 0xbb */ { NULL, NULL, 0 },
 761 /* 0xbc */ { NULL, NULL, 0 },
 762 /* 0xbd */ { NULL, NULL, 0 },
 763 /* 0xbe */ { NULL, NULL, 0 },
 764 /* 0xbf */ { NULL, NULL, 0 },
 765 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER | QUEUE_IN_OPLOCK },
 766 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 767 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 768 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 769 /* 0xc4 */ { NULL, NULL, 0 },
 770 /* 0xc5 */ { NULL, NULL, 0 },
 771 /* 0xc6 */ { NULL, NULL, 0 },
 772 /* 0xc7 */ { NULL, NULL, 0 },
 773 /* 0xc8 */ { NULL, NULL, 0 },
 774 /* 0xc9 */ { NULL, NULL, 0 },
 775 /* 0xca */ { NULL, NULL, 0 },
 776 /* 0xcb */ { NULL, NULL, 0 },
 777 /* 0xcc */ { NULL, NULL, 0 },
 778 /* 0xcd */ { NULL, NULL, 0 },
 779 /* 0xce */ { NULL, NULL, 0 },
 780 /* 0xcf */ { NULL, NULL, 0 },
 781 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 782 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 783 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 784 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 785 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 786 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 787 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 788 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 789 /* 0xd8 */ { NULL, NULL, 0 },
 790 /* 0xd9 */ { NULL, NULL, 0 },
 791 /* 0xda */ { NULL, NULL, 0 },
 792 /* 0xdb */ { NULL, NULL, 0 },
 793 /* 0xdc */ { NULL, NULL, 0 },
 794 /* 0xdd */ { NULL, NULL, 0 },
 795 /* 0xde */ { NULL, NULL, 0 },
 796 /* 0xdf */ { NULL, NULL, 0 },
 797 /* 0xe0 */ { NULL, NULL, 0 },
 798 /* 0xe1 */ { NULL, NULL, 0 },
 799 /* 0xe2 */ { NULL, NULL, 0 },
 800 /* 0xe3 */ { NULL, NULL, 0 },
 801 /* 0xe4 */ { NULL, NULL, 0 },
 802 /* 0xe5 */ { NULL, NULL, 0 },
 803 /* 0xe6 */ { NULL, NULL, 0 },
 804 /* 0xe7 */ { NULL, NULL, 0 },
 805 /* 0xe8 */ { NULL, NULL, 0 },
 806 /* 0xe9 */ { NULL, NULL, 0 },
 807 /* 0xea */ { NULL, NULL, 0 },
 808 /* 0xeb */ { NULL, NULL, 0 },
 809 /* 0xec */ { NULL, NULL, 0 },
 810 /* 0xed */ { NULL, NULL, 0 },
 811 /* 0xee */ { NULL, NULL, 0 },
 812 /* 0xef */ { NULL, NULL, 0 },
 813 /* 0xf0 */ { NULL, NULL, 0 },
 814 /* 0xf1 */ { NULL, NULL, 0 },
 815 /* 0xf2 */ { NULL, NULL, 0 },
 816 /* 0xf3 */ { NULL, NULL, 0 },
 817 /* 0xf4 */ { NULL, NULL, 0 },
 818 /* 0xf5 */ { NULL, NULL, 0 },
 819 /* 0xf6 */ { NULL, NULL, 0 },
 820 /* 0xf7 */ { NULL, NULL, 0 },
 821 /* 0xf8 */ { NULL, NULL, 0 },
 822 /* 0xf9 */ { NULL, NULL, 0 },
 823 /* 0xfa */ { NULL, NULL, 0 },
 824 /* 0xfb */ { NULL, NULL, 0 },
 825 /* 0xfc */ { NULL, NULL, 0 },
 826 /* 0xfd */ { NULL, NULL, 0 },
 827 /* 0xfe */ { NULL, NULL, 0 },
 828 /* 0xff */ { NULL, NULL, 0 }
 829
 830 };
 831
 832 /*******************************************************************
 833  Dump a packet to a file.
 834 ********************************************************************/
 835
 836 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 837 {
 838         int fd, i;
 839         pstring fname;
 840         if (DEBUGLEVEL < 50) return;
 841
 842         if (len < 4) len = smb_len(data)+4;
 843         for (i=1;i<100;i++) {
 844                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 845                                 type ? "req" : "resp");
 846                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 847                 if (fd != -1 || errno != EEXIST) break;
 848         }
 849         if (fd != -1) {
 850                 ssize_t ret = write(fd, data, len);
 851                 if (ret != len)
 852                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 853                 close(fd);
 854                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
 855         }
 856 }
 857
 858
 859 /****************************************************************************
 860  Do a switch on the message type, and return the response size
 861 ****************************************************************************/
 862
 863 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 864 {
 865         static pid_t pid= (pid_t)-1;
 866         int outsize = 0;
 867
 868         type &= 0xff;
 869
 870         if (pid == (pid_t)-1)
 871                 pid = sys_getpid();
 872
 873         errno = 0;
 874         set_saved_error_triple(0, 0, NT_STATUS_OK);
 875
 876         last_message = type;
 877
 878         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 879         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 880                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 881                 exit_server("Non-SMB packet");
 882                 return(-1);
 883         }
 884
 885         /* yuck! this is an interim measure before we get rid of our
 886                 current inbuf/outbuf system */
 887         global_smbpid = SVAL(inbuf,smb_pid);
 888
 889         if (smb_messages[type].fn == NULL) {
 890                 DEBUG(0,("Unknown message type %d!\n",type));
 891                 smb_dump("Unknown", 1, inbuf, size);
 892                 outsize = reply_unknown(inbuf,outbuf);
 893         } else {
 894                 int flags = smb_messages[type].flags;
 895                 static uint16 last_session_tag = UID_FIELD_INVALID;
 896                 /* In share mode security we must ignore the vuid. */
 897                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 898                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 899
 900                 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
 901
 902                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 903                 if(global_oplock_break) {
 904                         if(flags & QUEUE_IN_OPLOCK) {
 905                                 /*
 906                                  * Queue this message as we are the process of an oplock break.
 907                                  */
 908
 909                                 DEBUG( 2, ( "switch_message: queueing message due to being in " ) );
 910                                 DEBUGADD( 2, ( "oplock break state.\n" ) );
 911
 912                                 push_oplock_pending_smb_message( inbuf, size );
 913                                 return -1;
 914                         }
 915                 }
 916
 917                 /* Ensure this value is replaced in the incoming packet. */
 918                 SSVAL(inbuf,smb_uid,session_tag);
 919
 920                 /*
 921                  * Ensure the correct username is in current_user_info.
 922                  * This is a really ugly bugfix for problems with
 923                  * multiple session_setup_and_X's being done and
 924                  * allowing %U and %G substitutions to work correctly.
 925                  * There is a reason this code is done here, don't
 926                  * move it unless you know what you're doing... :-).
 927                  * JRA.
 928                  */
 929
 930                 if (session_tag != last_session_tag) {
 931                         user_struct *vuser = NULL;
 932
 933                         last_session_tag = session_tag;
 934                         if(session_tag != UID_FIELD_INVALID)
 935                                 vuser = get_valid_user_struct(session_tag);
 936                         if(vuser != NULL)
 937                                 set_current_user_info(&vuser->user);
 938                 }
 939
 940                 /* does this protocol need to be run as root? */
 941                 if (!(flags & AS_USER))
 942                         change_to_root_user();
 943
 944                 /* does this protocol need a valid tree connection? */
 945                 if ((flags & AS_USER) && !conn) {
 946                         /* Amazingly, the error code depends on the command (from Samba4). */
 947                         if (type == SMBntcreateX) {
 948                                 return ERROR_NT(NT_STATUS_INVALID_HANDLE);
 949                         } else {
 950                                 return ERROR_DOS(ERRSRV, ERRinvnid);
 951                         }
 952                 }
 953
 954
 955                 /* does this protocol need to be run as the connected user? */
 956                 if ((flags & AS_USER) && !change_to_user(conn,session_tag)) {
 957                         if (flags & AS_GUEST)
 958                                 flags &= ~AS_USER;
 959                         else
 960                                 return(ERROR_FORCE_DOS(ERRSRV,ERRbaduid));
 961                 }
 962
 963                 /* this code is to work around a bug is MS client 3 without
 964                         introducing a security hole - it needs to be able to do
 965                         print queue checks as guest if it isn't logged in properly */
 966                 if (flags & AS_USER)
 967                         flags &= ~AS_GUEST;
 968
 969                 /* does it need write permission? */
 970                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn))
 971                         return(ERROR_DOS(ERRSRV,ERRaccess));
 972
 973                 /* ipc services are limited */
 974                 if (IS_IPC(conn) && (flags & AS_USER) && !(flags & CAN_IPC))
 975                         return(ERROR_DOS(ERRSRV,ERRaccess));
 976
 977                 /* load service specific parameters */
 978                 if (conn) {
 979                         if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
 980                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 981                         }
 982                         conn->num_smb_operations++;
 983                 }
 984
 985                 /* does this protocol need to be run as guest? */
 986                 if ((flags & AS_GUEST) && (!change_to_guest() ||
 987                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))))
 988                         return(ERROR_DOS(ERRSRV,ERRaccess));
 989
 990                 current_inbuf = inbuf; /* In case we need to defer this message in open... */
 991                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
 992         }
 993
 994         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
 995
 996         return(outsize);
 997 }
 998
 999
1000 /****************************************************************************
1001  Construct a reply to the incoming packet.
1002 ****************************************************************************/
1003
1004 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1005 {
1006         int type = CVAL(inbuf,smb_com);
1007         int outsize = 0;
1008         int msg_type = CVAL(inbuf,0);
1009
1010         GetTimeOfDay(&smb_last_time);
1011
1012         chain_size = 0;
1013         file_chain_reset();
1014         reset_chain_p();
1015
1016         if (msg_type != 0)
1017                 return(reply_special(inbuf,outbuf));
1018
1019         construct_reply_common(inbuf, outbuf);
1020
1021         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1022
1023         outsize += chain_size;
1024
1025         if(outsize > 4)
1026                 smb_setlen(outbuf,outsize - 4);
1027         return(outsize);
1028 }
1029
1030 /****************************************************************************
1031  Keep track of the number of running smbd's. This functionality is used to
1032  'hard' limit Samba overhead on resource constrained systems.
1033 ****************************************************************************/
1034
1035 static BOOL process_count_update_successful = False;
1036
1037 static int32 increment_smbd_process_count(void)
1038 {
1039         int32 total_smbds;
1040
1041         if (lp_max_smbd_processes()) {
1042                 total_smbds = 0;
1043                 if (tdb_change_int32_atomic(conn_tdb_ctx(), "INFO/total_smbds", &total_smbds, 1) == -1)
1044                         return 1;
1045                 process_count_update_successful = True;
1046                 return total_smbds + 1;
1047         }
1048         return 1;
1049 }
1050
1051 void decrement_smbd_process_count(void)
1052 {
1053         int32 total_smbds;
1054
1055         if (lp_max_smbd_processes() && process_count_update_successful) {
1056                 total_smbds = 1;
1057                 tdb_change_int32_atomic(conn_tdb_ctx(), "INFO/total_smbds", &total_smbds, -1);
1058         }
1059 }
1060
1061 static BOOL smbd_process_limit(void)
1062 {
1063         int32  total_smbds;
1064
1065         if (lp_max_smbd_processes()) {
1066
1067                 /* Always add one to the smbd process count, as exit_server() always
1068                  * subtracts one.
1069                  */
1070
1071                 if (!conn_tdb_ctx()) {
1072                         DEBUG(0,("smbd_process_limit: max smbd processes parameter set with status parameter not \
1073 set. Ignoring max smbd restriction.\n"));
1074                         return False;
1075                 }
1076
1077                 total_smbds = increment_smbd_process_count();
1078                 return total_smbds > lp_max_smbd_processes();
1079         }
1080         else
1081                 return False;
1082 }
1083
1084 /****************************************************************************
1085  Process an smb from the client - split out from the smbd_process() code so
1086  it can be used by the oplock break code.
1087 ****************************************************************************/
1088
1089 void process_smb(char *inbuf, char *outbuf)
1090 {
1091         static int trans_num;
1092         int msg_type = CVAL(inbuf,0);
1093         int32 len = smb_len(inbuf);
1094         int nread = len + 4;
1095
1096         DO_PROFILE_INC(smb_count);
1097
1098         if (trans_num == 0) {
1099                 /* on the first packet, check the global hosts allow/ hosts
1100                 deny parameters before doing any parsing of the packet
1101                 passed to us by the client.  This prevents attacks on our
1102                 parsing code from hosts not in the hosts allow list */
1103                 if (smbd_process_limit() ||
1104                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))) {
1105                         /* send a negative session response "not listening on calling name" */
1106                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1107                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1108                         (void)send_smb(smbd_server_fd(),(char *)buf);
1109                         exit_server("connection denied");
1110                 }
1111         }
1112
1113         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1114         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1115
1116         if (msg_type == 0)
1117                 show_msg(inbuf);
1118         else if(msg_type == SMBkeepalive)
1119                 return; /* Keepalive packet. */
1120
1121         nread = construct_reply(inbuf,outbuf,nread,max_send);
1122
1123         if(nread > 0) {
1124                 if (CVAL(outbuf,0) == 0)
1125                         show_msg(outbuf);
1126
1127                 if (nread != smb_len(outbuf) + 4) {
1128                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1129                                 nread, smb_len(outbuf)));
1130                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1131                         exit_server("process_smb: send_smb failed.");
1132                 }
1133         }
1134         trans_num++;
1135 }
1136
1137 /****************************************************************************
1138  Return a string containing the function name of a SMB command.
1139 ****************************************************************************/
1140
1141 const char *smb_fn_name(int type)
1142 {
1143         const char *unknown_name = "SMBunknown";
1144
1145         if (smb_messages[type].name == NULL)
1146                 return(unknown_name);
1147
1148         return(smb_messages[type].name);
1149 }
1150
1151 /****************************************************************************
1152  Helper functions for contruct_reply.
1153 ****************************************************************************/
1154
1155 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1156
1157 void add_to_common_flags2(uint32 v)
1158 {
1159         common_flags2 |= v;
1160 }
1161
1162 void remove_from_common_flags2(uint32 v)
1163 {
1164         common_flags2 &= ~v;
1165 }
1166
1167 void construct_reply_common(char *inbuf,char *outbuf)
1168 {
1169         memset(outbuf,'\0',smb_size);
1170
1171         set_message(outbuf,0,0,True);
1172         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1173
1174         memcpy(outbuf+4,inbuf+4,4);
1175         SCVAL(outbuf,smb_rcls,SMB_SUCCESS);
1176         SCVAL(outbuf,smb_reh,0);
1177         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1178         SSVAL(outbuf,smb_flg2,
1179                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1180                 common_flags2);
1181
1182         SSVAL(outbuf,smb_err,SMB_SUCCESS);
1183         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1184         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1185         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1186         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1187 }
1188
1189 /****************************************************************************
1190  Construct a chained reply and add it to the already made reply
1191 ****************************************************************************/
1192
1193 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1194 {
1195         static char *orig_inbuf;
1196         static char *orig_outbuf;
1197         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1198         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1199         char *inbuf2, *outbuf2;
1200         int outsize2;
1201         char inbuf_saved[smb_wct];
1202         char outbuf_saved[smb_wct];
1203         int outsize = smb_len(outbuf) + 4;
1204
1205         /* maybe its not chained */
1206         if (smb_com2 == 0xFF) {
1207                 SCVAL(outbuf,smb_vwv0,0xFF);
1208                 return outsize;
1209         }
1210
1211         if (chain_size == 0) {
1212                 /* this is the first part of the chain */
1213                 orig_inbuf = inbuf;
1214                 orig_outbuf = outbuf;
1215         }
1216
1217         /*
1218          * The original Win95 redirector dies on a reply to
1219          * a lockingX and read chain unless the chain reply is
1220          * 4 byte aligned. JRA.
1221          */
1222
1223         outsize = (outsize + 3) & ~3;
1224
1225         /* we need to tell the client where the next part of the reply will be */
1226         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1227         SCVAL(outbuf,smb_vwv0,smb_com2);
1228
1229         /* remember how much the caller added to the chain, only counting stuff
1230                 after the parameter words */
1231         chain_size += outsize - smb_wct;
1232
1233         /* work out pointers into the original packets. The
1234                 headers on these need to be filled in */
1235         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1236         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1237
1238         /* remember the original command type */
1239         smb_com1 = CVAL(orig_inbuf,smb_com);
1240
1241         /* save the data which will be overwritten by the new headers */
1242         memcpy(inbuf_saved,inbuf2,smb_wct);
1243         memcpy(outbuf_saved,outbuf2,smb_wct);
1244
1245         /* give the new packet the same header as the last part of the SMB */
1246         memmove(inbuf2,inbuf,smb_wct);
1247
1248         /* create the in buffer */
1249         SCVAL(inbuf2,smb_com,smb_com2);
1250
1251         /* create the out buffer */
1252         construct_reply_common(inbuf2, outbuf2);
1253
1254         DEBUG(3,("Chained message\n"));
1255         show_msg(inbuf2);
1256
1257         /* process the request */
1258         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,size-chain_size,
1259                                 bufsize-chain_size);
1260
1261         /* copy the new reply and request headers over the old ones, but
1262                 preserve the smb_com field */
1263         memmove(orig_outbuf,outbuf2,smb_wct);
1264         SCVAL(orig_outbuf,smb_com,smb_com1);
1265
1266         /* restore the saved data, being careful not to overwrite any
1267                 data from the reply header */
1268         memcpy(inbuf2,inbuf_saved,smb_wct);
1269
1270         {
1271                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1272                 if (ofs < 0) ofs = 0;
1273                         memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1274         }
1275
1276         return outsize2;
1277 }
1278
1279 /****************************************************************************
1280  Setup the needed select timeout.
1281 ****************************************************************************/
1282
1283 static int setup_select_timeout(void)
1284 {
1285         int select_timeout;
1286         int t;
1287
1288         select_timeout = blocking_locks_timeout(SMBD_SELECT_TIMEOUT);
1289         select_timeout *= 1000;
1290
1291         t = change_notify_timeout();
1292         if (t != -1)
1293                 select_timeout = MIN(select_timeout, t*1000);
1294
1295         if (print_notify_messages_pending())
1296                 select_timeout = MIN(select_timeout, 1000);
1297
1298         return select_timeout;
1299 }
1300
1301 /****************************************************************************
1302  Check if services need reloading.
1303 ****************************************************************************/
1304
1305 void check_reload(int t)
1306 {
1307         static pid_t mypid = 0;
1308         static time_t last_smb_conf_reload_time = 0;
1309         static time_t last_printer_reload_time = 0;
1310         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1311
1312         if(last_smb_conf_reload_time == 0) {
1313                 last_smb_conf_reload_time = t;
1314                 /* Our printing subsystem might not be ready at smbd start up.
1315                    Then no printer is available till the first printers check
1316                    is performed.  A lower initial interval circumvents this. */
1317                 if ( printcap_cache_time > 60 )
1318                         last_printer_reload_time = t - printcap_cache_time + 60;
1319                 else
1320                         last_printer_reload_time = t;
1321         }
1322
1323         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1324                 /* randomize over 60 second the printcap reload to avoid all
1325                  * process hitting cupsd at the same time */
1326                 int time_range = 60;
1327
1328                 last_printer_reload_time += random() % time_range;
1329                 mypid = getpid();
1330         }
1331
1332         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1333                 reload_services(True);
1334                 reload_after_sighup = False;
1335                 last_smb_conf_reload_time = t;
1336         }
1337
1338         /* 'printcap cache time = 0' disable the feature */
1339
1340         if ( printcap_cache_time != 0 )
1341         {
1342                 /* see if it's time to reload or if the clock has been set back */
1343
1344                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1345                         || (t-last_printer_reload_time  < 0) )
1346                 {
1347                         DEBUG( 3,( "Printcap cache time expired.\n"));
1348                         reload_printers();
1349                         last_printer_reload_time = t;
1350                 }
1351         }
1352 }
1353
1354 /****************************************************************************
1355  Process any timeout housekeeping. Return False if the caller should exit.
1356 ****************************************************************************/
1357
1358 static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1359 {
1360         static time_t last_keepalive_sent_time = 0;
1361         static time_t last_idle_closed_check = 0;
1362         time_t t;
1363         BOOL allidle = True;
1364
1365         if (smb_read_error == READ_EOF) {
1366                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1367                 return False;
1368         }
1369
1370         if (smb_read_error == READ_ERROR) {
1371                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1372                         strerror(errno)));
1373                 return False;
1374         }
1375
1376         if (smb_read_error == READ_BAD_SIG) {
1377                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1378                 return False;
1379         }
1380
1381         *last_timeout_processing_time = t = time(NULL);
1382
1383         if(last_keepalive_sent_time == 0)
1384                 last_keepalive_sent_time = t;
1385
1386         if(last_idle_closed_check == 0)
1387                 last_idle_closed_check = t;
1388
1389         /* become root again if waiting */
1390         change_to_root_user();
1391
1392         /* run all registered idle events */
1393         smb_run_idle_events(t);
1394
1395         /* check if we need to reload services */
1396         check_reload(t);
1397
1398         /* automatic timeout if all connections are closed */
1399         if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1400                 DEBUG( 2, ( "Closing idle connection\n" ) );
1401                 return False;
1402         } else {
1403                 last_idle_closed_check = t;
1404         }
1405
1406         if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1407                 if (!send_keepalive(smbd_server_fd())) {
1408                         DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1409                         return False;
1410                 }
1411
1412                 /* send a keepalive for a password server or the like.
1413                         This is attached to the auth_info created in the
1414                 negprot */
1415                 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1416                                 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1417
1418                         negprot_global_auth_context->challenge_set_method->send_keepalive
1419                         (&negprot_global_auth_context->challenge_set_method->private_data);
1420                 }
1421
1422                 last_keepalive_sent_time = t;
1423         }
1424
1425         /* check for connection timeouts */
1426         allidle = conn_idle_all(t, deadtime);
1427
1428         if (allidle && conn_num_open()>0) {
1429                 DEBUG(2,("Closing idle connection 2.\n"));
1430                 return False;
1431         }
1432
1433         if(global_machine_password_needs_changing &&
1434                         /* for ADS we need to do a regular ADS password change, not a domain
1435                                         password change */
1436                         lp_security() == SEC_DOMAIN) {
1437
1438                 unsigned char trust_passwd_hash[16];
1439                 time_t lct;
1440
1441                 /*
1442                  * We're in domain level security, and the code that
1443                  * read the machine password flagged that the machine
1444                  * password needs changing.
1445                  */
1446
1447                 /*
1448                  * First, open the machine password file with an exclusive lock.
1449                  */
1450
1451                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1452                         DEBUG(0,("process: unable to lock the machine account password for \
1453 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1454                         return True;
1455                 }
1456
1457                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1458                         DEBUG(0,("process: unable to read the machine account password for \
1459 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1460                         secrets_lock_trust_account_password(lp_workgroup(), False);
1461                         return True;
1462                 }
1463
1464                 /*
1465                  * Make sure someone else hasn't already done this.
1466                  */
1467
1468                 if(t < lct + lp_machine_password_timeout()) {
1469                         global_machine_password_needs_changing = False;
1470                         secrets_lock_trust_account_password(lp_workgroup(), False);
1471                         return True;
1472                 }
1473
1474                 /* always just contact the PDC here */
1475
1476                 change_trust_account_password( lp_workgroup(), NULL);
1477                 global_machine_password_needs_changing = False;
1478                 secrets_lock_trust_account_password(lp_workgroup(), False);
1479         }
1480
1481         /*
1482          * Check to see if we have any blocking locks
1483          * outstanding on the queue.
1484          */
1485         process_blocking_lock_queue(t);
1486
1487         /* update printer queue caches if necessary */
1488
1489         update_monitored_printq_cache();
1490
1491         /*
1492          * Check to see if we have any change notifies
1493          * outstanding on the queue.
1494          */
1495         process_pending_change_notify_queue(t);
1496
1497         /*
1498          * Now we are root, check if the log files need pruning.
1499          * Force a log file check.
1500          */
1501         force_check_log_size();
1502         check_log_size();
1503
1504         /* Send any queued printer notify message to interested smbd's. */
1505
1506         print_notify_send_messages(0);
1507
1508         /*
1509          * Modify the select timeout depending upon
1510          * what we have remaining in our queues.
1511          */
1512
1513         *select_timeout = setup_select_timeout();
1514
1515         return True;
1516 }
1517
1518 /****************************************************************************
1519  Accessor functions for InBuffer, OutBuffer.
1520 ****************************************************************************/
1521
1522 char *get_InBuffer(void)
1523 {
1524         return InBuffer;
1525 }
1526
1527 void set_InBuffer(char *new_inbuf)
1528 {
1529         InBuffer = new_inbuf;
1530         current_inbuf = InBuffer;
1531 }
1532
1533 char *get_OutBuffer(void)
1534 {
1535         return OutBuffer;
1536 }
1537
1538 void set_OutBuffer(char *new_outbuf)
1539 {
1540         OutBuffer = new_outbuf;
1541 }
1542
1543 /****************************************************************************
1544  Free an InBuffer. Checks if not in use by aio system.
1545  Must have been allocated by NewInBuffer.
1546 ****************************************************************************/
1547
1548 void free_InBuffer(char *inbuf)
1549 {
1550         if (!aio_inbuffer_in_use(inbuf)) {
1551                 if (current_inbuf == inbuf) {
1552                         current_inbuf = NULL;
1553                 }
1554                 SAFE_FREE(inbuf);
1555         }
1556 }
1557
1558 /****************************************************************************
1559  Free an OutBuffer. No outbuffers currently stolen by aio system.
1560  Must have been allocated by NewInBuffer.
1561 ****************************************************************************/
1562
1563 void free_OutBuffer(char *outbuf)
1564 {
1565         SAFE_FREE(outbuf);
1566 }
1567
1568 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1569
1570 /****************************************************************************
1571  Allocate a new InBuffer. Returns the new and old ones.
1572 ****************************************************************************/
1573
1574 char *NewInBuffer(char **old_inbuf)
1575 {
1576         char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1577         if (!new_inbuf) {
1578                 return NULL;
1579         }
1580         if (old_inbuf) {
1581                 *old_inbuf = InBuffer;
1582         }
1583         InBuffer = new_inbuf;
1584 #if defined(DEVELOPER)
1585         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1586 #endif
1587         return InBuffer;
1588 }
1589
1590 /****************************************************************************
1591  Allocate a new OutBuffer. Returns the new and old ones.
1592 ****************************************************************************/
1593
1594 char *NewOutBuffer(char **old_outbuf)
1595 {
1596         char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1597         if (!new_outbuf) {
1598                 return NULL;
1599         }
1600         if (old_outbuf) {
1601                 *old_outbuf = OutBuffer;
1602         }
1603         OutBuffer = new_outbuf;
1604 #if defined(DEVELOPER)
1605         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1606 #endif
1607         return OutBuffer;
1608 }
1609
1610 /****************************************************************************
1611  Process commands from the client
1612 ****************************************************************************/
1613
1614 void smbd_process(void)
1615 {
1616         time_t last_timeout_processing_time = time(NULL);
1617         unsigned int num_smbs = 0;
1618
1619         /* Allocate the primary Inbut/Output buffers. */
1620
1621         if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1622                 return;
1623
1624         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1625
1626         while (True) {
1627                 int deadtime = lp_deadtime()*60;
1628                 int select_timeout = setup_select_timeout();
1629                 int num_echos;
1630
1631                 if (deadtime <= 0)
1632                         deadtime = DEFAULT_SMBD_TIMEOUT;
1633
1634                 errno = 0;
1635
1636                 /* free up temporary memory */
1637                 lp_talloc_free();
1638                 main_loop_talloc_free();
1639
1640                 /* Did someone ask for immediate checks on things like blocking locks ? */
1641                 if (select_timeout == 0) {
1642                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1643                                 return;
1644                         num_smbs = 0; /* Reset smb counter. */
1645                 }
1646
1647 #if defined(DEVELOPER)
1648                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1649 #endif
1650
1651                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1652                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1653                                 return;
1654                         num_smbs = 0; /* Reset smb counter. */
1655                 }
1656
1657                 /*
1658                  * Ensure we do timeout processing if the SMB we just got was
1659                  * only an echo request. This allows us to set the select
1660                  * timeout in 'receive_message_or_smb()' to any value we like
1661                  * without worrying that the client will send echo requests
1662                  * faster than the select timeout, thus starving out the
1663                  * essential processing (change notify, blocking locks) that
1664                  * the timeout code does. JRA.
1665                  */
1666                 num_echos = smb_echo_count;
1667
1668                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1669
1670                 process_smb(InBuffer, OutBuffer);
1671
1672                 if (smb_echo_count != num_echos) {
1673                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1674                                 return;
1675                         num_smbs = 0; /* Reset smb counter. */
1676                 }
1677
1678                 num_smbs++;
1679
1680                 /*
1681                  * If we are getting smb requests in a constant stream
1682                  * with no echos, make sure we attempt timeout processing
1683                  * every select_timeout milliseconds - but only check for this
1684                  * every 200 smb requests.
1685                  */
1686
1687                 if ((num_smbs % 200) == 0) {
1688                         time_t new_check_time = time(NULL);
1689                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1690                                 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1691                                         return;
1692                                 num_smbs = 0; /* Reset smb counter. */
1693                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1694                         }
1695                 }
1696
1697                 /* The timeout_processing function isn't run nearly
1698                    often enough to implement 'max log size' without
1699                    overrunning the size of the file by many megabytes.
1700                    This is especially true if we are running at debug
1701                    level 10.  Checking every 50 SMBs is a nice
1702                    tradeoff of performance vs log file size overrun. */
1703
1704                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1705                         change_to_root_user();
1706                         check_log_size();
1707                 }
1708         }
1709 }