source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43
  44 /* Internal message queue for deferred opens. */
  45 struct pending_message_list {
  46         struct pending_message_list *next, *prev;
  47         struct timeval request_time; /* When was this first issued? */
  48         struct smbd_server_connection *sconn;
  49         struct tevent_timer *te;
  50         struct smb_perfcount_data pcd;
  51         uint32_t seqnum;
  52         bool encrypted;
  53         bool processed;
  54         DATA_BLOB buf;
  55         DATA_BLOB private_data;
  56 };
  57
  58 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  59                                    char *outbuf);
  60 static struct pending_message_list *get_deferred_open_message_smb(
  61         struct smbd_server_connection *sconn, uint64_t mid);
  62 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  63
  64 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  65 {
  66         bool ok;
  67
  68         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  69                 return true;
  70         }
  71
  72         sconn->smb1.echo_handler.ref_count++;
  73
  74         if (sconn->smb1.echo_handler.ref_count > 1) {
  75                 return true;
  76         }
  77
  78         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
  79
  80         do {
  81                 ok = fcntl_lock(
  82                         sconn->smb1.echo_handler.socket_lock_fd,
  83                         F_SETLKW, 0, 0, F_WRLCK);
  84         } while (!ok && (errno == EINTR));
  85
  86         if (!ok) {
  87                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  88                 return false;
  89         }
  90
  91         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
  92
  93         return true;
  94 }
  95
  96 void smbd_lock_socket(struct smbd_server_connection *sconn)
  97 {
  98         if (!smbd_lock_socket_internal(sconn)) {
  99                 exit_server_cleanly("failed to lock socket");
 100         }
 101 }
 102
 103 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
 104 {
 105         bool ok;
 106
 107         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
 108                 return true;
 109         }
 110
 111         sconn->smb1.echo_handler.ref_count--;
 112
 113         if (sconn->smb1.echo_handler.ref_count > 0) {
 114                 return true;
 115         }
 116
 117         do {
 118                 ok = fcntl_lock(
 119                         sconn->smb1.echo_handler.socket_lock_fd,
 120                         F_SETLKW, 0, 0, F_UNLCK);
 121         } while (!ok && (errno == EINTR));
 122
 123         if (!ok) {
 124                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 125                 return false;
 126         }
 127
 128         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 129
 130         return true;
 131 }
 132
 133 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 134 {
 135         if (!smbd_unlock_socket_internal(sconn)) {
 136                 exit_server_cleanly("failed to unlock socket");
 137         }
 138 }
 139
 140 /* Accessor function for smb_read_error for smbd functions. */
 141
 142 /****************************************************************************
 143  Send an smb to a fd.
 144 ****************************************************************************/
 145
 146 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 147                   bool do_signing, uint32_t seqnum,
 148                   bool do_encrypt,
 149                   struct smb_perfcount_data *pcd)
 150 {
 151         size_t len = 0;
 152         ssize_t ret;
 153         char *buf_out = buffer;
 154
 155         smbd_lock_socket(sconn);
 156
 157         if (do_signing) {
 158                 /* Sign the outgoing packet if required. */
 159                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 160         }
 161
 162         if (do_encrypt) {
 163                 NTSTATUS status = srv_encrypt_buffer(sconn, buffer, &buf_out);
 164                 if (!NT_STATUS_IS_OK(status)) {
 165                         DEBUG(0, ("send_smb: SMB encryption failed "
 166                                 "on outgoing packet! Error %s\n",
 167                                 nt_errstr(status) ));
 168                         goto out;
 169                 }
 170         }
 171
 172         len = smb_len_large(buf_out) + 4;
 173
 174         ret = write_data(sconn->sock, buf_out, len);
 175         if (ret <= 0) {
 176
 177                 char addr[INET6_ADDRSTRLEN];
 178                 /*
 179                  * Try and give an error message saying what
 180                  * client failed.
 181                  */
 182                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 183                          (int)getpid(), (int)len,
 184                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 185                          (int)ret, strerror(errno) ));
 186
 187                 srv_free_enc_buffer(sconn, buf_out);
 188                 goto out;
 189         }
 190
 191         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 192         srv_free_enc_buffer(sconn, buf_out);
 193 out:
 194         SMB_PERFCOUNT_END(pcd);
 195
 196         smbd_unlock_socket(sconn);
 197         return true;
 198 }
 199
 200 /*******************************************************************
 201  Setup the word count and byte count for a smb message.
 202 ********************************************************************/
 203
 204 int srv_set_message(char *buf,
 205                         int num_words,
 206                         int num_bytes,
 207                         bool zero)
 208 {
 209         if (zero && (num_words || num_bytes)) {
 210                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 211         }
 212         SCVAL(buf,smb_wct,num_words);
 213         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 214         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 215         return (smb_size + num_words*2 + num_bytes);
 216 }
 217
 218 static bool valid_smb_header(struct smbd_server_connection *sconn,
 219                              const uint8_t *inbuf)
 220 {
 221         if (is_encrypted_packet(sconn, inbuf)) {
 222                 return true;
 223         }
 224         /*
 225          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 226          * but it just looks weird to call strncmp for this one.
 227          */
 228         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 229 }
 230
 231 /* Socket functions for smbd packet processing. */
 232
 233 static bool valid_packet_size(size_t len)
 234 {
 235         /*
 236          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 237          * of header. Don't print the error if this fits.... JRA.
 238          */
 239
 240         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 241                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 242                                         (unsigned long)len));
 243                 return false;
 244         }
 245         return true;
 246 }
 247
 248 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 249                                       unsigned int timeout, ssize_t len)
 250 {
 251         NTSTATUS status;
 252
 253         if (len <= 0) {
 254                 return NT_STATUS_OK;
 255         }
 256
 257         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 char addr[INET6_ADDRSTRLEN];
 260                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 261                           "error = %s.\n",
 262                           get_peer_addr(fd, addr, sizeof(addr)),
 263                           nt_errstr(status)));
 264         }
 265         return status;
 266 }
 267
 268 /****************************************************************************
 269  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 270 ****************************************************************************/
 271
 272 /*
 273  * Unfortunately, earlier versions of smbclient/libsmbclient
 274  * don't send this "standard" writeX header. I've fixed this
 275  * for 3.2 but we'll use the old method with earlier versions.
 276  * Windows and CIFSFS at least use this standard size. Not
 277  * sure about MacOSX.
 278  */
 279
 280 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 281                                 (2*14) + /* word count (including bcc) */ \
 282                                 1 /* pad byte */)
 283
 284 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 285                                                     const char lenbuf[4],
 286                                                     struct smbd_server_connection *sconn,
 287                                                     int sock,
 288                                                     char **buffer,
 289                                                     unsigned int timeout,
 290                                                     size_t *p_unread,
 291                                                     size_t *len_ret)
 292 {
 293         /* Size of a WRITEX call (+4 byte len). */
 294         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 295         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 296         ssize_t toread;
 297         NTSTATUS status;
 298
 299         memcpy(writeX_header, lenbuf, 4);
 300
 301         status = read_fd_with_timeout(
 302                 sock, writeX_header + 4,
 303                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 304                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 305                 timeout, NULL);
 306
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 309                           "error = %s.\n",
 310                           tsocket_address_string(sconn->remote_address,
 311                                                  talloc_tos()),
 312                           nt_errstr(status)));
 313                 return status;
 314         }
 315
 316         /*
 317          * Ok - now try and see if this is a possible
 318          * valid writeX call.
 319          */
 320
 321         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 322                 /*
 323                  * If the data offset is beyond what
 324                  * we've read, drain the extra bytes.
 325                  */
 326                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 327                 ssize_t newlen;
 328
 329                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 330                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 331                         if (drain_socket(sock, drain) != drain) {
 332                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 333                                         " failed to drain pending bytes");
 334                         }
 335                 } else {
 336                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 337                 }
 338
 339                 /* Spoof down the length and null out the bcc. */
 340                 set_message_bcc(writeX_header, 0);
 341                 newlen = smb_len(writeX_header);
 342
 343                 /* Copy the header we've written. */
 344
 345                 *buffer = (char *)talloc_memdup(mem_ctx,
 346                                 writeX_header,
 347                                 sizeof(writeX_header));
 348
 349                 if (*buffer == NULL) {
 350                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 351                                   (int)sizeof(writeX_header)));
 352                         return NT_STATUS_NO_MEMORY;
 353                 }
 354
 355                 /* Work out the remaining bytes. */
 356                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 357                 *len_ret = newlen + 4;
 358                 return NT_STATUS_OK;
 359         }
 360
 361         if (!valid_packet_size(len)) {
 362                 return NT_STATUS_INVALID_PARAMETER;
 363         }
 364
 365         /*
 366          * Not a valid writeX call. Just do the standard
 367          * talloc and return.
 368          */
 369
 370         *buffer = talloc_array(mem_ctx, char, len+4);
 371
 372         if (*buffer == NULL) {
 373                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 374                           (int)len+4));
 375                 return NT_STATUS_NO_MEMORY;
 376         }
 377
 378         /* Copy in what we already read. */
 379         memcpy(*buffer,
 380                 writeX_header,
 381                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 382         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 383
 384         if(toread > 0) {
 385                 status = read_packet_remainder(
 386                         sock,
 387                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 388                         timeout, toread);
 389
 390                 if (!NT_STATUS_IS_OK(status)) {
 391                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 392                                    nt_errstr(status)));
 393                         return status;
 394                 }
 395         }
 396
 397         *len_ret = len + 4;
 398         return NT_STATUS_OK;
 399 }
 400
 401 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 402                                        struct smbd_server_connection *sconn,
 403                                        int sock,
 404                                        char **buffer, unsigned int timeout,
 405                                        size_t *p_unread, size_t *plen)
 406 {
 407         char lenbuf[4];
 408         size_t len;
 409         int min_recv_size = lp_min_receive_file_size();
 410         NTSTATUS status;
 411
 412         *p_unread = 0;
 413
 414         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 415                                                   &len);
 416         if (!NT_STATUS_IS_OK(status)) {
 417                 return status;
 418         }
 419
 420         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 421             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 422                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 423             !srv_is_signing_active(sconn) &&
 424             sconn->smb1.echo_handler.trusted_fde == NULL) {
 425
 426                 return receive_smb_raw_talloc_partial_read(
 427                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 428                         p_unread, plen);
 429         }
 430
 431         if (!valid_packet_size(len)) {
 432                 return NT_STATUS_INVALID_PARAMETER;
 433         }
 434
 435         /*
 436          * The +4 here can't wrap, we've checked the length above already.
 437          */
 438
 439         *buffer = talloc_array(mem_ctx, char, len+4);
 440
 441         if (*buffer == NULL) {
 442                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 443                           (int)len+4));
 444                 return NT_STATUS_NO_MEMORY;
 445         }
 446
 447         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 448
 449         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 450         if (!NT_STATUS_IS_OK(status)) {
 451                 return status;
 452         }
 453
 454         *plen = len + 4;
 455         return NT_STATUS_OK;
 456 }
 457
 458 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 459                                    struct smbd_server_connection *sconn,
 460                                    int sock,
 461                                    char **buffer, unsigned int timeout,
 462                                    size_t *p_unread, bool *p_encrypted,
 463                                    size_t *p_len,
 464                                    uint32_t *seqnum,
 465                                    bool trusted_channel)
 466 {
 467         size_t len = 0;
 468         NTSTATUS status;
 469
 470         *p_encrypted = false;
 471
 472         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 473                                         p_unread, &len);
 474         if (!NT_STATUS_IS_OK(status)) {
 475                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 476                       ("receive_smb_raw_talloc failed for client %s "
 477                        "read error = %s.\n",
 478                        tsocket_address_string(sconn->remote_address,
 479                                               talloc_tos()),
 480                        nt_errstr(status)) );
 481                 return status;
 482         }
 483
 484         if (is_encrypted_packet(sconn, (uint8_t *)*buffer)) {
 485                 status = srv_decrypt_buffer(sconn, *buffer);
 486                 if (!NT_STATUS_IS_OK(status)) {
 487                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 488                                 "incoming packet! Error %s\n",
 489                                 nt_errstr(status) ));
 490                         return status;
 491                 }
 492                 *p_encrypted = true;
 493         }
 494
 495         /* Check the incoming SMB signature. */
 496         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 497                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 498                           "incoming packet!\n"));
 499                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 500         }
 501
 502         *p_len = len;
 503         return NT_STATUS_OK;
 504 }
 505
 506 /*
 507  * Initialize a struct smb_request from an inbuf
 508  */
 509
 510 static bool init_smb_request(struct smb_request *req,
 511                              struct smbd_server_connection *sconn,
 512                              const uint8 *inbuf,
 513                              size_t unread_bytes, bool encrypted,
 514                              uint32_t seqnum)
 515 {
 516         struct smbXsrv_tcon *tcon;
 517         NTSTATUS status;
 518         NTTIME now;
 519         size_t req_size = smb_len(inbuf) + 4;
 520
 521         /* Ensure we have at least smb_size bytes. */
 522         if (req_size < smb_size) {
 523                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 524                         (unsigned int)req_size ));
 525                 return false;
 526         }
 527
 528         req->request_time = timeval_current();
 529         now = timeval_to_nttime(&req->request_time);
 530
 531         req->cmd    = CVAL(inbuf, smb_com);
 532         req->flags2 = SVAL(inbuf, smb_flg2);
 533         req->smbpid = SVAL(inbuf, smb_pid);
 534         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 535         req->seqnum = seqnum;
 536         req->vuid   = SVAL(inbuf, smb_uid);
 537         req->tid    = SVAL(inbuf, smb_tid);
 538         req->wct    = CVAL(inbuf, smb_wct);
 539         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 540         req->buflen = smb_buflen(inbuf);
 541         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 542         req->unread_bytes = unread_bytes;
 543         req->encrypted = encrypted;
 544         req->sconn = sconn;
 545         status = smb1srv_tcon_lookup(sconn->conn, req->tid, now, &tcon);
 546         if (NT_STATUS_IS_OK(status)) {
 547                 req->conn = tcon->compat;
 548         } else {
 549                 req->conn = NULL;
 550         }
 551         req->chain_fsp = NULL;
 552         req->smb2req = NULL;
 553         req->priv_paths = NULL;
 554         req->chain = NULL;
 555         smb_init_perfcount_data(&req->pcd);
 556
 557         /* Ensure we have at least wct words and 2 bytes of bcc. */
 558         if (smb_size + req->wct*2 > req_size) {
 559                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 560                         (unsigned int)req->wct,
 561                         (unsigned int)req_size));
 562                 return false;
 563         }
 564         /* Ensure bcc is correct. */
 565         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 566                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 567                         "(wct = %u, size %u)\n",
 568                         (unsigned int)req->buflen,
 569                         (unsigned int)req->wct,
 570                         (unsigned int)req_size));
 571                 return false;
 572         }
 573
 574         req->outbuf = NULL;
 575         return true;
 576 }
 577
 578 static void process_smb(struct smbd_server_connection *conn,
 579                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 580                         uint32_t seqnum, bool encrypted,
 581                         struct smb_perfcount_data *deferred_pcd);
 582
 583 static void smbd_deferred_open_timer(struct tevent_context *ev,
 584                                      struct tevent_timer *te,
 585                                      struct timeval _tval,
 586                                      void *private_data)
 587 {
 588         struct pending_message_list *msg = talloc_get_type(private_data,
 589                                            struct pending_message_list);
 590         struct smbd_server_connection *sconn = msg->sconn;
 591         TALLOC_CTX *mem_ctx = talloc_tos();
 592         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 593         uint8_t *inbuf;
 594
 595         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 596                                          msg->buf.length);
 597         if (inbuf == NULL) {
 598                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 599                 return;
 600         }
 601
 602         /* We leave this message on the queue so the open code can
 603            know this is a retry. */
 604         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 605                 (unsigned long long)mid ));
 606
 607         /* Mark the message as processed so this is not
 608          * re-processed in error. */
 609         msg->processed = true;
 610
 611         process_smb(sconn, inbuf,
 612                     msg->buf.length, 0,
 613                     msg->seqnum, msg->encrypted, &msg->pcd);
 614
 615         /* If it's still there and was processed, remove it. */
 616         msg = get_deferred_open_message_smb(sconn, mid);
 617         if (msg && msg->processed) {
 618                 remove_deferred_open_message_smb(sconn, mid);
 619         }
 620 }
 621
 622 /****************************************************************************
 623  Function to push a message onto the tail of a linked list of smb messages ready
 624  for processing.
 625 ****************************************************************************/
 626
 627 static bool push_queued_message(struct smb_request *req,
 628                                 struct timeval request_time,
 629                                 struct timeval end_time,
 630                                 char *private_data, size_t private_len)
 631 {
 632         int msg_len = smb_len(req->inbuf) + 4;
 633         struct pending_message_list *msg;
 634
 635         msg = talloc_zero(NULL, struct pending_message_list);
 636
 637         if(msg == NULL) {
 638                 DEBUG(0,("push_message: malloc fail (1)\n"));
 639                 return False;
 640         }
 641         msg->sconn = req->sconn;
 642
 643         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 644         if(msg->buf.data == NULL) {
 645                 DEBUG(0,("push_message: malloc fail (2)\n"));
 646                 TALLOC_FREE(msg);
 647                 return False;
 648         }
 649
 650         msg->request_time = request_time;
 651         msg->seqnum = req->seqnum;
 652         msg->encrypted = req->encrypted;
 653         msg->processed = false;
 654         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 655
 656         if (private_data) {
 657                 msg->private_data = data_blob_talloc(msg, private_data,
 658                                                      private_len);
 659                 if (msg->private_data.data == NULL) {
 660                         DEBUG(0,("push_message: malloc fail (3)\n"));
 661                         TALLOC_FREE(msg);
 662                         return False;
 663                 }
 664         }
 665
 666 #if 0
 667         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 668                                    msg,
 669                                    end_time,
 670                                    smbd_deferred_open_timer,
 671                                    msg);
 672         if (!msg->te) {
 673                 DEBUG(0,("push_message: event_add_timed failed\n"));
 674                 TALLOC_FREE(msg);
 675                 return false;
 676         }
 677 #endif
 678
 679         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 680                       struct pending_message_list *);
 681
 682         DEBUG(10,("push_message: pushed message length %u on "
 683                   "deferred_open_queue\n", (unsigned int)msg_len));
 684
 685         return True;
 686 }
 687
 688 /****************************************************************************
 689  Function to delete a sharing violation open message by mid.
 690 ****************************************************************************/
 691
 692 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 693                                       uint64_t mid)
 694 {
 695         struct pending_message_list *pml;
 696
 697         if (sconn->using_smb2) {
 698                 remove_deferred_open_message_smb2(sconn, mid);
 699                 return;
 700         }
 701
 702         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 703                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 704                         DEBUG(10,("remove_deferred_open_message_smb: "
 705                                   "deleting mid %llu len %u\n",
 706                                   (unsigned long long)mid,
 707                                   (unsigned int)pml->buf.length ));
 708                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 709                         TALLOC_FREE(pml);
 710                         return;
 711                 }
 712         }
 713 }
 714
 715 /****************************************************************************
 716  Move a sharing violation open retry message to the front of the list and
 717  schedule it for immediate processing.
 718 ****************************************************************************/
 719
 720 bool schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 721                                         uint64_t mid)
 722 {
 723         struct pending_message_list *pml;
 724         int i = 0;
 725
 726         if (sconn->using_smb2) {
 727                 return schedule_deferred_open_message_smb2(sconn, mid);
 728         }
 729
 730         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 731                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 732
 733                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 734                         "msg_mid = %llu\n",
 735                         i++,
 736                         (unsigned long long)msg_mid ));
 737
 738                 if (mid == msg_mid) {
 739                         struct tevent_timer *te;
 740
 741                         if (pml->processed) {
 742                                 /* A processed message should not be
 743                                  * rescheduled. */
 744                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 745                                         "message mid %llu was already processed\n",
 746                                         (unsigned long long)msg_mid ));
 747                                 continue;
 748                         }
 749
 750                         DEBUG(10,("schedule_deferred_open_message_smb: "
 751                                 "scheduling mid %llu\n",
 752                                 (unsigned long long)mid ));
 753
 754                         te = tevent_add_timer(pml->sconn->ev_ctx,
 755                                               pml,
 756                                               timeval_zero(),
 757                                               smbd_deferred_open_timer,
 758                                               pml);
 759                         if (!te) {
 760                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 761                                         "event_add_timed() failed, "
 762                                         "skipping mid %llu\n",
 763                                         (unsigned long long)msg_mid ));
 764                         }
 765
 766                         TALLOC_FREE(pml->te);
 767                         pml->te = te;
 768                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 769                         return true;
 770                 }
 771         }
 772
 773         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 774                 "find message mid %llu\n",
 775                 (unsigned long long)mid ));
 776
 777         return false;
 778 }
 779
 780 /****************************************************************************
 781  Return true if this mid is on the deferred queue and was not yet processed.
 782 ****************************************************************************/
 783
 784 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 785 {
 786         struct pending_message_list *pml;
 787
 788         if (sconn->using_smb2) {
 789                 return open_was_deferred_smb2(sconn, mid);
 790         }
 791
 792         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 793                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 794                         return True;
 795                 }
 796         }
 797         return False;
 798 }
 799
 800 /****************************************************************************
 801  Return the message queued by this mid.
 802 ****************************************************************************/
 803
 804 static struct pending_message_list *get_deferred_open_message_smb(
 805         struct smbd_server_connection *sconn, uint64_t mid)
 806 {
 807         struct pending_message_list *pml;
 808
 809         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 810                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 811                         return pml;
 812                 }
 813         }
 814         return NULL;
 815 }
 816
 817 /****************************************************************************
 818  Get the state data queued by this mid.
 819 ****************************************************************************/
 820
 821 bool get_deferred_open_message_state(struct smb_request *smbreq,
 822                                 struct timeval *p_request_time,
 823                                 void **pp_state)
 824 {
 825         struct pending_message_list *pml;
 826
 827         if (smbreq->sconn->using_smb2) {
 828                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 829                                         p_request_time,
 830                                         pp_state);
 831         }
 832
 833         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 834         if (!pml) {
 835                 return false;
 836         }
 837         if (p_request_time) {
 838                 *p_request_time = pml->request_time;
 839         }
 840         if (pp_state) {
 841                 *pp_state = (void *)pml->private_data.data;
 842         }
 843         return true;
 844 }
 845
 846 /****************************************************************************
 847  Function to push a deferred open smb message onto a linked list of local smb
 848  messages ready for processing.
 849 ****************************************************************************/
 850
 851 bool push_deferred_open_message_smb(struct smb_request *req,
 852                                struct timeval request_time,
 853                                struct timeval timeout,
 854                                struct file_id id,
 855                                char *private_data, size_t priv_len)
 856 {
 857         struct timeval end_time;
 858
 859         if (req->smb2req) {
 860                 return push_deferred_open_message_smb2(req->smb2req,
 861                                                 request_time,
 862                                                 timeout,
 863                                                 id,
 864                                                 private_data,
 865                                                 priv_len);
 866         }
 867
 868         if (req->unread_bytes) {
 869                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 870                         "unread_bytes = %u\n",
 871                         (unsigned int)req->unread_bytes ));
 872                 smb_panic("push_deferred_open_message_smb: "
 873                         "logic error unread_bytes != 0" );
 874         }
 875
 876         end_time = timeval_sum(&request_time, &timeout);
 877
 878         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 879                 "len %u mid %llu timeout time [%u.%06u]\n",
 880                 (unsigned int) smb_len(req->inbuf)+4,
 881                 (unsigned long long)req->mid,
 882                 (unsigned int)end_time.tv_sec,
 883                 (unsigned int)end_time.tv_usec));
 884
 885         return push_queued_message(req, request_time, end_time,
 886                                    private_data, priv_len);
 887 }
 888
 889 static void smbd_sig_term_handler(struct tevent_context *ev,
 890                                   struct tevent_signal *se,
 891                                   int signum,
 892                                   int count,
 893                                   void *siginfo,
 894                                   void *private_data)
 895 {
 896         exit_server_cleanly("termination signal");
 897 }
 898
 899 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 900 {
 901         struct tevent_signal *se;
 902
 903         se = tevent_add_signal(sconn->ev_ctx,
 904                                sconn,
 905                                SIGTERM, 0,
 906                                smbd_sig_term_handler,
 907                                sconn);
 908         if (!se) {
 909                 exit_server("failed to setup SIGTERM handler");
 910         }
 911 }
 912
 913 static void smbd_sig_hup_handler(struct tevent_context *ev,
 914                                   struct tevent_signal *se,
 915                                   int signum,
 916                                   int count,
 917                                   void *siginfo,
 918                                   void *private_data)
 919 {
 920         struct smbd_server_connection *sconn =
 921                 talloc_get_type_abort(private_data,
 922                 struct smbd_server_connection);
 923
 924         change_to_root_user();
 925         DEBUG(1,("Reloading services after SIGHUP\n"));
 926         reload_services(sconn, conn_snum_used, false);
 927 }
 928
 929 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
 930 {
 931         struct tevent_signal *se;
 932
 933         se = tevent_add_signal(sconn->ev_ctx,
 934                                sconn,
 935                                SIGHUP, 0,
 936                                smbd_sig_hup_handler,
 937                                sconn);
 938         if (!se) {
 939                 exit_server("failed to setup SIGHUP handler");
 940         }
 941 }
 942
 943 static void smbd_conf_updated(struct messaging_context *msg,
 944                               void *private_data,
 945                               uint32_t msg_type,
 946                               struct server_id server_id,
 947                               DATA_BLOB *data)
 948 {
 949         struct smbd_server_connection *sconn =
 950                 talloc_get_type_abort(private_data,
 951                 struct smbd_server_connection);
 952
 953         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
 954                   "updated. Reloading.\n"));
 955         change_to_root_user();
 956         reload_services(sconn, conn_snum_used, false);
 957 }
 958
 959 /*
 960  * Only allow 5 outstanding trans requests. We're allocating memory, so
 961  * prevent a DoS.
 962  */
 963
 964 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 965 {
 966         int count = 0;
 967         for (; list != NULL; list = list->next) {
 968
 969                 if (list->mid == mid) {
 970                         return NT_STATUS_INVALID_PARAMETER;
 971                 }
 972
 973                 count += 1;
 974         }
 975         if (count > 5) {
 976                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 977         }
 978
 979         return NT_STATUS_OK;
 980 }
 981
 982 /*
 983 These flags determine some of the permissions required to do an operation
 984
 985 Note that I don't set NEED_WRITE on some write operations because they
 986 are used by some brain-dead clients when printing, and I don't want to
 987 force write permissions on print services.
 988 */
 989 #define AS_USER (1<<0)
 990 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 991 #define TIME_INIT (1<<2)
 992 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 993 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 994 #define DO_CHDIR (1<<6)
 995
 996 /*
 997    define a list of possible SMB messages and their corresponding
 998    functions. Any message that has a NULL function is unimplemented -
 999    please feel free to contribute implementations!
1000 */
1001 static const struct smb_message_struct {
1002         const char *name;
1003         void (*fn)(struct smb_request *req);
1004         int flags;
1005 } smb_messages[256] = {
1006
1007 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1008 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1009 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1010 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1011 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1012 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1013 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1014 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1015 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1016 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1017 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1018 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1019 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1020 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1021 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1022 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1023 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1024 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1025 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1026 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1027 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1028 /* 0x15 */ { NULL, NULL, 0 },
1029 /* 0x16 */ { NULL, NULL, 0 },
1030 /* 0x17 */ { NULL, NULL, 0 },
1031 /* 0x18 */ { NULL, NULL, 0 },
1032 /* 0x19 */ { NULL, NULL, 0 },
1033 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1034 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1035 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1036 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1037 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1038 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1039 /* 0x20 */ { "SMBwritec", NULL,0},
1040 /* 0x21 */ { NULL, NULL, 0 },
1041 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1042 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1043 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1044 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1045 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1046 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1047 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1048 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1049 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1050 /* 0x2b */ { "SMBecho",reply_echo,0},
1051 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1052 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1053 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1054 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1055 /* 0x30 */ { NULL, NULL, 0 },
1056 /* 0x31 */ { NULL, NULL, 0 },
1057 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1058 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1059 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1060 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1061 /* 0x36 */ { NULL, NULL, 0 },
1062 /* 0x37 */ { NULL, NULL, 0 },
1063 /* 0x38 */ { NULL, NULL, 0 },
1064 /* 0x39 */ { NULL, NULL, 0 },
1065 /* 0x3a */ { NULL, NULL, 0 },
1066 /* 0x3b */ { NULL, NULL, 0 },
1067 /* 0x3c */ { NULL, NULL, 0 },
1068 /* 0x3d */ { NULL, NULL, 0 },
1069 /* 0x3e */ { NULL, NULL, 0 },
1070 /* 0x3f */ { NULL, NULL, 0 },
1071 /* 0x40 */ { NULL, NULL, 0 },
1072 /* 0x41 */ { NULL, NULL, 0 },
1073 /* 0x42 */ { NULL, NULL, 0 },
1074 /* 0x43 */ { NULL, NULL, 0 },
1075 /* 0x44 */ { NULL, NULL, 0 },
1076 /* 0x45 */ { NULL, NULL, 0 },
1077 /* 0x46 */ { NULL, NULL, 0 },
1078 /* 0x47 */ { NULL, NULL, 0 },
1079 /* 0x48 */ { NULL, NULL, 0 },
1080 /* 0x49 */ { NULL, NULL, 0 },
1081 /* 0x4a */ { NULL, NULL, 0 },
1082 /* 0x4b */ { NULL, NULL, 0 },
1083 /* 0x4c */ { NULL, NULL, 0 },
1084 /* 0x4d */ { NULL, NULL, 0 },
1085 /* 0x4e */ { NULL, NULL, 0 },
1086 /* 0x4f */ { NULL, NULL, 0 },
1087 /* 0x50 */ { NULL, NULL, 0 },
1088 /* 0x51 */ { NULL, NULL, 0 },
1089 /* 0x52 */ { NULL, NULL, 0 },
1090 /* 0x53 */ { NULL, NULL, 0 },
1091 /* 0x54 */ { NULL, NULL, 0 },
1092 /* 0x55 */ { NULL, NULL, 0 },
1093 /* 0x56 */ { NULL, NULL, 0 },
1094 /* 0x57 */ { NULL, NULL, 0 },
1095 /* 0x58 */ { NULL, NULL, 0 },
1096 /* 0x59 */ { NULL, NULL, 0 },
1097 /* 0x5a */ { NULL, NULL, 0 },
1098 /* 0x5b */ { NULL, NULL, 0 },
1099 /* 0x5c */ { NULL, NULL, 0 },
1100 /* 0x5d */ { NULL, NULL, 0 },
1101 /* 0x5e */ { NULL, NULL, 0 },
1102 /* 0x5f */ { NULL, NULL, 0 },
1103 /* 0x60 */ { NULL, NULL, 0 },
1104 /* 0x61 */ { NULL, NULL, 0 },
1105 /* 0x62 */ { NULL, NULL, 0 },
1106 /* 0x63 */ { NULL, NULL, 0 },
1107 /* 0x64 */ { NULL, NULL, 0 },
1108 /* 0x65 */ { NULL, NULL, 0 },
1109 /* 0x66 */ { NULL, NULL, 0 },
1110 /* 0x67 */ { NULL, NULL, 0 },
1111 /* 0x68 */ { NULL, NULL, 0 },
1112 /* 0x69 */ { NULL, NULL, 0 },
1113 /* 0x6a */ { NULL, NULL, 0 },
1114 /* 0x6b */ { NULL, NULL, 0 },
1115 /* 0x6c */ { NULL, NULL, 0 },
1116 /* 0x6d */ { NULL, NULL, 0 },
1117 /* 0x6e */ { NULL, NULL, 0 },
1118 /* 0x6f */ { NULL, NULL, 0 },
1119 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1120 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1121 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1122 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1123 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1124 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1125 /* 0x76 */ { NULL, NULL, 0 },
1126 /* 0x77 */ { NULL, NULL, 0 },
1127 /* 0x78 */ { NULL, NULL, 0 },
1128 /* 0x79 */ { NULL, NULL, 0 },
1129 /* 0x7a */ { NULL, NULL, 0 },
1130 /* 0x7b */ { NULL, NULL, 0 },
1131 /* 0x7c */ { NULL, NULL, 0 },
1132 /* 0x7d */ { NULL, NULL, 0 },
1133 /* 0x7e */ { NULL, NULL, 0 },
1134 /* 0x7f */ { NULL, NULL, 0 },
1135 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1136 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1137 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1138 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1139 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1140 /* 0x85 */ { NULL, NULL, 0 },
1141 /* 0x86 */ { NULL, NULL, 0 },
1142 /* 0x87 */ { NULL, NULL, 0 },
1143 /* 0x88 */ { NULL, NULL, 0 },
1144 /* 0x89 */ { NULL, NULL, 0 },
1145 /* 0x8a */ { NULL, NULL, 0 },
1146 /* 0x8b */ { NULL, NULL, 0 },
1147 /* 0x8c */ { NULL, NULL, 0 },
1148 /* 0x8d */ { NULL, NULL, 0 },
1149 /* 0x8e */ { NULL, NULL, 0 },
1150 /* 0x8f */ { NULL, NULL, 0 },
1151 /* 0x90 */ { NULL, NULL, 0 },
1152 /* 0x91 */ { NULL, NULL, 0 },
1153 /* 0x92 */ { NULL, NULL, 0 },
1154 /* 0x93 */ { NULL, NULL, 0 },
1155 /* 0x94 */ { NULL, NULL, 0 },
1156 /* 0x95 */ { NULL, NULL, 0 },
1157 /* 0x96 */ { NULL, NULL, 0 },
1158 /* 0x97 */ { NULL, NULL, 0 },
1159 /* 0x98 */ { NULL, NULL, 0 },
1160 /* 0x99 */ { NULL, NULL, 0 },
1161 /* 0x9a */ { NULL, NULL, 0 },
1162 /* 0x9b */ { NULL, NULL, 0 },
1163 /* 0x9c */ { NULL, NULL, 0 },
1164 /* 0x9d */ { NULL, NULL, 0 },
1165 /* 0x9e */ { NULL, NULL, 0 },
1166 /* 0x9f */ { NULL, NULL, 0 },
1167 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1168 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1169 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1170 /* 0xa3 */ { NULL, NULL, 0 },
1171 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1172 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1173 /* 0xa6 */ { NULL, NULL, 0 },
1174 /* 0xa7 */ { NULL, NULL, 0 },
1175 /* 0xa8 */ { NULL, NULL, 0 },
1176 /* 0xa9 */ { NULL, NULL, 0 },
1177 /* 0xaa */ { NULL, NULL, 0 },
1178 /* 0xab */ { NULL, NULL, 0 },
1179 /* 0xac */ { NULL, NULL, 0 },
1180 /* 0xad */ { NULL, NULL, 0 },
1181 /* 0xae */ { NULL, NULL, 0 },
1182 /* 0xaf */ { NULL, NULL, 0 },
1183 /* 0xb0 */ { NULL, NULL, 0 },
1184 /* 0xb1 */ { NULL, NULL, 0 },
1185 /* 0xb2 */ { NULL, NULL, 0 },
1186 /* 0xb3 */ { NULL, NULL, 0 },
1187 /* 0xb4 */ { NULL, NULL, 0 },
1188 /* 0xb5 */ { NULL, NULL, 0 },
1189 /* 0xb6 */ { NULL, NULL, 0 },
1190 /* 0xb7 */ { NULL, NULL, 0 },
1191 /* 0xb8 */ { NULL, NULL, 0 },
1192 /* 0xb9 */ { NULL, NULL, 0 },
1193 /* 0xba */ { NULL, NULL, 0 },
1194 /* 0xbb */ { NULL, NULL, 0 },
1195 /* 0xbc */ { NULL, NULL, 0 },
1196 /* 0xbd */ { NULL, NULL, 0 },
1197 /* 0xbe */ { NULL, NULL, 0 },
1198 /* 0xbf */ { NULL, NULL, 0 },
1199 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1200 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1201 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1202 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1203 /* 0xc4 */ { NULL, NULL, 0 },
1204 /* 0xc5 */ { NULL, NULL, 0 },
1205 /* 0xc6 */ { NULL, NULL, 0 },
1206 /* 0xc7 */ { NULL, NULL, 0 },
1207 /* 0xc8 */ { NULL, NULL, 0 },
1208 /* 0xc9 */ { NULL, NULL, 0 },
1209 /* 0xca */ { NULL, NULL, 0 },
1210 /* 0xcb */ { NULL, NULL, 0 },
1211 /* 0xcc */ { NULL, NULL, 0 },
1212 /* 0xcd */ { NULL, NULL, 0 },
1213 /* 0xce */ { NULL, NULL, 0 },
1214 /* 0xcf */ { NULL, NULL, 0 },
1215 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1216 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1217 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1218 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1219 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1220 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1221 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1222 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1223 /* 0xd8 */ { NULL, NULL, 0 },
1224 /* 0xd9 */ { NULL, NULL, 0 },
1225 /* 0xda */ { NULL, NULL, 0 },
1226 /* 0xdb */ { NULL, NULL, 0 },
1227 /* 0xdc */ { NULL, NULL, 0 },
1228 /* 0xdd */ { NULL, NULL, 0 },
1229 /* 0xde */ { NULL, NULL, 0 },
1230 /* 0xdf */ { NULL, NULL, 0 },
1231 /* 0xe0 */ { NULL, NULL, 0 },
1232 /* 0xe1 */ { NULL, NULL, 0 },
1233 /* 0xe2 */ { NULL, NULL, 0 },
1234 /* 0xe3 */ { NULL, NULL, 0 },
1235 /* 0xe4 */ { NULL, NULL, 0 },
1236 /* 0xe5 */ { NULL, NULL, 0 },
1237 /* 0xe6 */ { NULL, NULL, 0 },
1238 /* 0xe7 */ { NULL, NULL, 0 },
1239 /* 0xe8 */ { NULL, NULL, 0 },
1240 /* 0xe9 */ { NULL, NULL, 0 },
1241 /* 0xea */ { NULL, NULL, 0 },
1242 /* 0xeb */ { NULL, NULL, 0 },
1243 /* 0xec */ { NULL, NULL, 0 },
1244 /* 0xed */ { NULL, NULL, 0 },
1245 /* 0xee */ { NULL, NULL, 0 },
1246 /* 0xef */ { NULL, NULL, 0 },
1247 /* 0xf0 */ { NULL, NULL, 0 },
1248 /* 0xf1 */ { NULL, NULL, 0 },
1249 /* 0xf2 */ { NULL, NULL, 0 },
1250 /* 0xf3 */ { NULL, NULL, 0 },
1251 /* 0xf4 */ { NULL, NULL, 0 },
1252 /* 0xf5 */ { NULL, NULL, 0 },
1253 /* 0xf6 */ { NULL, NULL, 0 },
1254 /* 0xf7 */ { NULL, NULL, 0 },
1255 /* 0xf8 */ { NULL, NULL, 0 },
1256 /* 0xf9 */ { NULL, NULL, 0 },
1257 /* 0xfa */ { NULL, NULL, 0 },
1258 /* 0xfb */ { NULL, NULL, 0 },
1259 /* 0xfc */ { NULL, NULL, 0 },
1260 /* 0xfd */ { NULL, NULL, 0 },
1261 /* 0xfe */ { NULL, NULL, 0 },
1262 /* 0xff */ { NULL, NULL, 0 }
1263
1264 };
1265
1266 /*******************************************************************
1267  allocate and initialize a reply packet
1268 ********************************************************************/
1269
1270 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1271                           const char *inbuf, char **outbuf, uint8_t num_words,
1272                           uint32_t num_bytes)
1273 {
1274         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1275
1276         /*
1277          * Protect against integer wrap.
1278          * The SMB layer reply can be up to 0xFFFFFF bytes.
1279          */
1280         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1281                 char *msg;
1282                 if (asprintf(&msg, "num_bytes too large: %u",
1283                              (unsigned)num_bytes) == -1) {
1284                         msg = discard_const_p(char, "num_bytes too large");
1285                 }
1286                 smb_panic(msg);
1287         }
1288
1289         /*
1290          * Here we include the NBT header for now.
1291          */
1292         *outbuf = talloc_array(mem_ctx, char,
1293                                NBT_HDR_SIZE + smb_len);
1294         if (*outbuf == NULL) {
1295                 return false;
1296         }
1297
1298         construct_reply_common(req, inbuf, *outbuf);
1299         srv_set_message(*outbuf, num_words, num_bytes, false);
1300         /*
1301          * Zero out the word area, the caller has to take care of the bcc area
1302          * himself
1303          */
1304         if (num_words != 0) {
1305                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1306         }
1307
1308         return true;
1309 }
1310
1311 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1312 {
1313         char *outbuf;
1314         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1315                            num_bytes)) {
1316                 smb_panic("could not allocate output buffer\n");
1317         }
1318         req->outbuf = (uint8_t *)outbuf;
1319 }
1320
1321
1322 /*******************************************************************
1323  Dump a packet to a file.
1324 ********************************************************************/
1325
1326 static void smb_dump(const char *name, int type, const char *data)
1327 {
1328         size_t len;
1329         int fd, i;
1330         char *fname = NULL;
1331         if (DEBUGLEVEL < 50) {
1332                 return;
1333         }
1334
1335         len = smb_len_tcp(data)+4;
1336         for (i=1;i<100;i++) {
1337                 fname = talloc_asprintf(talloc_tos(),
1338                                 "/tmp/%s.%d.%s",
1339                                 name,
1340                                 i,
1341                                 type ? "req" : "resp");
1342                 if (fname == NULL) {
1343                         return;
1344                 }
1345                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1346                 if (fd != -1 || errno != EEXIST) break;
1347                 TALLOC_FREE(fname);
1348         }
1349         if (fd != -1) {
1350                 ssize_t ret = write(fd, data, len);
1351                 if (ret != len)
1352                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1353                 close(fd);
1354                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1355         }
1356         TALLOC_FREE(fname);
1357 }
1358
1359 /****************************************************************************
1360  Prepare everything for calling the actual request function, and potentially
1361  call the request function via the "new" interface.
1362
1363  Return False if the "legacy" function needs to be called, everything is
1364  prepared.
1365
1366  Return True if we're done.
1367
1368  I know this API sucks, but it is the one with the least code change I could
1369  find.
1370 ****************************************************************************/
1371
1372 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1373 {
1374         int flags;
1375         uint64_t session_tag;
1376         connection_struct *conn = NULL;
1377         struct smbd_server_connection *sconn = req->sconn;
1378         NTTIME now = timeval_to_nttime(&req->request_time);
1379         struct smbXsrv_session *session = NULL;
1380         NTSTATUS status;
1381
1382         errno = 0;
1383
1384         if (smb_messages[type].fn == NULL) {
1385                 DEBUG(0,("Unknown message type %d!\n",type));
1386                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1387                 reply_unknown_new(req, type);
1388                 return NULL;
1389         }
1390
1391         flags = smb_messages[type].flags;
1392
1393         /* In share mode security we must ignore the vuid. */
1394         session_tag = req->vuid;
1395         conn = req->conn;
1396
1397         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1398                  (int)getpid(), (unsigned long)conn));
1399
1400         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1401
1402         /* Ensure this value is replaced in the incoming packet. */
1403         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1404
1405         /*
1406          * Ensure the correct username is in current_user_info.  This is a
1407          * really ugly bugfix for problems with multiple session_setup_and_X's
1408          * being done and allowing %U and %G substitutions to work correctly.
1409          * There is a reason this code is done here, don't move it unless you
1410          * know what you're doing... :-).
1411          * JRA.
1412          */
1413
1414         /*
1415          * lookup an existing session
1416          *
1417          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1418          * here, the main check is still in change_to_user()
1419          */
1420         status = smb1srv_session_lookup(sconn->conn,
1421                                         session_tag,
1422                                         now,
1423                                         &session);
1424         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1425                 switch (type) {
1426                 case SMBsesssetupX:
1427                         status = NT_STATUS_OK;
1428                         break;
1429                 default:
1430                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1431                                  (unsigned long long)session_tag,
1432                                  (unsigned long long)req->mid));
1433                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1434                         return conn;
1435                 }
1436         }
1437
1438         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1439                 struct user_struct *vuser = NULL;
1440
1441                 sconn->smb1.sessions.last_session_tag = session_tag;
1442                 if (session) {
1443                         vuser = session->compat;
1444                 }
1445                 if (vuser) {
1446                         set_current_user_info(
1447                                 vuser->session_info->unix_info->sanitized_username,
1448                                 vuser->session_info->unix_info->unix_name,
1449                                 vuser->session_info->info->domain_name);
1450                 }
1451         }
1452
1453         /* Does this call need to be run as the connected user? */
1454         if (flags & AS_USER) {
1455
1456                 /* Does this call need a valid tree connection? */
1457                 if (!conn) {
1458                         /*
1459                          * Amazingly, the error code depends on the command
1460                          * (from Samba4).
1461                          */
1462                         if (type == SMBntcreateX) {
1463                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1464                         } else {
1465                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1466                         }
1467                         return NULL;
1468                 }
1469
1470                 if (!change_to_user(conn,session_tag)) {
1471                         DEBUG(0, ("Error: Could not change to user. Removing "
1472                                 "deferred open, mid=%llu.\n",
1473                                 (unsigned long long)req->mid));
1474                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1475                         return conn;
1476                 }
1477
1478                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1479
1480                 /* Does it need write permission? */
1481                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1482                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1483                         return conn;
1484                 }
1485
1486                 /* IPC services are limited */
1487                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1488                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1489                         return conn;
1490                 }
1491         } else {
1492                 /* This call needs to be run as root */
1493                 change_to_root_user();
1494         }
1495
1496         /* load service specific parameters */
1497         if (conn) {
1498                 if (req->encrypted) {
1499                         conn->encrypted_tid = true;
1500                         /* encrypted required from now on. */
1501                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1502                 } else if (ENCRYPTION_REQUIRED(conn)) {
1503                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1504                                 DEBUG(1,("service[%s] requires encryption"
1505                                         "%s ACCESS_DENIED. mid=%llu\n",
1506                                         lp_servicename(talloc_tos(), SNUM(conn)),
1507                                         smb_fn_name(type),
1508                                         (unsigned long long)req->mid));
1509                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1510                                 return conn;
1511                         }
1512                 }
1513
1514                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1515                                          (flags & (AS_USER|DO_CHDIR)
1516                                           ?True:False))) {
1517                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1518                         return conn;
1519                 }
1520                 conn->num_smb_operations++;
1521         }
1522
1523         /*
1524          * Does this protocol need to be run as guest? (Only archane
1525          * messenger service requests have this...)
1526          */
1527         if (flags & AS_GUEST) {
1528                 char *raddr;
1529                 bool ok;
1530
1531                 if (!change_to_guest()) {
1532                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1533                         return conn;
1534                 }
1535
1536                 raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1537                                                          talloc_tos());
1538                 if (raddr == NULL) {
1539                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1540                         return conn;
1541                 }
1542
1543                 /*
1544                  * Haven't we checked this in smbd_process already???
1545                  */
1546
1547                 ok = allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1548                                   sconn->remote_hostname, raddr);
1549                 TALLOC_FREE(raddr);
1550
1551                 if (!ok) {
1552                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1553                         return conn;
1554                 }
1555         }
1556
1557         smb_messages[type].fn(req);
1558         return req->conn;
1559 }
1560
1561 /****************************************************************************
1562  Construct a reply to the incoming packet.
1563 ****************************************************************************/
1564
1565 static void construct_reply(struct smbd_server_connection *sconn,
1566                             char *inbuf, int size, size_t unread_bytes,
1567                             uint32_t seqnum, bool encrypted,
1568                             struct smb_perfcount_data *deferred_pcd)
1569 {
1570         connection_struct *conn;
1571         struct smb_request *req;
1572
1573         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1574                 smb_panic("could not allocate smb_request");
1575         }
1576
1577         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1578                               encrypted, seqnum)) {
1579                 exit_server_cleanly("Invalid SMB request");
1580         }
1581
1582         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1583
1584         /* we popped this message off the queue - keep original perf data */
1585         if (deferred_pcd)
1586                 req->pcd = *deferred_pcd;
1587         else {
1588                 SMB_PERFCOUNT_START(&req->pcd);
1589                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1590                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1591         }
1592
1593         conn = switch_message(req->cmd, req);
1594
1595         if (req->outbuf == NULL) {
1596                 return;
1597         }
1598
1599         if (CVAL(req->outbuf,0) == 0) {
1600                 show_msg((char *)req->outbuf);
1601         }
1602
1603         if (!srv_send_smb(req->sconn,
1604                         (char *)req->outbuf,
1605                         true, req->seqnum+1,
1606                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1607                         &req->pcd)) {
1608                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1609         }
1610
1611         TALLOC_FREE(req);
1612
1613         return;
1614 }
1615
1616 static void construct_reply_chain(struct smbd_server_connection *sconn,
1617                                   char *inbuf, int size, uint32_t seqnum,
1618                                   bool encrypted,
1619                                   struct smb_perfcount_data *deferred_pcd)
1620 {
1621         struct smb_request **reqs = NULL;
1622         struct smb_request *req;
1623         unsigned num_reqs;
1624         bool ok;
1625
1626         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, sconn, encrypted,
1627                               seqnum, &reqs, &num_reqs);
1628         if (!ok) {
1629                 char errbuf[smb_size];
1630                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1631                              __LINE__, __FILE__);
1632                 if (!srv_send_smb(sconn, errbuf, true, seqnum, encrypted,
1633                                   NULL)) {
1634                         exit_server_cleanly("construct_reply_chain: "
1635                                             "srv_send_smb failed.");
1636                 }
1637                 return;
1638         }
1639
1640         req = reqs[0];
1641         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1642
1643         req->conn = switch_message(req->cmd, req);
1644
1645         if (req->outbuf == NULL) {
1646                 /*
1647                  * Request has suspended itself, will come
1648                  * back here.
1649                  */
1650                 return;
1651         }
1652         smb_request_done(req);
1653 }
1654
1655 /*
1656  * To be called from an async SMB handler that is potentially chained
1657  * when it is finished for shipping.
1658  */
1659
1660 void smb_request_done(struct smb_request *req)
1661 {
1662         struct smb_request **reqs = NULL;
1663         struct smb_request *first_req;
1664         size_t i, num_reqs, next_index;
1665         NTSTATUS status;
1666
1667         if (req->chain == NULL) {
1668                 first_req = req;
1669                 goto shipit;
1670         }
1671
1672         reqs = req->chain;
1673         num_reqs = talloc_array_length(reqs);
1674
1675         for (i=0; i<num_reqs; i++) {
1676                 if (reqs[i] == req) {
1677                         break;
1678                 }
1679         }
1680         if (i == num_reqs) {
1681                 /*
1682                  * Invalid chain, should not happen
1683                  */
1684                 status = NT_STATUS_INTERNAL_ERROR;
1685                 goto error;
1686         }
1687         next_index = i+1;
1688
1689         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1690                 struct smb_request *next = reqs[next_index];
1691                 struct smbXsrv_tcon *tcon;
1692                 NTTIME now = timeval_to_nttime(&req->request_time);
1693
1694                 next->vuid = SVAL(req->outbuf, smb_uid);
1695                 next->tid  = SVAL(req->outbuf, smb_tid);
1696                 status = smb1srv_tcon_lookup(req->sconn->conn, req->tid,
1697                                              now, &tcon);
1698                 if (NT_STATUS_IS_OK(status)) {
1699                         req->conn = tcon->compat;
1700                 } else {
1701                         req->conn = NULL;
1702                 }
1703                 next->chain_fsp = req->chain_fsp;
1704                 next->inbuf = req->inbuf;
1705
1706                 req = next;
1707                 req->conn = switch_message(req->cmd, req);
1708
1709                 if (req->outbuf == NULL) {
1710                         /*
1711                          * Request has suspended itself, will come
1712                          * back here.
1713                          */
1714                         return;
1715                 }
1716                 next_index += 1;
1717         }
1718
1719         first_req = reqs[0];
1720
1721         for (i=1; i<next_index; i++) {
1722                 bool ok;
1723
1724                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1725                 if (!ok) {
1726                         status = NT_STATUS_INTERNAL_ERROR;
1727                         goto error;
1728                 }
1729         }
1730
1731         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1732         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1733
1734         /*
1735          * This scary statement intends to set the
1736          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1737          * to the value last_req->outbuf carries
1738          */
1739         SSVAL(first_req->outbuf, smb_flg2,
1740               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1741               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1742
1743         /*
1744          * Transfer the error codes from the subrequest to the main one
1745          */
1746         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1747         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1748
1749         _smb_setlen_large(
1750                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1751
1752 shipit:
1753         if (!srv_send_smb(first_req->sconn,
1754                           (char *)first_req->outbuf,
1755                           true, first_req->seqnum+1,
1756                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1757                           &first_req->pcd)) {
1758                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1759                                     "failed.");
1760         }
1761         TALLOC_FREE(req);       /* non-chained case */
1762         TALLOC_FREE(reqs);      /* chained case */
1763         return;
1764
1765 error:
1766         {
1767                 char errbuf[smb_size];
1768                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1769                 if (!srv_send_smb(req->sconn, errbuf, true,
1770                                   req->seqnum+1, req->encrypted,
1771                                   NULL)) {
1772                         exit_server_cleanly("construct_reply_chain: "
1773                                             "srv_send_smb failed.");
1774                 }
1775         }
1776         TALLOC_FREE(req);       /* non-chained case */
1777         TALLOC_FREE(reqs);      /* chained case */
1778 }
1779
1780 /****************************************************************************
1781  Process an smb from the client
1782 ****************************************************************************/
1783 static void process_smb(struct smbd_server_connection *sconn,
1784                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1785                         uint32_t seqnum, bool encrypted,
1786                         struct smb_perfcount_data *deferred_pcd)
1787 {
1788         int msg_type = CVAL(inbuf,0);
1789
1790         DO_PROFILE_INC(smb_count);
1791
1792         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1793                     smb_len(inbuf) ) );
1794         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1795                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1796
1797         if (msg_type != NBSSmessage) {
1798                 /*
1799                  * NetBIOS session request, keepalive, etc.
1800                  */
1801                 reply_special(sconn, (char *)inbuf, nread);
1802                 goto done;
1803         }
1804
1805         if (sconn->using_smb2) {
1806                 /* At this point we're not really using smb2,
1807                  * we make the decision here.. */
1808                 if (smbd_is_smb2_header(inbuf, nread)) {
1809                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1810                         return;
1811                 } else if (nread >= smb_size && valid_smb_header(sconn, inbuf)
1812                                 && CVAL(inbuf, smb_com) != 0x72) {
1813                         /* This is a non-negprot SMB1 packet.
1814                            Disable SMB2 from now on. */
1815                         sconn->using_smb2 = false;
1816                 }
1817         }
1818
1819         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1820          * so subtract 4 from it. */
1821         if ((nread < (smb_size - 4)) || !valid_smb_header(sconn, inbuf)) {
1822                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1823                          smb_len(inbuf)));
1824
1825                 /* special magic for immediate exit */
1826                 if ((nread == 9) &&
1827                     (IVAL(inbuf, 4) == 0x74697865) &&
1828                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1829                         uint8_t exitcode = CVAL(inbuf, 8);
1830                         DEBUG(1, ("Exiting immediately with code %d\n",
1831                                   (int)exitcode));
1832                         exit(exitcode);
1833                 }
1834
1835                 exit_server_cleanly("Non-SMB packet");
1836         }
1837
1838         show_msg((char *)inbuf);
1839
1840         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1841                 construct_reply_chain(sconn, (char *)inbuf, nread,
1842                                       seqnum, encrypted, deferred_pcd);
1843         } else {
1844                 construct_reply(sconn, (char *)inbuf, nread, unread_bytes,
1845                                 seqnum, encrypted, deferred_pcd);
1846         }
1847
1848         sconn->trans_num++;
1849
1850 done:
1851         sconn->num_requests++;
1852
1853         /* The timeout_processing function isn't run nearly
1854            often enough to implement 'max log size' without
1855            overrunning the size of the file by many megabytes.
1856            This is especially true if we are running at debug
1857            level 10.  Checking every 50 SMBs is a nice
1858            tradeoff of performance vs log file size overrun. */
1859
1860         if ((sconn->num_requests % 50) == 0 &&
1861             need_to_check_log_size()) {
1862                 change_to_root_user();
1863                 check_log_size();
1864         }
1865 }
1866
1867 /****************************************************************************
1868  Return a string containing the function name of a SMB command.
1869 ****************************************************************************/
1870
1871 const char *smb_fn_name(int type)
1872 {
1873         const char *unknown_name = "SMBunknown";
1874
1875         if (smb_messages[type].name == NULL)
1876                 return(unknown_name);
1877
1878         return(smb_messages[type].name);
1879 }
1880
1881 /****************************************************************************
1882  Helper functions for contruct_reply.
1883 ****************************************************************************/
1884
1885 void add_to_common_flags2(uint32 v)
1886 {
1887         common_flags2 |= v;
1888 }
1889
1890 void remove_from_common_flags2(uint32 v)
1891 {
1892         common_flags2 &= ~v;
1893 }
1894
1895 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1896                                    char *outbuf)
1897 {
1898         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1899         uint16_t out_flags2 = common_flags2;
1900
1901         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1902         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1903         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1904
1905         srv_set_message(outbuf,0,0,false);
1906
1907         SCVAL(outbuf, smb_com, req->cmd);
1908         SIVAL(outbuf,smb_rcls,0);
1909         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1910         SSVAL(outbuf,smb_flg2, out_flags2);
1911         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1912         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1913
1914         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1915         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1916         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1917         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1918 }
1919
1920 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1921 {
1922         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1923 }
1924
1925 /**
1926  * @brief Find the smb_cmd offset of the last command pushed
1927  * @param[in] buf       The buffer we're building up
1928  * @retval              Where can we put our next andx cmd?
1929  *
1930  * While chaining requests, the "next" request we're looking at needs to put
1931  * its SMB_Command before the data the previous request already built up added
1932  * to the chain. Find the offset to the place where we have to put our cmd.
1933  */
1934
1935 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1936 {
1937         uint8_t cmd;
1938         size_t ofs;
1939
1940         cmd = CVAL(buf, smb_com);
1941
1942         if (!is_andx_req(cmd)) {
1943                 return false;
1944         }
1945
1946         ofs = smb_vwv0;
1947
1948         while (CVAL(buf, ofs) != 0xff) {
1949
1950                 if (!is_andx_req(CVAL(buf, ofs))) {
1951                         return false;
1952                 }
1953
1954                 /*
1955                  * ofs is from start of smb header, so add the 4 length
1956                  * bytes. The next cmd is right after the wct field.
1957                  */
1958                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1959
1960                 if (ofs+4 >= talloc_get_size(buf)) {
1961                         return false;
1962                 }
1963         }
1964
1965         *pofs = ofs;
1966         return true;
1967 }
1968
1969 /**
1970  * @brief Do the smb chaining at a buffer level
1971  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1972  * @param[in] andx_buf          Buffer to be appended
1973  */
1974
1975 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
1976 {
1977         uint8_t smb_command     = CVAL(andx_buf, smb_com);
1978         uint8_t wct             = CVAL(andx_buf, smb_wct);
1979         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
1980         uint32_t num_bytes      = smb_buflen(andx_buf);
1981         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
1982
1983         uint8_t *outbuf;
1984         size_t old_size, new_size;
1985         size_t ofs;
1986         size_t chain_padding = 0;
1987         size_t andx_cmd_ofs;
1988
1989
1990         old_size = talloc_get_size(*poutbuf);
1991
1992         if ((old_size % 4) != 0) {
1993                 /*
1994                  * Align the wct field of subsequent requests to a 4-byte
1995                  * boundary
1996                  */
1997                 chain_padding = 4 - (old_size % 4);
1998         }
1999
2000         /*
2001          * After the old request comes the new wct field (1 byte), the vwv's
2002          * and the num_bytes field.
2003          */
2004
2005         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2006         new_size += num_bytes;
2007
2008         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2009                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2010                           (unsigned)new_size));
2011                 return false;
2012         }
2013
2014         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2015         if (outbuf == NULL) {
2016                 DEBUG(0, ("talloc failed\n"));
2017                 return false;
2018         }
2019         *poutbuf = outbuf;
2020
2021         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2022                 DEBUG(1, ("invalid command chain\n"));
2023                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2024                 return false;
2025         }
2026
2027         if (chain_padding != 0) {
2028                 memset(outbuf + old_size, 0, chain_padding);
2029                 old_size += chain_padding;
2030         }
2031
2032         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2033         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2034
2035         ofs = old_size;
2036
2037         /*
2038          * Push the chained request:
2039          *
2040          * wct field
2041          */
2042
2043         SCVAL(outbuf, ofs, wct);
2044         ofs += 1;
2045
2046         /*
2047          * vwv array
2048          */
2049
2050         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2051
2052         /*
2053          * HACK ALERT
2054          *
2055          * Read&X has an offset into its data buffer at
2056          * vwv[6]. reply_read_andx has no idea anymore that it's
2057          * running from within a chain, so we have to fix up the
2058          * offset here.
2059          *
2060          * Although it looks disgusting at this place, I want to keep
2061          * it here. The alternative would be to push knowledge about
2062          * the andx chain down into read&x again.
2063          */
2064
2065         if (smb_command == SMBreadX) {
2066                 uint8_t *bytes_addr;
2067
2068                 if (wct < 7) {
2069                         /*
2070                          * Invalid read&x response
2071                          */
2072                         return false;
2073                 }
2074
2075                 bytes_addr = outbuf + ofs        /* vwv start */
2076                         + sizeof(uint16_t) * wct /* vwv array */
2077                         + sizeof(uint16_t);      /* bcc */
2078
2079                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2080                       bytes_addr - outbuf - 4);
2081         }
2082
2083         ofs += sizeof(uint16_t) * wct;
2084
2085         /*
2086          * bcc (byte count)
2087          */
2088
2089         SSVAL(outbuf, ofs, num_bytes);
2090         ofs += sizeof(uint16_t);
2091
2092         /*
2093          * The bytes field
2094          */
2095
2096         memcpy(outbuf + ofs, bytes, num_bytes);
2097
2098         return true;
2099 }
2100
2101 bool smb1_is_chain(const uint8_t *buf)
2102 {
2103         uint8_t cmd, wct, andx_cmd;
2104
2105         cmd = CVAL(buf, smb_com);
2106         if (!is_andx_req(cmd)) {
2107                 return false;
2108         }
2109         wct = CVAL(buf, smb_wct);
2110         if (wct < 2) {
2111                 return false;
2112         }
2113         andx_cmd = CVAL(buf, smb_vwv);
2114         return (andx_cmd != 0xFF);
2115 }
2116
2117 bool smb1_walk_chain(const uint8_t *buf,
2118                      bool (*fn)(uint8_t cmd,
2119                                 uint8_t wct, const uint16_t *vwv,
2120                                 uint16_t num_bytes, const uint8_t *bytes,
2121                                 void *private_data),
2122                      void *private_data)
2123 {
2124         size_t smblen = smb_len(buf);
2125         const char *smb_buf = smb_base(buf);
2126         uint8_t cmd, chain_cmd;
2127         uint8_t wct;
2128         const uint16_t *vwv;
2129         uint16_t num_bytes;
2130         const uint8_t *bytes;
2131
2132         cmd = CVAL(buf, smb_com);
2133         wct = CVAL(buf, smb_wct);
2134         vwv = (const uint16_t *)(buf + smb_vwv);
2135         num_bytes = smb_buflen(buf);
2136         bytes = (uint8_t *)smb_buf_const(buf);
2137
2138         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2139                 return false;
2140         }
2141
2142         if (!is_andx_req(cmd)) {
2143                 return true;
2144         }
2145         if (wct < 2) {
2146                 return false;
2147         }
2148
2149         chain_cmd = CVAL(vwv, 0);
2150
2151         while (chain_cmd != 0xff) {
2152                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2153                 size_t length_needed;
2154                 ptrdiff_t vwv_offset;
2155
2156                 chain_offset = SVAL(vwv+1, 0);
2157
2158                 /*
2159                  * Check if the client tries to fool us. The chain
2160                  * offset needs to point beyond the current request in
2161                  * the chain, it needs to strictly grow. Otherwise we
2162                  * might be tricked into an endless loop always
2163                  * processing the same request over and over again. We
2164                  * used to assume that vwv and the byte buffer array
2165                  * in a chain are always attached, but OS/2 the
2166                  * Write&X/Read&X chain puts the Read&X vwv array
2167                  * right behind the Write&X vwv chain. The Write&X bcc
2168                  * array is put behind the Read&X vwv array. So now we
2169                  * check whether the chain offset points strictly
2170                  * behind the previous vwv array. req->buf points
2171                  * right after the vwv array of the previous
2172                  * request. See
2173                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2174                  * more information.
2175                  */
2176
2177                 vwv_offset = ((const char *)vwv - smb_buf);
2178                 if (chain_offset <= vwv_offset) {
2179                         return false;
2180                 }
2181
2182                 /*
2183                  * Next check: Make sure the chain offset does not
2184                  * point beyond the overall smb request length.
2185                  */
2186
2187                 length_needed = chain_offset+1; /* wct */
2188                 if (length_needed > smblen) {
2189                         return false;
2190                 }
2191
2192                 /*
2193                  * Now comes the pointer magic. Goal here is to set up
2194                  * vwv and buf correctly again. The chain offset (the
2195                  * former vwv[1]) points at the new wct field.
2196                  */
2197
2198                 wct = CVAL(smb_buf, chain_offset);
2199
2200                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2201                         return false;
2202                 }
2203
2204                 /*
2205                  * Next consistency check: Make the new vwv array fits
2206                  * in the overall smb request.
2207                  */
2208
2209                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2210                 if (length_needed > smblen) {
2211                         return false;
2212                 }
2213                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2214
2215                 /*
2216                  * Now grab the new byte buffer....
2217                  */
2218
2219                 num_bytes = SVAL(vwv+wct, 0);
2220
2221                 /*
2222                  * .. and check that it fits.
2223                  */
2224
2225                 length_needed += num_bytes;
2226                 if (length_needed > smblen) {
2227                         return false;
2228                 }
2229                 bytes = (const uint8_t *)(vwv+wct+1);
2230
2231                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2232                         return false;
2233                 }
2234
2235                 if (!is_andx_req(chain_cmd)) {
2236                         return true;
2237                 }
2238                 chain_cmd = CVAL(vwv, 0);
2239         }
2240         return true;
2241 }
2242
2243 static bool smb1_chain_length_cb(uint8_t cmd,
2244                                  uint8_t wct, const uint16_t *vwv,
2245                                  uint16_t num_bytes, const uint8_t *bytes,
2246                                  void *private_data)
2247 {
2248         unsigned *count = (unsigned *)private_data;
2249         *count += 1;
2250         return true;
2251 }
2252
2253 unsigned smb1_chain_length(const uint8_t *buf)
2254 {
2255         unsigned count = 0;
2256
2257         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2258                 return 0;
2259         }
2260         return count;
2261 }
2262
2263 struct smb1_parse_chain_state {
2264         TALLOC_CTX *mem_ctx;
2265         const uint8_t *buf;
2266         struct smbd_server_connection *sconn;
2267         bool encrypted;
2268         uint32_t seqnum;
2269
2270         struct smb_request **reqs;
2271         unsigned num_reqs;
2272 };
2273
2274 static bool smb1_parse_chain_cb(uint8_t cmd,
2275                                 uint8_t wct, const uint16_t *vwv,
2276                                 uint16_t num_bytes, const uint8_t *bytes,
2277                                 void *private_data)
2278 {
2279         struct smb1_parse_chain_state *state =
2280                 (struct smb1_parse_chain_state *)private_data;
2281         struct smb_request **reqs;
2282         struct smb_request *req;
2283         bool ok;
2284
2285         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2286                               struct smb_request *, state->num_reqs+1);
2287         if (reqs == NULL) {
2288                 return false;
2289         }
2290         state->reqs = reqs;
2291
2292         req = talloc(reqs, struct smb_request);
2293         if (req == NULL) {
2294                 return false;
2295         }
2296
2297         ok = init_smb_request(req, state->sconn, state->buf, 0,
2298                               state->encrypted, state->seqnum);
2299         if (!ok) {
2300                 return false;
2301         }
2302         req->cmd = cmd;
2303         req->wct = wct;
2304         req->vwv = vwv;
2305         req->buflen = num_bytes;
2306         req->buf = bytes;
2307
2308         reqs[state->num_reqs] = req;
2309         state->num_reqs += 1;
2310         return true;
2311 }
2312
2313 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2314                       struct smbd_server_connection *sconn,
2315                       bool encrypted, uint32_t seqnum,
2316                       struct smb_request ***reqs, unsigned *num_reqs)
2317 {
2318         struct smb1_parse_chain_state state;
2319         unsigned i;
2320
2321         state.mem_ctx = mem_ctx;
2322         state.buf = buf;
2323         state.sconn = sconn;
2324         state.encrypted = encrypted;
2325         state.seqnum = seqnum;
2326         state.reqs = NULL;
2327         state.num_reqs = 0;
2328
2329         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2330                 TALLOC_FREE(state.reqs);
2331                 return false;
2332         }
2333         for (i=0; i<state.num_reqs; i++) {
2334                 state.reqs[i]->chain = state.reqs;
2335         }
2336         *reqs = state.reqs;
2337         *num_reqs = state.num_reqs;
2338         return true;
2339 }
2340
2341 /****************************************************************************
2342  Check if services need reloading.
2343 ****************************************************************************/
2344
2345 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2346 {
2347
2348         if (last_smb_conf_reload_time == 0) {
2349                 last_smb_conf_reload_time = t;
2350         }
2351
2352         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2353                 reload_services(sconn, conn_snum_used, true);
2354                 last_smb_conf_reload_time = t;
2355         }
2356 }
2357
2358 static bool fd_is_readable(int fd)
2359 {
2360         int ret, revents;
2361
2362         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2363
2364         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2365
2366 }
2367
2368 static void smbd_server_connection_write_handler(
2369         struct smbd_server_connection *sconn)
2370 {
2371         /* TODO: make write nonblocking */
2372 }
2373
2374 static void smbd_server_connection_read_handler(
2375         struct smbd_server_connection *sconn, int fd)
2376 {
2377         uint8_t *inbuf = NULL;
2378         size_t inbuf_len = 0;
2379         size_t unread_bytes = 0;
2380         bool encrypted = false;
2381         TALLOC_CTX *mem_ctx = talloc_tos();
2382         NTSTATUS status;
2383         uint32_t seqnum;
2384
2385         bool from_client;
2386
2387         if (lp_async_smb_echo_handler()
2388             && fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2389                 /*
2390                  * This is the super-ugly hack to prefer the packets
2391                  * forwarded by the echo handler over the ones by the
2392                  * client directly
2393                  */
2394                 fd = sconn->smb1.echo_handler.trusted_fd;
2395         }
2396
2397         from_client = (sconn->sock == fd);
2398
2399         if (from_client) {
2400                 smbd_lock_socket(sconn);
2401
2402                 if (!fd_is_readable(fd)) {
2403                         DEBUG(10,("the echo listener was faster\n"));
2404                         smbd_unlock_socket(sconn);
2405                         return;
2406                 }
2407         }
2408
2409         /* TODO: make this completely nonblocking */
2410         status = receive_smb_talloc(mem_ctx, sconn, fd,
2411                                     (char **)(void *)&inbuf,
2412                                     0, /* timeout */
2413                                     &unread_bytes,
2414                                     &encrypted,
2415                                     &inbuf_len, &seqnum,
2416                                     !from_client /* trusted channel */);
2417
2418         if (from_client) {
2419                 smbd_unlock_socket(sconn);
2420         }
2421
2422         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2423                 goto process;
2424         }
2425         if (NT_STATUS_IS_ERR(status)) {
2426                 exit_server_cleanly("failed to receive smb request");
2427         }
2428         if (!NT_STATUS_IS_OK(status)) {
2429                 return;
2430         }
2431
2432 process:
2433         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2434                     seqnum, encrypted, NULL);
2435 }
2436
2437 static void smbd_server_connection_handler(struct tevent_context *ev,
2438                                            struct tevent_fd *fde,
2439                                            uint16_t flags,
2440                                            void *private_data)
2441 {
2442         struct smbd_server_connection *conn = talloc_get_type(private_data,
2443                                               struct smbd_server_connection);
2444
2445         if (flags & TEVENT_FD_WRITE) {
2446                 smbd_server_connection_write_handler(conn);
2447                 return;
2448         }
2449         if (flags & TEVENT_FD_READ) {
2450                 smbd_server_connection_read_handler(conn, conn->sock);
2451                 return;
2452         }
2453 }
2454
2455 static void smbd_server_echo_handler(struct tevent_context *ev,
2456                                      struct tevent_fd *fde,
2457                                      uint16_t flags,
2458                                      void *private_data)
2459 {
2460         struct smbd_server_connection *conn = talloc_get_type(private_data,
2461                                               struct smbd_server_connection);
2462
2463         if (flags & TEVENT_FD_WRITE) {
2464                 smbd_server_connection_write_handler(conn);
2465                 return;
2466         }
2467         if (flags & TEVENT_FD_READ) {
2468                 smbd_server_connection_read_handler(
2469                         conn, conn->smb1.echo_handler.trusted_fd);
2470                 return;
2471         }
2472 }
2473
2474 #ifdef CLUSTER_SUPPORT
2475
2476 struct smbd_release_ip_state {
2477         struct smbd_server_connection *sconn;
2478         char addr[INET6_ADDRSTRLEN];
2479 };
2480
2481 /****************************************************************************
2482 received when we should release a specific IP
2483 ****************************************************************************/
2484 static void release_ip(const char *ip, void *priv)
2485 {
2486         struct smbd_release_ip_state *state =
2487                 talloc_get_type_abort(priv,
2488                 struct smbd_release_ip_state);
2489         const char *addr = state->addr;
2490         const char *p = addr;
2491
2492         if (strncmp("::ffff:", addr, 7) == 0) {
2493                 p = addr + 7;
2494         }
2495
2496         DEBUG(10, ("Got release IP message for %s, "
2497                    "our address is %s\n", ip, p));
2498
2499         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2500                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2501                         ip));
2502                 /*
2503                  * With SMB2 we should do a clean disconnect,
2504                  * the previous_session_id in the session setup
2505                  * will cleanup the old session, tcons and opens.
2506                  *
2507                  * A clean disconnect is needed in order to support
2508                  * durable handles.
2509                  *
2510                  * Note: typically this is never triggered
2511                  *       as we got a TCP RST (triggered by ctdb event scripts)
2512                  *       before we get CTDB_SRVID_RELEASE_IP.
2513                  *
2514                  * We used to call _exit(1) here, but as this was mostly never
2515                  * triggered and has implication on our process model,
2516                  * we can just use smbd_server_connection_terminate()
2517                  * (also for SMB1).
2518                  */
2519                 smbd_server_connection_terminate(state->sconn,
2520                                                  "CTDB_SRVID_RELEASE_IP");
2521                 return;
2522         }
2523 }
2524
2525 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2526                                   struct sockaddr_storage *srv,
2527                                   struct sockaddr_storage *clnt)
2528 {
2529         struct smbd_release_ip_state *state;
2530         struct ctdbd_connection *cconn;
2531
2532         cconn = messaging_ctdbd_connection();
2533         if (cconn == NULL) {
2534                 return NT_STATUS_NO_MEMORY;
2535         }
2536
2537         state = talloc_zero(sconn, struct smbd_release_ip_state);
2538         if (state == NULL) {
2539                 return NT_STATUS_NO_MEMORY;
2540         }
2541         state->sconn = sconn;
2542         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2543                 return NT_STATUS_NO_MEMORY;
2544         }
2545
2546         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2547 }
2548
2549 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2550                                struct sockaddr_storage *client)
2551 {
2552         socklen_t length;
2553         length = sizeof(*server);
2554         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2555                 return -1;
2556         }
2557         length = sizeof(*client);
2558         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2559                 return -1;
2560         }
2561         return 0;
2562 }
2563 #endif
2564
2565 /*
2566  * Send keepalive packets to our client
2567  */
2568 static bool keepalive_fn(const struct timeval *now, void *private_data)
2569 {
2570         struct smbd_server_connection *sconn = talloc_get_type_abort(
2571                 private_data, struct smbd_server_connection);
2572         bool ret;
2573
2574         if (sconn->using_smb2) {
2575                 /* Don't do keepalives on an SMB2 connection. */
2576                 return false;
2577         }
2578
2579         smbd_lock_socket(sconn);
2580         ret = send_keepalive(sconn->sock);
2581         smbd_unlock_socket(sconn);
2582
2583         if (!ret) {
2584                 char addr[INET6_ADDRSTRLEN];
2585                 /*
2586                  * Try and give an error message saying what
2587                  * client failed.
2588                  */
2589                 DEBUG(0, ("send_keepalive failed for client %s. "
2590                           "Error %s - exiting\n",
2591                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2592                           strerror(errno)));
2593                 return False;
2594         }
2595         return True;
2596 }
2597
2598 /*
2599  * Do the recurring check if we're idle
2600  */
2601 static bool deadtime_fn(const struct timeval *now, void *private_data)
2602 {
2603         struct smbd_server_connection *sconn =
2604                 (struct smbd_server_connection *)private_data;
2605
2606         if ((conn_num_open(sconn) == 0)
2607             || (conn_idle_all(sconn, now->tv_sec))) {
2608                 DEBUG( 2, ( "Closing idle connection\n" ) );
2609                 messaging_send(sconn->msg_ctx,
2610                                messaging_server_id(sconn->msg_ctx),
2611                                MSG_SHUTDOWN, &data_blob_null);
2612                 return False;
2613         }
2614
2615         return True;
2616 }
2617
2618 /*
2619  * Do the recurring log file and smb.conf reload checks.
2620  */
2621
2622 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2623 {
2624         struct smbd_server_connection *sconn = talloc_get_type_abort(
2625                 private_data, struct smbd_server_connection);
2626
2627         DEBUG(5, ("housekeeping\n"));
2628
2629         change_to_root_user();
2630
2631         /* update printer queue caches if necessary */
2632         update_monitored_printq_cache(sconn->msg_ctx);
2633
2634         /* check if we need to reload services */
2635         check_reload(sconn, time_mono(NULL));
2636
2637         /*
2638          * Force a log file check.
2639          */
2640         force_check_log_size();
2641         check_log_size();
2642         return true;
2643 }
2644
2645 /*
2646  * Read an smb packet in the echo handler child, giving the parent
2647  * smbd one second to react once the socket becomes readable.
2648  */
2649
2650 struct smbd_echo_read_state {
2651         struct tevent_context *ev;
2652         struct smbd_server_connection *sconn;
2653
2654         char *buf;
2655         size_t buflen;
2656         uint32_t seqnum;
2657 };
2658
2659 static void smbd_echo_read_readable(struct tevent_req *subreq);
2660 static void smbd_echo_read_waited(struct tevent_req *subreq);
2661
2662 static struct tevent_req *smbd_echo_read_send(
2663         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2664         struct smbd_server_connection *sconn)
2665 {
2666         struct tevent_req *req, *subreq;
2667         struct smbd_echo_read_state *state;
2668
2669         req = tevent_req_create(mem_ctx, &state,
2670                                 struct smbd_echo_read_state);
2671         if (req == NULL) {
2672                 return NULL;
2673         }
2674         state->ev = ev;
2675         state->sconn = sconn;
2676
2677         subreq = wait_for_read_send(state, ev, sconn->sock);
2678         if (tevent_req_nomem(subreq, req)) {
2679                 return tevent_req_post(req, ev);
2680         }
2681         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2682         return req;
2683 }
2684
2685 static void smbd_echo_read_readable(struct tevent_req *subreq)
2686 {
2687         struct tevent_req *req = tevent_req_callback_data(
2688                 subreq, struct tevent_req);
2689         struct smbd_echo_read_state *state = tevent_req_data(
2690                 req, struct smbd_echo_read_state);
2691         bool ok;
2692         int err;
2693
2694         ok = wait_for_read_recv(subreq, &err);
2695         TALLOC_FREE(subreq);
2696         if (!ok) {
2697                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2698                 return;
2699         }
2700
2701         /*
2702          * Give the parent smbd one second to step in
2703          */
2704
2705         subreq = tevent_wakeup_send(
2706                 state, state->ev, timeval_current_ofs(1, 0));
2707         if (tevent_req_nomem(subreq, req)) {
2708                 return;
2709         }
2710         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2711 }
2712
2713 static void smbd_echo_read_waited(struct tevent_req *subreq)
2714 {
2715         struct tevent_req *req = tevent_req_callback_data(
2716                 subreq, struct tevent_req);
2717         struct smbd_echo_read_state *state = tevent_req_data(
2718                 req, struct smbd_echo_read_state);
2719         struct smbd_server_connection *sconn = state->sconn;
2720         bool ok;
2721         NTSTATUS status;
2722         size_t unread = 0;
2723         bool encrypted;
2724
2725         ok = tevent_wakeup_recv(subreq);
2726         TALLOC_FREE(subreq);
2727         if (!ok) {
2728                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2729                 return;
2730         }
2731
2732         ok = smbd_lock_socket_internal(sconn);
2733         if (!ok) {
2734                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2735                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2736                 return;
2737         }
2738
2739         if (!fd_is_readable(sconn->sock)) {
2740                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2741                           (int)getpid()));
2742
2743                 ok = smbd_unlock_socket_internal(sconn);
2744                 if (!ok) {
2745                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2746                         DEBUG(1, ("%s: failed to unlock socket\n",
2747                                 __location__));
2748                         return;
2749                 }
2750
2751                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2752                 if (tevent_req_nomem(subreq, req)) {
2753                         return;
2754                 }
2755                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2756                 return;
2757         }
2758
2759         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2760                                     0 /* timeout */,
2761                                     &unread,
2762                                     &encrypted,
2763                                     &state->buflen,
2764                                     &state->seqnum,
2765                                     false /* trusted_channel*/);
2766
2767         if (tevent_req_nterror(req, status)) {
2768                 tevent_req_nterror(req, status);
2769                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2770                           (int)getpid(), nt_errstr(status)));
2771                 return;
2772         }
2773
2774         ok = smbd_unlock_socket_internal(sconn);
2775         if (!ok) {
2776                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2777                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2778                 return;
2779         }
2780         tevent_req_done(req);
2781 }
2782
2783 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2784                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2785 {
2786         struct smbd_echo_read_state *state = tevent_req_data(
2787                 req, struct smbd_echo_read_state);
2788         NTSTATUS status;
2789
2790         if (tevent_req_is_nterror(req, &status)) {
2791                 return status;
2792         }
2793         *pbuf = talloc_move(mem_ctx, &state->buf);
2794         *pbuflen = state->buflen;
2795         *pseqnum = state->seqnum;
2796         return NT_STATUS_OK;
2797 }
2798
2799 struct smbd_echo_state {
2800         struct tevent_context *ev;
2801         struct iovec *pending;
2802         struct smbd_server_connection *sconn;
2803         int parent_pipe;
2804
2805         struct tevent_fd *parent_fde;
2806
2807         struct tevent_req *write_req;
2808 };
2809
2810 static void smbd_echo_writer_done(struct tevent_req *req);
2811
2812 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2813 {
2814         int num_pending;
2815
2816         if (state->write_req != NULL) {
2817                 return;
2818         }
2819
2820         num_pending = talloc_array_length(state->pending);
2821         if (num_pending == 0) {
2822                 return;
2823         }
2824
2825         state->write_req = writev_send(state, state->ev, NULL,
2826                                        state->parent_pipe, false,
2827                                        state->pending, num_pending);
2828         if (state->write_req == NULL) {
2829                 DEBUG(1, ("writev_send failed\n"));
2830                 exit(1);
2831         }
2832
2833         talloc_steal(state->write_req, state->pending);
2834         state->pending = NULL;
2835
2836         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2837                                 state);
2838 }
2839
2840 static void smbd_echo_writer_done(struct tevent_req *req)
2841 {
2842         struct smbd_echo_state *state = tevent_req_callback_data(
2843                 req, struct smbd_echo_state);
2844         ssize_t written;
2845         int err;
2846
2847         written = writev_recv(req, &err);
2848         TALLOC_FREE(req);
2849         state->write_req = NULL;
2850         if (written == -1) {
2851                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2852                 exit(1);
2853         }
2854         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
2855         smbd_echo_activate_writer(state);
2856 }
2857
2858 static bool smbd_echo_reply(struct smbd_echo_state *state,
2859                             uint8_t *inbuf, size_t inbuf_len,
2860                             uint32_t seqnum)
2861 {
2862         struct smb_request req;
2863         uint16_t num_replies;
2864         char *outbuf;
2865         bool ok;
2866
2867         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2868                 DEBUG(10, ("Got netbios keepalive\n"));
2869                 /*
2870                  * Just swallow it
2871                  */
2872                 return true;
2873         }
2874
2875         if (inbuf_len < smb_size) {
2876                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2877                 return false;
2878         }
2879         if (!valid_smb_header(state->sconn, inbuf)) {
2880                 DEBUG(10, ("Got invalid SMB header\n"));
2881                 return false;
2882         }
2883
2884         if (!init_smb_request(&req, state->sconn, inbuf, 0, false,
2885                               seqnum)) {
2886                 return false;
2887         }
2888         req.inbuf = inbuf;
2889
2890         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2891                    smb_messages[req.cmd].name
2892                    ? smb_messages[req.cmd].name : "unknown"));
2893
2894         if (req.cmd != SMBecho) {
2895                 return false;
2896         }
2897         if (req.wct < 1) {
2898                 return false;
2899         }
2900
2901         num_replies = SVAL(req.vwv+0, 0);
2902         if (num_replies != 1) {
2903                 /* Not a Windows "Hey, you're still there?" request */
2904                 return false;
2905         }
2906
2907         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2908                            1, req.buflen)) {
2909                 DEBUG(10, ("create_outbuf failed\n"));
2910                 return false;
2911         }
2912         req.outbuf = (uint8_t *)outbuf;
2913
2914         SSVAL(req.outbuf, smb_vwv0, num_replies);
2915
2916         if (req.buflen > 0) {
2917                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2918         }
2919
2920         ok = srv_send_smb(req.sconn,
2921                           (char *)outbuf,
2922                           true, seqnum+1,
2923                           false, &req.pcd);
2924         TALLOC_FREE(outbuf);
2925         if (!ok) {
2926                 exit(1);
2927         }
2928
2929         return true;
2930 }
2931
2932 static void smbd_echo_exit(struct tevent_context *ev,
2933                            struct tevent_fd *fde, uint16_t flags,
2934                            void *private_data)
2935 {
2936         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2937         exit(0);
2938 }
2939
2940 static void smbd_echo_got_packet(struct tevent_req *req);
2941
2942 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2943                            int parent_pipe)
2944 {
2945         struct smbd_echo_state *state;
2946         struct tevent_req *read_req;
2947
2948         state = talloc_zero(sconn, struct smbd_echo_state);
2949         if (state == NULL) {
2950                 DEBUG(1, ("talloc failed\n"));
2951                 return;
2952         }
2953         state->sconn = sconn;
2954         state->parent_pipe = parent_pipe;
2955         state->ev = s3_tevent_context_init(state);
2956         if (state->ev == NULL) {
2957                 DEBUG(1, ("tevent_context_init failed\n"));
2958                 TALLOC_FREE(state);
2959                 return;
2960         }
2961         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2962                                         TEVENT_FD_READ, smbd_echo_exit,
2963                                         state);
2964         if (state->parent_fde == NULL) {
2965                 DEBUG(1, ("tevent_add_fd failed\n"));
2966                 TALLOC_FREE(state);
2967                 return;
2968         }
2969
2970         read_req = smbd_echo_read_send(state, state->ev, sconn);
2971         if (read_req == NULL) {
2972                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2973                 TALLOC_FREE(state);
2974                 return;
2975         }
2976         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2977
2978         while (true) {
2979                 if (tevent_loop_once(state->ev) == -1) {
2980                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2981                                   strerror(errno)));
2982                         break;
2983                 }
2984         }
2985         TALLOC_FREE(state);
2986 }
2987
2988 static void smbd_echo_got_packet(struct tevent_req *req)
2989 {
2990         struct smbd_echo_state *state = tevent_req_callback_data(
2991                 req, struct smbd_echo_state);
2992         NTSTATUS status;
2993         char *buf = NULL;
2994         size_t buflen = 0;
2995         uint32_t seqnum = 0;
2996         bool reply;
2997
2998         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2999         TALLOC_FREE(req);
3000         if (!NT_STATUS_IS_OK(status)) {
3001                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3002                           nt_errstr(status)));
3003                 exit(1);
3004         }
3005
3006         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3007         if (!reply) {
3008                 size_t num_pending;
3009                 struct iovec *tmp;
3010                 struct iovec *iov;
3011
3012                 num_pending = talloc_array_length(state->pending);
3013                 tmp = talloc_realloc(state, state->pending, struct iovec,
3014                                      num_pending+1);
3015                 if (tmp == NULL) {
3016                         DEBUG(1, ("talloc_realloc failed\n"));
3017                         exit(1);
3018                 }
3019                 state->pending = tmp;
3020
3021                 if (buflen >= smb_size) {
3022                         /*
3023                          * place the seqnum in the packet so that the main process
3024                          * can reply with signing
3025                          */
3026                         SIVAL(buf, smb_ss_field, seqnum);
3027                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3028                 }
3029
3030                 iov = &state->pending[num_pending];
3031                 iov->iov_base = talloc_move(state->pending, &buf);
3032                 iov->iov_len = buflen;
3033
3034                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3035                           (int)getpid()));
3036                 smbd_echo_activate_writer(state);
3037         }
3038
3039         req = smbd_echo_read_send(state, state->ev, state->sconn);
3040         if (req == NULL) {
3041                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3042                 exit(1);
3043         }
3044         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3045 }
3046
3047
3048 /*
3049  * Handle SMBecho requests in a forked child process
3050  */
3051 bool fork_echo_handler(struct smbd_server_connection *sconn)
3052 {
3053         int listener_pipe[2];
3054         int res;
3055         pid_t child;
3056
3057         res = pipe(listener_pipe);
3058         if (res == -1) {
3059                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3060                 return false;
3061         }
3062         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
3063         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
3064                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
3065                 goto fail;
3066         }
3067
3068         child = fork();
3069         if (child == 0) {
3070                 NTSTATUS status;
3071
3072                 close(listener_pipe[0]);
3073                 set_blocking(listener_pipe[1], false);
3074
3075                 status = reinit_after_fork(sconn->msg_ctx,
3076                                            sconn->ev_ctx,
3077                                            true);
3078                 if (!NT_STATUS_IS_OK(status)) {
3079                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3080                                   nt_errstr(status)));
3081                         exit(1);
3082                 }
3083                 smbd_echo_loop(sconn, listener_pipe[1]);
3084                 exit(0);
3085         }
3086         close(listener_pipe[1]);
3087         listener_pipe[1] = -1;
3088         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3089
3090         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3091
3092         /*
3093          * Without smb signing this is the same as the normal smbd
3094          * listener. This needs to change once signing comes in.
3095          */
3096         sconn->smb1.echo_handler.trusted_fde = tevent_add_fd(sconn->ev_ctx,
3097                                         sconn,
3098                                         sconn->smb1.echo_handler.trusted_fd,
3099                                         TEVENT_FD_READ,
3100                                         smbd_server_echo_handler,
3101                                         sconn);
3102         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
3103                 DEBUG(1, ("event_add_fd failed\n"));
3104                 goto fail;
3105         }
3106
3107         return true;
3108
3109 fail:
3110         if (listener_pipe[0] != -1) {
3111                 close(listener_pipe[0]);
3112         }
3113         if (listener_pipe[1] != -1) {
3114                 close(listener_pipe[1]);
3115         }
3116         sconn->smb1.echo_handler.trusted_fd = -1;
3117         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
3118                 close(sconn->smb1.echo_handler.socket_lock_fd);
3119         }
3120         sconn->smb1.echo_handler.trusted_fd = -1;
3121         sconn->smb1.echo_handler.socket_lock_fd = -1;
3122         return false;
3123 }
3124
3125 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3126 {
3127         while (user) {
3128                 if (user->session_info &&
3129                     (user->session_info->unix_token->uid == uid)) {
3130                         return true;
3131                 }
3132                 user = user->next;
3133         }
3134         return false;
3135 }
3136
3137 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3138 {
3139         while (user) {
3140                 if (user->session_info != NULL) {
3141                         int i;
3142                         struct security_unix_token *utok;
3143
3144                         utok = user->session_info->unix_token;
3145                         if (utok->gid == gid) {
3146                                 return true;
3147                         }
3148                         for(i=0; i<utok->ngroups; i++) {
3149                                 if (utok->groups[i] == gid) {
3150                                         return true;
3151                                 }
3152                         }
3153                 }
3154                 user = user->next;
3155         }
3156         return false;
3157 }
3158
3159 static bool sid_in_use(const struct user_struct *user,
3160                        const struct dom_sid *psid)
3161 {
3162         while (user) {
3163                 struct security_token *tok;
3164
3165                 if (user->session_info == NULL) {
3166                         continue;
3167                 }
3168                 tok = user->session_info->security_token;
3169                 if (tok == NULL) {
3170                         /*
3171                          * Not sure session_info->security_token can
3172                          * ever be NULL. This check might be not
3173                          * necessary.
3174                          */
3175                         continue;
3176                 }
3177                 if (security_token_has_sid(tok, psid)) {
3178                         return true;
3179                 }
3180                 user = user->next;
3181         }
3182         return false;
3183 }
3184
3185 static bool id_in_use(const struct user_struct *user,
3186                       const struct id_cache_ref *id)
3187 {
3188         switch(id->type) {
3189         case UID:
3190                 return uid_in_use(user, id->id.uid);
3191         case GID:
3192                 return gid_in_use(user, id->id.gid);
3193         case SID:
3194                 return sid_in_use(user, &id->id.sid);
3195         default:
3196                 break;
3197         }
3198         return false;
3199 }
3200
3201 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3202                                void *private_data,
3203                                uint32_t msg_type,
3204                                struct server_id server_id,
3205                                DATA_BLOB* data)
3206 {
3207         const char *msg = (data && data->data)
3208                 ? (const char *)data->data : "<NULL>";
3209         struct id_cache_ref id;
3210         struct smbd_server_connection *sconn =
3211                 talloc_get_type_abort(private_data,
3212                 struct smbd_server_connection);
3213
3214         if (!id_cache_ref_parse(msg, &id)) {
3215                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3216                 return;
3217         }
3218
3219         if (id_in_use(sconn->users, &id)) {
3220                 exit_server_cleanly(msg);
3221         }
3222         id_cache_delete_from_cache(&id);
3223 }
3224
3225 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3226                                         enum protocol_types protocol)
3227 {
3228         NTSTATUS status;
3229
3230         set_Protocol(protocol);
3231         conn->protocol = protocol;
3232
3233         if (protocol >= PROTOCOL_SMB2_02) {
3234                 status = smb2srv_session_table_init(conn);
3235                 if (!NT_STATUS_IS_OK(status)) {
3236                         return status;
3237                 }
3238
3239                 status = smb2srv_open_table_init(conn);
3240                 if (!NT_STATUS_IS_OK(status)) {
3241                         return status;
3242                 }
3243         } else {
3244                 status = smb1srv_session_table_init(conn);
3245                 if (!NT_STATUS_IS_OK(status)) {
3246                         return status;
3247                 }
3248
3249                 status = smb1srv_tcon_table_init(conn);
3250                 if (!NT_STATUS_IS_OK(status)) {
3251                         return status;
3252                 }
3253
3254                 status = smb1srv_open_table_init(conn);
3255                 if (!NT_STATUS_IS_OK(status)) {
3256                         return status;
3257                 }
3258         }
3259
3260         return NT_STATUS_OK;
3261 }
3262
3263 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3264                                        void *private_data)
3265 {
3266         struct smbXsrv_connection *conn =
3267                 talloc_get_type_abort(private_data,
3268                 struct smbXsrv_connection);
3269
3270         switch (point) {
3271         case TEVENT_TRACE_BEFORE_WAIT:
3272                 /*
3273                  * This just removes compiler warning
3274                  * without profile support
3275                  */
3276                 conn->smbd_idle_profstamp = 0;
3277                 START_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3278                 break;
3279         case TEVENT_TRACE_AFTER_WAIT:
3280                 END_PROFILE_STAMP(smbd_idle, conn->smbd_idle_profstamp);
3281                 break;
3282         }
3283 }
3284
3285 /****************************************************************************
3286  Process commands from the client
3287 ****************************************************************************/
3288
3289 void smbd_process(struct tevent_context *ev_ctx,
3290                   struct messaging_context *msg_ctx,
3291                   int sock_fd,
3292                   bool interactive)
3293 {
3294         TALLOC_CTX *frame = talloc_stackframe();
3295         struct smbXsrv_connection *conn;
3296         struct smbd_server_connection *sconn;
3297         struct sockaddr_storage ss;
3298         struct sockaddr *sa = NULL;
3299         socklen_t sa_socklen;
3300         struct tsocket_address *local_address = NULL;
3301         struct tsocket_address *remote_address = NULL;
3302         const char *locaddr = NULL;
3303         const char *remaddr = NULL;
3304         char *rhost;
3305         int ret;
3306
3307         conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
3308         if (conn == NULL) {
3309                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3310                 exit_server_cleanly("talloc_zero(struct smbXsrv_connection).\n");
3311         }
3312
3313         conn->ev_ctx = ev_ctx;
3314         conn->msg_ctx = msg_ctx;
3315
3316         sconn = talloc_zero(conn, struct smbd_server_connection);
3317         if (!sconn) {
3318                 exit_server("failed to create smbd_server_connection");
3319         }
3320
3321         conn->sconn = sconn;
3322         sconn->conn = conn;
3323
3324         /*
3325          * TODO: remove this...:-)
3326          */
3327         global_smbXsrv_connection = conn;
3328
3329         sconn->ev_ctx = ev_ctx;
3330         sconn->msg_ctx = msg_ctx;
3331         sconn->sock = sock_fd;
3332         sconn->smb1.echo_handler.trusted_fd = -1;
3333         sconn->smb1.echo_handler.socket_lock_fd = -1;
3334
3335         if (!interactive) {
3336                 smbd_setup_sig_term_handler(sconn);
3337                 smbd_setup_sig_hup_handler(sconn);
3338
3339                 if (!serverid_register(messaging_server_id(msg_ctx),
3340                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3341                                        |FLAG_MSG_DBWRAP
3342                                        |FLAG_MSG_PRINT_GENERAL)) {
3343                         exit_server_cleanly("Could not register myself in "
3344                                             "serverid.tdb");
3345                 }
3346         }
3347
3348         if (lp_srv_maxprotocol() >= PROTOCOL_SMB2_02) {
3349                 /*
3350                  * We're not making the decision here,
3351                  * we're just allowing the client
3352                  * to decide between SMB1 and SMB2
3353                  * with the first negprot
3354                  * packet.
3355                  */
3356                 sconn->using_smb2 = true;
3357         }
3358
3359         /* Ensure child is set to blocking mode */
3360         set_blocking(sconn->sock,True);
3361
3362         set_socket_options(sconn->sock, "SO_KEEPALIVE");
3363         set_socket_options(sconn->sock, lp_socket_options());
3364
3365         sa = (struct sockaddr *)(void *)&ss;
3366         sa_socklen = sizeof(ss);
3367         ret = getpeername(sconn->sock, sa, &sa_socklen);
3368         if (ret != 0) {
3369                 int level = (errno == ENOTCONN)?2:0;
3370                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
3371                 exit_server_cleanly("getpeername() failed.\n");
3372         }
3373         ret = tsocket_address_bsd_from_sockaddr(sconn,
3374                                                 sa, sa_socklen,
3375                                                 &remote_address);
3376         if (ret != 0) {
3377                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3378                         __location__, strerror(errno)));
3379                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3380         }
3381
3382         sa = (struct sockaddr *)(void *)&ss;
3383         sa_socklen = sizeof(ss);
3384         ret = getsockname(sconn->sock, sa, &sa_socklen);
3385         if (ret != 0) {
3386                 int level = (errno == ENOTCONN)?2:0;
3387                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3388                 exit_server_cleanly("getsockname() failed.\n");
3389         }
3390         ret = tsocket_address_bsd_from_sockaddr(sconn,
3391                                                 sa, sa_socklen,
3392                                                 &local_address);
3393         if (ret != 0) {
3394                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3395                         __location__, strerror(errno)));
3396                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3397         }
3398
3399         sconn->local_address = local_address;
3400         sconn->remote_address = remote_address;
3401
3402         if (tsocket_address_is_inet(local_address, "ip")) {
3403                 locaddr = tsocket_address_inet_addr_string(
3404                                 sconn->local_address,
3405                                 talloc_tos());
3406                 if (locaddr == NULL) {
3407                         DEBUG(0,("%s: tsocket_address_inet_addr_string local failed - %s\n",
3408                                  __location__, strerror(errno)));
3409                         exit_server_cleanly("tsocket_address_inet_addr_string local failed.\n");
3410                 }
3411         } else {
3412                 locaddr = "0.0.0.0";
3413         }
3414
3415         if (tsocket_address_is_inet(remote_address, "ip")) {
3416                 remaddr = tsocket_address_inet_addr_string(
3417                                 sconn->remote_address,
3418                                 talloc_tos());
3419                 if (remaddr == NULL) {
3420                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3421                                  __location__, strerror(errno)));
3422                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3423                 }
3424         } else {
3425                 remaddr = "0.0.0.0";
3426         }
3427
3428         /* this is needed so that we get decent entries
3429            in smbstatus for port 445 connects */
3430         set_remote_machine_name(remaddr, false);
3431         reload_services(sconn, conn_snum_used, true);
3432
3433         /*
3434          * Before the first packet, check the global hosts allow/ hosts deny
3435          * parameters before doing any parsing of packets passed to us by the
3436          * client. This prevents attacks on our parsing code from hosts not in
3437          * the hosts allow list.
3438          */
3439
3440         ret = get_remote_hostname(remote_address,
3441                                   &rhost,
3442                                   talloc_tos());
3443         if (ret < 0) {
3444                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3445                         __location__, strerror(errno)));
3446                 exit_server_cleanly("get_remote_hostname failed.\n");
3447         }
3448         if (strequal(rhost, "UNKNOWN")) {
3449                 rhost = talloc_strdup(talloc_tos(), remaddr);
3450         }
3451         sconn->remote_hostname = talloc_move(sconn, &rhost);
3452
3453         sub_set_socket_ids(remaddr,
3454                            sconn->remote_hostname,
3455                            locaddr);
3456
3457         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3458                           sconn->remote_hostname,
3459                           remaddr)) {
3460                 /*
3461                  * send a negative session response "not listening on calling
3462                  * name"
3463                  */
3464                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3465                 DEBUG( 1, ("Connection denied from %s to %s\n",
3466                            tsocket_address_string(remote_address, talloc_tos()),
3467                            tsocket_address_string(local_address, talloc_tos())));
3468                 (void)srv_send_smb(sconn,(char *)buf, false,
3469                                    0, false, NULL);
3470                 exit_server_cleanly("connection denied");
3471         }
3472
3473         DEBUG(10, ("Connection allowed from %s to %s\n",
3474                    tsocket_address_string(remote_address, talloc_tos()),
3475                    tsocket_address_string(local_address, talloc_tos())));
3476
3477         if (lp_preload_modules()) {
3478                 smb_load_modules(lp_preload_modules());
3479         }
3480
3481         smb_perfcount_init();
3482
3483         if (!init_account_policy()) {
3484                 exit_server("Could not open account policy tdb.\n");
3485         }
3486
3487         if (*lp_rootdir(talloc_tos())) {
3488                 if (chroot(lp_rootdir(talloc_tos())) != 0) {
3489                         DEBUG(0,("Failed to change root to %s\n",
3490                                  lp_rootdir(talloc_tos())));
3491                         exit_server("Failed to chroot()");
3492                 }
3493                 if (chdir("/") == -1) {
3494                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir(talloc_tos())));
3495                         exit_server("Failed to chroot()");
3496                 }
3497                 DEBUG(0,("Changed root to %s\n", lp_rootdir(talloc_tos())));
3498         }
3499
3500         if (!srv_init_signing(sconn)) {
3501                 exit_server("Failed to init smb_signing");
3502         }
3503
3504         if (!file_init(sconn)) {
3505                 exit_server("file_init() failed");
3506         }
3507
3508         /* Setup oplocks */
3509         if (!init_oplocks(sconn))
3510                 exit_server("Failed to init oplocks");
3511
3512         /* register our message handlers */
3513         messaging_register(sconn->msg_ctx, sconn,
3514                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3515         messaging_register(sconn->msg_ctx, sconn,
3516                            MSG_SMB_CLOSE_FILE, msg_close_file);
3517         messaging_register(sconn->msg_ctx, sconn,
3518                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3519
3520         id_cache_register_msgs(sconn->msg_ctx);
3521         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3522         messaging_register(sconn->msg_ctx, sconn,
3523                            ID_CACHE_KILL, smbd_id_cache_kill);
3524
3525         messaging_deregister(sconn->msg_ctx,
3526                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3527         messaging_register(sconn->msg_ctx, sconn,
3528                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3529
3530         /*
3531          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3532          * MSGs to all child processes
3533          */
3534         messaging_deregister(sconn->msg_ctx,
3535                              MSG_DEBUG, NULL);
3536         messaging_register(sconn->msg_ctx, NULL,
3537                            MSG_DEBUG, debug_message);
3538
3539         if ((lp_keepalive() != 0)
3540             && !(event_add_idle(ev_ctx, NULL,
3541                                 timeval_set(lp_keepalive(), 0),
3542                                 "keepalive", keepalive_fn,
3543                                 sconn))) {
3544                 DEBUG(0, ("Could not add keepalive event\n"));
3545                 exit(1);
3546         }
3547
3548         if (!(event_add_idle(ev_ctx, NULL,
3549                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3550                              "deadtime", deadtime_fn, sconn))) {
3551                 DEBUG(0, ("Could not add deadtime event\n"));
3552                 exit(1);
3553         }
3554
3555         if (!(event_add_idle(ev_ctx, NULL,
3556                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3557                              "housekeeping", housekeeping_fn, sconn))) {
3558                 DEBUG(0, ("Could not add housekeeping event\n"));
3559                 exit(1);
3560         }
3561
3562 #ifdef CLUSTER_SUPPORT
3563
3564         if (lp_clustering()) {
3565                 /*
3566                  * We need to tell ctdb about our client's TCP
3567                  * connection, so that for failover ctdbd can send
3568                  * tickle acks, triggering a reconnection by the
3569                  * client.
3570                  */
3571
3572                 struct sockaddr_storage srv, clnt;
3573
3574                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3575                         NTSTATUS status;
3576                         status = smbd_register_ips(sconn, &srv, &clnt);
3577                         if (!NT_STATUS_IS_OK(status)) {
3578                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3579                                           nt_errstr(status)));
3580                         }
3581                 } else {
3582                         int level = (errno == ENOTCONN)?2:0;
3583                         DEBUG(level,("Unable to get tcp info for "
3584                                      "smbd_register_ips: %s\n",
3585                                      strerror(errno)));
3586                         exit_server_cleanly("client_get_tcp_info() failed.\n");
3587                 }
3588         }
3589
3590 #endif
3591
3592         sconn->nbt.got_session = false;
3593
3594         sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
3595
3596         sconn->smb1.sessions.done_sesssetup = false;
3597         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3598         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3599
3600         if (!init_dptrs(sconn)) {
3601                 exit_server("init_dptrs() failed");
3602         }
3603
3604         sconn->smb1.fde = tevent_add_fd(ev_ctx,
3605                                                   sconn,
3606                                                   sconn->sock,
3607                                                   TEVENT_FD_READ,
3608                                                   smbd_server_connection_handler,
3609                                                   sconn);
3610         if (!sconn->smb1.fde) {
3611                 exit_server("failed to create smbd_server_connection fde");
3612         }
3613
3614         sconn->conn->local_address = sconn->local_address;
3615         sconn->conn->remote_address = sconn->remote_address;
3616         sconn->conn->remote_hostname = sconn->remote_hostname;
3617         sconn->conn->protocol = PROTOCOL_NONE;
3618
3619         TALLOC_FREE(frame);
3620
3621         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback, conn);
3622
3623         while (True) {
3624                 frame = talloc_stackframe_pool(8192);
3625
3626                 errno = 0;
3627                 if (tevent_loop_once(ev_ctx) == -1) {
3628                         if (errno != EINTR) {
3629                                 DEBUG(3, ("tevent_loop_once failed: %s,"
3630                                           " exiting\n", strerror(errno) ));
3631                                 break;
3632                         }
3633                 }
3634
3635                 TALLOC_FREE(frame);
3636         }
3637
3638         exit_server_cleanly(NULL);
3639 }
3640
3641 bool req_is_in_chain(const struct smb_request *req)
3642 {
3643         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3644                 /*
3645                  * We're right now handling a subsequent request, so we must
3646                  * be in a chain
3647                  */
3648                 return true;
3649         }
3650
3651         if (!is_andx_req(req->cmd)) {
3652                 return false;
3653         }
3654
3655         if (req->wct < 2) {
3656                 /*
3657                  * Okay, an illegal request, but definitely not chained :-)
3658                  */
3659                 return false;
3660         }
3661
3662         return (CVAL(req->vwv+0, 0) != 0xFF);
3663 }