source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../librpc/gen_ndr/srv_dfs.h"
  24 #include "../librpc/gen_ndr/srv_dssetup.h"
  25 #include "../librpc/gen_ndr/srv_echo.h"
  26 #include "../librpc/gen_ndr/srv_eventlog.h"
  27 #include "../librpc/gen_ndr/srv_initshutdown.h"
  28 #include "../librpc/gen_ndr/srv_lsa.h"
  29 #include "../librpc/gen_ndr/srv_netlogon.h"
  30 #include "../librpc/gen_ndr/srv_ntsvcs.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32 #include "../librpc/gen_ndr/srv_spoolss.h"
  33 #include "../librpc/gen_ndr/srv_srvsvc.h"
  34 #include "../librpc/gen_ndr/srv_svcctl.h"
  35 #include "../librpc/gen_ndr/srv_winreg.h"
  36 #include "../librpc/gen_ndr/srv_wkssvc.h"
  37 #include "librpc/gen_ndr/messaging.h"
  38
  39 extern bool global_machine_password_needs_changing;
  40
  41 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  42                                    char *outbuf);
  43 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
  44
  45 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  46 {
  47         bool ok;
  48
  49         if (smbd_server_conn->smb1.echo_handler.socket_lock_fd == -1) {
  50                 return true;
  51         }
  52
  53         smbd_server_conn->smb1.echo_handler.ref_count++;
  54
  55         if (smbd_server_conn->smb1.echo_handler.ref_count > 1) {
  56                 return true;
  57         }
  58
  59         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  60
  61         ok = fcntl_lock(smbd_server_conn->smb1.echo_handler.socket_lock_fd,
  62                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  63         if (!ok) {
  64                 return false;
  65         }
  66
  67         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  68
  69         return true;
  70 }
  71
  72 void smbd_lock_socket(struct smbd_server_connection *sconn)
  73 {
  74         if (!smbd_lock_socket_internal(sconn)) {
  75                 exit_server_cleanly("failed to lock socket");
  76         }
  77 }
  78
  79 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  80 {
  81         bool ok;
  82
  83         if (smbd_server_conn->smb1.echo_handler.socket_lock_fd == -1) {
  84                 return true;
  85         }
  86
  87         smbd_server_conn->smb1.echo_handler.ref_count--;
  88
  89         if (smbd_server_conn->smb1.echo_handler.ref_count > 0) {
  90                 return true;
  91         }
  92
  93         ok = fcntl_lock(smbd_server_conn->smb1.echo_handler.socket_lock_fd,
  94                         SMB_F_SETLKW, 0, 0, F_UNLCK);
  95         if (!ok) {
  96                 return false;
  97         }
  98
  99         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 100
 101         return true;
 102 }
 103
 104 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 105 {
 106         if (!smbd_unlock_socket_internal(sconn)) {
 107                 exit_server_cleanly("failed to unlock socket");
 108         }
 109 }
 110
 111 /* Accessor function for smb_read_error for smbd functions. */
 112
 113 /****************************************************************************
 114  Send an smb to a fd.
 115 ****************************************************************************/
 116
 117 bool srv_send_smb(int fd, char *buffer,
 118                   bool do_signing, uint32_t seqnum,
 119                   bool do_encrypt,
 120                   struct smb_perfcount_data *pcd)
 121 {
 122         size_t len = 0;
 123         size_t nwritten=0;
 124         ssize_t ret;
 125         char *buf_out = buffer;
 126
 127         smbd_lock_socket(smbd_server_conn);
 128
 129         if (do_signing) {
 130                 /* Sign the outgoing packet if required. */
 131                 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
 132         }
 133
 134         if (do_encrypt) {
 135                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 136                 if (!NT_STATUS_IS_OK(status)) {
 137                         DEBUG(0, ("send_smb: SMB encryption failed "
 138                                 "on outgoing packet! Error %s\n",
 139                                 nt_errstr(status) ));
 140                         goto out;
 141                 }
 142         }
 143
 144         len = smb_len(buf_out) + 4;
 145
 146         ret = write_data(fd,buf_out+nwritten,len - nwritten);
 147         if (ret <= 0) {
 148                 DEBUG(0,("pid[%d] Error writing %d bytes to client. %d. (%s)\n",
 149                         (int)sys_getpid(), (int)len,(int)ret, strerror(errno) ));
 150                 srv_free_enc_buffer(buf_out);
 151                 goto out;
 152         }
 153
 154         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 155         srv_free_enc_buffer(buf_out);
 156 out:
 157         SMB_PERFCOUNT_END(pcd);
 158
 159         smbd_unlock_socket(smbd_server_conn);
 160         return true;
 161 }
 162
 163 /*******************************************************************
 164  Setup the word count and byte count for a smb message.
 165 ********************************************************************/
 166
 167 int srv_set_message(char *buf,
 168                         int num_words,
 169                         int num_bytes,
 170                         bool zero)
 171 {
 172         if (zero && (num_words || num_bytes)) {
 173                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 174         }
 175         SCVAL(buf,smb_wct,num_words);
 176         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 177         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 178         return (smb_size + num_words*2 + num_bytes);
 179 }
 180
 181 static bool valid_smb_header(const uint8_t *inbuf)
 182 {
 183         if (is_encrypted_packet(inbuf)) {
 184                 return true;
 185         }
 186         /*
 187          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 188          * but it just looks weird to call strncmp for this one.
 189          */
 190         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 191 }
 192
 193 /* Socket functions for smbd packet processing. */
 194
 195 static bool valid_packet_size(size_t len)
 196 {
 197         /*
 198          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 199          * of header. Don't print the error if this fits.... JRA.
 200          */
 201
 202         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 203                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 204                                         (unsigned long)len));
 205                 return false;
 206         }
 207         return true;
 208 }
 209
 210 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 211                                       unsigned int timeout, ssize_t len)
 212 {
 213         if (len <= 0) {
 214                 return NT_STATUS_OK;
 215         }
 216
 217         return read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 218 }
 219
 220 /****************************************************************************
 221  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 222 ****************************************************************************/
 223
 224 /*
 225  * Unfortunately, earlier versions of smbclient/libsmbclient
 226  * don't send this "standard" writeX header. I've fixed this
 227  * for 3.2 but we'll use the old method with earlier versions.
 228  * Windows and CIFSFS at least use this standard size. Not
 229  * sure about MacOSX.
 230  */
 231
 232 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 233                                 (2*14) + /* word count (including bcc) */ \
 234                                 1 /* pad byte */)
 235
 236 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 237                                                     const char lenbuf[4],
 238                                                     int fd, char **buffer,
 239                                                     unsigned int timeout,
 240                                                     size_t *p_unread,
 241                                                     size_t *len_ret)
 242 {
 243         /* Size of a WRITEX call (+4 byte len). */
 244         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 245         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 246         ssize_t toread;
 247         NTSTATUS status;
 248
 249         memcpy(writeX_header, lenbuf, 4);
 250
 251         status = read_fd_with_timeout(
 252                 fd, writeX_header + 4,
 253                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 254                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 255                 timeout, NULL);
 256
 257         if (!NT_STATUS_IS_OK(status)) {
 258                 return status;
 259         }
 260
 261         /*
 262          * Ok - now try and see if this is a possible
 263          * valid writeX call.
 264          */
 265
 266         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 267                 /*
 268                  * If the data offset is beyond what
 269                  * we've read, drain the extra bytes.
 270                  */
 271                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 272                 ssize_t newlen;
 273
 274                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 275                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 276                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 277                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 278                                         " failed to drain pending bytes");
 279                         }
 280                 } else {
 281                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 282                 }
 283
 284                 /* Spoof down the length and null out the bcc. */
 285                 set_message_bcc(writeX_header, 0);
 286                 newlen = smb_len(writeX_header);
 287
 288                 /* Copy the header we've written. */
 289
 290                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 291                                 writeX_header,
 292                                 sizeof(writeX_header));
 293
 294                 if (*buffer == NULL) {
 295                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 296                                   (int)sizeof(writeX_header)));
 297                         return NT_STATUS_NO_MEMORY;
 298                 }
 299
 300                 /* Work out the remaining bytes. */
 301                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 302                 *len_ret = newlen + 4;
 303                 return NT_STATUS_OK;
 304         }
 305
 306         if (!valid_packet_size(len)) {
 307                 return NT_STATUS_INVALID_PARAMETER;
 308         }
 309
 310         /*
 311          * Not a valid writeX call. Just do the standard
 312          * talloc and return.
 313          */
 314
 315         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 316
 317         if (*buffer == NULL) {
 318                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 319                           (int)len+4));
 320                 return NT_STATUS_NO_MEMORY;
 321         }
 322
 323         /* Copy in what we already read. */
 324         memcpy(*buffer,
 325                 writeX_header,
 326                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 327         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 328
 329         if(toread > 0) {
 330                 status = read_packet_remainder(
 331                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 332                         timeout, toread);
 333
 334                 if (!NT_STATUS_IS_OK(status)) {
 335                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 336                                    nt_errstr(status)));
 337                         return status;
 338                 }
 339         }
 340
 341         *len_ret = len + 4;
 342         return NT_STATUS_OK;
 343 }
 344
 345 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 346                                        char **buffer, unsigned int timeout,
 347                                        size_t *p_unread, size_t *plen)
 348 {
 349         char lenbuf[4];
 350         size_t len;
 351         int min_recv_size = lp_min_receive_file_size();
 352         NTSTATUS status;
 353
 354         *p_unread = 0;
 355
 356         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 357         if (!NT_STATUS_IS_OK(status)) {
 358                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 359                 return status;
 360         }
 361
 362         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 363             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 364                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 365             !srv_is_signing_active(smbd_server_conn) &&
 366             smbd_server_conn->smb1.echo_handler.trusted_fde == NULL) {
 367
 368                 return receive_smb_raw_talloc_partial_read(
 369                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 370         }
 371
 372         if (!valid_packet_size(len)) {
 373                 return NT_STATUS_INVALID_PARAMETER;
 374         }
 375
 376         /*
 377          * The +4 here can't wrap, we've checked the length above already.
 378          */
 379
 380         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 381
 382         if (*buffer == NULL) {
 383                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 384                           (int)len+4));
 385                 return NT_STATUS_NO_MEMORY;
 386         }
 387
 388         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 389
 390         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 391         if (!NT_STATUS_IS_OK(status)) {
 392                 return status;
 393         }
 394
 395         *plen = len + 4;
 396         return NT_STATUS_OK;
 397 }
 398
 399 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 400                                    char **buffer, unsigned int timeout,
 401                                    size_t *p_unread, bool *p_encrypted,
 402                                    size_t *p_len,
 403                                    uint32_t *seqnum,
 404                                    bool trusted_channel)
 405 {
 406         size_t len = 0;
 407         NTSTATUS status;
 408
 409         *p_encrypted = false;
 410
 411         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 412                                         p_unread, &len);
 413         if (!NT_STATUS_IS_OK(status)) {
 414                 return status;
 415         }
 416
 417         if (is_encrypted_packet((uint8_t *)*buffer)) {
 418                 status = srv_decrypt_buffer(*buffer);
 419                 if (!NT_STATUS_IS_OK(status)) {
 420                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 421                                 "incoming packet! Error %s\n",
 422                                 nt_errstr(status) ));
 423                         return status;
 424                 }
 425                 *p_encrypted = true;
 426         }
 427
 428         /* Check the incoming SMB signature. */
 429         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, trusted_channel)) {
 430                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 431                           "incoming packet!\n"));
 432                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 433         }
 434
 435         *p_len = len;
 436         return NT_STATUS_OK;
 437 }
 438
 439 /*
 440  * Initialize a struct smb_request from an inbuf
 441  */
 442
 443 static bool init_smb_request(struct smb_request *req, const uint8 *inbuf,
 444                              size_t unread_bytes, bool encrypted,
 445                              uint32_t seqnum)
 446 {
 447         struct smbd_server_connection *sconn = smbd_server_conn;
 448         size_t req_size = smb_len(inbuf) + 4;
 449         /* Ensure we have at least smb_size bytes. */
 450         if (req_size < smb_size) {
 451                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 452                         (unsigned int)req_size ));
 453                 return false;
 454         }
 455         req->cmd    = CVAL(inbuf, smb_com);
 456         req->flags2 = SVAL(inbuf, smb_flg2);
 457         req->smbpid = SVAL(inbuf, smb_pid);
 458         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 459         req->seqnum = seqnum;
 460         req->vuid   = SVAL(inbuf, smb_uid);
 461         req->tid    = SVAL(inbuf, smb_tid);
 462         req->wct    = CVAL(inbuf, smb_wct);
 463         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 464         req->buflen = smb_buflen(inbuf);
 465         req->buf    = (const uint8_t *)smb_buf(inbuf);
 466         req->unread_bytes = unread_bytes;
 467         req->encrypted = encrypted;
 468         req->conn = conn_find(sconn,req->tid);
 469         req->chain_fsp = NULL;
 470         req->chain_outbuf = NULL;
 471         req->done = false;
 472         req->smb2req = NULL;
 473         smb_init_perfcount_data(&req->pcd);
 474
 475         /* Ensure we have at least wct words and 2 bytes of bcc. */
 476         if (smb_size + req->wct*2 > req_size) {
 477                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 478                         (unsigned int)req->wct,
 479                         (unsigned int)req_size));
 480                 return false;
 481         }
 482         /* Ensure bcc is correct. */
 483         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 484                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 485                         "(wct = %u, size %u)\n",
 486                         (unsigned int)req->buflen,
 487                         (unsigned int)req->wct,
 488                         (unsigned int)req_size));
 489                 return false;
 490         }
 491
 492         req->outbuf = NULL;
 493         return true;
 494 }
 495
 496 static void process_smb(struct smbd_server_connection *conn,
 497                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 498                         uint32_t seqnum, bool encrypted,
 499                         struct smb_perfcount_data *deferred_pcd);
 500
 501 static void smbd_deferred_open_timer(struct event_context *ev,
 502                                      struct timed_event *te,
 503                                      struct timeval _tval,
 504                                      void *private_data)
 505 {
 506         struct pending_message_list *msg = talloc_get_type(private_data,
 507                                            struct pending_message_list);
 508         TALLOC_CTX *mem_ctx = talloc_tos();
 509         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 510         uint8_t *inbuf;
 511
 512         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 513                                          msg->buf.length);
 514         if (inbuf == NULL) {
 515                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 516                 return;
 517         }
 518
 519         /* We leave this message on the queue so the open code can
 520            know this is a retry. */
 521         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 522                 (unsigned long long)mid ));
 523
 524         /* Mark the message as processed so this is not
 525          * re-processed in error. */
 526         msg->processed = true;
 527
 528         process_smb(smbd_server_conn, inbuf,
 529                     msg->buf.length, 0,
 530                     msg->seqnum, msg->encrypted, &msg->pcd);
 531
 532         /* If it's still there and was processed, remove it. */
 533         msg = get_deferred_open_message_smb(mid);
 534         if (msg && msg->processed) {
 535                 remove_deferred_open_message_smb(mid);
 536         }
 537 }
 538
 539 /****************************************************************************
 540  Function to push a message onto the tail of a linked list of smb messages ready
 541  for processing.
 542 ****************************************************************************/
 543
 544 static bool push_queued_message(struct smb_request *req,
 545                                 struct timeval request_time,
 546                                 struct timeval end_time,
 547                                 char *private_data, size_t private_len)
 548 {
 549         int msg_len = smb_len(req->inbuf) + 4;
 550         struct pending_message_list *msg;
 551
 552         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 553
 554         if(msg == NULL) {
 555                 DEBUG(0,("push_message: malloc fail (1)\n"));
 556                 return False;
 557         }
 558
 559         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 560         if(msg->buf.data == NULL) {
 561                 DEBUG(0,("push_message: malloc fail (2)\n"));
 562                 TALLOC_FREE(msg);
 563                 return False;
 564         }
 565
 566         msg->request_time = request_time;
 567         msg->seqnum = req->seqnum;
 568         msg->encrypted = req->encrypted;
 569         msg->processed = false;
 570         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 571
 572         if (private_data) {
 573                 msg->private_data = data_blob_talloc(msg, private_data,
 574                                                      private_len);
 575                 if (msg->private_data.data == NULL) {
 576                         DEBUG(0,("push_message: malloc fail (3)\n"));
 577                         TALLOC_FREE(msg);
 578                         return False;
 579                 }
 580         }
 581
 582         msg->te = event_add_timed(smbd_event_context(),
 583                                   msg,
 584                                   end_time,
 585                                   smbd_deferred_open_timer,
 586                                   msg);
 587         if (!msg->te) {
 588                 DEBUG(0,("push_message: event_add_timed failed\n"));
 589                 TALLOC_FREE(msg);
 590                 return false;
 591         }
 592
 593         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 594
 595         DEBUG(10,("push_message: pushed message length %u on "
 596                   "deferred_open_queue\n", (unsigned int)msg_len));
 597
 598         return True;
 599 }
 600
 601 /****************************************************************************
 602  Function to delete a sharing violation open message by mid.
 603 ****************************************************************************/
 604
 605 void remove_deferred_open_message_smb(uint64_t mid)
 606 {
 607         struct pending_message_list *pml;
 608
 609         if (smbd_server_conn->allow_smb2) {
 610                 remove_deferred_open_message_smb2(mid);
 611                 return;
 612         }
 613
 614         for (pml = deferred_open_queue; pml; pml = pml->next) {
 615                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 616                         DEBUG(10,("remove_deferred_open_message_smb: "
 617                                   "deleting mid %llu len %u\n",
 618                                   (unsigned long long)mid,
 619                                   (unsigned int)pml->buf.length ));
 620                         DLIST_REMOVE(deferred_open_queue, pml);
 621                         TALLOC_FREE(pml);
 622                         return;
 623                 }
 624         }
 625 }
 626
 627 /****************************************************************************
 628  Move a sharing violation open retry message to the front of the list and
 629  schedule it for immediate processing.
 630 ****************************************************************************/
 631
 632 void schedule_deferred_open_message_smb(uint64_t mid)
 633 {
 634         struct pending_message_list *pml;
 635         int i = 0;
 636
 637         if (smbd_server_conn->allow_smb2) {
 638                 schedule_deferred_open_message_smb2(mid);
 639                 return;
 640         }
 641
 642         for (pml = deferred_open_queue; pml; pml = pml->next) {
 643                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 644
 645                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 646                         "msg_mid = %llu\n",
 647                         i++,
 648                         (unsigned long long)msg_mid ));
 649
 650                 if (mid == msg_mid) {
 651                         struct timed_event *te;
 652
 653                         if (pml->processed) {
 654                                 /* A processed message should not be
 655                                  * rescheduled. */
 656                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 657                                         "message mid %llu was already processed\n",
 658                                         (unsigned long long)msg_mid ));
 659                                 continue;
 660                         }
 661
 662                         DEBUG(10,("schedule_deferred_open_message_smb: "
 663                                 "scheduling mid %llu\n",
 664                                 (unsigned long long)mid ));
 665
 666                         te = event_add_timed(smbd_event_context(),
 667                                              pml,
 668                                              timeval_zero(),
 669                                              smbd_deferred_open_timer,
 670                                              pml);
 671                         if (!te) {
 672                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 673                                         "event_add_timed() failed, "
 674                                         "skipping mid %llu\n",
 675                                         (unsigned long long)msg_mid ));
 676                         }
 677
 678                         TALLOC_FREE(pml->te);
 679                         pml->te = te;
 680                         DLIST_PROMOTE(deferred_open_queue, pml);
 681                         return;
 682                 }
 683         }
 684
 685         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 686                 "find message mid %llu\n",
 687                 (unsigned long long)mid ));
 688 }
 689
 690 /****************************************************************************
 691  Return true if this mid is on the deferred queue and was not yet processed.
 692 ****************************************************************************/
 693
 694 bool open_was_deferred(uint64_t mid)
 695 {
 696         struct pending_message_list *pml;
 697
 698         if (smbd_server_conn->allow_smb2) {
 699                 return open_was_deferred_smb2(mid);
 700         }
 701
 702         for (pml = deferred_open_queue; pml; pml = pml->next) {
 703                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 704                         return True;
 705                 }
 706         }
 707         return False;
 708 }
 709
 710 /****************************************************************************
 711  Return the message queued by this mid.
 712 ****************************************************************************/
 713
 714 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
 715 {
 716         struct pending_message_list *pml;
 717
 718         for (pml = deferred_open_queue; pml; pml = pml->next) {
 719                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 720                         return pml;
 721                 }
 722         }
 723         return NULL;
 724 }
 725
 726 /****************************************************************************
 727  Get the state data queued by this mid.
 728 ****************************************************************************/
 729
 730 bool get_deferred_open_message_state(struct smb_request *smbreq,
 731                                 struct timeval *p_request_time,
 732                                 void **pp_state)
 733 {
 734         struct pending_message_list *pml;
 735
 736         if (smbd_server_conn->allow_smb2) {
 737                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 738                                         p_request_time,
 739                                         pp_state);
 740         }
 741
 742         pml = get_deferred_open_message_smb(smbreq->mid);
 743         if (!pml) {
 744                 return false;
 745         }
 746         if (p_request_time) {
 747                 *p_request_time = pml->request_time;
 748         }
 749         if (pp_state) {
 750                 *pp_state = (void *)pml->private_data.data;
 751         }
 752         return true;
 753 }
 754
 755 /****************************************************************************
 756  Function to push a deferred open smb message onto a linked list of local smb
 757  messages ready for processing.
 758 ****************************************************************************/
 759
 760 bool push_deferred_open_message_smb(struct smb_request *req,
 761                                struct timeval request_time,
 762                                struct timeval timeout,
 763                                struct file_id id,
 764                                char *private_data, size_t priv_len)
 765 {
 766         struct timeval end_time;
 767
 768         if (req->smb2req) {
 769                 return push_deferred_open_message_smb2(req->smb2req,
 770                                                 request_time,
 771                                                 timeout,
 772                                                 id,
 773                                                 private_data,
 774                                                 priv_len);
 775         }
 776
 777         if (req->unread_bytes) {
 778                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 779                         "unread_bytes = %u\n",
 780                         (unsigned int)req->unread_bytes ));
 781                 smb_panic("push_deferred_open_message_smb: "
 782                         "logic error unread_bytes != 0" );
 783         }
 784
 785         end_time = timeval_sum(&request_time, &timeout);
 786
 787         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 788                 "len %u mid %llu timeout time [%u.%06u]\n",
 789                 (unsigned int) smb_len(req->inbuf)+4,
 790                 (unsigned long long)req->mid,
 791                 (unsigned int)end_time.tv_sec,
 792                 (unsigned int)end_time.tv_usec));
 793
 794         return push_queued_message(req, request_time, end_time,
 795                                    private_data, priv_len);
 796 }
 797
 798 struct idle_event {
 799         struct timed_event *te;
 800         struct timeval interval;
 801         char *name;
 802         bool (*handler)(const struct timeval *now, void *private_data);
 803         void *private_data;
 804 };
 805
 806 static void smbd_idle_event_handler(struct event_context *ctx,
 807                                     struct timed_event *te,
 808                                     struct timeval now,
 809                                     void *private_data)
 810 {
 811         struct idle_event *event =
 812                 talloc_get_type_abort(private_data, struct idle_event);
 813
 814         TALLOC_FREE(event->te);
 815
 816         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 817                   event->name, event->te));
 818
 819         if (!event->handler(&now, event->private_data)) {
 820                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 821                           event->name, event->te));
 822                 /* Don't repeat, delete ourselves */
 823                 TALLOC_FREE(event);
 824                 return;
 825         }
 826
 827         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 828                   event->name, event->te));
 829
 830         event->te = event_add_timed(ctx, event,
 831                                     timeval_sum(&now, &event->interval),
 832                                     smbd_idle_event_handler, event);
 833
 834         /* We can't do much but fail here. */
 835         SMB_ASSERT(event->te != NULL);
 836 }
 837
 838 struct idle_event *event_add_idle(struct event_context *event_ctx,
 839                                   TALLOC_CTX *mem_ctx,
 840                                   struct timeval interval,
 841                                   const char *name,
 842                                   bool (*handler)(const struct timeval *now,
 843                                                   void *private_data),
 844                                   void *private_data)
 845 {
 846         struct idle_event *result;
 847         struct timeval now = timeval_current();
 848
 849         result = TALLOC_P(mem_ctx, struct idle_event);
 850         if (result == NULL) {
 851                 DEBUG(0, ("talloc failed\n"));
 852                 return NULL;
 853         }
 854
 855         result->interval = interval;
 856         result->handler = handler;
 857         result->private_data = private_data;
 858
 859         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 860                 DEBUG(0, ("talloc failed\n"));
 861                 TALLOC_FREE(result);
 862                 return NULL;
 863         }
 864
 865         result->te = event_add_timed(event_ctx, result,
 866                                      timeval_sum(&now, &interval),
 867                                      smbd_idle_event_handler, result);
 868         if (result->te == NULL) {
 869                 DEBUG(0, ("event_add_timed failed\n"));
 870                 TALLOC_FREE(result);
 871                 return NULL;
 872         }
 873
 874         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 875         return result;
 876 }
 877
 878 static void smbd_sig_term_handler(struct tevent_context *ev,
 879                                   struct tevent_signal *se,
 880                                   int signum,
 881                                   int count,
 882                                   void *siginfo,
 883                                   void *private_data)
 884 {
 885         exit_server_cleanly("termination signal");
 886 }
 887
 888 void smbd_setup_sig_term_handler(void)
 889 {
 890         struct tevent_signal *se;
 891
 892         se = tevent_add_signal(smbd_event_context(),
 893                                smbd_event_context(),
 894                                SIGTERM, 0,
 895                                smbd_sig_term_handler,
 896                                NULL);
 897         if (!se) {
 898                 exit_server("failed to setup SIGTERM handler");
 899         }
 900 }
 901
 902 static void smbd_sig_hup_handler(struct tevent_context *ev,
 903                                   struct tevent_signal *se,
 904                                   int signum,
 905                                   int count,
 906                                   void *siginfo,
 907                                   void *private_data)
 908 {
 909         change_to_root_user();
 910         DEBUG(1,("Reloading services after SIGHUP\n"));
 911         reload_services(False);
 912 }
 913
 914 void smbd_setup_sig_hup_handler(void)
 915 {
 916         struct tevent_signal *se;
 917
 918         se = tevent_add_signal(smbd_event_context(),
 919                                smbd_event_context(),
 920                                SIGHUP, 0,
 921                                smbd_sig_hup_handler,
 922                                NULL);
 923         if (!se) {
 924                 exit_server("failed to setup SIGHUP handler");
 925         }
 926 }
 927
 928 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 929 {
 930         fd_set r_fds, w_fds;
 931         int selrtn;
 932         struct timeval to;
 933         int maxfd = 0;
 934
 935         to.tv_sec = SMBD_SELECT_TIMEOUT;
 936         to.tv_usec = 0;
 937
 938         /*
 939          * Setup the select fd sets.
 940          */
 941
 942         FD_ZERO(&r_fds);
 943         FD_ZERO(&w_fds);
 944
 945         /*
 946          * Are there any timed events waiting ? If so, ensure we don't
 947          * select for longer than it would take to wait for them.
 948          */
 949
 950         {
 951                 struct timeval now;
 952                 GetTimeOfDay(&now);
 953
 954                 event_add_to_select_args(smbd_event_context(), &now,
 955                                          &r_fds, &w_fds, &to, &maxfd);
 956         }
 957
 958         /* Process a signal and timed events now... */
 959         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 960                 return NT_STATUS_RETRY;
 961         }
 962
 963         {
 964                 int sav;
 965                 START_PROFILE(smbd_idle);
 966
 967                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 968                 sav = errno;
 969
 970                 END_PROFILE(smbd_idle);
 971                 errno = sav;
 972         }
 973
 974         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 975                 return NT_STATUS_RETRY;
 976         }
 977
 978         /* Check if error */
 979         if (selrtn == -1) {
 980                 /* something is wrong. Maybe the socket is dead? */
 981                 return map_nt_error_from_unix(errno);
 982         }
 983
 984         /* Did we timeout ? */
 985         if (selrtn == 0) {
 986                 return NT_STATUS_RETRY;
 987         }
 988
 989         /* should not be reached */
 990         return NT_STATUS_INTERNAL_ERROR;
 991 }
 992
 993 /*
 994  * Only allow 5 outstanding trans requests. We're allocating memory, so
 995  * prevent a DoS.
 996  */
 997
 998 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 999 {
1000         int count = 0;
1001         for (; list != NULL; list = list->next) {
1002
1003                 if (list->mid == mid) {
1004                         return NT_STATUS_INVALID_PARAMETER;
1005                 }
1006
1007                 count += 1;
1008         }
1009         if (count > 5) {
1010                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1011         }
1012
1013         return NT_STATUS_OK;
1014 }
1015
1016 /*
1017 These flags determine some of the permissions required to do an operation
1018
1019 Note that I don't set NEED_WRITE on some write operations because they
1020 are used by some brain-dead clients when printing, and I don't want to
1021 force write permissions on print services.
1022 */
1023 #define AS_USER (1<<0)
1024 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1025 #define TIME_INIT (1<<2)
1026 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1027 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1028 #define DO_CHDIR (1<<6)
1029
1030 /*
1031    define a list of possible SMB messages and their corresponding
1032    functions. Any message that has a NULL function is unimplemented -
1033    please feel free to contribute implementations!
1034 */
1035 static const struct smb_message_struct {
1036         const char *name;
1037         void (*fn)(struct smb_request *req);
1038         int flags;
1039 } smb_messages[256] = {
1040
1041 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1042 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1043 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1044 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1045 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1046 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1047 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1048 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1049 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1050 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1051 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1052 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1053 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1054 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1055 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1056 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1057 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1058 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1059 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1060 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1061 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1062 /* 0x15 */ { NULL, NULL, 0 },
1063 /* 0x16 */ { NULL, NULL, 0 },
1064 /* 0x17 */ { NULL, NULL, 0 },
1065 /* 0x18 */ { NULL, NULL, 0 },
1066 /* 0x19 */ { NULL, NULL, 0 },
1067 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1068 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1069 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1070 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1071 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1072 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1073 /* 0x20 */ { "SMBwritec", NULL,0},
1074 /* 0x21 */ { NULL, NULL, 0 },
1075 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1076 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1077 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1078 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1079 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1080 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1081 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1082 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1083 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1084 /* 0x2b */ { "SMBecho",reply_echo,0},
1085 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1086 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1087 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1088 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1089 /* 0x30 */ { NULL, NULL, 0 },
1090 /* 0x31 */ { NULL, NULL, 0 },
1091 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1092 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1093 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1094 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1095 /* 0x36 */ { NULL, NULL, 0 },
1096 /* 0x37 */ { NULL, NULL, 0 },
1097 /* 0x38 */ { NULL, NULL, 0 },
1098 /* 0x39 */ { NULL, NULL, 0 },
1099 /* 0x3a */ { NULL, NULL, 0 },
1100 /* 0x3b */ { NULL, NULL, 0 },
1101 /* 0x3c */ { NULL, NULL, 0 },
1102 /* 0x3d */ { NULL, NULL, 0 },
1103 /* 0x3e */ { NULL, NULL, 0 },
1104 /* 0x3f */ { NULL, NULL, 0 },
1105 /* 0x40 */ { NULL, NULL, 0 },
1106 /* 0x41 */ { NULL, NULL, 0 },
1107 /* 0x42 */ { NULL, NULL, 0 },
1108 /* 0x43 */ { NULL, NULL, 0 },
1109 /* 0x44 */ { NULL, NULL, 0 },
1110 /* 0x45 */ { NULL, NULL, 0 },
1111 /* 0x46 */ { NULL, NULL, 0 },
1112 /* 0x47 */ { NULL, NULL, 0 },
1113 /* 0x48 */ { NULL, NULL, 0 },
1114 /* 0x49 */ { NULL, NULL, 0 },
1115 /* 0x4a */ { NULL, NULL, 0 },
1116 /* 0x4b */ { NULL, NULL, 0 },
1117 /* 0x4c */ { NULL, NULL, 0 },
1118 /* 0x4d */ { NULL, NULL, 0 },
1119 /* 0x4e */ { NULL, NULL, 0 },
1120 /* 0x4f */ { NULL, NULL, 0 },
1121 /* 0x50 */ { NULL, NULL, 0 },
1122 /* 0x51 */ { NULL, NULL, 0 },
1123 /* 0x52 */ { NULL, NULL, 0 },
1124 /* 0x53 */ { NULL, NULL, 0 },
1125 /* 0x54 */ { NULL, NULL, 0 },
1126 /* 0x55 */ { NULL, NULL, 0 },
1127 /* 0x56 */ { NULL, NULL, 0 },
1128 /* 0x57 */ { NULL, NULL, 0 },
1129 /* 0x58 */ { NULL, NULL, 0 },
1130 /* 0x59 */ { NULL, NULL, 0 },
1131 /* 0x5a */ { NULL, NULL, 0 },
1132 /* 0x5b */ { NULL, NULL, 0 },
1133 /* 0x5c */ { NULL, NULL, 0 },
1134 /* 0x5d */ { NULL, NULL, 0 },
1135 /* 0x5e */ { NULL, NULL, 0 },
1136 /* 0x5f */ { NULL, NULL, 0 },
1137 /* 0x60 */ { NULL, NULL, 0 },
1138 /* 0x61 */ { NULL, NULL, 0 },
1139 /* 0x62 */ { NULL, NULL, 0 },
1140 /* 0x63 */ { NULL, NULL, 0 },
1141 /* 0x64 */ { NULL, NULL, 0 },
1142 /* 0x65 */ { NULL, NULL, 0 },
1143 /* 0x66 */ { NULL, NULL, 0 },
1144 /* 0x67 */ { NULL, NULL, 0 },
1145 /* 0x68 */ { NULL, NULL, 0 },
1146 /* 0x69 */ { NULL, NULL, 0 },
1147 /* 0x6a */ { NULL, NULL, 0 },
1148 /* 0x6b */ { NULL, NULL, 0 },
1149 /* 0x6c */ { NULL, NULL, 0 },
1150 /* 0x6d */ { NULL, NULL, 0 },
1151 /* 0x6e */ { NULL, NULL, 0 },
1152 /* 0x6f */ { NULL, NULL, 0 },
1153 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1154 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1155 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1156 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1157 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1158 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1159 /* 0x76 */ { NULL, NULL, 0 },
1160 /* 0x77 */ { NULL, NULL, 0 },
1161 /* 0x78 */ { NULL, NULL, 0 },
1162 /* 0x79 */ { NULL, NULL, 0 },
1163 /* 0x7a */ { NULL, NULL, 0 },
1164 /* 0x7b */ { NULL, NULL, 0 },
1165 /* 0x7c */ { NULL, NULL, 0 },
1166 /* 0x7d */ { NULL, NULL, 0 },
1167 /* 0x7e */ { NULL, NULL, 0 },
1168 /* 0x7f */ { NULL, NULL, 0 },
1169 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1170 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1171 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1172 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1173 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1174 /* 0x85 */ { NULL, NULL, 0 },
1175 /* 0x86 */ { NULL, NULL, 0 },
1176 /* 0x87 */ { NULL, NULL, 0 },
1177 /* 0x88 */ { NULL, NULL, 0 },
1178 /* 0x89 */ { NULL, NULL, 0 },
1179 /* 0x8a */ { NULL, NULL, 0 },
1180 /* 0x8b */ { NULL, NULL, 0 },
1181 /* 0x8c */ { NULL, NULL, 0 },
1182 /* 0x8d */ { NULL, NULL, 0 },
1183 /* 0x8e */ { NULL, NULL, 0 },
1184 /* 0x8f */ { NULL, NULL, 0 },
1185 /* 0x90 */ { NULL, NULL, 0 },
1186 /* 0x91 */ { NULL, NULL, 0 },
1187 /* 0x92 */ { NULL, NULL, 0 },
1188 /* 0x93 */ { NULL, NULL, 0 },
1189 /* 0x94 */ { NULL, NULL, 0 },
1190 /* 0x95 */ { NULL, NULL, 0 },
1191 /* 0x96 */ { NULL, NULL, 0 },
1192 /* 0x97 */ { NULL, NULL, 0 },
1193 /* 0x98 */ { NULL, NULL, 0 },
1194 /* 0x99 */ { NULL, NULL, 0 },
1195 /* 0x9a */ { NULL, NULL, 0 },
1196 /* 0x9b */ { NULL, NULL, 0 },
1197 /* 0x9c */ { NULL, NULL, 0 },
1198 /* 0x9d */ { NULL, NULL, 0 },
1199 /* 0x9e */ { NULL, NULL, 0 },
1200 /* 0x9f */ { NULL, NULL, 0 },
1201 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1202 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1203 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1204 /* 0xa3 */ { NULL, NULL, 0 },
1205 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1206 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1207 /* 0xa6 */ { NULL, NULL, 0 },
1208 /* 0xa7 */ { NULL, NULL, 0 },
1209 /* 0xa8 */ { NULL, NULL, 0 },
1210 /* 0xa9 */ { NULL, NULL, 0 },
1211 /* 0xaa */ { NULL, NULL, 0 },
1212 /* 0xab */ { NULL, NULL, 0 },
1213 /* 0xac */ { NULL, NULL, 0 },
1214 /* 0xad */ { NULL, NULL, 0 },
1215 /* 0xae */ { NULL, NULL, 0 },
1216 /* 0xaf */ { NULL, NULL, 0 },
1217 /* 0xb0 */ { NULL, NULL, 0 },
1218 /* 0xb1 */ { NULL, NULL, 0 },
1219 /* 0xb2 */ { NULL, NULL, 0 },
1220 /* 0xb3 */ { NULL, NULL, 0 },
1221 /* 0xb4 */ { NULL, NULL, 0 },
1222 /* 0xb5 */ { NULL, NULL, 0 },
1223 /* 0xb6 */ { NULL, NULL, 0 },
1224 /* 0xb7 */ { NULL, NULL, 0 },
1225 /* 0xb8 */ { NULL, NULL, 0 },
1226 /* 0xb9 */ { NULL, NULL, 0 },
1227 /* 0xba */ { NULL, NULL, 0 },
1228 /* 0xbb */ { NULL, NULL, 0 },
1229 /* 0xbc */ { NULL, NULL, 0 },
1230 /* 0xbd */ { NULL, NULL, 0 },
1231 /* 0xbe */ { NULL, NULL, 0 },
1232 /* 0xbf */ { NULL, NULL, 0 },
1233 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1234 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1235 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1236 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1237 /* 0xc4 */ { NULL, NULL, 0 },
1238 /* 0xc5 */ { NULL, NULL, 0 },
1239 /* 0xc6 */ { NULL, NULL, 0 },
1240 /* 0xc7 */ { NULL, NULL, 0 },
1241 /* 0xc8 */ { NULL, NULL, 0 },
1242 /* 0xc9 */ { NULL, NULL, 0 },
1243 /* 0xca */ { NULL, NULL, 0 },
1244 /* 0xcb */ { NULL, NULL, 0 },
1245 /* 0xcc */ { NULL, NULL, 0 },
1246 /* 0xcd */ { NULL, NULL, 0 },
1247 /* 0xce */ { NULL, NULL, 0 },
1248 /* 0xcf */ { NULL, NULL, 0 },
1249 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1250 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1251 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1252 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1253 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1254 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1255 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1256 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1257 /* 0xd8 */ { NULL, NULL, 0 },
1258 /* 0xd9 */ { NULL, NULL, 0 },
1259 /* 0xda */ { NULL, NULL, 0 },
1260 /* 0xdb */ { NULL, NULL, 0 },
1261 /* 0xdc */ { NULL, NULL, 0 },
1262 /* 0xdd */ { NULL, NULL, 0 },
1263 /* 0xde */ { NULL, NULL, 0 },
1264 /* 0xdf */ { NULL, NULL, 0 },
1265 /* 0xe0 */ { NULL, NULL, 0 },
1266 /* 0xe1 */ { NULL, NULL, 0 },
1267 /* 0xe2 */ { NULL, NULL, 0 },
1268 /* 0xe3 */ { NULL, NULL, 0 },
1269 /* 0xe4 */ { NULL, NULL, 0 },
1270 /* 0xe5 */ { NULL, NULL, 0 },
1271 /* 0xe6 */ { NULL, NULL, 0 },
1272 /* 0xe7 */ { NULL, NULL, 0 },
1273 /* 0xe8 */ { NULL, NULL, 0 },
1274 /* 0xe9 */ { NULL, NULL, 0 },
1275 /* 0xea */ { NULL, NULL, 0 },
1276 /* 0xeb */ { NULL, NULL, 0 },
1277 /* 0xec */ { NULL, NULL, 0 },
1278 /* 0xed */ { NULL, NULL, 0 },
1279 /* 0xee */ { NULL, NULL, 0 },
1280 /* 0xef */ { NULL, NULL, 0 },
1281 /* 0xf0 */ { NULL, NULL, 0 },
1282 /* 0xf1 */ { NULL, NULL, 0 },
1283 /* 0xf2 */ { NULL, NULL, 0 },
1284 /* 0xf3 */ { NULL, NULL, 0 },
1285 /* 0xf4 */ { NULL, NULL, 0 },
1286 /* 0xf5 */ { NULL, NULL, 0 },
1287 /* 0xf6 */ { NULL, NULL, 0 },
1288 /* 0xf7 */ { NULL, NULL, 0 },
1289 /* 0xf8 */ { NULL, NULL, 0 },
1290 /* 0xf9 */ { NULL, NULL, 0 },
1291 /* 0xfa */ { NULL, NULL, 0 },
1292 /* 0xfb */ { NULL, NULL, 0 },
1293 /* 0xfc */ { NULL, NULL, 0 },
1294 /* 0xfd */ { NULL, NULL, 0 },
1295 /* 0xfe */ { NULL, NULL, 0 },
1296 /* 0xff */ { NULL, NULL, 0 }
1297
1298 };
1299
1300 /*******************************************************************
1301  allocate and initialize a reply packet
1302 ********************************************************************/
1303
1304 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1305                           const char *inbuf, char **outbuf, uint8_t num_words,
1306                           uint32_t num_bytes)
1307 {
1308         /*
1309          * Protect against integer wrap
1310          */
1311         if ((num_bytes > 0xffffff)
1312             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1313                 char *msg;
1314                 if (asprintf(&msg, "num_bytes too large: %u",
1315                              (unsigned)num_bytes) == -1) {
1316                         msg = CONST_DISCARD(char *, "num_bytes too large");
1317                 }
1318                 smb_panic(msg);
1319         }
1320
1321         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1322                                smb_size + num_words*2 + num_bytes);
1323         if (*outbuf == NULL) {
1324                 return false;
1325         }
1326
1327         construct_reply_common(req, inbuf, *outbuf);
1328         srv_set_message(*outbuf, num_words, num_bytes, false);
1329         /*
1330          * Zero out the word area, the caller has to take care of the bcc area
1331          * himself
1332          */
1333         if (num_words != 0) {
1334                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1335         }
1336
1337         return true;
1338 }
1339
1340 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1341 {
1342         char *outbuf;
1343         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1344                            num_bytes)) {
1345                 smb_panic("could not allocate output buffer\n");
1346         }
1347         req->outbuf = (uint8_t *)outbuf;
1348 }
1349
1350
1351 /*******************************************************************
1352  Dump a packet to a file.
1353 ********************************************************************/
1354
1355 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1356 {
1357         int fd, i;
1358         char *fname = NULL;
1359         if (DEBUGLEVEL < 50) {
1360                 return;
1361         }
1362
1363         if (len < 4) len = smb_len(data)+4;
1364         for (i=1;i<100;i++) {
1365                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1366                              type ? "req" : "resp") == -1) {
1367                         return;
1368                 }
1369                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1370                 if (fd != -1 || errno != EEXIST) break;
1371         }
1372         if (fd != -1) {
1373                 ssize_t ret = write(fd, data, len);
1374                 if (ret != len)
1375                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1376                 close(fd);
1377                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1378         }
1379         SAFE_FREE(fname);
1380 }
1381
1382 /****************************************************************************
1383  Prepare everything for calling the actual request function, and potentially
1384  call the request function via the "new" interface.
1385
1386  Return False if the "legacy" function needs to be called, everything is
1387  prepared.
1388
1389  Return True if we're done.
1390
1391  I know this API sucks, but it is the one with the least code change I could
1392  find.
1393 ****************************************************************************/
1394
1395 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1396 {
1397         int flags;
1398         uint16 session_tag;
1399         connection_struct *conn = NULL;
1400         struct smbd_server_connection *sconn = smbd_server_conn;
1401
1402         errno = 0;
1403
1404         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1405          * so subtract 4 from it. */
1406         if (!valid_smb_header(req->inbuf)
1407             || (size < (smb_size - 4))) {
1408                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1409                          smb_len(req->inbuf)));
1410                 exit_server_cleanly("Non-SMB packet");
1411         }
1412
1413         if (smb_messages[type].fn == NULL) {
1414                 DEBUG(0,("Unknown message type %d!\n",type));
1415                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1416                 reply_unknown_new(req, type);
1417                 return NULL;
1418         }
1419
1420         flags = smb_messages[type].flags;
1421
1422         /* In share mode security we must ignore the vuid. */
1423         session_tag = (lp_security() == SEC_SHARE)
1424                 ? UID_FIELD_INVALID : req->vuid;
1425         conn = req->conn;
1426
1427         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1428                  (int)sys_getpid(), (unsigned long)conn));
1429
1430         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1431
1432         /* Ensure this value is replaced in the incoming packet. */
1433         SSVAL(req->inbuf,smb_uid,session_tag);
1434
1435         /*
1436          * Ensure the correct username is in current_user_info.  This is a
1437          * really ugly bugfix for problems with multiple session_setup_and_X's
1438          * being done and allowing %U and %G substitutions to work correctly.
1439          * There is a reason this code is done here, don't move it unless you
1440          * know what you're doing... :-).
1441          * JRA.
1442          */
1443
1444         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1445                 user_struct *vuser = NULL;
1446
1447                 sconn->smb1.sessions.last_session_tag = session_tag;
1448                 if(session_tag != UID_FIELD_INVALID) {
1449                         vuser = get_valid_user_struct(sconn, session_tag);
1450                         if (vuser) {
1451                                 set_current_user_info(
1452                                         vuser->server_info->sanitized_username,
1453                                         vuser->server_info->unix_name,
1454                                         pdb_get_domain(vuser->server_info
1455                                                        ->sam_account));
1456                         }
1457                 }
1458         }
1459
1460         /* Does this call need to be run as the connected user? */
1461         if (flags & AS_USER) {
1462
1463                 /* Does this call need a valid tree connection? */
1464                 if (!conn) {
1465                         /*
1466                          * Amazingly, the error code depends on the command
1467                          * (from Samba4).
1468                          */
1469                         if (type == SMBntcreateX) {
1470                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1471                         } else {
1472                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1473                         }
1474                         return NULL;
1475                 }
1476
1477                 if (!change_to_user(conn,session_tag)) {
1478                         DEBUG(0, ("Error: Could not change to user. Removing "
1479                                 "deferred open, mid=%llu.\n",
1480                                 (unsigned long long)req->mid));
1481                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1482                         return conn;
1483                 }
1484
1485                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1486
1487                 /* Does it need write permission? */
1488                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1489                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1490                         return conn;
1491                 }
1492
1493                 /* IPC services are limited */
1494                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1495                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1496                         return conn;
1497                 }
1498         } else {
1499                 /* This call needs to be run as root */
1500                 change_to_root_user();
1501         }
1502
1503         /* load service specific parameters */
1504         if (conn) {
1505                 if (req->encrypted) {
1506                         conn->encrypted_tid = true;
1507                         /* encrypted required from now on. */
1508                         conn->encrypt_level = Required;
1509                 } else if (ENCRYPTION_REQUIRED(conn)) {
1510                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1511                                 exit_server_cleanly("encryption required "
1512                                         "on connection");
1513                                 return conn;
1514                         }
1515                 }
1516
1517                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1518                                          (flags & (AS_USER|DO_CHDIR)
1519                                           ?True:False))) {
1520                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1521                         return conn;
1522                 }
1523                 conn->num_smb_operations++;
1524         }
1525
1526         /* does this protocol need to be run as guest? */
1527         if ((flags & AS_GUEST)
1528             && (!change_to_guest() ||
1529                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1530                               lp_hostsdeny(-1)))) {
1531                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1532                 return conn;
1533         }
1534
1535         smb_messages[type].fn(req);
1536         return req->conn;
1537 }
1538
1539 /****************************************************************************
1540  Construct a reply to the incoming packet.
1541 ****************************************************************************/
1542
1543 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1544                             uint32_t seqnum, bool encrypted,
1545                             struct smb_perfcount_data *deferred_pcd)
1546 {
1547         connection_struct *conn;
1548         struct smb_request *req;
1549
1550         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1551                 smb_panic("could not allocate smb_request");
1552         }
1553
1554         if (!init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted,
1555                               seqnum)) {
1556                 exit_server_cleanly("Invalid SMB request");
1557         }
1558
1559         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1560
1561         /* we popped this message off the queue - keep original perf data */
1562         if (deferred_pcd)
1563                 req->pcd = *deferred_pcd;
1564         else {
1565                 SMB_PERFCOUNT_START(&req->pcd);
1566                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1567                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1568         }
1569
1570         conn = switch_message(req->cmd, req, size);
1571
1572         if (req->unread_bytes) {
1573                 /* writeX failed. drain socket. */
1574                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1575                                 req->unread_bytes) {
1576                         smb_panic("failed to drain pending bytes");
1577                 }
1578                 req->unread_bytes = 0;
1579         }
1580
1581         if (req->done) {
1582                 TALLOC_FREE(req);
1583                 return;
1584         }
1585
1586         if (req->outbuf == NULL) {
1587                 return;
1588         }
1589
1590         if (CVAL(req->outbuf,0) == 0) {
1591                 show_msg((char *)req->outbuf);
1592         }
1593
1594         if (!srv_send_smb(smbd_server_fd(),
1595                         (char *)req->outbuf,
1596                         true, req->seqnum+1,
1597                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1598                         &req->pcd)) {
1599                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1600         }
1601
1602         TALLOC_FREE(req);
1603
1604         return;
1605 }
1606
1607 /****************************************************************************
1608  Process an smb from the client
1609 ****************************************************************************/
1610 static void process_smb(struct smbd_server_connection *conn,
1611                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1612                         uint32_t seqnum, bool encrypted,
1613                         struct smb_perfcount_data *deferred_pcd)
1614 {
1615         int msg_type = CVAL(inbuf,0);
1616
1617         DO_PROFILE_INC(smb_count);
1618
1619         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1620                     smb_len(inbuf) ) );
1621         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1622                                 (int)nread,
1623                                 (unsigned int)unread_bytes ));
1624
1625         if (msg_type != 0) {
1626                 /*
1627                  * NetBIOS session request, keepalive, etc.
1628                  */
1629                 reply_special((char *)inbuf);
1630                 goto done;
1631         }
1632
1633         if (smbd_server_conn->allow_smb2) {
1634                 if (smbd_is_smb2_header(inbuf, nread)) {
1635                         smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1636                         return;
1637                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1638                                 && CVAL(inbuf, smb_com) != 0x72) {
1639                         /* This is a non-negprot SMB1 packet.
1640                            Disable SMB2 from now on. */
1641                         smbd_server_conn->allow_smb2 = false;
1642                 }
1643         }
1644
1645         show_msg((char *)inbuf);
1646
1647         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1648         trans_num++;
1649
1650 done:
1651         conn->smb1.num_requests++;
1652
1653         /* The timeout_processing function isn't run nearly
1654            often enough to implement 'max log size' without
1655            overrunning the size of the file by many megabytes.
1656            This is especially true if we are running at debug
1657            level 10.  Checking every 50 SMBs is a nice
1658            tradeoff of performance vs log file size overrun. */
1659
1660         if ((conn->smb1.num_requests % 50) == 0 &&
1661             need_to_check_log_size()) {
1662                 change_to_root_user();
1663                 check_log_size();
1664         }
1665 }
1666
1667 /****************************************************************************
1668  Return a string containing the function name of a SMB command.
1669 ****************************************************************************/
1670
1671 const char *smb_fn_name(int type)
1672 {
1673         const char *unknown_name = "SMBunknown";
1674
1675         if (smb_messages[type].name == NULL)
1676                 return(unknown_name);
1677
1678         return(smb_messages[type].name);
1679 }
1680
1681 /****************************************************************************
1682  Helper functions for contruct_reply.
1683 ****************************************************************************/
1684
1685 void add_to_common_flags2(uint32 v)
1686 {
1687         common_flags2 |= v;
1688 }
1689
1690 void remove_from_common_flags2(uint32 v)
1691 {
1692         common_flags2 &= ~v;
1693 }
1694
1695 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1696                                    char *outbuf)
1697 {
1698         srv_set_message(outbuf,0,0,false);
1699
1700         SCVAL(outbuf, smb_com, req->cmd);
1701         SIVAL(outbuf,smb_rcls,0);
1702         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1703         SSVAL(outbuf,smb_flg2,
1704                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1705                 common_flags2);
1706         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1707
1708         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1709         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1710         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1711         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1712 }
1713
1714 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1715 {
1716         construct_reply_common(req, (char *)req->inbuf, outbuf);
1717 }
1718
1719 /*
1720  * How many bytes have we already accumulated up to the current wct field
1721  * offset?
1722  */
1723
1724 size_t req_wct_ofs(struct smb_request *req)
1725 {
1726         size_t buf_size;
1727
1728         if (req->chain_outbuf == NULL) {
1729                 return smb_wct - 4;
1730         }
1731         buf_size = talloc_get_size(req->chain_outbuf);
1732         if ((buf_size % 4) != 0) {
1733                 buf_size += (4 - (buf_size % 4));
1734         }
1735         return buf_size - 4;
1736 }
1737
1738 /*
1739  * Hack around reply_nterror & friends not being aware of chained requests,
1740  * generating illegal (i.e. wct==0) chain replies.
1741  */
1742
1743 static void fixup_chain_error_packet(struct smb_request *req)
1744 {
1745         uint8_t *outbuf = req->outbuf;
1746         req->outbuf = NULL;
1747         reply_outbuf(req, 2, 0);
1748         memcpy(req->outbuf, outbuf, smb_wct);
1749         TALLOC_FREE(outbuf);
1750         SCVAL(req->outbuf, smb_vwv0, 0xff);
1751 }
1752
1753 /**
1754  * @brief Find the smb_cmd offset of the last command pushed
1755  * @param[in] buf       The buffer we're building up
1756  * @retval              Where can we put our next andx cmd?
1757  *
1758  * While chaining requests, the "next" request we're looking at needs to put
1759  * its SMB_Command before the data the previous request already built up added
1760  * to the chain. Find the offset to the place where we have to put our cmd.
1761  */
1762
1763 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1764 {
1765         uint8_t cmd;
1766         size_t ofs;
1767
1768         cmd = CVAL(buf, smb_com);
1769
1770         SMB_ASSERT(is_andx_req(cmd));
1771
1772         ofs = smb_vwv0;
1773
1774         while (CVAL(buf, ofs) != 0xff) {
1775
1776                 if (!is_andx_req(CVAL(buf, ofs))) {
1777                         return false;
1778                 }
1779
1780                 /*
1781                  * ofs is from start of smb header, so add the 4 length
1782                  * bytes. The next cmd is right after the wct field.
1783                  */
1784                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1785
1786                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1787         }
1788
1789         *pofs = ofs;
1790         return true;
1791 }
1792
1793 /**
1794  * @brief Do the smb chaining at a buffer level
1795  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1796  * @param[in] smb_command       The command that we want to issue
1797  * @param[in] wct               How many words?
1798  * @param[in] vwv               The words, already in network order
1799  * @param[in] bytes_alignment   How shall we align "bytes"?
1800  * @param[in] num_bytes         How many bytes?
1801  * @param[in] bytes             The data the request ships
1802  *
1803  * smb_splice_chain() adds the vwv and bytes to the request already present in
1804  * *poutbuf.
1805  */
1806
1807 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1808                              uint8_t wct, const uint16_t *vwv,
1809                              size_t bytes_alignment,
1810                              uint32_t num_bytes, const uint8_t *bytes)
1811 {
1812         uint8_t *outbuf;
1813         size_t old_size, new_size;
1814         size_t ofs;
1815         size_t chain_padding = 0;
1816         size_t bytes_padding = 0;
1817         bool first_request;
1818
1819         old_size = talloc_get_size(*poutbuf);
1820
1821         /*
1822          * old_size == smb_wct means we're pushing the first request in for
1823          * libsmb/
1824          */
1825
1826         first_request = (old_size == smb_wct);
1827
1828         if (!first_request && ((old_size % 4) != 0)) {
1829                 /*
1830                  * Align the wct field of subsequent requests to a 4-byte
1831                  * boundary
1832                  */
1833                 chain_padding = 4 - (old_size % 4);
1834         }
1835
1836         /*
1837          * After the old request comes the new wct field (1 byte), the vwv's
1838          * and the num_bytes field. After at we might need to align the bytes
1839          * given to us to "bytes_alignment", increasing the num_bytes value.
1840          */
1841
1842         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1843
1844         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1845                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1846         }
1847
1848         new_size += bytes_padding + num_bytes;
1849
1850         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1851                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1852                           (unsigned)new_size));
1853                 return false;
1854         }
1855
1856         outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1857         if (outbuf == NULL) {
1858                 DEBUG(0, ("talloc failed\n"));
1859                 return false;
1860         }
1861         *poutbuf = outbuf;
1862
1863         if (first_request) {
1864                 SCVAL(outbuf, smb_com, smb_command);
1865         } else {
1866                 size_t andx_cmd_ofs;
1867
1868                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1869                         DEBUG(1, ("invalid command chain\n"));
1870                         *poutbuf = TALLOC_REALLOC_ARRAY(
1871                                 NULL, *poutbuf, uint8_t, old_size);
1872                         return false;
1873                 }
1874
1875                 if (chain_padding != 0) {
1876                         memset(outbuf + old_size, 0, chain_padding);
1877                         old_size += chain_padding;
1878                 }
1879
1880                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1881                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1882         }
1883
1884         ofs = old_size;
1885
1886         /*
1887          * Push the chained request:
1888          *
1889          * wct field
1890          */
1891
1892         SCVAL(outbuf, ofs, wct);
1893         ofs += 1;
1894
1895         /*
1896          * vwv array
1897          */
1898
1899         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1900         ofs += sizeof(uint16_t) * wct;
1901
1902         /*
1903          * bcc (byte count)
1904          */
1905
1906         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1907         ofs += sizeof(uint16_t);
1908
1909         /*
1910          * padding
1911          */
1912
1913         if (bytes_padding != 0) {
1914                 memset(outbuf + ofs, 0, bytes_padding);
1915                 ofs += bytes_padding;
1916         }
1917
1918         /*
1919          * The bytes field
1920          */
1921
1922         memcpy(outbuf + ofs, bytes, num_bytes);
1923
1924         return true;
1925 }
1926
1927 /****************************************************************************
1928  Construct a chained reply and add it to the already made reply
1929 ****************************************************************************/
1930
1931 void chain_reply(struct smb_request *req)
1932 {
1933         size_t smblen = smb_len(req->inbuf);
1934         size_t already_used, length_needed;
1935         uint8_t chain_cmd;
1936         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1937
1938         uint8_t wct;
1939         uint16_t *vwv;
1940         uint16_t buflen;
1941         uint8_t *buf;
1942
1943         if (IVAL(req->outbuf, smb_rcls) != 0) {
1944                 fixup_chain_error_packet(req);
1945         }
1946
1947         /*
1948          * Any of the AndX requests and replies have at least a wct of
1949          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1950          * beginning of the SMB header to the next wct field.
1951          *
1952          * None of the AndX requests put anything valuable in vwv[0] and [1],
1953          * so we can overwrite it here to form the chain.
1954          */
1955
1956         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1957                 if (req->chain_outbuf == NULL) {
1958                         req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1959                                 req, req->outbuf, uint8_t,
1960                                 smb_len(req->outbuf) + 4);
1961                         if (req->chain_outbuf == NULL) {
1962                                 smb_panic("talloc failed");
1963                         }
1964                 }
1965                 req->outbuf = NULL;
1966                 goto error;
1967         }
1968
1969         /*
1970          * Here we assume that this is the end of the chain. For that we need
1971          * to set "next command" to 0xff and the offset to 0. If we later find
1972          * more commands in the chain, this will be overwritten again.
1973          */
1974
1975         SCVAL(req->outbuf, smb_vwv0, 0xff);
1976         SCVAL(req->outbuf, smb_vwv0+1, 0);
1977         SSVAL(req->outbuf, smb_vwv1, 0);
1978
1979         if (req->chain_outbuf == NULL) {
1980                 /*
1981                  * In req->chain_outbuf we collect all the replies. Start the
1982                  * chain by copying in the first reply.
1983                  *
1984                  * We do the realloc because later on we depend on
1985                  * talloc_get_size to determine the length of
1986                  * chain_outbuf. The reply_xxx routines might have
1987                  * over-allocated (reply_pipe_read_and_X used to be such an
1988                  * example).
1989                  */
1990                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1991                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1992                 if (req->chain_outbuf == NULL) {
1993                         smb_panic("talloc failed");
1994                 }
1995                 req->outbuf = NULL;
1996         } else {
1997                 /*
1998                  * Update smb headers where subsequent chained commands
1999                  * may have updated them.
2000                  */
2001                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
2002                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
2003
2004                 if (!smb_splice_chain(&req->chain_outbuf,
2005                                       CVAL(req->outbuf, smb_com),
2006                                       CVAL(req->outbuf, smb_wct),
2007                                       (uint16_t *)(req->outbuf + smb_vwv),
2008                                       0, smb_buflen(req->outbuf),
2009                                       (uint8_t *)smb_buf(req->outbuf))) {
2010                         goto error;
2011                 }
2012                 TALLOC_FREE(req->outbuf);
2013         }
2014
2015         /*
2016          * We use the old request's vwv field to grab the next chained command
2017          * and offset into the chained fields.
2018          */
2019
2020         chain_cmd = CVAL(req->vwv+0, 0);
2021         chain_offset = SVAL(req->vwv+1, 0);
2022
2023         if (chain_cmd == 0xff) {
2024                 /*
2025                  * End of chain, no more requests from the client. So ship the
2026                  * replies.
2027                  */
2028                 smb_setlen((char *)(req->chain_outbuf),
2029                            talloc_get_size(req->chain_outbuf) - 4);
2030
2031                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2032                                   true, req->seqnum+1,
2033                                   IS_CONN_ENCRYPTED(req->conn)
2034                                   ||req->encrypted,
2035                                   &req->pcd)) {
2036                         exit_server_cleanly("chain_reply: srv_send_smb "
2037                                             "failed.");
2038                 }
2039                 TALLOC_FREE(req->chain_outbuf);
2040                 req->done = true;
2041                 return;
2042         }
2043
2044         /* add a new perfcounter for this element of chain */
2045         SMB_PERFCOUNT_ADD(&req->pcd);
2046         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2047         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2048
2049         /*
2050          * Check if the client tries to fool us. The request so far uses the
2051          * space to the end of the byte buffer in the request just
2052          * processed. The chain_offset can't point into that area. If that was
2053          * the case, we could end up with an endless processing of the chain,
2054          * we would always handle the same request.
2055          */
2056
2057         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2058         if (chain_offset < already_used) {
2059                 goto error;
2060         }
2061
2062         /*
2063          * Next check: Make sure the chain offset does not point beyond the
2064          * overall smb request length.
2065          */
2066
2067         length_needed = chain_offset+1; /* wct */
2068         if (length_needed > smblen) {
2069                 goto error;
2070         }
2071
2072         /*
2073          * Now comes the pointer magic. Goal here is to set up req->vwv and
2074          * req->buf correctly again to be able to call the subsequent
2075          * switch_message(). The chain offset (the former vwv[1]) points at
2076          * the new wct field.
2077          */
2078
2079         wct = CVAL(smb_base(req->inbuf), chain_offset);
2080
2081         /*
2082          * Next consistency check: Make the new vwv array fits in the overall
2083          * smb request.
2084          */
2085
2086         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2087         if (length_needed > smblen) {
2088                 goto error;
2089         }
2090         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2091
2092         /*
2093          * Now grab the new byte buffer....
2094          */
2095
2096         buflen = SVAL(vwv+wct, 0);
2097
2098         /*
2099          * .. and check that it fits.
2100          */
2101
2102         length_needed += buflen;
2103         if (length_needed > smblen) {
2104                 goto error;
2105         }
2106         buf = (uint8_t *)(vwv+wct+1);
2107
2108         req->cmd = chain_cmd;
2109         req->wct = wct;
2110         req->vwv = vwv;
2111         req->buflen = buflen;
2112         req->buf = buf;
2113
2114         switch_message(chain_cmd, req, smblen);
2115
2116         if (req->outbuf == NULL) {
2117                 /*
2118                  * This happens if the chained command has suspended itself or
2119                  * if it has called srv_send_smb() itself.
2120                  */
2121                 return;
2122         }
2123
2124         /*
2125          * We end up here if the chained command was not itself chained or
2126          * suspended, but for example a close() command. We now need to splice
2127          * the chained commands' outbuf into the already built up chain_outbuf
2128          * and ship the result.
2129          */
2130         goto done;
2131
2132  error:
2133         /*
2134          * We end up here if there's any error in the chain syntax. Report a
2135          * DOS error, just like Windows does.
2136          */
2137         reply_force_doserror(req, ERRSRV, ERRerror);
2138         fixup_chain_error_packet(req);
2139
2140  done:
2141         /*
2142          * This scary statement intends to set the
2143          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2144          * to the value req->outbuf carries
2145          */
2146         SSVAL(req->chain_outbuf, smb_flg2,
2147               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2148               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2149
2150         /*
2151          * Transfer the error codes from the subrequest to the main one
2152          */
2153         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2154         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2155
2156         if (!smb_splice_chain(&req->chain_outbuf,
2157                               CVAL(req->outbuf, smb_com),
2158                               CVAL(req->outbuf, smb_wct),
2159                               (uint16_t *)(req->outbuf + smb_vwv),
2160                               0, smb_buflen(req->outbuf),
2161                               (uint8_t *)smb_buf(req->outbuf))) {
2162                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2163         }
2164         TALLOC_FREE(req->outbuf);
2165
2166         smb_setlen((char *)(req->chain_outbuf),
2167                    talloc_get_size(req->chain_outbuf) - 4);
2168
2169         show_msg((char *)(req->chain_outbuf));
2170
2171         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2172                           true, req->seqnum+1,
2173                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2174                           &req->pcd)) {
2175                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2176         }
2177         TALLOC_FREE(req->chain_outbuf);
2178         req->done = true;
2179 }
2180
2181 /****************************************************************************
2182  Check if services need reloading.
2183 ****************************************************************************/
2184
2185 void check_reload(time_t t)
2186 {
2187         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2188
2189         if(last_smb_conf_reload_time == 0) {
2190                 last_smb_conf_reload_time = t;
2191                 /* Our printing subsystem might not be ready at smbd start up.
2192                    Then no printer is available till the first printers check
2193                    is performed.  A lower initial interval circumvents this. */
2194                 if ( printcap_cache_time > 60 )
2195                         last_printer_reload_time = t - printcap_cache_time + 60;
2196                 else
2197                         last_printer_reload_time = t;
2198         }
2199
2200         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2201                 /* randomize over 60 second the printcap reload to avoid all
2202                  * process hitting cupsd at the same time */
2203                 int time_range = 60;
2204
2205                 last_printer_reload_time += random() % time_range;
2206                 mypid = getpid();
2207         }
2208
2209         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2210                 reload_services(True);
2211                 last_smb_conf_reload_time = t;
2212         }
2213
2214         /* 'printcap cache time = 0' disable the feature */
2215
2216         if ( printcap_cache_time != 0 )
2217         {
2218                 /* see if it's time to reload or if the clock has been set back */
2219
2220                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2221                         || (t-last_printer_reload_time  < 0) )
2222                 {
2223                         DEBUG( 3,( "Printcap cache time expired.\n"));
2224                         reload_printers();
2225                         last_printer_reload_time = t;
2226                 }
2227         }
2228 }
2229
2230 static bool fd_is_readable(int fd)
2231 {
2232         fd_set fds;
2233         struct timeval timeout = {0, };
2234         int ret;
2235
2236         FD_ZERO(&fds);
2237         FD_SET(fd, &fds);
2238
2239         ret = sys_select(fd+1, &fds, NULL, NULL, &timeout);
2240         if (ret == -1) {
2241                 return false;
2242         }
2243         return FD_ISSET(fd, &fds);
2244 }
2245
2246 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2247 {
2248         /* TODO: make write nonblocking */
2249 }
2250
2251 static void smbd_server_connection_read_handler(
2252         struct smbd_server_connection *conn, int fd)
2253 {
2254         uint8_t *inbuf = NULL;
2255         size_t inbuf_len = 0;
2256         size_t unread_bytes = 0;
2257         bool encrypted = false;
2258         TALLOC_CTX *mem_ctx = talloc_tos();
2259         NTSTATUS status;
2260         uint32_t seqnum;
2261
2262         bool from_client = (smbd_server_fd() == fd)?true:false;
2263
2264         if (from_client) {
2265                 smbd_lock_socket(conn);
2266
2267                 if (!fd_is_readable(smbd_server_fd())) {
2268                         DEBUG(10,("the echo listener was faster\n"));
2269                         smbd_unlock_socket(conn);
2270                         return;
2271                 }
2272
2273                 /* TODO: make this completely nonblocking */
2274                 status = receive_smb_talloc(mem_ctx, fd,
2275                                             (char **)(void *)&inbuf,
2276                                             0, /* timeout */
2277                                             &unread_bytes,
2278                                             &encrypted,
2279                                             &inbuf_len, &seqnum,
2280                                             false /* trusted channel */);
2281                 smbd_unlock_socket(conn);
2282         } else {
2283                 /* TODO: make this completely nonblocking */
2284                 status = receive_smb_talloc(mem_ctx, fd,
2285                                             (char **)(void *)&inbuf,
2286                                             0, /* timeout */
2287                                             &unread_bytes,
2288                                             &encrypted,
2289                                             &inbuf_len, &seqnum,
2290                                             true /* trusted channel */);
2291         }
2292
2293         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2294                 goto process;
2295         }
2296         if (NT_STATUS_IS_ERR(status)) {
2297                 exit_server_cleanly("failed to receive smb request");
2298         }
2299         if (!NT_STATUS_IS_OK(status)) {
2300                 return;
2301         }
2302
2303 process:
2304         process_smb(conn, inbuf, inbuf_len, unread_bytes,
2305                     seqnum, encrypted, NULL);
2306 }
2307
2308 static void smbd_server_connection_handler(struct event_context *ev,
2309                                            struct fd_event *fde,
2310                                            uint16_t flags,
2311                                            void *private_data)
2312 {
2313         struct smbd_server_connection *conn = talloc_get_type(private_data,
2314                                               struct smbd_server_connection);
2315
2316         if (flags & EVENT_FD_WRITE) {
2317                 smbd_server_connection_write_handler(conn);
2318         } else if (flags & EVENT_FD_READ) {
2319                 smbd_server_connection_read_handler(conn, smbd_server_fd());
2320         }
2321 }
2322
2323 static void smbd_server_echo_handler(struct event_context *ev,
2324                                      struct fd_event *fde,
2325                                      uint16_t flags,
2326                                      void *private_data)
2327 {
2328         struct smbd_server_connection *conn = talloc_get_type(private_data,
2329                                               struct smbd_server_connection);
2330
2331         if (flags & EVENT_FD_WRITE) {
2332                 smbd_server_connection_write_handler(conn);
2333         } else if (flags & EVENT_FD_READ) {
2334                 smbd_server_connection_read_handler(
2335                         conn, conn->smb1.echo_handler.trusted_fd);
2336         }
2337 }
2338
2339 /****************************************************************************
2340 received when we should release a specific IP
2341 ****************************************************************************/
2342 static void release_ip(const char *ip, void *priv)
2343 {
2344         char addr[INET6_ADDRSTRLEN];
2345         char *p = addr;
2346
2347         client_socket_addr(get_client_fd(),addr,sizeof(addr));
2348
2349         if (strncmp("::ffff:", addr, 7) == 0) {
2350                 p = addr + 7;
2351         }
2352
2353         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2354                 /* we can't afford to do a clean exit - that involves
2355                    database writes, which would potentially mean we
2356                    are still running after the failover has finished -
2357                    we have to get rid of this process ID straight
2358                    away */
2359                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2360                         ip));
2361                 /* note we must exit with non-zero status so the unclean handler gets
2362                    called in the parent, so that the brl database is tickled */
2363                 _exit(1);
2364         }
2365 }
2366
2367 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2368                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2369 {
2370         release_ip((char *)data->data, NULL);
2371 }
2372
2373 #ifdef CLUSTER_SUPPORT
2374 static int client_get_tcp_info(struct sockaddr_storage *server,
2375                                struct sockaddr_storage *client)
2376 {
2377         socklen_t length;
2378         if (server_fd == -1) {
2379                 return -1;
2380         }
2381         length = sizeof(*server);
2382         if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
2383                 return -1;
2384         }
2385         length = sizeof(*client);
2386         if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
2387                 return -1;
2388         }
2389         return 0;
2390 }
2391 #endif
2392
2393 /*
2394  * Send keepalive packets to our client
2395  */
2396 static bool keepalive_fn(const struct timeval *now, void *private_data)
2397 {
2398         bool ret;
2399
2400         smbd_lock_socket(smbd_server_conn);
2401         ret = send_keepalive(smbd_server_fd());
2402         smbd_unlock_socket(smbd_server_conn);
2403
2404         if (!ret) {
2405                 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2406                 return False;
2407         }
2408         return True;
2409 }
2410
2411 /*
2412  * Do the recurring check if we're idle
2413  */
2414 static bool deadtime_fn(const struct timeval *now, void *private_data)
2415 {
2416         struct smbd_server_connection *sconn = smbd_server_conn;
2417
2418         if (sconn->allow_smb2) {
2419                 /* TODO: implement real idle check */
2420                 if (sconn->smb2.sessions.list) {
2421                         return true;
2422                 }
2423                 DEBUG( 2, ( "Closing idle SMB2 connection\n" ) );
2424                 messaging_send(smbd_messaging_context(), procid_self(),
2425                                MSG_SHUTDOWN, &data_blob_null);
2426                 return false;
2427         }
2428
2429         if ((conn_num_open(sconn) == 0)
2430             || (conn_idle_all(sconn, now->tv_sec))) {
2431                 DEBUG( 2, ( "Closing idle SMB1 connection\n" ) );
2432                 messaging_send(smbd_messaging_context(), procid_self(),
2433                                MSG_SHUTDOWN, &data_blob_null);
2434                 return False;
2435         }
2436
2437         return True;
2438 }
2439
2440 /*
2441  * Do the recurring log file and smb.conf reload checks.
2442  */
2443
2444 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2445 {
2446         change_to_root_user();
2447
2448         /* update printer queue caches if necessary */
2449         update_monitored_printq_cache();
2450
2451         /* check if we need to reload services */
2452         check_reload(time(NULL));
2453
2454         /* Change machine password if neccessary. */
2455         attempt_machine_password_change();
2456
2457         /*
2458          * Force a log file check.
2459          */
2460         force_check_log_size();
2461         check_log_size();
2462         return true;
2463 }
2464
2465 static int create_unlink_tmp(const char *dir)
2466 {
2467         char *fname;
2468         int fd;
2469
2470         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2471         if (fname == NULL) {
2472                 errno = ENOMEM;
2473                 return -1;
2474         }
2475         fd = mkstemp(fname);
2476         if (fd == -1) {
2477                 TALLOC_FREE(fname);
2478                 return -1;
2479         }
2480         if (unlink(fname) == -1) {
2481                 int sys_errno = errno;
2482                 close(fd);
2483                 TALLOC_FREE(fname);
2484                 errno = sys_errno;
2485                 return -1;
2486         }
2487         TALLOC_FREE(fname);
2488         return fd;
2489 }
2490
2491 struct smbd_echo_state {
2492         struct tevent_context *ev;
2493         struct iovec *pending;
2494         struct smbd_server_connection *sconn;
2495         int parent_pipe;
2496
2497         struct tevent_fd *parent_fde;
2498
2499         struct tevent_fd *read_fde;
2500         struct tevent_req *write_req;
2501 };
2502
2503 static void smbd_echo_writer_done(struct tevent_req *req);
2504
2505 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2506 {
2507         int num_pending;
2508
2509         if (state->write_req != NULL) {
2510                 return;
2511         }
2512
2513         num_pending = talloc_array_length(state->pending);
2514         if (num_pending == 0) {
2515                 return;
2516         }
2517
2518         state->write_req = writev_send(state, state->ev, NULL,
2519                                        state->parent_pipe, false,
2520                                        state->pending, num_pending);
2521         if (state->write_req == NULL) {
2522                 DEBUG(1, ("writev_send failed\n"));
2523                 exit(1);
2524         }
2525
2526         talloc_steal(state->write_req, state->pending);
2527         state->pending = NULL;
2528
2529         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2530                                 state);
2531 }
2532
2533 static void smbd_echo_writer_done(struct tevent_req *req)
2534 {
2535         struct smbd_echo_state *state = tevent_req_callback_data(
2536                 req, struct smbd_echo_state);
2537         ssize_t written;
2538         int err;
2539
2540         written = writev_recv(req, &err);
2541         TALLOC_FREE(req);
2542         state->write_req = NULL;
2543         if (written == -1) {
2544                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2545                 exit(1);
2546         }
2547         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2548         smbd_echo_activate_writer(state);
2549 }
2550
2551 static bool smbd_echo_reply(int fd,
2552                             uint8_t *inbuf, size_t inbuf_len,
2553                             uint32_t seqnum)
2554 {
2555         struct smb_request req;
2556         uint16_t num_replies;
2557         size_t out_len;
2558         char *outbuf;
2559         bool ok;
2560
2561         if (inbuf_len < smb_size) {
2562                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2563                 return false;
2564         }
2565         if (!valid_smb_header(inbuf)) {
2566                 DEBUG(10, ("Got invalid SMB header\n"));
2567                 return false;
2568         }
2569
2570         if (!init_smb_request(&req, inbuf, 0, false, seqnum)) {
2571                 return false;
2572         }
2573         req.inbuf = inbuf;
2574
2575         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2576                    smb_messages[req.cmd].name
2577                    ? smb_messages[req.cmd].name : "unknown"));
2578
2579         if (req.cmd != SMBecho) {
2580                 return false;
2581         }
2582         if (req.wct < 1) {
2583                 return false;
2584         }
2585
2586         num_replies = SVAL(req.vwv+0, 0);
2587         if (num_replies != 1) {
2588                 /* Not a Windows "Hey, you're still there?" request */
2589                 return false;
2590         }
2591
2592         if (!create_outbuf(talloc_tos(), &req, (char *)req.inbuf, &outbuf,
2593                            1, req.buflen)) {
2594                 DEBUG(10, ("create_outbuf failed\n"));
2595                 return false;
2596         }
2597         req.outbuf = (uint8_t *)outbuf;
2598
2599         SSVAL(req.outbuf, smb_vwv0, num_replies);
2600
2601         if (req.buflen > 0) {
2602                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2603         }
2604
2605         out_len = smb_len(req.outbuf) + 4;
2606
2607         ok = srv_send_smb(smbd_server_fd(),
2608                           (char *)outbuf,
2609                           true, seqnum+1,
2610                           false, &req.pcd);
2611         TALLOC_FREE(outbuf);
2612         if (!ok) {
2613                 exit(1);
2614         }
2615
2616         return true;
2617 }
2618
2619 static void smbd_echo_exit(struct tevent_context *ev,
2620                            struct tevent_fd *fde, uint16_t flags,
2621                            void *private_data)
2622 {
2623         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2624         exit(0);
2625 }
2626
2627 static void smbd_echo_reader(struct tevent_context *ev,
2628                              struct tevent_fd *fde, uint16_t flags,
2629                              void *private_data)
2630 {
2631         struct smbd_echo_state *state = talloc_get_type_abort(
2632                 private_data, struct smbd_echo_state);
2633         struct smbd_server_connection *sconn = state->sconn;
2634         size_t unread, num_pending;
2635         NTSTATUS status;
2636         struct iovec *tmp;
2637         uint32_t seqnum = 0;
2638         bool reply;
2639         bool ok;
2640         bool encrypted = false;
2641
2642         ok = smbd_lock_socket_internal(sconn);
2643         if (!ok) {
2644                 DEBUG(0, ("%s: failed to lock socket\n",
2645                         __location__));
2646                 exit(1);
2647         }
2648
2649         if (!fd_is_readable(smbd_server_fd())) {
2650                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2651                           (int)sys_getpid()));
2652                 ok = smbd_unlock_socket_internal(sconn);
2653                 if (!ok) {
2654                         DEBUG(1, ("%s: failed to unlock socket in\n",
2655                                 __location__));
2656                         exit(1);
2657                 }
2658                 return;
2659         }
2660
2661         num_pending = talloc_array_length(state->pending);
2662         tmp = talloc_realloc(state, state->pending, struct iovec,
2663                              num_pending+1);
2664         if (tmp == NULL) {
2665                 DEBUG(1, ("talloc_realloc failed\n"));
2666                 exit(1);
2667         }
2668         state->pending = tmp;
2669
2670         DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2671
2672         status = receive_smb_talloc(state->pending, smbd_server_fd(),
2673                                     (char **)(void *)&state->pending[num_pending].iov_base,
2674                                     0 /* timeout */,
2675                                     &unread,
2676                                     &encrypted,
2677                                     &state->pending[num_pending].iov_len,
2678                                     &seqnum,
2679                                     false /* trusted_channel*/);
2680         if (!NT_STATUS_IS_OK(status)) {
2681                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2682                           (int)sys_getpid(), nt_errstr(status)));
2683                 exit(1);
2684         }
2685
2686         ok = smbd_unlock_socket_internal(sconn);
2687         if (!ok) {
2688                 DEBUG(1, ("%s: failed to unlock socket in\n",
2689                         __location__));
2690                 exit(1);
2691         }
2692
2693         /*
2694          * place the seqnum in the packet so that the main process can reply
2695          * with signing
2696          */
2697         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field, seqnum);
2698         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2699
2700         reply = smbd_echo_reply(smbd_server_fd(),
2701                                 (uint8_t *)state->pending[num_pending].iov_base,
2702                                 state->pending[num_pending].iov_len,
2703                                 seqnum);
2704         if (reply) {
2705                 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2706                 /* no check, shrinking by some bytes does not fail */
2707                 state->pending = talloc_realloc(state, state->pending,
2708                                                 struct iovec,
2709                                                 num_pending);
2710         } else {
2711                 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2712                 smbd_echo_activate_writer(state);
2713         }
2714 }
2715
2716 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2717                            int parent_pipe)
2718 {
2719         struct smbd_echo_state *state;
2720
2721         state = talloc_zero(sconn, struct smbd_echo_state);
2722         if (state == NULL) {
2723                 DEBUG(1, ("talloc failed\n"));
2724                 return;
2725         }
2726         state->sconn = sconn;
2727         state->parent_pipe = parent_pipe;
2728         state->ev = s3_tevent_context_init(state);
2729         if (state->ev == NULL) {
2730                 DEBUG(1, ("tevent_context_init failed\n"));
2731                 TALLOC_FREE(state);
2732                 return;
2733         }
2734         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2735                                         TEVENT_FD_READ, smbd_echo_exit,
2736                                         state);
2737         if (state->parent_fde == NULL) {
2738                 DEBUG(1, ("tevent_add_fd failed\n"));
2739                 TALLOC_FREE(state);
2740                 return;
2741         }
2742         state->read_fde = tevent_add_fd(state->ev, state, smbd_server_fd(),
2743                                         TEVENT_FD_READ, smbd_echo_reader,
2744                                         state);
2745         if (state->read_fde == NULL) {
2746                 DEBUG(1, ("tevent_add_fd failed\n"));
2747                 TALLOC_FREE(state);
2748                 return;
2749         }
2750
2751         while (true) {
2752                 if (tevent_loop_once(state->ev) == -1) {
2753                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2754                                   strerror(errno)));
2755                         break;
2756                 }
2757         }
2758         TALLOC_FREE(state);
2759 }
2760
2761 /*
2762  * Handle SMBecho requests in a forked child process
2763  */
2764 static bool fork_echo_handler(struct smbd_server_connection *sconn)
2765 {
2766         int listener_pipe[2];
2767         int res;
2768         pid_t child;
2769
2770         res = pipe(listener_pipe);
2771         if (res == -1) {
2772                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2773                 return false;
2774         }
2775         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2776         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2777                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2778                 goto fail;
2779         }
2780
2781         child = sys_fork();
2782         if (child == 0) {
2783                 NTSTATUS status;
2784
2785                 close(listener_pipe[0]);
2786
2787                 status = reinit_after_fork(smbd_messaging_context(),
2788                                            smbd_event_context(), false);
2789                 if (!NT_STATUS_IS_OK(status)) {
2790                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2791                                   nt_errstr(status)));
2792                         exit(1);
2793                 }
2794                 smbd_echo_loop(sconn, listener_pipe[1]);
2795                 exit(0);
2796         }
2797         close(listener_pipe[1]);
2798         listener_pipe[1] = -1;
2799         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2800
2801         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2802
2803         /*
2804          * Without smb signing this is the same as the normal smbd
2805          * listener. This needs to change once signing comes in.
2806          */
2807         sconn->smb1.echo_handler.trusted_fde = event_add_fd(smbd_event_context(),
2808                                         sconn,
2809                                         sconn->smb1.echo_handler.trusted_fd,
2810                                         EVENT_FD_READ,
2811                                         smbd_server_echo_handler,
2812                                         sconn);
2813         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2814                 DEBUG(1, ("event_add_fd failed\n"));
2815                 goto fail;
2816         }
2817
2818         return true;
2819
2820 fail:
2821         if (listener_pipe[0] != -1) {
2822                 close(listener_pipe[0]);
2823         }
2824         if (listener_pipe[1] != -1) {
2825                 close(listener_pipe[1]);
2826         }
2827         sconn->smb1.echo_handler.trusted_fd = -1;
2828         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2829                 close(sconn->smb1.echo_handler.socket_lock_fd);
2830         }
2831         sconn->smb1.echo_handler.trusted_fd = -1;
2832         sconn->smb1.echo_handler.socket_lock_fd = -1;
2833         return false;
2834 }
2835
2836 /****************************************************************************
2837  Process commands from the client
2838 ****************************************************************************/
2839
2840 void smbd_process(void)
2841 {
2842         TALLOC_CTX *frame = talloc_stackframe();
2843         struct sockaddr_storage ss;
2844         struct sockaddr *sa = NULL;
2845         socklen_t sa_len;
2846         struct tsocket_address *local_address = NULL;
2847         struct tsocket_address *remote_address = NULL;
2848         const char *remaddr = NULL;
2849         int ret;
2850
2851         if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2852             lp_security() != SEC_SHARE &&
2853             !lp_async_smb_echo_handler()) {
2854                 smbd_server_conn->allow_smb2 = true;
2855         }
2856
2857         /* Ensure child is set to blocking mode */
2858         set_blocking(smbd_server_fd(),True);
2859
2860         set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2861         set_socket_options(smbd_server_fd(), lp_socket_options());
2862
2863         sa = (struct sockaddr *)(void *)&ss;
2864         sa_len = sizeof(ss);
2865         ret = getpeername(smbd_server_fd(), sa, &sa_len);
2866         if (ret != 0) {
2867                 int level = (errno == ENOTCONN)?2:0;
2868                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2869                 exit_server("getpeername() failed.\n");
2870         }
2871         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2872                                                 sa, sa_len,
2873                                                 &remote_address);
2874         if (ret != 0) {
2875                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2876                         __location__, strerror(errno)));
2877                 exit_server("tsocket_address_bsd_from_sockaddr remote failed.\n");
2878         }
2879
2880         sa = (struct sockaddr *)(void *)&ss;
2881         sa_len = sizeof(ss);
2882         ret = getsockname(smbd_server_fd(), sa, &sa_len);
2883         if (ret != 0) {
2884                 int level = (errno == ENOTCONN)?2:0;
2885                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2886                 exit_server("getsockname() failed.\n");
2887         }
2888         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2889                                                 sa, sa_len,
2890                                                 &local_address);
2891         if (ret != 0) {
2892                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2893                         __location__, strerror(errno)));
2894                 exit_server("tsocket_address_bsd_from_sockaddr remote failed.\n");
2895         }
2896
2897         smbd_server_conn->local_address = local_address;
2898         smbd_server_conn->remote_address = remote_address;
2899
2900         if (tsocket_address_is_inet(remote_address, "ip")) {
2901                 remaddr = tsocket_address_inet_addr_string(
2902                                 smbd_server_conn->remote_address,
2903                                 talloc_tos());
2904                 if (remaddr == NULL) {
2905
2906                 }
2907         } else {
2908                 remaddr = "0.0.0.0";
2909         }
2910
2911         /* this is needed so that we get decent entries
2912            in smbstatus for port 445 connects */
2913         set_remote_machine_name(remaddr, false);
2914         reload_services(true);
2915
2916         /*
2917          * Before the first packet, check the global hosts allow/ hosts deny
2918          * parameters before doing any parsing of packets passed to us by the
2919          * client. This prevents attacks on our parsing code from hosts not in
2920          * the hosts allow list.
2921          */
2922
2923         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2924                           lp_hostsdeny(-1))) {
2925                 /*
2926                  * send a negative session response "not listening on calling
2927                  * name"
2928                  */
2929                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2930                 DEBUG( 1, ("Connection denied from %s to %s\n",
2931                            tsocket_address_string(remote_address, talloc_tos()),
2932                            tsocket_address_string(local_address, talloc_tos())));
2933                 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2934                                    0, false, NULL);
2935                 exit_server_cleanly("connection denied");
2936         }
2937
2938         DEBUG(10, ("Connection allowed from %s to %s\n",
2939                    tsocket_address_string(remote_address, talloc_tos()),
2940                    tsocket_address_string(local_address, talloc_tos())));
2941
2942         static_init_rpc;
2943
2944         init_modules();
2945
2946         smb_perfcount_init();
2947
2948         if (!init_account_policy()) {
2949                 exit_server("Could not open account policy tdb.\n");
2950         }
2951
2952         if (*lp_rootdir()) {
2953                 if (chroot(lp_rootdir()) != 0) {
2954                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2955                         exit_server("Failed to chroot()");
2956                 }
2957                 if (chdir("/") == -1) {
2958                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2959                         exit_server("Failed to chroot()");
2960                 }
2961                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2962         }
2963
2964         if (!srv_init_signing(smbd_server_conn)) {
2965                 exit_server("Failed to init smb_signing");
2966         }
2967
2968         if (lp_async_smb_echo_handler() && !fork_echo_handler(smbd_server_conn)) {
2969                 exit_server("Failed to fork echo handler");
2970         }
2971
2972         /* Setup oplocks */
2973         if (!init_oplocks(smbd_messaging_context()))
2974                 exit_server("Failed to init oplocks");
2975
2976         /* register our message handlers */
2977         messaging_register(smbd_messaging_context(), NULL,
2978                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
2979         messaging_register(smbd_messaging_context(), NULL,
2980                            MSG_SMB_RELEASE_IP, msg_release_ip);
2981         messaging_register(smbd_messaging_context(), NULL,
2982                            MSG_SMB_CLOSE_FILE, msg_close_file);
2983
2984         /*
2985          * Use the default MSG_DEBUG handler to avoid rebroadcasting
2986          * MSGs to all child processes
2987          */
2988         messaging_deregister(smbd_messaging_context(),
2989                              MSG_DEBUG, NULL);
2990         messaging_register(smbd_messaging_context(), NULL,
2991                            MSG_DEBUG, debug_message);
2992
2993         if ((lp_keepalive() != 0)
2994             && !(event_add_idle(smbd_event_context(), NULL,
2995                                 timeval_set(lp_keepalive(), 0),
2996                                 "keepalive", keepalive_fn,
2997                                 NULL))) {
2998                 DEBUG(0, ("Could not add keepalive event\n"));
2999                 exit(1);
3000         }
3001
3002         if (!(event_add_idle(smbd_event_context(), NULL,
3003                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3004                              "deadtime", deadtime_fn, NULL))) {
3005                 DEBUG(0, ("Could not add deadtime event\n"));
3006                 exit(1);
3007         }
3008
3009         if (!(event_add_idle(smbd_event_context(), NULL,
3010                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
3011                              "housekeeping", housekeeping_fn, NULL))) {
3012                 DEBUG(0, ("Could not add housekeeping event\n"));
3013                 exit(1);
3014         }
3015
3016 #ifdef CLUSTER_SUPPORT
3017
3018         if (lp_clustering()) {
3019                 /*
3020                  * We need to tell ctdb about our client's TCP
3021                  * connection, so that for failover ctdbd can send
3022                  * tickle acks, triggering a reconnection by the
3023                  * client.
3024                  */
3025
3026                 struct sockaddr_storage srv, clnt;
3027
3028                 if (client_get_tcp_info(&srv, &clnt) == 0) {
3029
3030                         NTSTATUS status;
3031
3032                         status = ctdbd_register_ips(
3033                                 messaging_ctdbd_connection(),
3034                                 &srv, &clnt, release_ip, NULL);
3035
3036                         if (!NT_STATUS_IS_OK(status)) {
3037                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3038                                           nt_errstr(status)));
3039                         }
3040                 } else
3041                 {
3042                         DEBUG(0,("Unable to get tcp info for "
3043                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3044                                  strerror(errno)));
3045                 }
3046         }
3047
3048 #endif
3049
3050         smbd_server_conn->nbt.got_session = false;
3051
3052         smbd_server_conn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3053
3054         smbd_server_conn->smb1.sessions.done_sesssetup = false;
3055         smbd_server_conn->smb1.sessions.max_send = BUFFER_SIZE;
3056         smbd_server_conn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3057         /* users from session setup */
3058         smbd_server_conn->smb1.sessions.session_userlist = NULL;
3059         /* workgroup from session setup. */
3060         smbd_server_conn->smb1.sessions.session_workgroup = NULL;
3061         /* this holds info on user ids that are already validated for this VC */
3062         smbd_server_conn->smb1.sessions.validated_users = NULL;
3063         smbd_server_conn->smb1.sessions.next_vuid = VUID_OFFSET;
3064         smbd_server_conn->smb1.sessions.num_validated_vuids = 0;
3065 #ifdef HAVE_NETGROUP
3066         smbd_server_conn->smb1.sessions.my_yp_domain = NULL;
3067 #endif
3068
3069         conn_init(smbd_server_conn);
3070         if (!init_dptrs(smbd_server_conn)) {
3071                 exit_server("init_dptrs() failed");
3072         }
3073
3074         smbd_server_conn->smb1.fde = event_add_fd(smbd_event_context(),
3075                                                   smbd_server_conn,
3076                                                   smbd_server_fd(),
3077                                                   EVENT_FD_READ,
3078                                                   smbd_server_connection_handler,
3079                                                   smbd_server_conn);
3080         if (!smbd_server_conn->smb1.fde) {
3081                 exit_server("failed to create smbd_server_connection fde");
3082         }
3083
3084         TALLOC_FREE(frame);
3085
3086         while (True) {
3087                 NTSTATUS status;
3088
3089                 frame = talloc_stackframe_pool(8192);
3090
3091                 errno = 0;
3092
3093                 status = smbd_server_connection_loop_once(smbd_server_conn);
3094                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3095                     !NT_STATUS_IS_OK(status)) {
3096                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3097                                   " exiting\n", nt_errstr(status)));
3098                         break;
3099                 }
3100
3101                 TALLOC_FREE(frame);
3102         }
3103
3104         exit_server_cleanly(NULL);
3105 }
3106
3107 bool req_is_in_chain(struct smb_request *req)
3108 {
3109         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
3110                 /*
3111                  * We're right now handling a subsequent request, so we must
3112                  * be in a chain
3113                  */
3114                 return true;
3115         }
3116
3117         if (!is_andx_req(req->cmd)) {
3118                 return false;
3119         }
3120
3121         if (req->wct < 2) {
3122                 /*
3123                  * Okay, an illegal request, but definitely not chained :-)
3124                  */
3125                 return false;
3126         }
3127
3128         return (CVAL(req->vwv+0, 0) != 0xFF);
3129 }