source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../librpc/gen_ndr/srv_dfs.h"
  24 #include "../librpc/gen_ndr/srv_dssetup.h"
  25 #include "../librpc/gen_ndr/srv_echo.h"
  26 #include "../librpc/gen_ndr/srv_eventlog.h"
  27 #include "../librpc/gen_ndr/srv_initshutdown.h"
  28 #include "../librpc/gen_ndr/srv_lsa.h"
  29 #include "../librpc/gen_ndr/srv_netlogon.h"
  30 #include "../librpc/gen_ndr/srv_ntsvcs.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32 #include "../librpc/gen_ndr/srv_spoolss.h"
  33 #include "../librpc/gen_ndr/srv_srvsvc.h"
  34 #include "../librpc/gen_ndr/srv_svcctl.h"
  35 #include "../librpc/gen_ndr/srv_winreg.h"
  36 #include "../librpc/gen_ndr/srv_wkssvc.h"
  37
  38 extern bool global_machine_password_needs_changing;
  39
  40 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  41                                    char *outbuf);
  42 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
  43
  44 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  45 {
  46         bool ok;
  47
  48         if (smbd_server_conn->smb1.echo_handler.socket_lock_fd == -1) {
  49                 return true;
  50         }
  51
  52         smbd_server_conn->smb1.echo_handler.ref_count++;
  53
  54         if (smbd_server_conn->smb1.echo_handler.ref_count > 1) {
  55                 return true;
  56         }
  57
  58         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  59
  60         ok = fcntl_lock(smbd_server_conn->smb1.echo_handler.socket_lock_fd,
  61                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  62         if (!ok) {
  63                 return false;
  64         }
  65
  66         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  67
  68         return true;
  69 }
  70
  71 void smbd_lock_socket(struct smbd_server_connection *sconn)
  72 {
  73         if (!smbd_lock_socket_internal(sconn)) {
  74                 exit_server_cleanly("failed to lock socket");
  75         }
  76 }
  77
  78 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  79 {
  80         bool ok;
  81
  82         if (smbd_server_conn->smb1.echo_handler.socket_lock_fd == -1) {
  83                 return true;
  84         }
  85
  86         smbd_server_conn->smb1.echo_handler.ref_count--;
  87
  88         if (smbd_server_conn->smb1.echo_handler.ref_count > 0) {
  89                 return true;
  90         }
  91
  92         ok = fcntl_lock(smbd_server_conn->smb1.echo_handler.socket_lock_fd,
  93                         SMB_F_SETLKW, 0, 0, F_UNLCK);
  94         if (!ok) {
  95                 return false;
  96         }
  97
  98         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
  99
 100         return true;
 101 }
 102
 103 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 104 {
 105         if (!smbd_unlock_socket_internal(sconn)) {
 106                 exit_server_cleanly("failed to unlock socket");
 107         }
 108 }
 109
 110 /* Accessor function for smb_read_error for smbd functions. */
 111
 112 /****************************************************************************
 113  Send an smb to a fd.
 114 ****************************************************************************/
 115
 116 bool srv_send_smb(int fd, char *buffer,
 117                   bool do_signing, uint32_t seqnum,
 118                   bool do_encrypt,
 119                   struct smb_perfcount_data *pcd)
 120 {
 121         size_t len = 0;
 122         size_t nwritten=0;
 123         ssize_t ret;
 124         char *buf_out = buffer;
 125
 126         smbd_lock_socket(smbd_server_conn);
 127
 128         if (do_signing) {
 129                 /* Sign the outgoing packet if required. */
 130                 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
 131         }
 132
 133         if (do_encrypt) {
 134                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 135                 if (!NT_STATUS_IS_OK(status)) {
 136                         DEBUG(0, ("send_smb: SMB encryption failed "
 137                                 "on outgoing packet! Error %s\n",
 138                                 nt_errstr(status) ));
 139                         goto out;
 140                 }
 141         }
 142
 143         len = smb_len(buf_out) + 4;
 144
 145         ret = write_data(fd,buf_out+nwritten,len - nwritten);
 146         if (ret <= 0) {
 147                 DEBUG(0,("pid[%d] Error writing %d bytes to client. %d. (%s)\n",
 148                         (int)sys_getpid(), (int)len,(int)ret, strerror(errno) ));
 149                 srv_free_enc_buffer(buf_out);
 150                 goto out;
 151         }
 152
 153         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 154         srv_free_enc_buffer(buf_out);
 155 out:
 156         SMB_PERFCOUNT_END(pcd);
 157
 158         smbd_unlock_socket(smbd_server_conn);
 159         return true;
 160 }
 161
 162 /*******************************************************************
 163  Setup the word count and byte count for a smb message.
 164 ********************************************************************/
 165
 166 int srv_set_message(char *buf,
 167                         int num_words,
 168                         int num_bytes,
 169                         bool zero)
 170 {
 171         if (zero && (num_words || num_bytes)) {
 172                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 173         }
 174         SCVAL(buf,smb_wct,num_words);
 175         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 176         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 177         return (smb_size + num_words*2 + num_bytes);
 178 }
 179
 180 static bool valid_smb_header(const uint8_t *inbuf)
 181 {
 182         if (is_encrypted_packet(inbuf)) {
 183                 return true;
 184         }
 185         /*
 186          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 187          * but it just looks weird to call strncmp for this one.
 188          */
 189         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 190 }
 191
 192 /* Socket functions for smbd packet processing. */
 193
 194 static bool valid_packet_size(size_t len)
 195 {
 196         /*
 197          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 198          * of header. Don't print the error if this fits.... JRA.
 199          */
 200
 201         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 202                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 203                                         (unsigned long)len));
 204                 return false;
 205         }
 206         return true;
 207 }
 208
 209 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 210                                       unsigned int timeout, ssize_t len)
 211 {
 212         if (len <= 0) {
 213                 return NT_STATUS_OK;
 214         }
 215
 216         return read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 217 }
 218
 219 /****************************************************************************
 220  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 221 ****************************************************************************/
 222
 223 /*
 224  * Unfortunately, earlier versions of smbclient/libsmbclient
 225  * don't send this "standard" writeX header. I've fixed this
 226  * for 3.2 but we'll use the old method with earlier versions.
 227  * Windows and CIFSFS at least use this standard size. Not
 228  * sure about MacOSX.
 229  */
 230
 231 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 232                                 (2*14) + /* word count (including bcc) */ \
 233                                 1 /* pad byte */)
 234
 235 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 236                                                     const char lenbuf[4],
 237                                                     int fd, char **buffer,
 238                                                     unsigned int timeout,
 239                                                     size_t *p_unread,
 240                                                     size_t *len_ret)
 241 {
 242         /* Size of a WRITEX call (+4 byte len). */
 243         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 244         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 245         ssize_t toread;
 246         NTSTATUS status;
 247
 248         memcpy(writeX_header, lenbuf, 4);
 249
 250         status = read_fd_with_timeout(
 251                 fd, writeX_header + 4,
 252                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 253                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 254                 timeout, NULL);
 255
 256         if (!NT_STATUS_IS_OK(status)) {
 257                 return status;
 258         }
 259
 260         /*
 261          * Ok - now try and see if this is a possible
 262          * valid writeX call.
 263          */
 264
 265         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 266                 /*
 267                  * If the data offset is beyond what
 268                  * we've read, drain the extra bytes.
 269                  */
 270                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 271                 ssize_t newlen;
 272
 273                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 274                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 275                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 276                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 277                                         " failed to drain pending bytes");
 278                         }
 279                 } else {
 280                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 281                 }
 282
 283                 /* Spoof down the length and null out the bcc. */
 284                 set_message_bcc(writeX_header, 0);
 285                 newlen = smb_len(writeX_header);
 286
 287                 /* Copy the header we've written. */
 288
 289                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 290                                 writeX_header,
 291                                 sizeof(writeX_header));
 292
 293                 if (*buffer == NULL) {
 294                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 295                                   (int)sizeof(writeX_header)));
 296                         return NT_STATUS_NO_MEMORY;
 297                 }
 298
 299                 /* Work out the remaining bytes. */
 300                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 301                 *len_ret = newlen + 4;
 302                 return NT_STATUS_OK;
 303         }
 304
 305         if (!valid_packet_size(len)) {
 306                 return NT_STATUS_INVALID_PARAMETER;
 307         }
 308
 309         /*
 310          * Not a valid writeX call. Just do the standard
 311          * talloc and return.
 312          */
 313
 314         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 315
 316         if (*buffer == NULL) {
 317                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 318                           (int)len+4));
 319                 return NT_STATUS_NO_MEMORY;
 320         }
 321
 322         /* Copy in what we already read. */
 323         memcpy(*buffer,
 324                 writeX_header,
 325                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 326         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 327
 328         if(toread > 0) {
 329                 status = read_packet_remainder(
 330                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 331                         timeout, toread);
 332
 333                 if (!NT_STATUS_IS_OK(status)) {
 334                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 335                                    nt_errstr(status)));
 336                         return status;
 337                 }
 338         }
 339
 340         *len_ret = len + 4;
 341         return NT_STATUS_OK;
 342 }
 343
 344 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 345                                        char **buffer, unsigned int timeout,
 346                                        size_t *p_unread, size_t *plen)
 347 {
 348         char lenbuf[4];
 349         size_t len;
 350         int min_recv_size = lp_min_receive_file_size();
 351         NTSTATUS status;
 352
 353         *p_unread = 0;
 354
 355         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 358                 return status;
 359         }
 360
 361         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 362             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 363                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 364             !srv_is_signing_active(smbd_server_conn) &&
 365             smbd_server_conn->smb1.echo_handler.trusted_fde == NULL) {
 366
 367                 return receive_smb_raw_talloc_partial_read(
 368                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 369         }
 370
 371         if (!valid_packet_size(len)) {
 372                 return NT_STATUS_INVALID_PARAMETER;
 373         }
 374
 375         /*
 376          * The +4 here can't wrap, we've checked the length above already.
 377          */
 378
 379         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 380
 381         if (*buffer == NULL) {
 382                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 383                           (int)len+4));
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386
 387         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 388
 389         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 390         if (!NT_STATUS_IS_OK(status)) {
 391                 return status;
 392         }
 393
 394         *plen = len + 4;
 395         return NT_STATUS_OK;
 396 }
 397
 398 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 399                                    char **buffer, unsigned int timeout,
 400                                    size_t *p_unread, bool *p_encrypted,
 401                                    size_t *p_len,
 402                                    uint32_t *seqnum,
 403                                    bool trusted_channel)
 404 {
 405         size_t len = 0;
 406         NTSTATUS status;
 407
 408         *p_encrypted = false;
 409
 410         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 411                                         p_unread, &len);
 412         if (!NT_STATUS_IS_OK(status)) {
 413                 return status;
 414         }
 415
 416         if (is_encrypted_packet((uint8_t *)*buffer)) {
 417                 status = srv_decrypt_buffer(*buffer);
 418                 if (!NT_STATUS_IS_OK(status)) {
 419                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 420                                 "incoming packet! Error %s\n",
 421                                 nt_errstr(status) ));
 422                         return status;
 423                 }
 424                 *p_encrypted = true;
 425         }
 426
 427         /* Check the incoming SMB signature. */
 428         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, trusted_channel)) {
 429                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 430                           "incoming packet!\n"));
 431                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 432         }
 433
 434         *p_len = len;
 435         return NT_STATUS_OK;
 436 }
 437
 438 /*
 439  * Initialize a struct smb_request from an inbuf
 440  */
 441
 442 static bool init_smb_request(struct smb_request *req, const uint8 *inbuf,
 443                              size_t unread_bytes, bool encrypted,
 444                              uint32_t seqnum)
 445 {
 446         struct smbd_server_connection *sconn = smbd_server_conn;
 447         size_t req_size = smb_len(inbuf) + 4;
 448         /* Ensure we have at least smb_size bytes. */
 449         if (req_size < smb_size) {
 450                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 451                         (unsigned int)req_size ));
 452                 return false;
 453         }
 454         req->cmd    = CVAL(inbuf, smb_com);
 455         req->flags2 = SVAL(inbuf, smb_flg2);
 456         req->smbpid = SVAL(inbuf, smb_pid);
 457         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 458         req->seqnum = seqnum;
 459         req->vuid   = SVAL(inbuf, smb_uid);
 460         req->tid    = SVAL(inbuf, smb_tid);
 461         req->wct    = CVAL(inbuf, smb_wct);
 462         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 463         req->buflen = smb_buflen(inbuf);
 464         req->buf    = (const uint8_t *)smb_buf(inbuf);
 465         req->unread_bytes = unread_bytes;
 466         req->encrypted = encrypted;
 467         req->conn = conn_find(sconn,req->tid);
 468         req->chain_fsp = NULL;
 469         req->chain_outbuf = NULL;
 470         req->done = false;
 471         req->smb2req = NULL;
 472         smb_init_perfcount_data(&req->pcd);
 473
 474         /* Ensure we have at least wct words and 2 bytes of bcc. */
 475         if (smb_size + req->wct*2 > req_size) {
 476                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 477                         (unsigned int)req->wct,
 478                         (unsigned int)req_size));
 479                 return false;
 480         }
 481         /* Ensure bcc is correct. */
 482         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 483                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 484                         "(wct = %u, size %u)\n",
 485                         (unsigned int)req->buflen,
 486                         (unsigned int)req->wct,
 487                         (unsigned int)req_size));
 488                 return false;
 489         }
 490
 491         req->outbuf = NULL;
 492         return true;
 493 }
 494
 495 static void process_smb(struct smbd_server_connection *conn,
 496                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 497                         uint32_t seqnum, bool encrypted,
 498                         struct smb_perfcount_data *deferred_pcd);
 499
 500 static void smbd_deferred_open_timer(struct event_context *ev,
 501                                      struct timed_event *te,
 502                                      struct timeval _tval,
 503                                      void *private_data)
 504 {
 505         struct pending_message_list *msg = talloc_get_type(private_data,
 506                                            struct pending_message_list);
 507         TALLOC_CTX *mem_ctx = talloc_tos();
 508         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 509         uint8_t *inbuf;
 510
 511         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 512                                          msg->buf.length);
 513         if (inbuf == NULL) {
 514                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 515                 return;
 516         }
 517
 518         /* We leave this message on the queue so the open code can
 519            know this is a retry. */
 520         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 521                 (unsigned long long)mid ));
 522
 523         /* Mark the message as processed so this is not
 524          * re-processed in error. */
 525         msg->processed = true;
 526
 527         process_smb(smbd_server_conn, inbuf,
 528                     msg->buf.length, 0,
 529                     msg->seqnum, msg->encrypted, &msg->pcd);
 530
 531         /* If it's still there and was processed, remove it. */
 532         msg = get_deferred_open_message_smb(mid);
 533         if (msg && msg->processed) {
 534                 remove_deferred_open_message_smb(mid);
 535         }
 536 }
 537
 538 /****************************************************************************
 539  Function to push a message onto the tail of a linked list of smb messages ready
 540  for processing.
 541 ****************************************************************************/
 542
 543 static bool push_queued_message(struct smb_request *req,
 544                                 struct timeval request_time,
 545                                 struct timeval end_time,
 546                                 char *private_data, size_t private_len)
 547 {
 548         int msg_len = smb_len(req->inbuf) + 4;
 549         struct pending_message_list *msg;
 550
 551         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 552
 553         if(msg == NULL) {
 554                 DEBUG(0,("push_message: malloc fail (1)\n"));
 555                 return False;
 556         }
 557
 558         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 559         if(msg->buf.data == NULL) {
 560                 DEBUG(0,("push_message: malloc fail (2)\n"));
 561                 TALLOC_FREE(msg);
 562                 return False;
 563         }
 564
 565         msg->request_time = request_time;
 566         msg->seqnum = req->seqnum;
 567         msg->encrypted = req->encrypted;
 568         msg->processed = false;
 569         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 570
 571         if (private_data) {
 572                 msg->private_data = data_blob_talloc(msg, private_data,
 573                                                      private_len);
 574                 if (msg->private_data.data == NULL) {
 575                         DEBUG(0,("push_message: malloc fail (3)\n"));
 576                         TALLOC_FREE(msg);
 577                         return False;
 578                 }
 579         }
 580
 581         msg->te = event_add_timed(smbd_event_context(),
 582                                   msg,
 583                                   end_time,
 584                                   smbd_deferred_open_timer,
 585                                   msg);
 586         if (!msg->te) {
 587                 DEBUG(0,("push_message: event_add_timed failed\n"));
 588                 TALLOC_FREE(msg);
 589                 return false;
 590         }
 591
 592         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 593
 594         DEBUG(10,("push_message: pushed message length %u on "
 595                   "deferred_open_queue\n", (unsigned int)msg_len));
 596
 597         return True;
 598 }
 599
 600 /****************************************************************************
 601  Function to delete a sharing violation open message by mid.
 602 ****************************************************************************/
 603
 604 void remove_deferred_open_message_smb(uint64_t mid)
 605 {
 606         struct pending_message_list *pml;
 607
 608         if (smbd_server_conn->allow_smb2) {
 609                 remove_deferred_open_message_smb2(mid);
 610                 return;
 611         }
 612
 613         for (pml = deferred_open_queue; pml; pml = pml->next) {
 614                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 615                         DEBUG(10,("remove_deferred_open_message_smb: "
 616                                   "deleting mid %llu len %u\n",
 617                                   (unsigned long long)mid,
 618                                   (unsigned int)pml->buf.length ));
 619                         DLIST_REMOVE(deferred_open_queue, pml);
 620                         TALLOC_FREE(pml);
 621                         return;
 622                 }
 623         }
 624 }
 625
 626 /****************************************************************************
 627  Move a sharing violation open retry message to the front of the list and
 628  schedule it for immediate processing.
 629 ****************************************************************************/
 630
 631 void schedule_deferred_open_message_smb(uint64_t mid)
 632 {
 633         struct pending_message_list *pml;
 634         int i = 0;
 635
 636         if (smbd_server_conn->allow_smb2) {
 637                 schedule_deferred_open_message_smb2(mid);
 638                 return;
 639         }
 640
 641         for (pml = deferred_open_queue; pml; pml = pml->next) {
 642                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 643
 644                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 645                         "msg_mid = %llu\n",
 646                         i++,
 647                         (unsigned long long)msg_mid ));
 648
 649                 if (mid == msg_mid) {
 650                         struct timed_event *te;
 651
 652                         if (pml->processed) {
 653                                 /* A processed message should not be
 654                                  * rescheduled. */
 655                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 656                                         "message mid %llu was already processed\n",
 657                                         (unsigned long long)msg_mid ));
 658                                 continue;
 659                         }
 660
 661                         DEBUG(10,("schedule_deferred_open_message_smb: "
 662                                 "scheduling mid %llu\n",
 663                                 (unsigned long long)mid ));
 664
 665                         te = event_add_timed(smbd_event_context(),
 666                                              pml,
 667                                              timeval_zero(),
 668                                              smbd_deferred_open_timer,
 669                                              pml);
 670                         if (!te) {
 671                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 672                                         "event_add_timed() failed, "
 673                                         "skipping mid %llu\n",
 674                                         (unsigned long long)msg_mid ));
 675                         }
 676
 677                         TALLOC_FREE(pml->te);
 678                         pml->te = te;
 679                         DLIST_PROMOTE(deferred_open_queue, pml);
 680                         return;
 681                 }
 682         }
 683
 684         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 685                 "find message mid %llu\n",
 686                 (unsigned long long)mid ));
 687 }
 688
 689 /****************************************************************************
 690  Return true if this mid is on the deferred queue and was not yet processed.
 691 ****************************************************************************/
 692
 693 bool open_was_deferred(uint64_t mid)
 694 {
 695         struct pending_message_list *pml;
 696
 697         if (smbd_server_conn->allow_smb2) {
 698                 return open_was_deferred_smb2(mid);
 699         }
 700
 701         for (pml = deferred_open_queue; pml; pml = pml->next) {
 702                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 703                         return True;
 704                 }
 705         }
 706         return False;
 707 }
 708
 709 /****************************************************************************
 710  Return the message queued by this mid.
 711 ****************************************************************************/
 712
 713 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
 714 {
 715         struct pending_message_list *pml;
 716
 717         for (pml = deferred_open_queue; pml; pml = pml->next) {
 718                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 719                         return pml;
 720                 }
 721         }
 722         return NULL;
 723 }
 724
 725 /****************************************************************************
 726  Get the state data queued by this mid.
 727 ****************************************************************************/
 728
 729 bool get_deferred_open_message_state(struct smb_request *smbreq,
 730                                 struct timeval *p_request_time,
 731                                 void **pp_state)
 732 {
 733         struct pending_message_list *pml;
 734
 735         if (smbd_server_conn->allow_smb2) {
 736                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 737                                         p_request_time,
 738                                         pp_state);
 739         }
 740
 741         pml = get_deferred_open_message_smb(smbreq->mid);
 742         if (!pml) {
 743                 return false;
 744         }
 745         if (p_request_time) {
 746                 *p_request_time = pml->request_time;
 747         }
 748         if (pp_state) {
 749                 *pp_state = (void *)pml->private_data.data;
 750         }
 751         return true;
 752 }
 753
 754 /****************************************************************************
 755  Function to push a deferred open smb message onto a linked list of local smb
 756  messages ready for processing.
 757 ****************************************************************************/
 758
 759 bool push_deferred_open_message_smb(struct smb_request *req,
 760                                struct timeval request_time,
 761                                struct timeval timeout,
 762                                struct file_id id,
 763                                char *private_data, size_t priv_len)
 764 {
 765         struct timeval end_time;
 766
 767         if (req->smb2req) {
 768                 return push_deferred_open_message_smb2(req->smb2req,
 769                                                 request_time,
 770                                                 timeout,
 771                                                 id,
 772                                                 private_data,
 773                                                 priv_len);
 774         }
 775
 776         if (req->unread_bytes) {
 777                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 778                         "unread_bytes = %u\n",
 779                         (unsigned int)req->unread_bytes ));
 780                 smb_panic("push_deferred_open_message_smb: "
 781                         "logic error unread_bytes != 0" );
 782         }
 783
 784         end_time = timeval_sum(&request_time, &timeout);
 785
 786         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 787                 "len %u mid %llu timeout time [%u.%06u]\n",
 788                 (unsigned int) smb_len(req->inbuf)+4,
 789                 (unsigned long long)req->mid,
 790                 (unsigned int)end_time.tv_sec,
 791                 (unsigned int)end_time.tv_usec));
 792
 793         return push_queued_message(req, request_time, end_time,
 794                                    private_data, priv_len);
 795 }
 796
 797 struct idle_event {
 798         struct timed_event *te;
 799         struct timeval interval;
 800         char *name;
 801         bool (*handler)(const struct timeval *now, void *private_data);
 802         void *private_data;
 803 };
 804
 805 static void smbd_idle_event_handler(struct event_context *ctx,
 806                                     struct timed_event *te,
 807                                     struct timeval now,
 808                                     void *private_data)
 809 {
 810         struct idle_event *event =
 811                 talloc_get_type_abort(private_data, struct idle_event);
 812
 813         TALLOC_FREE(event->te);
 814
 815         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 816                   event->name, event->te));
 817
 818         if (!event->handler(&now, event->private_data)) {
 819                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 820                           event->name, event->te));
 821                 /* Don't repeat, delete ourselves */
 822                 TALLOC_FREE(event);
 823                 return;
 824         }
 825
 826         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 827                   event->name, event->te));
 828
 829         event->te = event_add_timed(ctx, event,
 830                                     timeval_sum(&now, &event->interval),
 831                                     smbd_idle_event_handler, event);
 832
 833         /* We can't do much but fail here. */
 834         SMB_ASSERT(event->te != NULL);
 835 }
 836
 837 struct idle_event *event_add_idle(struct event_context *event_ctx,
 838                                   TALLOC_CTX *mem_ctx,
 839                                   struct timeval interval,
 840                                   const char *name,
 841                                   bool (*handler)(const struct timeval *now,
 842                                                   void *private_data),
 843                                   void *private_data)
 844 {
 845         struct idle_event *result;
 846         struct timeval now = timeval_current();
 847
 848         result = TALLOC_P(mem_ctx, struct idle_event);
 849         if (result == NULL) {
 850                 DEBUG(0, ("talloc failed\n"));
 851                 return NULL;
 852         }
 853
 854         result->interval = interval;
 855         result->handler = handler;
 856         result->private_data = private_data;
 857
 858         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 859                 DEBUG(0, ("talloc failed\n"));
 860                 TALLOC_FREE(result);
 861                 return NULL;
 862         }
 863
 864         result->te = event_add_timed(event_ctx, result,
 865                                      timeval_sum(&now, &interval),
 866                                      smbd_idle_event_handler, result);
 867         if (result->te == NULL) {
 868                 DEBUG(0, ("event_add_timed failed\n"));
 869                 TALLOC_FREE(result);
 870                 return NULL;
 871         }
 872
 873         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 874         return result;
 875 }
 876
 877 static void smbd_sig_term_handler(struct tevent_context *ev,
 878                                   struct tevent_signal *se,
 879                                   int signum,
 880                                   int count,
 881                                   void *siginfo,
 882                                   void *private_data)
 883 {
 884         exit_server_cleanly("termination signal");
 885 }
 886
 887 void smbd_setup_sig_term_handler(void)
 888 {
 889         struct tevent_signal *se;
 890
 891         se = tevent_add_signal(smbd_event_context(),
 892                                smbd_event_context(),
 893                                SIGTERM, 0,
 894                                smbd_sig_term_handler,
 895                                NULL);
 896         if (!se) {
 897                 exit_server("failed to setup SIGTERM handler");
 898         }
 899 }
 900
 901 static void smbd_sig_hup_handler(struct tevent_context *ev,
 902                                   struct tevent_signal *se,
 903                                   int signum,
 904                                   int count,
 905                                   void *siginfo,
 906                                   void *private_data)
 907 {
 908         change_to_root_user();
 909         DEBUG(1,("Reloading services after SIGHUP\n"));
 910         reload_services(False);
 911 }
 912
 913 void smbd_setup_sig_hup_handler(void)
 914 {
 915         struct tevent_signal *se;
 916
 917         se = tevent_add_signal(smbd_event_context(),
 918                                smbd_event_context(),
 919                                SIGHUP, 0,
 920                                smbd_sig_hup_handler,
 921                                NULL);
 922         if (!se) {
 923                 exit_server("failed to setup SIGHUP handler");
 924         }
 925 }
 926
 927 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 928 {
 929         fd_set r_fds, w_fds;
 930         int selrtn;
 931         struct timeval to;
 932         int maxfd = 0;
 933
 934         to.tv_sec = SMBD_SELECT_TIMEOUT;
 935         to.tv_usec = 0;
 936
 937         /*
 938          * Setup the select fd sets.
 939          */
 940
 941         FD_ZERO(&r_fds);
 942         FD_ZERO(&w_fds);
 943
 944         /*
 945          * Are there any timed events waiting ? If so, ensure we don't
 946          * select for longer than it would take to wait for them.
 947          */
 948
 949         {
 950                 struct timeval now;
 951                 GetTimeOfDay(&now);
 952
 953                 event_add_to_select_args(smbd_event_context(), &now,
 954                                          &r_fds, &w_fds, &to, &maxfd);
 955         }
 956
 957         /* Process a signal and timed events now... */
 958         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 959                 return NT_STATUS_RETRY;
 960         }
 961
 962         {
 963                 int sav;
 964                 START_PROFILE(smbd_idle);
 965
 966                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 967                 sav = errno;
 968
 969                 END_PROFILE(smbd_idle);
 970                 errno = sav;
 971         }
 972
 973         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 974                 return NT_STATUS_RETRY;
 975         }
 976
 977         /* Check if error */
 978         if (selrtn == -1) {
 979                 /* something is wrong. Maybe the socket is dead? */
 980                 return map_nt_error_from_unix(errno);
 981         }
 982
 983         /* Did we timeout ? */
 984         if (selrtn == 0) {
 985                 return NT_STATUS_RETRY;
 986         }
 987
 988         /* should not be reached */
 989         return NT_STATUS_INTERNAL_ERROR;
 990 }
 991
 992 /*
 993  * Only allow 5 outstanding trans requests. We're allocating memory, so
 994  * prevent a DoS.
 995  */
 996
 997 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 998 {
 999         int count = 0;
1000         for (; list != NULL; list = list->next) {
1001
1002                 if (list->mid == mid) {
1003                         return NT_STATUS_INVALID_PARAMETER;
1004                 }
1005
1006                 count += 1;
1007         }
1008         if (count > 5) {
1009                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1010         }
1011
1012         return NT_STATUS_OK;
1013 }
1014
1015 /*
1016 These flags determine some of the permissions required to do an operation
1017
1018 Note that I don't set NEED_WRITE on some write operations because they
1019 are used by some brain-dead clients when printing, and I don't want to
1020 force write permissions on print services.
1021 */
1022 #define AS_USER (1<<0)
1023 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1024 #define TIME_INIT (1<<2)
1025 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1026 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1027 #define DO_CHDIR (1<<6)
1028
1029 /*
1030    define a list of possible SMB messages and their corresponding
1031    functions. Any message that has a NULL function is unimplemented -
1032    please feel free to contribute implementations!
1033 */
1034 static const struct smb_message_struct {
1035         const char *name;
1036         void (*fn)(struct smb_request *req);
1037         int flags;
1038 } smb_messages[256] = {
1039
1040 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1041 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1042 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1043 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1044 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1045 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1046 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1047 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1048 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1049 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1050 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1051 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1052 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1053 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1054 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1055 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1056 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1057 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1058 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1059 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1060 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1061 /* 0x15 */ { NULL, NULL, 0 },
1062 /* 0x16 */ { NULL, NULL, 0 },
1063 /* 0x17 */ { NULL, NULL, 0 },
1064 /* 0x18 */ { NULL, NULL, 0 },
1065 /* 0x19 */ { NULL, NULL, 0 },
1066 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1067 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1068 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1069 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1070 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1071 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1072 /* 0x20 */ { "SMBwritec", NULL,0},
1073 /* 0x21 */ { NULL, NULL, 0 },
1074 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1075 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1076 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1077 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1078 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1079 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1080 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1081 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1082 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1083 /* 0x2b */ { "SMBecho",reply_echo,0},
1084 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1085 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1086 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1087 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1088 /* 0x30 */ { NULL, NULL, 0 },
1089 /* 0x31 */ { NULL, NULL, 0 },
1090 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1091 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1092 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1093 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1094 /* 0x36 */ { NULL, NULL, 0 },
1095 /* 0x37 */ { NULL, NULL, 0 },
1096 /* 0x38 */ { NULL, NULL, 0 },
1097 /* 0x39 */ { NULL, NULL, 0 },
1098 /* 0x3a */ { NULL, NULL, 0 },
1099 /* 0x3b */ { NULL, NULL, 0 },
1100 /* 0x3c */ { NULL, NULL, 0 },
1101 /* 0x3d */ { NULL, NULL, 0 },
1102 /* 0x3e */ { NULL, NULL, 0 },
1103 /* 0x3f */ { NULL, NULL, 0 },
1104 /* 0x40 */ { NULL, NULL, 0 },
1105 /* 0x41 */ { NULL, NULL, 0 },
1106 /* 0x42 */ { NULL, NULL, 0 },
1107 /* 0x43 */ { NULL, NULL, 0 },
1108 /* 0x44 */ { NULL, NULL, 0 },
1109 /* 0x45 */ { NULL, NULL, 0 },
1110 /* 0x46 */ { NULL, NULL, 0 },
1111 /* 0x47 */ { NULL, NULL, 0 },
1112 /* 0x48 */ { NULL, NULL, 0 },
1113 /* 0x49 */ { NULL, NULL, 0 },
1114 /* 0x4a */ { NULL, NULL, 0 },
1115 /* 0x4b */ { NULL, NULL, 0 },
1116 /* 0x4c */ { NULL, NULL, 0 },
1117 /* 0x4d */ { NULL, NULL, 0 },
1118 /* 0x4e */ { NULL, NULL, 0 },
1119 /* 0x4f */ { NULL, NULL, 0 },
1120 /* 0x50 */ { NULL, NULL, 0 },
1121 /* 0x51 */ { NULL, NULL, 0 },
1122 /* 0x52 */ { NULL, NULL, 0 },
1123 /* 0x53 */ { NULL, NULL, 0 },
1124 /* 0x54 */ { NULL, NULL, 0 },
1125 /* 0x55 */ { NULL, NULL, 0 },
1126 /* 0x56 */ { NULL, NULL, 0 },
1127 /* 0x57 */ { NULL, NULL, 0 },
1128 /* 0x58 */ { NULL, NULL, 0 },
1129 /* 0x59 */ { NULL, NULL, 0 },
1130 /* 0x5a */ { NULL, NULL, 0 },
1131 /* 0x5b */ { NULL, NULL, 0 },
1132 /* 0x5c */ { NULL, NULL, 0 },
1133 /* 0x5d */ { NULL, NULL, 0 },
1134 /* 0x5e */ { NULL, NULL, 0 },
1135 /* 0x5f */ { NULL, NULL, 0 },
1136 /* 0x60 */ { NULL, NULL, 0 },
1137 /* 0x61 */ { NULL, NULL, 0 },
1138 /* 0x62 */ { NULL, NULL, 0 },
1139 /* 0x63 */ { NULL, NULL, 0 },
1140 /* 0x64 */ { NULL, NULL, 0 },
1141 /* 0x65 */ { NULL, NULL, 0 },
1142 /* 0x66 */ { NULL, NULL, 0 },
1143 /* 0x67 */ { NULL, NULL, 0 },
1144 /* 0x68 */ { NULL, NULL, 0 },
1145 /* 0x69 */ { NULL, NULL, 0 },
1146 /* 0x6a */ { NULL, NULL, 0 },
1147 /* 0x6b */ { NULL, NULL, 0 },
1148 /* 0x6c */ { NULL, NULL, 0 },
1149 /* 0x6d */ { NULL, NULL, 0 },
1150 /* 0x6e */ { NULL, NULL, 0 },
1151 /* 0x6f */ { NULL, NULL, 0 },
1152 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1153 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1154 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1155 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1156 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1157 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1158 /* 0x76 */ { NULL, NULL, 0 },
1159 /* 0x77 */ { NULL, NULL, 0 },
1160 /* 0x78 */ { NULL, NULL, 0 },
1161 /* 0x79 */ { NULL, NULL, 0 },
1162 /* 0x7a */ { NULL, NULL, 0 },
1163 /* 0x7b */ { NULL, NULL, 0 },
1164 /* 0x7c */ { NULL, NULL, 0 },
1165 /* 0x7d */ { NULL, NULL, 0 },
1166 /* 0x7e */ { NULL, NULL, 0 },
1167 /* 0x7f */ { NULL, NULL, 0 },
1168 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1169 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1170 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1171 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1172 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1173 /* 0x85 */ { NULL, NULL, 0 },
1174 /* 0x86 */ { NULL, NULL, 0 },
1175 /* 0x87 */ { NULL, NULL, 0 },
1176 /* 0x88 */ { NULL, NULL, 0 },
1177 /* 0x89 */ { NULL, NULL, 0 },
1178 /* 0x8a */ { NULL, NULL, 0 },
1179 /* 0x8b */ { NULL, NULL, 0 },
1180 /* 0x8c */ { NULL, NULL, 0 },
1181 /* 0x8d */ { NULL, NULL, 0 },
1182 /* 0x8e */ { NULL, NULL, 0 },
1183 /* 0x8f */ { NULL, NULL, 0 },
1184 /* 0x90 */ { NULL, NULL, 0 },
1185 /* 0x91 */ { NULL, NULL, 0 },
1186 /* 0x92 */ { NULL, NULL, 0 },
1187 /* 0x93 */ { NULL, NULL, 0 },
1188 /* 0x94 */ { NULL, NULL, 0 },
1189 /* 0x95 */ { NULL, NULL, 0 },
1190 /* 0x96 */ { NULL, NULL, 0 },
1191 /* 0x97 */ { NULL, NULL, 0 },
1192 /* 0x98 */ { NULL, NULL, 0 },
1193 /* 0x99 */ { NULL, NULL, 0 },
1194 /* 0x9a */ { NULL, NULL, 0 },
1195 /* 0x9b */ { NULL, NULL, 0 },
1196 /* 0x9c */ { NULL, NULL, 0 },
1197 /* 0x9d */ { NULL, NULL, 0 },
1198 /* 0x9e */ { NULL, NULL, 0 },
1199 /* 0x9f */ { NULL, NULL, 0 },
1200 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1201 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1202 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1203 /* 0xa3 */ { NULL, NULL, 0 },
1204 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1205 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1206 /* 0xa6 */ { NULL, NULL, 0 },
1207 /* 0xa7 */ { NULL, NULL, 0 },
1208 /* 0xa8 */ { NULL, NULL, 0 },
1209 /* 0xa9 */ { NULL, NULL, 0 },
1210 /* 0xaa */ { NULL, NULL, 0 },
1211 /* 0xab */ { NULL, NULL, 0 },
1212 /* 0xac */ { NULL, NULL, 0 },
1213 /* 0xad */ { NULL, NULL, 0 },
1214 /* 0xae */ { NULL, NULL, 0 },
1215 /* 0xaf */ { NULL, NULL, 0 },
1216 /* 0xb0 */ { NULL, NULL, 0 },
1217 /* 0xb1 */ { NULL, NULL, 0 },
1218 /* 0xb2 */ { NULL, NULL, 0 },
1219 /* 0xb3 */ { NULL, NULL, 0 },
1220 /* 0xb4 */ { NULL, NULL, 0 },
1221 /* 0xb5 */ { NULL, NULL, 0 },
1222 /* 0xb6 */ { NULL, NULL, 0 },
1223 /* 0xb7 */ { NULL, NULL, 0 },
1224 /* 0xb8 */ { NULL, NULL, 0 },
1225 /* 0xb9 */ { NULL, NULL, 0 },
1226 /* 0xba */ { NULL, NULL, 0 },
1227 /* 0xbb */ { NULL, NULL, 0 },
1228 /* 0xbc */ { NULL, NULL, 0 },
1229 /* 0xbd */ { NULL, NULL, 0 },
1230 /* 0xbe */ { NULL, NULL, 0 },
1231 /* 0xbf */ { NULL, NULL, 0 },
1232 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1233 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1234 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1235 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1236 /* 0xc4 */ { NULL, NULL, 0 },
1237 /* 0xc5 */ { NULL, NULL, 0 },
1238 /* 0xc6 */ { NULL, NULL, 0 },
1239 /* 0xc7 */ { NULL, NULL, 0 },
1240 /* 0xc8 */ { NULL, NULL, 0 },
1241 /* 0xc9 */ { NULL, NULL, 0 },
1242 /* 0xca */ { NULL, NULL, 0 },
1243 /* 0xcb */ { NULL, NULL, 0 },
1244 /* 0xcc */ { NULL, NULL, 0 },
1245 /* 0xcd */ { NULL, NULL, 0 },
1246 /* 0xce */ { NULL, NULL, 0 },
1247 /* 0xcf */ { NULL, NULL, 0 },
1248 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1249 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1250 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1251 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1252 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1253 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1254 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1255 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1256 /* 0xd8 */ { NULL, NULL, 0 },
1257 /* 0xd9 */ { NULL, NULL, 0 },
1258 /* 0xda */ { NULL, NULL, 0 },
1259 /* 0xdb */ { NULL, NULL, 0 },
1260 /* 0xdc */ { NULL, NULL, 0 },
1261 /* 0xdd */ { NULL, NULL, 0 },
1262 /* 0xde */ { NULL, NULL, 0 },
1263 /* 0xdf */ { NULL, NULL, 0 },
1264 /* 0xe0 */ { NULL, NULL, 0 },
1265 /* 0xe1 */ { NULL, NULL, 0 },
1266 /* 0xe2 */ { NULL, NULL, 0 },
1267 /* 0xe3 */ { NULL, NULL, 0 },
1268 /* 0xe4 */ { NULL, NULL, 0 },
1269 /* 0xe5 */ { NULL, NULL, 0 },
1270 /* 0xe6 */ { NULL, NULL, 0 },
1271 /* 0xe7 */ { NULL, NULL, 0 },
1272 /* 0xe8 */ { NULL, NULL, 0 },
1273 /* 0xe9 */ { NULL, NULL, 0 },
1274 /* 0xea */ { NULL, NULL, 0 },
1275 /* 0xeb */ { NULL, NULL, 0 },
1276 /* 0xec */ { NULL, NULL, 0 },
1277 /* 0xed */ { NULL, NULL, 0 },
1278 /* 0xee */ { NULL, NULL, 0 },
1279 /* 0xef */ { NULL, NULL, 0 },
1280 /* 0xf0 */ { NULL, NULL, 0 },
1281 /* 0xf1 */ { NULL, NULL, 0 },
1282 /* 0xf2 */ { NULL, NULL, 0 },
1283 /* 0xf3 */ { NULL, NULL, 0 },
1284 /* 0xf4 */ { NULL, NULL, 0 },
1285 /* 0xf5 */ { NULL, NULL, 0 },
1286 /* 0xf6 */ { NULL, NULL, 0 },
1287 /* 0xf7 */ { NULL, NULL, 0 },
1288 /* 0xf8 */ { NULL, NULL, 0 },
1289 /* 0xf9 */ { NULL, NULL, 0 },
1290 /* 0xfa */ { NULL, NULL, 0 },
1291 /* 0xfb */ { NULL, NULL, 0 },
1292 /* 0xfc */ { NULL, NULL, 0 },
1293 /* 0xfd */ { NULL, NULL, 0 },
1294 /* 0xfe */ { NULL, NULL, 0 },
1295 /* 0xff */ { NULL, NULL, 0 }
1296
1297 };
1298
1299 /*******************************************************************
1300  allocate and initialize a reply packet
1301 ********************************************************************/
1302
1303 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1304                           const char *inbuf, char **outbuf, uint8_t num_words,
1305                           uint32_t num_bytes)
1306 {
1307         /*
1308          * Protect against integer wrap
1309          */
1310         if ((num_bytes > 0xffffff)
1311             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1312                 char *msg;
1313                 if (asprintf(&msg, "num_bytes too large: %u",
1314                              (unsigned)num_bytes) == -1) {
1315                         msg = CONST_DISCARD(char *, "num_bytes too large");
1316                 }
1317                 smb_panic(msg);
1318         }
1319
1320         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1321                                smb_size + num_words*2 + num_bytes);
1322         if (*outbuf == NULL) {
1323                 return false;
1324         }
1325
1326         construct_reply_common(req, inbuf, *outbuf);
1327         srv_set_message(*outbuf, num_words, num_bytes, false);
1328         /*
1329          * Zero out the word area, the caller has to take care of the bcc area
1330          * himself
1331          */
1332         if (num_words != 0) {
1333                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1334         }
1335
1336         return true;
1337 }
1338
1339 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1340 {
1341         char *outbuf;
1342         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1343                            num_bytes)) {
1344                 smb_panic("could not allocate output buffer\n");
1345         }
1346         req->outbuf = (uint8_t *)outbuf;
1347 }
1348
1349
1350 /*******************************************************************
1351  Dump a packet to a file.
1352 ********************************************************************/
1353
1354 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1355 {
1356         int fd, i;
1357         char *fname = NULL;
1358         if (DEBUGLEVEL < 50) {
1359                 return;
1360         }
1361
1362         if (len < 4) len = smb_len(data)+4;
1363         for (i=1;i<100;i++) {
1364                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1365                              type ? "req" : "resp") == -1) {
1366                         return;
1367                 }
1368                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1369                 if (fd != -1 || errno != EEXIST) break;
1370         }
1371         if (fd != -1) {
1372                 ssize_t ret = write(fd, data, len);
1373                 if (ret != len)
1374                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1375                 close(fd);
1376                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1377         }
1378         SAFE_FREE(fname);
1379 }
1380
1381 /****************************************************************************
1382  Prepare everything for calling the actual request function, and potentially
1383  call the request function via the "new" interface.
1384
1385  Return False if the "legacy" function needs to be called, everything is
1386  prepared.
1387
1388  Return True if we're done.
1389
1390  I know this API sucks, but it is the one with the least code change I could
1391  find.
1392 ****************************************************************************/
1393
1394 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1395 {
1396         int flags;
1397         uint16 session_tag;
1398         connection_struct *conn = NULL;
1399         struct smbd_server_connection *sconn = smbd_server_conn;
1400
1401         errno = 0;
1402
1403         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1404          * so subtract 4 from it. */
1405         if (!valid_smb_header(req->inbuf)
1406             || (size < (smb_size - 4))) {
1407                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1408                          smb_len(req->inbuf)));
1409                 exit_server_cleanly("Non-SMB packet");
1410         }
1411
1412         if (smb_messages[type].fn == NULL) {
1413                 DEBUG(0,("Unknown message type %d!\n",type));
1414                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1415                 reply_unknown_new(req, type);
1416                 return NULL;
1417         }
1418
1419         flags = smb_messages[type].flags;
1420
1421         /* In share mode security we must ignore the vuid. */
1422         session_tag = (lp_security() == SEC_SHARE)
1423                 ? UID_FIELD_INVALID : req->vuid;
1424         conn = req->conn;
1425
1426         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1427                  (int)sys_getpid(), (unsigned long)conn));
1428
1429         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1430
1431         /* Ensure this value is replaced in the incoming packet. */
1432         SSVAL(req->inbuf,smb_uid,session_tag);
1433
1434         /*
1435          * Ensure the correct username is in current_user_info.  This is a
1436          * really ugly bugfix for problems with multiple session_setup_and_X's
1437          * being done and allowing %U and %G substitutions to work correctly.
1438          * There is a reason this code is done here, don't move it unless you
1439          * know what you're doing... :-).
1440          * JRA.
1441          */
1442
1443         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1444                 user_struct *vuser = NULL;
1445
1446                 sconn->smb1.sessions.last_session_tag = session_tag;
1447                 if(session_tag != UID_FIELD_INVALID) {
1448                         vuser = get_valid_user_struct(sconn, session_tag);
1449                         if (vuser) {
1450                                 set_current_user_info(
1451                                         vuser->server_info->sanitized_username,
1452                                         vuser->server_info->unix_name,
1453                                         pdb_get_domain(vuser->server_info
1454                                                        ->sam_account));
1455                         }
1456                 }
1457         }
1458
1459         /* Does this call need to be run as the connected user? */
1460         if (flags & AS_USER) {
1461
1462                 /* Does this call need a valid tree connection? */
1463                 if (!conn) {
1464                         /*
1465                          * Amazingly, the error code depends on the command
1466                          * (from Samba4).
1467                          */
1468                         if (type == SMBntcreateX) {
1469                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1470                         } else {
1471                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1472                         }
1473                         return NULL;
1474                 }
1475
1476                 if (!change_to_user(conn,session_tag)) {
1477                         DEBUG(0, ("Error: Could not change to user. Removing "
1478                                 "deferred open, mid=%llu.\n",
1479                                 (unsigned long long)req->mid));
1480                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1481                         return conn;
1482                 }
1483
1484                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1485
1486                 /* Does it need write permission? */
1487                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1488                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1489                         return conn;
1490                 }
1491
1492                 /* IPC services are limited */
1493                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1494                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1495                         return conn;
1496                 }
1497         } else {
1498                 /* This call needs to be run as root */
1499                 change_to_root_user();
1500         }
1501
1502         /* load service specific parameters */
1503         if (conn) {
1504                 if (req->encrypted) {
1505                         conn->encrypted_tid = true;
1506                         /* encrypted required from now on. */
1507                         conn->encrypt_level = Required;
1508                 } else if (ENCRYPTION_REQUIRED(conn)) {
1509                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1510                                 exit_server_cleanly("encryption required "
1511                                         "on connection");
1512                                 return conn;
1513                         }
1514                 }
1515
1516                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1517                                          (flags & (AS_USER|DO_CHDIR)
1518                                           ?True:False))) {
1519                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1520                         return conn;
1521                 }
1522                 conn->num_smb_operations++;
1523         }
1524
1525         /* does this protocol need to be run as guest? */
1526         if ((flags & AS_GUEST)
1527             && (!change_to_guest() ||
1528                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1529                               lp_hostsdeny(-1)))) {
1530                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1531                 return conn;
1532         }
1533
1534         smb_messages[type].fn(req);
1535         return req->conn;
1536 }
1537
1538 /****************************************************************************
1539  Construct a reply to the incoming packet.
1540 ****************************************************************************/
1541
1542 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1543                             uint32_t seqnum, bool encrypted,
1544                             struct smb_perfcount_data *deferred_pcd)
1545 {
1546         connection_struct *conn;
1547         struct smb_request *req;
1548
1549         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1550                 smb_panic("could not allocate smb_request");
1551         }
1552
1553         if (!init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted,
1554                               seqnum)) {
1555                 exit_server_cleanly("Invalid SMB request");
1556         }
1557
1558         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1559
1560         /* we popped this message off the queue - keep original perf data */
1561         if (deferred_pcd)
1562                 req->pcd = *deferred_pcd;
1563         else {
1564                 SMB_PERFCOUNT_START(&req->pcd);
1565                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1566                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1567         }
1568
1569         conn = switch_message(req->cmd, req, size);
1570
1571         if (req->unread_bytes) {
1572                 /* writeX failed. drain socket. */
1573                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1574                                 req->unread_bytes) {
1575                         smb_panic("failed to drain pending bytes");
1576                 }
1577                 req->unread_bytes = 0;
1578         }
1579
1580         if (req->done) {
1581                 TALLOC_FREE(req);
1582                 return;
1583         }
1584
1585         if (req->outbuf == NULL) {
1586                 return;
1587         }
1588
1589         if (CVAL(req->outbuf,0) == 0) {
1590                 show_msg((char *)req->outbuf);
1591         }
1592
1593         if (!srv_send_smb(smbd_server_fd(),
1594                         (char *)req->outbuf,
1595                         true, req->seqnum+1,
1596                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1597                         &req->pcd)) {
1598                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1599         }
1600
1601         TALLOC_FREE(req);
1602
1603         return;
1604 }
1605
1606 /****************************************************************************
1607  Process an smb from the client
1608 ****************************************************************************/
1609 static void process_smb(struct smbd_server_connection *conn,
1610                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1611                         uint32_t seqnum, bool encrypted,
1612                         struct smb_perfcount_data *deferred_pcd)
1613 {
1614         int msg_type = CVAL(inbuf,0);
1615
1616         DO_PROFILE_INC(smb_count);
1617
1618         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1619                     smb_len(inbuf) ) );
1620         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1621                                 (int)nread,
1622                                 (unsigned int)unread_bytes ));
1623
1624         if (msg_type != 0) {
1625                 /*
1626                  * NetBIOS session request, keepalive, etc.
1627                  */
1628                 reply_special((char *)inbuf);
1629                 goto done;
1630         }
1631
1632         if (smbd_server_conn->allow_smb2) {
1633                 if (smbd_is_smb2_header(inbuf, nread)) {
1634                         smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1635                         return;
1636                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1637                                 && CVAL(inbuf, smb_com) != 0x72) {
1638                         /* This is a non-negprot SMB1 packet.
1639                            Disable SMB2 from now on. */
1640                         smbd_server_conn->allow_smb2 = false;
1641                 }
1642         }
1643
1644         show_msg((char *)inbuf);
1645
1646         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1647         trans_num++;
1648
1649 done:
1650         conn->smb1.num_requests++;
1651
1652         /* The timeout_processing function isn't run nearly
1653            often enough to implement 'max log size' without
1654            overrunning the size of the file by many megabytes.
1655            This is especially true if we are running at debug
1656            level 10.  Checking every 50 SMBs is a nice
1657            tradeoff of performance vs log file size overrun. */
1658
1659         if ((conn->smb1.num_requests % 50) == 0 &&
1660             need_to_check_log_size()) {
1661                 change_to_root_user();
1662                 check_log_size();
1663         }
1664 }
1665
1666 /****************************************************************************
1667  Return a string containing the function name of a SMB command.
1668 ****************************************************************************/
1669
1670 const char *smb_fn_name(int type)
1671 {
1672         const char *unknown_name = "SMBunknown";
1673
1674         if (smb_messages[type].name == NULL)
1675                 return(unknown_name);
1676
1677         return(smb_messages[type].name);
1678 }
1679
1680 /****************************************************************************
1681  Helper functions for contruct_reply.
1682 ****************************************************************************/
1683
1684 void add_to_common_flags2(uint32 v)
1685 {
1686         common_flags2 |= v;
1687 }
1688
1689 void remove_from_common_flags2(uint32 v)
1690 {
1691         common_flags2 &= ~v;
1692 }
1693
1694 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1695                                    char *outbuf)
1696 {
1697         srv_set_message(outbuf,0,0,false);
1698
1699         SCVAL(outbuf, smb_com, req->cmd);
1700         SIVAL(outbuf,smb_rcls,0);
1701         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1702         SSVAL(outbuf,smb_flg2,
1703                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1704                 common_flags2);
1705         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1706
1707         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1708         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1709         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1710         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1711 }
1712
1713 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1714 {
1715         construct_reply_common(req, (char *)req->inbuf, outbuf);
1716 }
1717
1718 /*
1719  * How many bytes have we already accumulated up to the current wct field
1720  * offset?
1721  */
1722
1723 size_t req_wct_ofs(struct smb_request *req)
1724 {
1725         size_t buf_size;
1726
1727         if (req->chain_outbuf == NULL) {
1728                 return smb_wct - 4;
1729         }
1730         buf_size = talloc_get_size(req->chain_outbuf);
1731         if ((buf_size % 4) != 0) {
1732                 buf_size += (4 - (buf_size % 4));
1733         }
1734         return buf_size - 4;
1735 }
1736
1737 /*
1738  * Hack around reply_nterror & friends not being aware of chained requests,
1739  * generating illegal (i.e. wct==0) chain replies.
1740  */
1741
1742 static void fixup_chain_error_packet(struct smb_request *req)
1743 {
1744         uint8_t *outbuf = req->outbuf;
1745         req->outbuf = NULL;
1746         reply_outbuf(req, 2, 0);
1747         memcpy(req->outbuf, outbuf, smb_wct);
1748         TALLOC_FREE(outbuf);
1749         SCVAL(req->outbuf, smb_vwv0, 0xff);
1750 }
1751
1752 /**
1753  * @brief Find the smb_cmd offset of the last command pushed
1754  * @param[in] buf       The buffer we're building up
1755  * @retval              Where can we put our next andx cmd?
1756  *
1757  * While chaining requests, the "next" request we're looking at needs to put
1758  * its SMB_Command before the data the previous request already built up added
1759  * to the chain. Find the offset to the place where we have to put our cmd.
1760  */
1761
1762 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1763 {
1764         uint8_t cmd;
1765         size_t ofs;
1766
1767         cmd = CVAL(buf, smb_com);
1768
1769         SMB_ASSERT(is_andx_req(cmd));
1770
1771         ofs = smb_vwv0;
1772
1773         while (CVAL(buf, ofs) != 0xff) {
1774
1775                 if (!is_andx_req(CVAL(buf, ofs))) {
1776                         return false;
1777                 }
1778
1779                 /*
1780                  * ofs is from start of smb header, so add the 4 length
1781                  * bytes. The next cmd is right after the wct field.
1782                  */
1783                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1784
1785                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1786         }
1787
1788         *pofs = ofs;
1789         return true;
1790 }
1791
1792 /**
1793  * @brief Do the smb chaining at a buffer level
1794  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1795  * @param[in] smb_command       The command that we want to issue
1796  * @param[in] wct               How many words?
1797  * @param[in] vwv               The words, already in network order
1798  * @param[in] bytes_alignment   How shall we align "bytes"?
1799  * @param[in] num_bytes         How many bytes?
1800  * @param[in] bytes             The data the request ships
1801  *
1802  * smb_splice_chain() adds the vwv and bytes to the request already present in
1803  * *poutbuf.
1804  */
1805
1806 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1807                              uint8_t wct, const uint16_t *vwv,
1808                              size_t bytes_alignment,
1809                              uint32_t num_bytes, const uint8_t *bytes)
1810 {
1811         uint8_t *outbuf;
1812         size_t old_size, new_size;
1813         size_t ofs;
1814         size_t chain_padding = 0;
1815         size_t bytes_padding = 0;
1816         bool first_request;
1817
1818         old_size = talloc_get_size(*poutbuf);
1819
1820         /*
1821          * old_size == smb_wct means we're pushing the first request in for
1822          * libsmb/
1823          */
1824
1825         first_request = (old_size == smb_wct);
1826
1827         if (!first_request && ((old_size % 4) != 0)) {
1828                 /*
1829                  * Align the wct field of subsequent requests to a 4-byte
1830                  * boundary
1831                  */
1832                 chain_padding = 4 - (old_size % 4);
1833         }
1834
1835         /*
1836          * After the old request comes the new wct field (1 byte), the vwv's
1837          * and the num_bytes field. After at we might need to align the bytes
1838          * given to us to "bytes_alignment", increasing the num_bytes value.
1839          */
1840
1841         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1842
1843         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1844                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1845         }
1846
1847         new_size += bytes_padding + num_bytes;
1848
1849         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1850                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1851                           (unsigned)new_size));
1852                 return false;
1853         }
1854
1855         outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1856         if (outbuf == NULL) {
1857                 DEBUG(0, ("talloc failed\n"));
1858                 return false;
1859         }
1860         *poutbuf = outbuf;
1861
1862         if (first_request) {
1863                 SCVAL(outbuf, smb_com, smb_command);
1864         } else {
1865                 size_t andx_cmd_ofs;
1866
1867                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1868                         DEBUG(1, ("invalid command chain\n"));
1869                         *poutbuf = TALLOC_REALLOC_ARRAY(
1870                                 NULL, *poutbuf, uint8_t, old_size);
1871                         return false;
1872                 }
1873
1874                 if (chain_padding != 0) {
1875                         memset(outbuf + old_size, 0, chain_padding);
1876                         old_size += chain_padding;
1877                 }
1878
1879                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1880                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1881         }
1882
1883         ofs = old_size;
1884
1885         /*
1886          * Push the chained request:
1887          *
1888          * wct field
1889          */
1890
1891         SCVAL(outbuf, ofs, wct);
1892         ofs += 1;
1893
1894         /*
1895          * vwv array
1896          */
1897
1898         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1899         ofs += sizeof(uint16_t) * wct;
1900
1901         /*
1902          * bcc (byte count)
1903          */
1904
1905         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1906         ofs += sizeof(uint16_t);
1907
1908         /*
1909          * padding
1910          */
1911
1912         if (bytes_padding != 0) {
1913                 memset(outbuf + ofs, 0, bytes_padding);
1914                 ofs += bytes_padding;
1915         }
1916
1917         /*
1918          * The bytes field
1919          */
1920
1921         memcpy(outbuf + ofs, bytes, num_bytes);
1922
1923         return true;
1924 }
1925
1926 /****************************************************************************
1927  Construct a chained reply and add it to the already made reply
1928 ****************************************************************************/
1929
1930 void chain_reply(struct smb_request *req)
1931 {
1932         size_t smblen = smb_len(req->inbuf);
1933         size_t already_used, length_needed;
1934         uint8_t chain_cmd;
1935         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1936
1937         uint8_t wct;
1938         uint16_t *vwv;
1939         uint16_t buflen;
1940         uint8_t *buf;
1941
1942         if (IVAL(req->outbuf, smb_rcls) != 0) {
1943                 fixup_chain_error_packet(req);
1944         }
1945
1946         /*
1947          * Any of the AndX requests and replies have at least a wct of
1948          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1949          * beginning of the SMB header to the next wct field.
1950          *
1951          * None of the AndX requests put anything valuable in vwv[0] and [1],
1952          * so we can overwrite it here to form the chain.
1953          */
1954
1955         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1956                 if (req->chain_outbuf == NULL) {
1957                         req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1958                                 req, req->outbuf, uint8_t,
1959                                 smb_len(req->outbuf) + 4);
1960                         if (req->chain_outbuf == NULL) {
1961                                 smb_panic("talloc failed");
1962                         }
1963                 }
1964                 req->outbuf = NULL;
1965                 goto error;
1966         }
1967
1968         /*
1969          * Here we assume that this is the end of the chain. For that we need
1970          * to set "next command" to 0xff and the offset to 0. If we later find
1971          * more commands in the chain, this will be overwritten again.
1972          */
1973
1974         SCVAL(req->outbuf, smb_vwv0, 0xff);
1975         SCVAL(req->outbuf, smb_vwv0+1, 0);
1976         SSVAL(req->outbuf, smb_vwv1, 0);
1977
1978         if (req->chain_outbuf == NULL) {
1979                 /*
1980                  * In req->chain_outbuf we collect all the replies. Start the
1981                  * chain by copying in the first reply.
1982                  *
1983                  * We do the realloc because later on we depend on
1984                  * talloc_get_size to determine the length of
1985                  * chain_outbuf. The reply_xxx routines might have
1986                  * over-allocated (reply_pipe_read_and_X used to be such an
1987                  * example).
1988                  */
1989                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1990                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1991                 if (req->chain_outbuf == NULL) {
1992                         smb_panic("talloc failed");
1993                 }
1994                 req->outbuf = NULL;
1995         } else {
1996                 /*
1997                  * Update smb headers where subsequent chained commands
1998                  * may have updated them.
1999                  */
2000                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
2001                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
2002
2003                 if (!smb_splice_chain(&req->chain_outbuf,
2004                                       CVAL(req->outbuf, smb_com),
2005                                       CVAL(req->outbuf, smb_wct),
2006                                       (uint16_t *)(req->outbuf + smb_vwv),
2007                                       0, smb_buflen(req->outbuf),
2008                                       (uint8_t *)smb_buf(req->outbuf))) {
2009                         goto error;
2010                 }
2011                 TALLOC_FREE(req->outbuf);
2012         }
2013
2014         /*
2015          * We use the old request's vwv field to grab the next chained command
2016          * and offset into the chained fields.
2017          */
2018
2019         chain_cmd = CVAL(req->vwv+0, 0);
2020         chain_offset = SVAL(req->vwv+1, 0);
2021
2022         if (chain_cmd == 0xff) {
2023                 /*
2024                  * End of chain, no more requests from the client. So ship the
2025                  * replies.
2026                  */
2027                 smb_setlen((char *)(req->chain_outbuf),
2028                            talloc_get_size(req->chain_outbuf) - 4);
2029
2030                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2031                                   true, req->seqnum+1,
2032                                   IS_CONN_ENCRYPTED(req->conn)
2033                                   ||req->encrypted,
2034                                   &req->pcd)) {
2035                         exit_server_cleanly("chain_reply: srv_send_smb "
2036                                             "failed.");
2037                 }
2038                 TALLOC_FREE(req->chain_outbuf);
2039                 req->done = true;
2040                 return;
2041         }
2042
2043         /* add a new perfcounter for this element of chain */
2044         SMB_PERFCOUNT_ADD(&req->pcd);
2045         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2046         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2047
2048         /*
2049          * Check if the client tries to fool us. The request so far uses the
2050          * space to the end of the byte buffer in the request just
2051          * processed. The chain_offset can't point into that area. If that was
2052          * the case, we could end up with an endless processing of the chain,
2053          * we would always handle the same request.
2054          */
2055
2056         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2057         if (chain_offset < already_used) {
2058                 goto error;
2059         }
2060
2061         /*
2062          * Next check: Make sure the chain offset does not point beyond the
2063          * overall smb request length.
2064          */
2065
2066         length_needed = chain_offset+1; /* wct */
2067         if (length_needed > smblen) {
2068                 goto error;
2069         }
2070
2071         /*
2072          * Now comes the pointer magic. Goal here is to set up req->vwv and
2073          * req->buf correctly again to be able to call the subsequent
2074          * switch_message(). The chain offset (the former vwv[1]) points at
2075          * the new wct field.
2076          */
2077
2078         wct = CVAL(smb_base(req->inbuf), chain_offset);
2079
2080         /*
2081          * Next consistency check: Make the new vwv array fits in the overall
2082          * smb request.
2083          */
2084
2085         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2086         if (length_needed > smblen) {
2087                 goto error;
2088         }
2089         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2090
2091         /*
2092          * Now grab the new byte buffer....
2093          */
2094
2095         buflen = SVAL(vwv+wct, 0);
2096
2097         /*
2098          * .. and check that it fits.
2099          */
2100
2101         length_needed += buflen;
2102         if (length_needed > smblen) {
2103                 goto error;
2104         }
2105         buf = (uint8_t *)(vwv+wct+1);
2106
2107         req->cmd = chain_cmd;
2108         req->wct = wct;
2109         req->vwv = vwv;
2110         req->buflen = buflen;
2111         req->buf = buf;
2112
2113         switch_message(chain_cmd, req, smblen);
2114
2115         if (req->outbuf == NULL) {
2116                 /*
2117                  * This happens if the chained command has suspended itself or
2118                  * if it has called srv_send_smb() itself.
2119                  */
2120                 return;
2121         }
2122
2123         /*
2124          * We end up here if the chained command was not itself chained or
2125          * suspended, but for example a close() command. We now need to splice
2126          * the chained commands' outbuf into the already built up chain_outbuf
2127          * and ship the result.
2128          */
2129         goto done;
2130
2131  error:
2132         /*
2133          * We end up here if there's any error in the chain syntax. Report a
2134          * DOS error, just like Windows does.
2135          */
2136         reply_force_doserror(req, ERRSRV, ERRerror);
2137         fixup_chain_error_packet(req);
2138
2139  done:
2140         /*
2141          * This scary statement intends to set the
2142          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2143          * to the value req->outbuf carries
2144          */
2145         SSVAL(req->chain_outbuf, smb_flg2,
2146               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2147               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2148
2149         /*
2150          * Transfer the error codes from the subrequest to the main one
2151          */
2152         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2153         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2154
2155         if (!smb_splice_chain(&req->chain_outbuf,
2156                               CVAL(req->outbuf, smb_com),
2157                               CVAL(req->outbuf, smb_wct),
2158                               (uint16_t *)(req->outbuf + smb_vwv),
2159                               0, smb_buflen(req->outbuf),
2160                               (uint8_t *)smb_buf(req->outbuf))) {
2161                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2162         }
2163         TALLOC_FREE(req->outbuf);
2164
2165         smb_setlen((char *)(req->chain_outbuf),
2166                    talloc_get_size(req->chain_outbuf) - 4);
2167
2168         show_msg((char *)(req->chain_outbuf));
2169
2170         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2171                           true, req->seqnum+1,
2172                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2173                           &req->pcd)) {
2174                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2175         }
2176         TALLOC_FREE(req->chain_outbuf);
2177         req->done = true;
2178 }
2179
2180 /****************************************************************************
2181  Check if services need reloading.
2182 ****************************************************************************/
2183
2184 void check_reload(time_t t)
2185 {
2186         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2187
2188         if(last_smb_conf_reload_time == 0) {
2189                 last_smb_conf_reload_time = t;
2190                 /* Our printing subsystem might not be ready at smbd start up.
2191                    Then no printer is available till the first printers check
2192                    is performed.  A lower initial interval circumvents this. */
2193                 if ( printcap_cache_time > 60 )
2194                         last_printer_reload_time = t - printcap_cache_time + 60;
2195                 else
2196                         last_printer_reload_time = t;
2197         }
2198
2199         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2200                 /* randomize over 60 second the printcap reload to avoid all
2201                  * process hitting cupsd at the same time */
2202                 int time_range = 60;
2203
2204                 last_printer_reload_time += random() % time_range;
2205                 mypid = getpid();
2206         }
2207
2208         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2209                 reload_services(True);
2210                 last_smb_conf_reload_time = t;
2211         }
2212
2213         /* 'printcap cache time = 0' disable the feature */
2214
2215         if ( printcap_cache_time != 0 )
2216         {
2217                 /* see if it's time to reload or if the clock has been set back */
2218
2219                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2220                         || (t-last_printer_reload_time  < 0) )
2221                 {
2222                         DEBUG( 3,( "Printcap cache time expired.\n"));
2223                         reload_printers();
2224                         last_printer_reload_time = t;
2225                 }
2226         }
2227 }
2228
2229 static bool fd_is_readable(int fd)
2230 {
2231         fd_set fds;
2232         struct timeval timeout = {0, };
2233         int ret;
2234
2235         FD_ZERO(&fds);
2236         FD_SET(fd, &fds);
2237
2238         ret = sys_select(fd+1, &fds, NULL, NULL, &timeout);
2239         if (ret == -1) {
2240                 return false;
2241         }
2242         return FD_ISSET(fd, &fds);
2243 }
2244
2245 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2246 {
2247         /* TODO: make write nonblocking */
2248 }
2249
2250 static void smbd_server_connection_read_handler(
2251         struct smbd_server_connection *conn, int fd)
2252 {
2253         uint8_t *inbuf = NULL;
2254         size_t inbuf_len = 0;
2255         size_t unread_bytes = 0;
2256         bool encrypted = false;
2257         TALLOC_CTX *mem_ctx = talloc_tos();
2258         NTSTATUS status;
2259         uint32_t seqnum;
2260
2261         bool from_client = (smbd_server_fd() == fd)?true:false;
2262
2263         if (from_client) {
2264                 smbd_lock_socket(conn);
2265
2266                 if (!fd_is_readable(smbd_server_fd())) {
2267                         DEBUG(10,("the echo listener was faster\n"));
2268                         smbd_unlock_socket(conn);
2269                         return;
2270                 }
2271
2272                 /* TODO: make this completely nonblocking */
2273                 status = receive_smb_talloc(mem_ctx, fd,
2274                                             (char **)(void *)&inbuf,
2275                                             0, /* timeout */
2276                                             &unread_bytes,
2277                                             &encrypted,
2278                                             &inbuf_len, &seqnum,
2279                                             false /* trusted channel */);
2280                 smbd_unlock_socket(conn);
2281         } else {
2282                 /* TODO: make this completely nonblocking */
2283                 status = receive_smb_talloc(mem_ctx, fd,
2284                                             (char **)(void *)&inbuf,
2285                                             0, /* timeout */
2286                                             &unread_bytes,
2287                                             &encrypted,
2288                                             &inbuf_len, &seqnum,
2289                                             true /* trusted channel */);
2290         }
2291
2292         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2293                 goto process;
2294         }
2295         if (NT_STATUS_IS_ERR(status)) {
2296                 exit_server_cleanly("failed to receive smb request");
2297         }
2298         if (!NT_STATUS_IS_OK(status)) {
2299                 return;
2300         }
2301
2302 process:
2303         process_smb(conn, inbuf, inbuf_len, unread_bytes,
2304                     seqnum, encrypted, NULL);
2305 }
2306
2307 static void smbd_server_connection_handler(struct event_context *ev,
2308                                            struct fd_event *fde,
2309                                            uint16_t flags,
2310                                            void *private_data)
2311 {
2312         struct smbd_server_connection *conn = talloc_get_type(private_data,
2313                                               struct smbd_server_connection);
2314
2315         if (flags & EVENT_FD_WRITE) {
2316                 smbd_server_connection_write_handler(conn);
2317         } else if (flags & EVENT_FD_READ) {
2318                 smbd_server_connection_read_handler(conn, smbd_server_fd());
2319         }
2320 }
2321
2322 static void smbd_server_echo_handler(struct event_context *ev,
2323                                      struct fd_event *fde,
2324                                      uint16_t flags,
2325                                      void *private_data)
2326 {
2327         struct smbd_server_connection *conn = talloc_get_type(private_data,
2328                                               struct smbd_server_connection);
2329
2330         if (flags & EVENT_FD_WRITE) {
2331                 smbd_server_connection_write_handler(conn);
2332         } else if (flags & EVENT_FD_READ) {
2333                 smbd_server_connection_read_handler(
2334                         conn, conn->smb1.echo_handler.trusted_fd);
2335         }
2336 }
2337
2338 /****************************************************************************
2339 received when we should release a specific IP
2340 ****************************************************************************/
2341 static void release_ip(const char *ip, void *priv)
2342 {
2343         char addr[INET6_ADDRSTRLEN];
2344         char *p = addr;
2345
2346         client_socket_addr(get_client_fd(),addr,sizeof(addr));
2347
2348         if (strncmp("::ffff:", addr, 7) == 0) {
2349                 p = addr + 7;
2350         }
2351
2352         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2353                 /* we can't afford to do a clean exit - that involves
2354                    database writes, which would potentially mean we
2355                    are still running after the failover has finished -
2356                    we have to get rid of this process ID straight
2357                    away */
2358                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2359                         ip));
2360                 /* note we must exit with non-zero status so the unclean handler gets
2361                    called in the parent, so that the brl database is tickled */
2362                 _exit(1);
2363         }
2364 }
2365
2366 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2367                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2368 {
2369         release_ip((char *)data->data, NULL);
2370 }
2371
2372 #ifdef CLUSTER_SUPPORT
2373 static int client_get_tcp_info(struct sockaddr_storage *server,
2374                                struct sockaddr_storage *client)
2375 {
2376         socklen_t length;
2377         if (server_fd == -1) {
2378                 return -1;
2379         }
2380         length = sizeof(*server);
2381         if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
2382                 return -1;
2383         }
2384         length = sizeof(*client);
2385         if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
2386                 return -1;
2387         }
2388         return 0;
2389 }
2390 #endif
2391
2392 /*
2393  * Send keepalive packets to our client
2394  */
2395 static bool keepalive_fn(const struct timeval *now, void *private_data)
2396 {
2397         bool ret;
2398
2399         smbd_lock_socket(smbd_server_conn);
2400         ret = send_keepalive(smbd_server_fd());
2401         smbd_unlock_socket(smbd_server_conn);
2402
2403         if (!ret) {
2404                 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2405                 return False;
2406         }
2407         return True;
2408 }
2409
2410 /*
2411  * Do the recurring check if we're idle
2412  */
2413 static bool deadtime_fn(const struct timeval *now, void *private_data)
2414 {
2415         struct smbd_server_connection *sconn = smbd_server_conn;
2416
2417         if (sconn->allow_smb2) {
2418                 /* TODO: implement real idle check */
2419                 if (sconn->smb2.sessions.list) {
2420                         return true;
2421                 }
2422                 DEBUG( 2, ( "Closing idle SMB2 connection\n" ) );
2423                 messaging_send(smbd_messaging_context(), procid_self(),
2424                                MSG_SHUTDOWN, &data_blob_null);
2425                 return false;
2426         }
2427
2428         if ((conn_num_open(sconn) == 0)
2429             || (conn_idle_all(sconn, now->tv_sec))) {
2430                 DEBUG( 2, ( "Closing idle SMB1 connection\n" ) );
2431                 messaging_send(smbd_messaging_context(), procid_self(),
2432                                MSG_SHUTDOWN, &data_blob_null);
2433                 return False;
2434         }
2435
2436         return True;
2437 }
2438
2439 /*
2440  * Do the recurring log file and smb.conf reload checks.
2441  */
2442
2443 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2444 {
2445         change_to_root_user();
2446
2447         /* update printer queue caches if necessary */
2448         update_monitored_printq_cache();
2449
2450         /* check if we need to reload services */
2451         check_reload(time(NULL));
2452
2453         /* Change machine password if neccessary. */
2454         attempt_machine_password_change();
2455
2456         /*
2457          * Force a log file check.
2458          */
2459         force_check_log_size();
2460         check_log_size();
2461         return true;
2462 }
2463
2464 static int create_unlink_tmp(const char *dir)
2465 {
2466         char *fname;
2467         int fd;
2468
2469         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2470         if (fname == NULL) {
2471                 errno = ENOMEM;
2472                 return -1;
2473         }
2474         fd = mkstemp(fname);
2475         if (fd == -1) {
2476                 TALLOC_FREE(fname);
2477                 return -1;
2478         }
2479         if (unlink(fname) == -1) {
2480                 int sys_errno = errno;
2481                 close(fd);
2482                 TALLOC_FREE(fname);
2483                 errno = sys_errno;
2484                 return -1;
2485         }
2486         TALLOC_FREE(fname);
2487         return fd;
2488 }
2489
2490 struct smbd_echo_state {
2491         struct tevent_context *ev;
2492         struct iovec *pending;
2493         struct smbd_server_connection *sconn;
2494         int parent_pipe;
2495
2496         struct tevent_fd *parent_fde;
2497
2498         struct tevent_fd *read_fde;
2499         struct tevent_req *write_req;
2500 };
2501
2502 static void smbd_echo_writer_done(struct tevent_req *req);
2503
2504 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2505 {
2506         int num_pending;
2507
2508         if (state->write_req != NULL) {
2509                 return;
2510         }
2511
2512         num_pending = talloc_array_length(state->pending);
2513         if (num_pending == 0) {
2514                 return;
2515         }
2516
2517         state->write_req = writev_send(state, state->ev, NULL,
2518                                        state->parent_pipe, false,
2519                                        state->pending, num_pending);
2520         if (state->write_req == NULL) {
2521                 DEBUG(1, ("writev_send failed\n"));
2522                 exit(1);
2523         }
2524
2525         talloc_steal(state->write_req, state->pending);
2526         state->pending = NULL;
2527
2528         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2529                                 state);
2530 }
2531
2532 static void smbd_echo_writer_done(struct tevent_req *req)
2533 {
2534         struct smbd_echo_state *state = tevent_req_callback_data(
2535                 req, struct smbd_echo_state);
2536         ssize_t written;
2537         int err;
2538
2539         written = writev_recv(req, &err);
2540         TALLOC_FREE(req);
2541         state->write_req = NULL;
2542         if (written == -1) {
2543                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2544                 exit(1);
2545         }
2546         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2547         smbd_echo_activate_writer(state);
2548 }
2549
2550 static bool smbd_echo_reply(int fd,
2551                             uint8_t *inbuf, size_t inbuf_len,
2552                             uint32_t seqnum)
2553 {
2554         struct smb_request req;
2555         uint16_t num_replies;
2556         size_t out_len;
2557         char *outbuf;
2558         bool ok;
2559
2560         if (inbuf_len < smb_size) {
2561                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2562                 return false;
2563         }
2564         if (!valid_smb_header(inbuf)) {
2565                 DEBUG(10, ("Got invalid SMB header\n"));
2566                 return false;
2567         }
2568
2569         if (!init_smb_request(&req, inbuf, 0, false, seqnum)) {
2570                 return false;
2571         }
2572         req.inbuf = inbuf;
2573
2574         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2575                    smb_messages[req.cmd].name
2576                    ? smb_messages[req.cmd].name : "unknown"));
2577
2578         if (req.cmd != SMBecho) {
2579                 return false;
2580         }
2581         if (req.wct < 1) {
2582                 return false;
2583         }
2584
2585         num_replies = SVAL(req.vwv+0, 0);
2586         if (num_replies != 1) {
2587                 /* Not a Windows "Hey, you're still there?" request */
2588                 return false;
2589         }
2590
2591         if (!create_outbuf(talloc_tos(), &req, (char *)req.inbuf, &outbuf,
2592                            1, req.buflen)) {
2593                 DEBUG(10, ("create_outbuf failed\n"));
2594                 return false;
2595         }
2596         req.outbuf = (uint8_t *)outbuf;
2597
2598         SSVAL(req.outbuf, smb_vwv0, num_replies);
2599
2600         if (req.buflen > 0) {
2601                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2602         }
2603
2604         out_len = smb_len(req.outbuf) + 4;
2605
2606         ok = srv_send_smb(smbd_server_fd(),
2607                           (char *)outbuf,
2608                           true, seqnum+1,
2609                           false, &req.pcd);
2610         TALLOC_FREE(outbuf);
2611         if (!ok) {
2612                 exit(1);
2613         }
2614
2615         return true;
2616 }
2617
2618 static void smbd_echo_exit(struct tevent_context *ev,
2619                            struct tevent_fd *fde, uint16_t flags,
2620                            void *private_data)
2621 {
2622         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2623         exit(0);
2624 }
2625
2626 static void smbd_echo_reader(struct tevent_context *ev,
2627                              struct tevent_fd *fde, uint16_t flags,
2628                              void *private_data)
2629 {
2630         struct smbd_echo_state *state = talloc_get_type_abort(
2631                 private_data, struct smbd_echo_state);
2632         struct smbd_server_connection *sconn = state->sconn;
2633         size_t unread, num_pending;
2634         NTSTATUS status;
2635         struct iovec *tmp;
2636         uint32_t seqnum = 0;
2637         bool reply;
2638         bool ok;
2639         bool encrypted = false;
2640
2641         ok = smbd_lock_socket_internal(sconn);
2642         if (!ok) {
2643                 DEBUG(0, ("%s: failed to lock socket\n",
2644                         __location__));
2645                 exit(1);
2646         }
2647
2648         if (!fd_is_readable(smbd_server_fd())) {
2649                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2650                           (int)sys_getpid()));
2651                 ok = smbd_unlock_socket_internal(sconn);
2652                 if (!ok) {
2653                         DEBUG(1, ("%s: failed to unlock socket in\n",
2654                                 __location__));
2655                         exit(1);
2656                 }
2657                 return;
2658         }
2659
2660         num_pending = talloc_array_length(state->pending);
2661         tmp = talloc_realloc(state, state->pending, struct iovec,
2662                              num_pending+1);
2663         if (tmp == NULL) {
2664                 DEBUG(1, ("talloc_realloc failed\n"));
2665                 exit(1);
2666         }
2667         state->pending = tmp;
2668
2669         DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2670
2671         status = receive_smb_talloc(state, smbd_server_fd(),
2672                                     (char **)(void *)&state->pending[num_pending].iov_base,
2673                                     0 /* timeout */,
2674                                     &unread,
2675                                     &encrypted,
2676                                     &state->pending[num_pending].iov_len,
2677                                     &seqnum,
2678                                     false /* trusted_channel*/);
2679         if (!NT_STATUS_IS_OK(status)) {
2680                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2681                           (int)sys_getpid(), nt_errstr(status)));
2682                 exit(1);
2683         }
2684
2685         ok = smbd_unlock_socket_internal(sconn);
2686         if (!ok) {
2687                 DEBUG(1, ("%s: failed to unlock socket in\n",
2688                         __location__));
2689                 exit(1);
2690         }
2691
2692         /*
2693          * place the seqnum in the packet so that the main process can reply
2694          * with signing
2695          */
2696         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field, seqnum);
2697         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2698
2699         reply = smbd_echo_reply(smbd_server_fd(),
2700                                 (uint8_t *)state->pending[num_pending].iov_base,
2701                                 state->pending[num_pending].iov_len,
2702                                 seqnum);
2703         if (reply) {
2704                 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2705                 /* no check, shrinking by some bytes does not fail */
2706                 state->pending = talloc_realloc(state, state->pending,
2707                                                 struct iovec,
2708                                                 num_pending);
2709         } else {
2710                 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2711                 smbd_echo_activate_writer(state);
2712         }
2713 }
2714
2715 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2716                            int parent_pipe)
2717 {
2718         struct smbd_echo_state *state;
2719
2720         state = talloc_zero(sconn, struct smbd_echo_state);
2721         if (state == NULL) {
2722                 DEBUG(1, ("talloc failed\n"));
2723                 return;
2724         }
2725         state->sconn = sconn;
2726         state->parent_pipe = parent_pipe;
2727         state->ev = s3_tevent_context_init(state);
2728         if (state->ev == NULL) {
2729                 DEBUG(1, ("tevent_context_init failed\n"));
2730                 TALLOC_FREE(state);
2731                 return;
2732         }
2733         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2734                                         TEVENT_FD_READ, smbd_echo_exit,
2735                                         state);
2736         if (state->parent_fde == NULL) {
2737                 DEBUG(1, ("tevent_add_fd failed\n"));
2738                 TALLOC_FREE(state);
2739                 return;
2740         }
2741         state->read_fde = tevent_add_fd(state->ev, state, smbd_server_fd(),
2742                                         TEVENT_FD_READ, smbd_echo_reader,
2743                                         state);
2744         if (state->read_fde == NULL) {
2745                 DEBUG(1, ("tevent_add_fd failed\n"));
2746                 TALLOC_FREE(state);
2747                 return;
2748         }
2749
2750         while (true) {
2751                 if (tevent_loop_once(state->ev) == -1) {
2752                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2753                                   strerror(errno)));
2754                         break;
2755                 }
2756         }
2757         TALLOC_FREE(state);
2758 }
2759
2760 /*
2761  * Handle SMBecho requests in a forked child process
2762  */
2763 static bool fork_echo_handler(struct smbd_server_connection *sconn)
2764 {
2765         int listener_pipe[2];
2766         int res;
2767         pid_t child;
2768
2769         res = pipe(listener_pipe);
2770         if (res == -1) {
2771                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2772                 return false;
2773         }
2774         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2775         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2776                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2777                 goto fail;
2778         }
2779
2780         child = sys_fork();
2781         if (child == 0) {
2782                 NTSTATUS status;
2783
2784                 close(listener_pipe[0]);
2785
2786                 status = reinit_after_fork(smbd_messaging_context(),
2787                                            smbd_event_context(), false);
2788                 if (!NT_STATUS_IS_OK(status)) {
2789                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2790                                   nt_errstr(status)));
2791                         exit(1);
2792                 }
2793                 smbd_echo_loop(sconn, listener_pipe[1]);
2794                 exit(0);
2795         }
2796         close(listener_pipe[1]);
2797         listener_pipe[1] = -1;
2798         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2799
2800         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2801
2802         /*
2803          * Without smb signing this is the same as the normal smbd
2804          * listener. This needs to change once signing comes in.
2805          */
2806         sconn->smb1.echo_handler.trusted_fde = event_add_fd(smbd_event_context(),
2807                                         sconn,
2808                                         sconn->smb1.echo_handler.trusted_fd,
2809                                         EVENT_FD_READ,
2810                                         smbd_server_echo_handler,
2811                                         sconn);
2812         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2813                 DEBUG(1, ("event_add_fd failed\n"));
2814                 goto fail;
2815         }
2816
2817         return true;
2818
2819 fail:
2820         if (listener_pipe[0] != -1) {
2821                 close(listener_pipe[0]);
2822         }
2823         if (listener_pipe[1] != -1) {
2824                 close(listener_pipe[1]);
2825         }
2826         sconn->smb1.echo_handler.trusted_fd = -1;
2827         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2828                 close(sconn->smb1.echo_handler.socket_lock_fd);
2829         }
2830         sconn->smb1.echo_handler.trusted_fd = -1;
2831         sconn->smb1.echo_handler.socket_lock_fd = -1;
2832         return false;
2833 }
2834
2835 /****************************************************************************
2836  Process commands from the client
2837 ****************************************************************************/
2838
2839 void smbd_process(void)
2840 {
2841         TALLOC_CTX *frame = talloc_stackframe();
2842         struct sockaddr_storage ss;
2843         struct sockaddr *sa = NULL;
2844         socklen_t sa_len;
2845         struct tsocket_address *local_address = NULL;
2846         struct tsocket_address *remote_address = NULL;
2847         const char *remaddr = NULL;
2848         int ret;
2849
2850         if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2851             lp_security() != SEC_SHARE &&
2852             !lp_async_smb_echo_handler()) {
2853                 smbd_server_conn->allow_smb2 = true;
2854         }
2855
2856         /* Ensure child is set to blocking mode */
2857         set_blocking(smbd_server_fd(),True);
2858
2859         set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2860         set_socket_options(smbd_server_fd(), lp_socket_options());
2861
2862         sa = (struct sockaddr *)(void *)&ss;
2863         sa_len = sizeof(ss);
2864         ret = getpeername(smbd_server_fd(), sa, &sa_len);
2865         if (ret != 0) {
2866                 int level = (errno == ENOTCONN)?2:0;
2867                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2868                 exit_server("getpeername() failed.\n");
2869         }
2870         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2871                                                 sa, sa_len,
2872                                                 &remote_address);
2873         if (ret != 0) {
2874                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2875                         __location__, strerror(errno)));
2876                 exit_server("tsocket_address_bsd_from_sockaddr remote failed.\n");
2877         }
2878
2879         sa = (struct sockaddr *)(void *)&ss;
2880         sa_len = sizeof(ss);
2881         ret = getsockname(smbd_server_fd(), sa, &sa_len);
2882         if (ret != 0) {
2883                 int level = (errno == ENOTCONN)?2:0;
2884                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2885                 exit_server("getsockname() failed.\n");
2886         }
2887         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2888                                                 sa, sa_len,
2889                                                 &local_address);
2890         if (ret != 0) {
2891                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2892                         __location__, strerror(errno)));
2893                 exit_server("tsocket_address_bsd_from_sockaddr remote failed.\n");
2894         }
2895
2896         smbd_server_conn->local_address = local_address;
2897         smbd_server_conn->remote_address = remote_address;
2898
2899         if (tsocket_address_is_inet(remote_address, "ip")) {
2900                 remaddr = tsocket_address_inet_addr_string(
2901                                 smbd_server_conn->remote_address,
2902                                 talloc_tos());
2903                 if (remaddr == NULL) {
2904
2905                 }
2906         } else {
2907                 remaddr = "0.0.0.0";
2908         }
2909
2910         /* this is needed so that we get decent entries
2911            in smbstatus for port 445 connects */
2912         set_remote_machine_name(remaddr, false);
2913         reload_services(true);
2914
2915         /*
2916          * Before the first packet, check the global hosts allow/ hosts deny
2917          * parameters before doing any parsing of packets passed to us by the
2918          * client. This prevents attacks on our parsing code from hosts not in
2919          * the hosts allow list.
2920          */
2921
2922         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2923                           lp_hostsdeny(-1))) {
2924                 /*
2925                  * send a negative session response "not listening on calling
2926                  * name"
2927                  */
2928                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2929                 DEBUG( 1, ("Connection denied from %s to %s\n",
2930                            tsocket_address_string(remote_address, talloc_tos()),
2931                            tsocket_address_string(local_address, talloc_tos())));
2932                 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2933                                    0, false, NULL);
2934                 exit_server_cleanly("connection denied");
2935         }
2936
2937         DEBUG(10, ("Connection allowed from %s to %s\n",
2938                    tsocket_address_string(remote_address, talloc_tos()),
2939                    tsocket_address_string(local_address, talloc_tos())));
2940
2941         static_init_rpc;
2942
2943         init_modules();
2944
2945         smb_perfcount_init();
2946
2947         if (!init_account_policy()) {
2948                 exit_server("Could not open account policy tdb.\n");
2949         }
2950
2951         if (*lp_rootdir()) {
2952                 if (chroot(lp_rootdir()) != 0) {
2953                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2954                         exit_server("Failed to chroot()");
2955                 }
2956                 if (chdir("/") == -1) {
2957                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2958                         exit_server("Failed to chroot()");
2959                 }
2960                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2961         }
2962
2963         if (!srv_init_signing(smbd_server_conn)) {
2964                 exit_server("Failed to init smb_signing");
2965         }
2966
2967         if (lp_async_smb_echo_handler() && !fork_echo_handler(smbd_server_conn)) {
2968                 exit_server("Failed to fork echo handler");
2969         }
2970
2971         /* Setup oplocks */
2972         if (!init_oplocks(smbd_messaging_context()))
2973                 exit_server("Failed to init oplocks");
2974
2975         /* register our message handlers */
2976         messaging_register(smbd_messaging_context(), NULL,
2977                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
2978         messaging_register(smbd_messaging_context(), NULL,
2979                            MSG_SMB_RELEASE_IP, msg_release_ip);
2980         messaging_register(smbd_messaging_context(), NULL,
2981                            MSG_SMB_CLOSE_FILE, msg_close_file);
2982
2983         /*
2984          * Use the default MSG_DEBUG handler to avoid rebroadcasting
2985          * MSGs to all child processes
2986          */
2987         messaging_deregister(smbd_messaging_context(),
2988                              MSG_DEBUG, NULL);
2989         messaging_register(smbd_messaging_context(), NULL,
2990                            MSG_DEBUG, debug_message);
2991
2992         if ((lp_keepalive() != 0)
2993             && !(event_add_idle(smbd_event_context(), NULL,
2994                                 timeval_set(lp_keepalive(), 0),
2995                                 "keepalive", keepalive_fn,
2996                                 NULL))) {
2997                 DEBUG(0, ("Could not add keepalive event\n"));
2998                 exit(1);
2999         }
3000
3001         if (!(event_add_idle(smbd_event_context(), NULL,
3002                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3003                              "deadtime", deadtime_fn, NULL))) {
3004                 DEBUG(0, ("Could not add deadtime event\n"));
3005                 exit(1);
3006         }
3007
3008         if (!(event_add_idle(smbd_event_context(), NULL,
3009                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
3010                              "housekeeping", housekeeping_fn, NULL))) {
3011                 DEBUG(0, ("Could not add housekeeping event\n"));
3012                 exit(1);
3013         }
3014
3015 #ifdef CLUSTER_SUPPORT
3016
3017         if (lp_clustering()) {
3018                 /*
3019                  * We need to tell ctdb about our client's TCP
3020                  * connection, so that for failover ctdbd can send
3021                  * tickle acks, triggering a reconnection by the
3022                  * client.
3023                  */
3024
3025                 struct sockaddr_storage srv, clnt;
3026
3027                 if (client_get_tcp_info(&srv, &clnt) == 0) {
3028
3029                         NTSTATUS status;
3030
3031                         status = ctdbd_register_ips(
3032                                 messaging_ctdbd_connection(),
3033                                 &srv, &clnt, release_ip, NULL);
3034
3035                         if (!NT_STATUS_IS_OK(status)) {
3036                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3037                                           nt_errstr(status)));
3038                         }
3039                 } else
3040                 {
3041                         DEBUG(0,("Unable to get tcp info for "
3042                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3043                                  strerror(errno)));
3044                 }
3045         }
3046
3047 #endif
3048
3049         smbd_server_conn->nbt.got_session = false;
3050
3051         smbd_server_conn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3052
3053         smbd_server_conn->smb1.sessions.done_sesssetup = false;
3054         smbd_server_conn->smb1.sessions.max_send = BUFFER_SIZE;
3055         smbd_server_conn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3056         /* users from session setup */
3057         smbd_server_conn->smb1.sessions.session_userlist = NULL;
3058         /* workgroup from session setup. */
3059         smbd_server_conn->smb1.sessions.session_workgroup = NULL;
3060         /* this holds info on user ids that are already validated for this VC */
3061         smbd_server_conn->smb1.sessions.validated_users = NULL;
3062         smbd_server_conn->smb1.sessions.next_vuid = VUID_OFFSET;
3063         smbd_server_conn->smb1.sessions.num_validated_vuids = 0;
3064 #ifdef HAVE_NETGROUP
3065         smbd_server_conn->smb1.sessions.my_yp_domain = NULL;
3066 #endif
3067
3068         conn_init(smbd_server_conn);
3069         if (!init_dptrs(smbd_server_conn)) {
3070                 exit_server("init_dptrs() failed");
3071         }
3072
3073         smbd_server_conn->smb1.fde = event_add_fd(smbd_event_context(),
3074                                                   smbd_server_conn,
3075                                                   smbd_server_fd(),
3076                                                   EVENT_FD_READ,
3077                                                   smbd_server_connection_handler,
3078                                                   smbd_server_conn);
3079         if (!smbd_server_conn->smb1.fde) {
3080                 exit_server("failed to create smbd_server_connection fde");
3081         }
3082
3083         TALLOC_FREE(frame);
3084
3085         while (True) {
3086                 NTSTATUS status;
3087
3088                 frame = talloc_stackframe_pool(8192);
3089
3090                 errno = 0;
3091
3092                 status = smbd_server_connection_loop_once(smbd_server_conn);
3093                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3094                     !NT_STATUS_IS_OK(status)) {
3095                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3096                                   " exiting\n", nt_errstr(status)));
3097                         break;
3098                 }
3099
3100                 TALLOC_FREE(frame);
3101         }
3102
3103         exit_server_cleanly(NULL);
3104 }
3105
3106 bool req_is_in_chain(struct smb_request *req)
3107 {
3108         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
3109                 /*
3110                  * We're right now handling a subsequent request, so we must
3111                  * be in a chain
3112                  */
3113                 return true;
3114         }
3115
3116         if (!is_andx_req(req->cmd)) {
3117                 return false;
3118         }
3119
3120         if (req->wct < 2) {
3121                 /*
3122                  * Okay, an illegal request, but definitely not chained :-)
3123                  */
3124                 return false;
3125         }
3126
3127         return (CVAL(req->vwv+0, 0) != 0xFF);
3128 }