source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "../librpc/gen_ndr/srv_dfs.h"
  24 #include "../librpc/gen_ndr/srv_dssetup.h"
  25 #include "../librpc/gen_ndr/srv_echo.h"
  26 #include "../librpc/gen_ndr/srv_eventlog.h"
  27 #include "../librpc/gen_ndr/srv_initshutdown.h"
  28 #include "../librpc/gen_ndr/srv_lsa.h"
  29 #include "../librpc/gen_ndr/srv_netlogon.h"
  30 #include "../librpc/gen_ndr/srv_ntsvcs.h"
  31 #include "../librpc/gen_ndr/srv_samr.h"
  32 #include "../librpc/gen_ndr/srv_spoolss.h"
  33 #include "../librpc/gen_ndr/srv_srvsvc.h"
  34 #include "../librpc/gen_ndr/srv_svcctl.h"
  35 #include "../librpc/gen_ndr/srv_winreg.h"
  36 #include "../librpc/gen_ndr/srv_wkssvc.h"
  37 #include "librpc/gen_ndr/messaging.h"
  38 #include "printing/nt_printing_migrate.h"
  39
  40 extern bool global_machine_password_needs_changing;
  41
  42 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  43                                    char *outbuf);
  44 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
  45
  46 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  47 {
  48         bool ok;
  49
  50         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  51                 return true;
  52         }
  53
  54         sconn->smb1.echo_handler.ref_count++;
  55
  56         if (sconn->smb1.echo_handler.ref_count > 1) {
  57                 return true;
  58         }
  59
  60         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  61
  62         ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
  63                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  64         if (!ok) {
  65                 return false;
  66         }
  67
  68         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  69
  70         return true;
  71 }
  72
  73 void smbd_lock_socket(struct smbd_server_connection *sconn)
  74 {
  75         if (!smbd_lock_socket_internal(sconn)) {
  76                 exit_server_cleanly("failed to lock socket");
  77         }
  78 }
  79
  80 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  81 {
  82         bool ok;
  83
  84         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  85                 return true;
  86         }
  87
  88         sconn->smb1.echo_handler.ref_count--;
  89
  90         if (sconn->smb1.echo_handler.ref_count > 0) {
  91                 return true;
  92         }
  93
  94         ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
  95                         SMB_F_SETLKW, 0, 0, F_UNLCK);
  96         if (!ok) {
  97                 return false;
  98         }
  99
 100         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 101
 102         return true;
 103 }
 104
 105 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 106 {
 107         if (!smbd_unlock_socket_internal(sconn)) {
 108                 exit_server_cleanly("failed to unlock socket");
 109         }
 110 }
 111
 112 /* Accessor function for smb_read_error for smbd functions. */
 113
 114 /****************************************************************************
 115  Send an smb to a fd.
 116 ****************************************************************************/
 117
 118 bool srv_send_smb(int fd, char *buffer,
 119                   bool do_signing, uint32_t seqnum,
 120                   bool do_encrypt,
 121                   struct smb_perfcount_data *pcd)
 122 {
 123         size_t len = 0;
 124         size_t nwritten=0;
 125         ssize_t ret;
 126         char *buf_out = buffer;
 127
 128         smbd_lock_socket(smbd_server_conn);
 129
 130         if (do_signing) {
 131                 /* Sign the outgoing packet if required. */
 132                 srv_calculate_sign_mac(smbd_server_conn, buf_out, seqnum);
 133         }
 134
 135         if (do_encrypt) {
 136                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 137                 if (!NT_STATUS_IS_OK(status)) {
 138                         DEBUG(0, ("send_smb: SMB encryption failed "
 139                                 "on outgoing packet! Error %s\n",
 140                                 nt_errstr(status) ));
 141                         goto out;
 142                 }
 143         }
 144
 145         len = smb_len(buf_out) + 4;
 146
 147         ret = write_data(fd,buf_out+nwritten,len - nwritten);
 148         if (ret <= 0) {
 149                 DEBUG(0,("pid[%d] Error writing %d bytes to client. %d. (%s)\n",
 150                         (int)sys_getpid(), (int)len,(int)ret, strerror(errno) ));
 151                 srv_free_enc_buffer(buf_out);
 152                 goto out;
 153         }
 154
 155         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 156         srv_free_enc_buffer(buf_out);
 157 out:
 158         SMB_PERFCOUNT_END(pcd);
 159
 160         smbd_unlock_socket(smbd_server_conn);
 161         return true;
 162 }
 163
 164 /*******************************************************************
 165  Setup the word count and byte count for a smb message.
 166 ********************************************************************/
 167
 168 int srv_set_message(char *buf,
 169                         int num_words,
 170                         int num_bytes,
 171                         bool zero)
 172 {
 173         if (zero && (num_words || num_bytes)) {
 174                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 175         }
 176         SCVAL(buf,smb_wct,num_words);
 177         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 178         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 179         return (smb_size + num_words*2 + num_bytes);
 180 }
 181
 182 static bool valid_smb_header(const uint8_t *inbuf)
 183 {
 184         if (is_encrypted_packet(inbuf)) {
 185                 return true;
 186         }
 187         /*
 188          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 189          * but it just looks weird to call strncmp for this one.
 190          */
 191         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 192 }
 193
 194 /* Socket functions for smbd packet processing. */
 195
 196 static bool valid_packet_size(size_t len)
 197 {
 198         /*
 199          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 200          * of header. Don't print the error if this fits.... JRA.
 201          */
 202
 203         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 204                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 205                                         (unsigned long)len));
 206                 return false;
 207         }
 208         return true;
 209 }
 210
 211 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 212                                       unsigned int timeout, ssize_t len)
 213 {
 214         if (len <= 0) {
 215                 return NT_STATUS_OK;
 216         }
 217
 218         return read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 219 }
 220
 221 /****************************************************************************
 222  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 223 ****************************************************************************/
 224
 225 /*
 226  * Unfortunately, earlier versions of smbclient/libsmbclient
 227  * don't send this "standard" writeX header. I've fixed this
 228  * for 3.2 but we'll use the old method with earlier versions.
 229  * Windows and CIFSFS at least use this standard size. Not
 230  * sure about MacOSX.
 231  */
 232
 233 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 234                                 (2*14) + /* word count (including bcc) */ \
 235                                 1 /* pad byte */)
 236
 237 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 238                                                     const char lenbuf[4],
 239                                                     int fd, char **buffer,
 240                                                     unsigned int timeout,
 241                                                     size_t *p_unread,
 242                                                     size_t *len_ret)
 243 {
 244         /* Size of a WRITEX call (+4 byte len). */
 245         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 246         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 247         ssize_t toread;
 248         NTSTATUS status;
 249
 250         memcpy(writeX_header, lenbuf, 4);
 251
 252         status = read_fd_with_timeout(
 253                 fd, writeX_header + 4,
 254                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 255                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 256                 timeout, NULL);
 257
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 return status;
 260         }
 261
 262         /*
 263          * Ok - now try and see if this is a possible
 264          * valid writeX call.
 265          */
 266
 267         if (is_valid_writeX_buffer(smbd_server_conn,
 268                                    (uint8_t *)writeX_header)) {
 269                 /*
 270                  * If the data offset is beyond what
 271                  * we've read, drain the extra bytes.
 272                  */
 273                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 274                 ssize_t newlen;
 275
 276                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 277                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 278                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 279                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 280                                         " failed to drain pending bytes");
 281                         }
 282                 } else {
 283                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 284                 }
 285
 286                 /* Spoof down the length and null out the bcc. */
 287                 set_message_bcc(writeX_header, 0);
 288                 newlen = smb_len(writeX_header);
 289
 290                 /* Copy the header we've written. */
 291
 292                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 293                                 writeX_header,
 294                                 sizeof(writeX_header));
 295
 296                 if (*buffer == NULL) {
 297                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 298                                   (int)sizeof(writeX_header)));
 299                         return NT_STATUS_NO_MEMORY;
 300                 }
 301
 302                 /* Work out the remaining bytes. */
 303                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 304                 *len_ret = newlen + 4;
 305                 return NT_STATUS_OK;
 306         }
 307
 308         if (!valid_packet_size(len)) {
 309                 return NT_STATUS_INVALID_PARAMETER;
 310         }
 311
 312         /*
 313          * Not a valid writeX call. Just do the standard
 314          * talloc and return.
 315          */
 316
 317         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 318
 319         if (*buffer == NULL) {
 320                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 321                           (int)len+4));
 322                 return NT_STATUS_NO_MEMORY;
 323         }
 324
 325         /* Copy in what we already read. */
 326         memcpy(*buffer,
 327                 writeX_header,
 328                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 329         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 330
 331         if(toread > 0) {
 332                 status = read_packet_remainder(
 333                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 334                         timeout, toread);
 335
 336                 if (!NT_STATUS_IS_OK(status)) {
 337                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 338                                    nt_errstr(status)));
 339                         return status;
 340                 }
 341         }
 342
 343         *len_ret = len + 4;
 344         return NT_STATUS_OK;
 345 }
 346
 347 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 348                                        char **buffer, unsigned int timeout,
 349                                        size_t *p_unread, size_t *plen)
 350 {
 351         char lenbuf[4];
 352         size_t len;
 353         int min_recv_size = lp_min_receive_file_size();
 354         NTSTATUS status;
 355
 356         *p_unread = 0;
 357
 358         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 359         if (!NT_STATUS_IS_OK(status)) {
 360                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 361                 return status;
 362         }
 363
 364         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 365             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 366                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 367             !srv_is_signing_active(smbd_server_conn) &&
 368             smbd_server_conn->smb1.echo_handler.trusted_fde == NULL) {
 369
 370                 return receive_smb_raw_talloc_partial_read(
 371                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 372         }
 373
 374         if (!valid_packet_size(len)) {
 375                 return NT_STATUS_INVALID_PARAMETER;
 376         }
 377
 378         /*
 379          * The +4 here can't wrap, we've checked the length above already.
 380          */
 381
 382         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 383
 384         if (*buffer == NULL) {
 385                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 386                           (int)len+4));
 387                 return NT_STATUS_NO_MEMORY;
 388         }
 389
 390         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 391
 392         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 393         if (!NT_STATUS_IS_OK(status)) {
 394                 return status;
 395         }
 396
 397         *plen = len + 4;
 398         return NT_STATUS_OK;
 399 }
 400
 401 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 402                                    char **buffer, unsigned int timeout,
 403                                    size_t *p_unread, bool *p_encrypted,
 404                                    size_t *p_len,
 405                                    uint32_t *seqnum,
 406                                    bool trusted_channel)
 407 {
 408         size_t len = 0;
 409         NTSTATUS status;
 410
 411         *p_encrypted = false;
 412
 413         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 414                                         p_unread, &len);
 415         if (!NT_STATUS_IS_OK(status)) {
 416                 return status;
 417         }
 418
 419         if (is_encrypted_packet((uint8_t *)*buffer)) {
 420                 status = srv_decrypt_buffer(*buffer);
 421                 if (!NT_STATUS_IS_OK(status)) {
 422                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 423                                 "incoming packet! Error %s\n",
 424                                 nt_errstr(status) ));
 425                         return status;
 426                 }
 427                 *p_encrypted = true;
 428         }
 429
 430         /* Check the incoming SMB signature. */
 431         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, trusted_channel)) {
 432                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 433                           "incoming packet!\n"));
 434                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 435         }
 436
 437         *p_len = len;
 438         return NT_STATUS_OK;
 439 }
 440
 441 /*
 442  * Initialize a struct smb_request from an inbuf
 443  */
 444
 445 static bool init_smb_request(struct smb_request *req,
 446                              struct smbd_server_connection *sconn,
 447                              const uint8 *inbuf,
 448                              size_t unread_bytes, bool encrypted,
 449                              uint32_t seqnum)
 450 {
 451         size_t req_size = smb_len(inbuf) + 4;
 452         /* Ensure we have at least smb_size bytes. */
 453         if (req_size < smb_size) {
 454                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 455                         (unsigned int)req_size ));
 456                 return false;
 457         }
 458         req->cmd    = CVAL(inbuf, smb_com);
 459         req->flags2 = SVAL(inbuf, smb_flg2);
 460         req->smbpid = SVAL(inbuf, smb_pid);
 461         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 462         req->seqnum = seqnum;
 463         req->vuid   = SVAL(inbuf, smb_uid);
 464         req->tid    = SVAL(inbuf, smb_tid);
 465         req->wct    = CVAL(inbuf, smb_wct);
 466         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 467         req->buflen = smb_buflen(inbuf);
 468         req->buf    = (const uint8_t *)smb_buf(inbuf);
 469         req->unread_bytes = unread_bytes;
 470         req->encrypted = encrypted;
 471         req->sconn = sconn;
 472         req->conn = conn_find(sconn,req->tid);
 473         req->chain_fsp = NULL;
 474         req->chain_outbuf = NULL;
 475         req->done = false;
 476         req->smb2req = NULL;
 477         smb_init_perfcount_data(&req->pcd);
 478
 479         /* Ensure we have at least wct words and 2 bytes of bcc. */
 480         if (smb_size + req->wct*2 > req_size) {
 481                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 482                         (unsigned int)req->wct,
 483                         (unsigned int)req_size));
 484                 return false;
 485         }
 486         /* Ensure bcc is correct. */
 487         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 488                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 489                         "(wct = %u, size %u)\n",
 490                         (unsigned int)req->buflen,
 491                         (unsigned int)req->wct,
 492                         (unsigned int)req_size));
 493                 return false;
 494         }
 495
 496         req->outbuf = NULL;
 497         return true;
 498 }
 499
 500 static void process_smb(struct smbd_server_connection *conn,
 501                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 502                         uint32_t seqnum, bool encrypted,
 503                         struct smb_perfcount_data *deferred_pcd);
 504
 505 static void smbd_deferred_open_timer(struct event_context *ev,
 506                                      struct timed_event *te,
 507                                      struct timeval _tval,
 508                                      void *private_data)
 509 {
 510         struct pending_message_list *msg = talloc_get_type(private_data,
 511                                            struct pending_message_list);
 512         TALLOC_CTX *mem_ctx = talloc_tos();
 513         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 514         uint8_t *inbuf;
 515
 516         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 517                                          msg->buf.length);
 518         if (inbuf == NULL) {
 519                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 520                 return;
 521         }
 522
 523         /* We leave this message on the queue so the open code can
 524            know this is a retry. */
 525         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 526                 (unsigned long long)mid ));
 527
 528         /* Mark the message as processed so this is not
 529          * re-processed in error. */
 530         msg->processed = true;
 531
 532         process_smb(smbd_server_conn, inbuf,
 533                     msg->buf.length, 0,
 534                     msg->seqnum, msg->encrypted, &msg->pcd);
 535
 536         /* If it's still there and was processed, remove it. */
 537         msg = get_deferred_open_message_smb(mid);
 538         if (msg && msg->processed) {
 539                 remove_deferred_open_message_smb(mid);
 540         }
 541 }
 542
 543 /****************************************************************************
 544  Function to push a message onto the tail of a linked list of smb messages ready
 545  for processing.
 546 ****************************************************************************/
 547
 548 static bool push_queued_message(struct smb_request *req,
 549                                 struct timeval request_time,
 550                                 struct timeval end_time,
 551                                 char *private_data, size_t private_len)
 552 {
 553         int msg_len = smb_len(req->inbuf) + 4;
 554         struct pending_message_list *msg;
 555
 556         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 557
 558         if(msg == NULL) {
 559                 DEBUG(0,("push_message: malloc fail (1)\n"));
 560                 return False;
 561         }
 562
 563         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 564         if(msg->buf.data == NULL) {
 565                 DEBUG(0,("push_message: malloc fail (2)\n"));
 566                 TALLOC_FREE(msg);
 567                 return False;
 568         }
 569
 570         msg->request_time = request_time;
 571         msg->seqnum = req->seqnum;
 572         msg->encrypted = req->encrypted;
 573         msg->processed = false;
 574         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 575
 576         if (private_data) {
 577                 msg->private_data = data_blob_talloc(msg, private_data,
 578                                                      private_len);
 579                 if (msg->private_data.data == NULL) {
 580                         DEBUG(0,("push_message: malloc fail (3)\n"));
 581                         TALLOC_FREE(msg);
 582                         return False;
 583                 }
 584         }
 585
 586         msg->te = event_add_timed(smbd_event_context(),
 587                                   msg,
 588                                   end_time,
 589                                   smbd_deferred_open_timer,
 590                                   msg);
 591         if (!msg->te) {
 592                 DEBUG(0,("push_message: event_add_timed failed\n"));
 593                 TALLOC_FREE(msg);
 594                 return false;
 595         }
 596
 597         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 598
 599         DEBUG(10,("push_message: pushed message length %u on "
 600                   "deferred_open_queue\n", (unsigned int)msg_len));
 601
 602         return True;
 603 }
 604
 605 /****************************************************************************
 606  Function to delete a sharing violation open message by mid.
 607 ****************************************************************************/
 608
 609 void remove_deferred_open_message_smb(uint64_t mid)
 610 {
 611         struct pending_message_list *pml;
 612
 613         if (smbd_server_conn->using_smb2) {
 614                 remove_deferred_open_message_smb2(smbd_server_conn, mid);
 615                 return;
 616         }
 617
 618         for (pml = deferred_open_queue; pml; pml = pml->next) {
 619                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 620                         DEBUG(10,("remove_deferred_open_message_smb: "
 621                                   "deleting mid %llu len %u\n",
 622                                   (unsigned long long)mid,
 623                                   (unsigned int)pml->buf.length ));
 624                         DLIST_REMOVE(deferred_open_queue, pml);
 625                         TALLOC_FREE(pml);
 626                         return;
 627                 }
 628         }
 629 }
 630
 631 /****************************************************************************
 632  Move a sharing violation open retry message to the front of the list and
 633  schedule it for immediate processing.
 634 ****************************************************************************/
 635
 636 void schedule_deferred_open_message_smb(uint64_t mid)
 637 {
 638         struct pending_message_list *pml;
 639         int i = 0;
 640
 641         if (smbd_server_conn->using_smb2) {
 642                 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
 643                 return;
 644         }
 645
 646         for (pml = deferred_open_queue; pml; pml = pml->next) {
 647                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 648
 649                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 650                         "msg_mid = %llu\n",
 651                         i++,
 652                         (unsigned long long)msg_mid ));
 653
 654                 if (mid == msg_mid) {
 655                         struct timed_event *te;
 656
 657                         if (pml->processed) {
 658                                 /* A processed message should not be
 659                                  * rescheduled. */
 660                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 661                                         "message mid %llu was already processed\n",
 662                                         (unsigned long long)msg_mid ));
 663                                 continue;
 664                         }
 665
 666                         DEBUG(10,("schedule_deferred_open_message_smb: "
 667                                 "scheduling mid %llu\n",
 668                                 (unsigned long long)mid ));
 669
 670                         te = event_add_timed(smbd_event_context(),
 671                                              pml,
 672                                              timeval_zero(),
 673                                              smbd_deferred_open_timer,
 674                                              pml);
 675                         if (!te) {
 676                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 677                                         "event_add_timed() failed, "
 678                                         "skipping mid %llu\n",
 679                                         (unsigned long long)msg_mid ));
 680                         }
 681
 682                         TALLOC_FREE(pml->te);
 683                         pml->te = te;
 684                         DLIST_PROMOTE(deferred_open_queue, pml);
 685                         return;
 686                 }
 687         }
 688
 689         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 690                 "find message mid %llu\n",
 691                 (unsigned long long)mid ));
 692 }
 693
 694 /****************************************************************************
 695  Return true if this mid is on the deferred queue and was not yet processed.
 696 ****************************************************************************/
 697
 698 bool open_was_deferred(uint64_t mid)
 699 {
 700         struct pending_message_list *pml;
 701
 702         if (smbd_server_conn->using_smb2) {
 703                 return open_was_deferred_smb2(smbd_server_conn, mid);
 704         }
 705
 706         for (pml = deferred_open_queue; pml; pml = pml->next) {
 707                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 708                         return True;
 709                 }
 710         }
 711         return False;
 712 }
 713
 714 /****************************************************************************
 715  Return the message queued by this mid.
 716 ****************************************************************************/
 717
 718 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
 719 {
 720         struct pending_message_list *pml;
 721
 722         for (pml = deferred_open_queue; pml; pml = pml->next) {
 723                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 724                         return pml;
 725                 }
 726         }
 727         return NULL;
 728 }
 729
 730 /****************************************************************************
 731  Get the state data queued by this mid.
 732 ****************************************************************************/
 733
 734 bool get_deferred_open_message_state(struct smb_request *smbreq,
 735                                 struct timeval *p_request_time,
 736                                 void **pp_state)
 737 {
 738         struct pending_message_list *pml;
 739
 740         if (smbd_server_conn->using_smb2) {
 741                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 742                                         p_request_time,
 743                                         pp_state);
 744         }
 745
 746         pml = get_deferred_open_message_smb(smbreq->mid);
 747         if (!pml) {
 748                 return false;
 749         }
 750         if (p_request_time) {
 751                 *p_request_time = pml->request_time;
 752         }
 753         if (pp_state) {
 754                 *pp_state = (void *)pml->private_data.data;
 755         }
 756         return true;
 757 }
 758
 759 /****************************************************************************
 760  Function to push a deferred open smb message onto a linked list of local smb
 761  messages ready for processing.
 762 ****************************************************************************/
 763
 764 bool push_deferred_open_message_smb(struct smb_request *req,
 765                                struct timeval request_time,
 766                                struct timeval timeout,
 767                                struct file_id id,
 768                                char *private_data, size_t priv_len)
 769 {
 770         struct timeval end_time;
 771
 772         if (req->smb2req) {
 773                 return push_deferred_open_message_smb2(req->smb2req,
 774                                                 request_time,
 775                                                 timeout,
 776                                                 id,
 777                                                 private_data,
 778                                                 priv_len);
 779         }
 780
 781         if (req->unread_bytes) {
 782                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 783                         "unread_bytes = %u\n",
 784                         (unsigned int)req->unread_bytes ));
 785                 smb_panic("push_deferred_open_message_smb: "
 786                         "logic error unread_bytes != 0" );
 787         }
 788
 789         end_time = timeval_sum(&request_time, &timeout);
 790
 791         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 792                 "len %u mid %llu timeout time [%u.%06u]\n",
 793                 (unsigned int) smb_len(req->inbuf)+4,
 794                 (unsigned long long)req->mid,
 795                 (unsigned int)end_time.tv_sec,
 796                 (unsigned int)end_time.tv_usec));
 797
 798         return push_queued_message(req, request_time, end_time,
 799                                    private_data, priv_len);
 800 }
 801
 802 struct idle_event {
 803         struct timed_event *te;
 804         struct timeval interval;
 805         char *name;
 806         bool (*handler)(const struct timeval *now, void *private_data);
 807         void *private_data;
 808 };
 809
 810 static void smbd_idle_event_handler(struct event_context *ctx,
 811                                     struct timed_event *te,
 812                                     struct timeval now,
 813                                     void *private_data)
 814 {
 815         struct idle_event *event =
 816                 talloc_get_type_abort(private_data, struct idle_event);
 817
 818         TALLOC_FREE(event->te);
 819
 820         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 821                   event->name, event->te));
 822
 823         if (!event->handler(&now, event->private_data)) {
 824                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 825                           event->name, event->te));
 826                 /* Don't repeat, delete ourselves */
 827                 TALLOC_FREE(event);
 828                 return;
 829         }
 830
 831         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 832                   event->name, event->te));
 833
 834         event->te = event_add_timed(ctx, event,
 835                                     timeval_sum(&now, &event->interval),
 836                                     smbd_idle_event_handler, event);
 837
 838         /* We can't do much but fail here. */
 839         SMB_ASSERT(event->te != NULL);
 840 }
 841
 842 struct idle_event *event_add_idle(struct event_context *event_ctx,
 843                                   TALLOC_CTX *mem_ctx,
 844                                   struct timeval interval,
 845                                   const char *name,
 846                                   bool (*handler)(const struct timeval *now,
 847                                                   void *private_data),
 848                                   void *private_data)
 849 {
 850         struct idle_event *result;
 851         struct timeval now = timeval_current();
 852
 853         result = TALLOC_P(mem_ctx, struct idle_event);
 854         if (result == NULL) {
 855                 DEBUG(0, ("talloc failed\n"));
 856                 return NULL;
 857         }
 858
 859         result->interval = interval;
 860         result->handler = handler;
 861         result->private_data = private_data;
 862
 863         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 864                 DEBUG(0, ("talloc failed\n"));
 865                 TALLOC_FREE(result);
 866                 return NULL;
 867         }
 868
 869         result->te = event_add_timed(event_ctx, result,
 870                                      timeval_sum(&now, &interval),
 871                                      smbd_idle_event_handler, result);
 872         if (result->te == NULL) {
 873                 DEBUG(0, ("event_add_timed failed\n"));
 874                 TALLOC_FREE(result);
 875                 return NULL;
 876         }
 877
 878         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 879         return result;
 880 }
 881
 882 static void smbd_sig_term_handler(struct tevent_context *ev,
 883                                   struct tevent_signal *se,
 884                                   int signum,
 885                                   int count,
 886                                   void *siginfo,
 887                                   void *private_data)
 888 {
 889         exit_server_cleanly("termination signal");
 890 }
 891
 892 void smbd_setup_sig_term_handler(void)
 893 {
 894         struct tevent_signal *se;
 895
 896         se = tevent_add_signal(smbd_event_context(),
 897                                smbd_event_context(),
 898                                SIGTERM, 0,
 899                                smbd_sig_term_handler,
 900                                NULL);
 901         if (!se) {
 902                 exit_server("failed to setup SIGTERM handler");
 903         }
 904 }
 905
 906 static void smbd_sig_hup_handler(struct tevent_context *ev,
 907                                   struct tevent_signal *se,
 908                                   int signum,
 909                                   int count,
 910                                   void *siginfo,
 911                                   void *private_data)
 912 {
 913         change_to_root_user();
 914         DEBUG(1,("Reloading services after SIGHUP\n"));
 915         reload_services(False);
 916 }
 917
 918 void smbd_setup_sig_hup_handler(void)
 919 {
 920         struct tevent_signal *se;
 921
 922         se = tevent_add_signal(smbd_event_context(),
 923                                smbd_event_context(),
 924                                SIGHUP, 0,
 925                                smbd_sig_hup_handler,
 926                                NULL);
 927         if (!se) {
 928                 exit_server("failed to setup SIGHUP handler");
 929         }
 930 }
 931
 932 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 933 {
 934         fd_set r_fds, w_fds;
 935         int selrtn;
 936         struct timeval to;
 937         int maxfd = 0;
 938
 939         to.tv_sec = SMBD_SELECT_TIMEOUT;
 940         to.tv_usec = 0;
 941
 942         /*
 943          * Setup the select fd sets.
 944          */
 945
 946         FD_ZERO(&r_fds);
 947         FD_ZERO(&w_fds);
 948
 949         /*
 950          * Are there any timed events waiting ? If so, ensure we don't
 951          * select for longer than it would take to wait for them.
 952          */
 953
 954         {
 955                 struct timeval now;
 956                 GetTimeOfDay(&now);
 957
 958                 event_add_to_select_args(smbd_event_context(), &now,
 959                                          &r_fds, &w_fds, &to, &maxfd);
 960         }
 961
 962         /* Process a signal and timed events now... */
 963         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 964                 return NT_STATUS_RETRY;
 965         }
 966
 967         {
 968                 int sav;
 969                 START_PROFILE(smbd_idle);
 970
 971                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 972                 sav = errno;
 973
 974                 END_PROFILE(smbd_idle);
 975                 errno = sav;
 976         }
 977
 978         if ((conn->smb1.echo_handler.trusted_fd != -1)
 979             && FD_ISSET(smbd_server_fd(), &r_fds)
 980             && FD_ISSET(conn->smb1.echo_handler.trusted_fd, &r_fds)) {
 981                 /*
 982                  * Prefer to read pending requests from the echo handler. To
 983                  * quote Jeremy (da70f8ab1): This is a hack of monstrous
 984                  * proportions...
 985                  */
 986                 FD_CLR(smbd_server_fd(), &r_fds);
 987         }
 988
 989         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 990                 return NT_STATUS_RETRY;
 991         }
 992
 993         /* Check if error */
 994         if (selrtn == -1) {
 995                 /* something is wrong. Maybe the socket is dead? */
 996                 return map_nt_error_from_unix(errno);
 997         }
 998
 999         /* Did we timeout ? */
1000         if (selrtn == 0) {
1001                 return NT_STATUS_RETRY;
1002         }
1003
1004         /* should not be reached */
1005         return NT_STATUS_INTERNAL_ERROR;
1006 }
1007
1008 /*
1009  * Only allow 5 outstanding trans requests. We're allocating memory, so
1010  * prevent a DoS.
1011  */
1012
1013 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1014 {
1015         int count = 0;
1016         for (; list != NULL; list = list->next) {
1017
1018                 if (list->mid == mid) {
1019                         return NT_STATUS_INVALID_PARAMETER;
1020                 }
1021
1022                 count += 1;
1023         }
1024         if (count > 5) {
1025                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1026         }
1027
1028         return NT_STATUS_OK;
1029 }
1030
1031 /*
1032 These flags determine some of the permissions required to do an operation
1033
1034 Note that I don't set NEED_WRITE on some write operations because they
1035 are used by some brain-dead clients when printing, and I don't want to
1036 force write permissions on print services.
1037 */
1038 #define AS_USER (1<<0)
1039 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1040 #define TIME_INIT (1<<2)
1041 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1042 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1043 #define DO_CHDIR (1<<6)
1044
1045 /*
1046    define a list of possible SMB messages and their corresponding
1047    functions. Any message that has a NULL function is unimplemented -
1048    please feel free to contribute implementations!
1049 */
1050 static const struct smb_message_struct {
1051         const char *name;
1052         void (*fn)(struct smb_request *req);
1053         int flags;
1054 } smb_messages[256] = {
1055
1056 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1057 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1058 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1059 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1060 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1061 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1062 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1063 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1064 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1065 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1066 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1067 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1068 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1069 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1070 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1071 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1072 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1073 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1074 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1075 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1076 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1077 /* 0x15 */ { NULL, NULL, 0 },
1078 /* 0x16 */ { NULL, NULL, 0 },
1079 /* 0x17 */ { NULL, NULL, 0 },
1080 /* 0x18 */ { NULL, NULL, 0 },
1081 /* 0x19 */ { NULL, NULL, 0 },
1082 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1083 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1084 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1085 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1086 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1087 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1088 /* 0x20 */ { "SMBwritec", NULL,0},
1089 /* 0x21 */ { NULL, NULL, 0 },
1090 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1091 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1092 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1093 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1094 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1095 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1096 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1097 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1098 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1099 /* 0x2b */ { "SMBecho",reply_echo,0},
1100 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1101 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1102 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1103 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1104 /* 0x30 */ { NULL, NULL, 0 },
1105 /* 0x31 */ { NULL, NULL, 0 },
1106 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1107 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1108 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1109 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1110 /* 0x36 */ { NULL, NULL, 0 },
1111 /* 0x37 */ { NULL, NULL, 0 },
1112 /* 0x38 */ { NULL, NULL, 0 },
1113 /* 0x39 */ { NULL, NULL, 0 },
1114 /* 0x3a */ { NULL, NULL, 0 },
1115 /* 0x3b */ { NULL, NULL, 0 },
1116 /* 0x3c */ { NULL, NULL, 0 },
1117 /* 0x3d */ { NULL, NULL, 0 },
1118 /* 0x3e */ { NULL, NULL, 0 },
1119 /* 0x3f */ { NULL, NULL, 0 },
1120 /* 0x40 */ { NULL, NULL, 0 },
1121 /* 0x41 */ { NULL, NULL, 0 },
1122 /* 0x42 */ { NULL, NULL, 0 },
1123 /* 0x43 */ { NULL, NULL, 0 },
1124 /* 0x44 */ { NULL, NULL, 0 },
1125 /* 0x45 */ { NULL, NULL, 0 },
1126 /* 0x46 */ { NULL, NULL, 0 },
1127 /* 0x47 */ { NULL, NULL, 0 },
1128 /* 0x48 */ { NULL, NULL, 0 },
1129 /* 0x49 */ { NULL, NULL, 0 },
1130 /* 0x4a */ { NULL, NULL, 0 },
1131 /* 0x4b */ { NULL, NULL, 0 },
1132 /* 0x4c */ { NULL, NULL, 0 },
1133 /* 0x4d */ { NULL, NULL, 0 },
1134 /* 0x4e */ { NULL, NULL, 0 },
1135 /* 0x4f */ { NULL, NULL, 0 },
1136 /* 0x50 */ { NULL, NULL, 0 },
1137 /* 0x51 */ { NULL, NULL, 0 },
1138 /* 0x52 */ { NULL, NULL, 0 },
1139 /* 0x53 */ { NULL, NULL, 0 },
1140 /* 0x54 */ { NULL, NULL, 0 },
1141 /* 0x55 */ { NULL, NULL, 0 },
1142 /* 0x56 */ { NULL, NULL, 0 },
1143 /* 0x57 */ { NULL, NULL, 0 },
1144 /* 0x58 */ { NULL, NULL, 0 },
1145 /* 0x59 */ { NULL, NULL, 0 },
1146 /* 0x5a */ { NULL, NULL, 0 },
1147 /* 0x5b */ { NULL, NULL, 0 },
1148 /* 0x5c */ { NULL, NULL, 0 },
1149 /* 0x5d */ { NULL, NULL, 0 },
1150 /* 0x5e */ { NULL, NULL, 0 },
1151 /* 0x5f */ { NULL, NULL, 0 },
1152 /* 0x60 */ { NULL, NULL, 0 },
1153 /* 0x61 */ { NULL, NULL, 0 },
1154 /* 0x62 */ { NULL, NULL, 0 },
1155 /* 0x63 */ { NULL, NULL, 0 },
1156 /* 0x64 */ { NULL, NULL, 0 },
1157 /* 0x65 */ { NULL, NULL, 0 },
1158 /* 0x66 */ { NULL, NULL, 0 },
1159 /* 0x67 */ { NULL, NULL, 0 },
1160 /* 0x68 */ { NULL, NULL, 0 },
1161 /* 0x69 */ { NULL, NULL, 0 },
1162 /* 0x6a */ { NULL, NULL, 0 },
1163 /* 0x6b */ { NULL, NULL, 0 },
1164 /* 0x6c */ { NULL, NULL, 0 },
1165 /* 0x6d */ { NULL, NULL, 0 },
1166 /* 0x6e */ { NULL, NULL, 0 },
1167 /* 0x6f */ { NULL, NULL, 0 },
1168 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1169 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1170 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1171 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1172 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1173 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1174 /* 0x76 */ { NULL, NULL, 0 },
1175 /* 0x77 */ { NULL, NULL, 0 },
1176 /* 0x78 */ { NULL, NULL, 0 },
1177 /* 0x79 */ { NULL, NULL, 0 },
1178 /* 0x7a */ { NULL, NULL, 0 },
1179 /* 0x7b */ { NULL, NULL, 0 },
1180 /* 0x7c */ { NULL, NULL, 0 },
1181 /* 0x7d */ { NULL, NULL, 0 },
1182 /* 0x7e */ { NULL, NULL, 0 },
1183 /* 0x7f */ { NULL, NULL, 0 },
1184 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1185 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1186 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1187 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1188 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1189 /* 0x85 */ { NULL, NULL, 0 },
1190 /* 0x86 */ { NULL, NULL, 0 },
1191 /* 0x87 */ { NULL, NULL, 0 },
1192 /* 0x88 */ { NULL, NULL, 0 },
1193 /* 0x89 */ { NULL, NULL, 0 },
1194 /* 0x8a */ { NULL, NULL, 0 },
1195 /* 0x8b */ { NULL, NULL, 0 },
1196 /* 0x8c */ { NULL, NULL, 0 },
1197 /* 0x8d */ { NULL, NULL, 0 },
1198 /* 0x8e */ { NULL, NULL, 0 },
1199 /* 0x8f */ { NULL, NULL, 0 },
1200 /* 0x90 */ { NULL, NULL, 0 },
1201 /* 0x91 */ { NULL, NULL, 0 },
1202 /* 0x92 */ { NULL, NULL, 0 },
1203 /* 0x93 */ { NULL, NULL, 0 },
1204 /* 0x94 */ { NULL, NULL, 0 },
1205 /* 0x95 */ { NULL, NULL, 0 },
1206 /* 0x96 */ { NULL, NULL, 0 },
1207 /* 0x97 */ { NULL, NULL, 0 },
1208 /* 0x98 */ { NULL, NULL, 0 },
1209 /* 0x99 */ { NULL, NULL, 0 },
1210 /* 0x9a */ { NULL, NULL, 0 },
1211 /* 0x9b */ { NULL, NULL, 0 },
1212 /* 0x9c */ { NULL, NULL, 0 },
1213 /* 0x9d */ { NULL, NULL, 0 },
1214 /* 0x9e */ { NULL, NULL, 0 },
1215 /* 0x9f */ { NULL, NULL, 0 },
1216 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1217 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1218 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1219 /* 0xa3 */ { NULL, NULL, 0 },
1220 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1221 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1222 /* 0xa6 */ { NULL, NULL, 0 },
1223 /* 0xa7 */ { NULL, NULL, 0 },
1224 /* 0xa8 */ { NULL, NULL, 0 },
1225 /* 0xa9 */ { NULL, NULL, 0 },
1226 /* 0xaa */ { NULL, NULL, 0 },
1227 /* 0xab */ { NULL, NULL, 0 },
1228 /* 0xac */ { NULL, NULL, 0 },
1229 /* 0xad */ { NULL, NULL, 0 },
1230 /* 0xae */ { NULL, NULL, 0 },
1231 /* 0xaf */ { NULL, NULL, 0 },
1232 /* 0xb0 */ { NULL, NULL, 0 },
1233 /* 0xb1 */ { NULL, NULL, 0 },
1234 /* 0xb2 */ { NULL, NULL, 0 },
1235 /* 0xb3 */ { NULL, NULL, 0 },
1236 /* 0xb4 */ { NULL, NULL, 0 },
1237 /* 0xb5 */ { NULL, NULL, 0 },
1238 /* 0xb6 */ { NULL, NULL, 0 },
1239 /* 0xb7 */ { NULL, NULL, 0 },
1240 /* 0xb8 */ { NULL, NULL, 0 },
1241 /* 0xb9 */ { NULL, NULL, 0 },
1242 /* 0xba */ { NULL, NULL, 0 },
1243 /* 0xbb */ { NULL, NULL, 0 },
1244 /* 0xbc */ { NULL, NULL, 0 },
1245 /* 0xbd */ { NULL, NULL, 0 },
1246 /* 0xbe */ { NULL, NULL, 0 },
1247 /* 0xbf */ { NULL, NULL, 0 },
1248 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1249 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1250 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1251 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1252 /* 0xc4 */ { NULL, NULL, 0 },
1253 /* 0xc5 */ { NULL, NULL, 0 },
1254 /* 0xc6 */ { NULL, NULL, 0 },
1255 /* 0xc7 */ { NULL, NULL, 0 },
1256 /* 0xc8 */ { NULL, NULL, 0 },
1257 /* 0xc9 */ { NULL, NULL, 0 },
1258 /* 0xca */ { NULL, NULL, 0 },
1259 /* 0xcb */ { NULL, NULL, 0 },
1260 /* 0xcc */ { NULL, NULL, 0 },
1261 /* 0xcd */ { NULL, NULL, 0 },
1262 /* 0xce */ { NULL, NULL, 0 },
1263 /* 0xcf */ { NULL, NULL, 0 },
1264 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1265 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1266 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1267 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1268 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1269 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1270 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1271 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1272 /* 0xd8 */ { NULL, NULL, 0 },
1273 /* 0xd9 */ { NULL, NULL, 0 },
1274 /* 0xda */ { NULL, NULL, 0 },
1275 /* 0xdb */ { NULL, NULL, 0 },
1276 /* 0xdc */ { NULL, NULL, 0 },
1277 /* 0xdd */ { NULL, NULL, 0 },
1278 /* 0xde */ { NULL, NULL, 0 },
1279 /* 0xdf */ { NULL, NULL, 0 },
1280 /* 0xe0 */ { NULL, NULL, 0 },
1281 /* 0xe1 */ { NULL, NULL, 0 },
1282 /* 0xe2 */ { NULL, NULL, 0 },
1283 /* 0xe3 */ { NULL, NULL, 0 },
1284 /* 0xe4 */ { NULL, NULL, 0 },
1285 /* 0xe5 */ { NULL, NULL, 0 },
1286 /* 0xe6 */ { NULL, NULL, 0 },
1287 /* 0xe7 */ { NULL, NULL, 0 },
1288 /* 0xe8 */ { NULL, NULL, 0 },
1289 /* 0xe9 */ { NULL, NULL, 0 },
1290 /* 0xea */ { NULL, NULL, 0 },
1291 /* 0xeb */ { NULL, NULL, 0 },
1292 /* 0xec */ { NULL, NULL, 0 },
1293 /* 0xed */ { NULL, NULL, 0 },
1294 /* 0xee */ { NULL, NULL, 0 },
1295 /* 0xef */ { NULL, NULL, 0 },
1296 /* 0xf0 */ { NULL, NULL, 0 },
1297 /* 0xf1 */ { NULL, NULL, 0 },
1298 /* 0xf2 */ { NULL, NULL, 0 },
1299 /* 0xf3 */ { NULL, NULL, 0 },
1300 /* 0xf4 */ { NULL, NULL, 0 },
1301 /* 0xf5 */ { NULL, NULL, 0 },
1302 /* 0xf6 */ { NULL, NULL, 0 },
1303 /* 0xf7 */ { NULL, NULL, 0 },
1304 /* 0xf8 */ { NULL, NULL, 0 },
1305 /* 0xf9 */ { NULL, NULL, 0 },
1306 /* 0xfa */ { NULL, NULL, 0 },
1307 /* 0xfb */ { NULL, NULL, 0 },
1308 /* 0xfc */ { NULL, NULL, 0 },
1309 /* 0xfd */ { NULL, NULL, 0 },
1310 /* 0xfe */ { NULL, NULL, 0 },
1311 /* 0xff */ { NULL, NULL, 0 }
1312
1313 };
1314
1315 /*******************************************************************
1316  allocate and initialize a reply packet
1317 ********************************************************************/
1318
1319 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1320                           const char *inbuf, char **outbuf, uint8_t num_words,
1321                           uint32_t num_bytes)
1322 {
1323         /*
1324          * Protect against integer wrap
1325          */
1326         if ((num_bytes > 0xffffff)
1327             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1328                 char *msg;
1329                 if (asprintf(&msg, "num_bytes too large: %u",
1330                              (unsigned)num_bytes) == -1) {
1331                         msg = CONST_DISCARD(char *, "num_bytes too large");
1332                 }
1333                 smb_panic(msg);
1334         }
1335
1336         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1337                                smb_size + num_words*2 + num_bytes);
1338         if (*outbuf == NULL) {
1339                 return false;
1340         }
1341
1342         construct_reply_common(req, inbuf, *outbuf);
1343         srv_set_message(*outbuf, num_words, num_bytes, false);
1344         /*
1345          * Zero out the word area, the caller has to take care of the bcc area
1346          * himself
1347          */
1348         if (num_words != 0) {
1349                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1350         }
1351
1352         return true;
1353 }
1354
1355 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1356 {
1357         char *outbuf;
1358         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1359                            num_bytes)) {
1360                 smb_panic("could not allocate output buffer\n");
1361         }
1362         req->outbuf = (uint8_t *)outbuf;
1363 }
1364
1365
1366 /*******************************************************************
1367  Dump a packet to a file.
1368 ********************************************************************/
1369
1370 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1371 {
1372         int fd, i;
1373         char *fname = NULL;
1374         if (DEBUGLEVEL < 50) {
1375                 return;
1376         }
1377
1378         if (len < 4) len = smb_len(data)+4;
1379         for (i=1;i<100;i++) {
1380                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1381                              type ? "req" : "resp") == -1) {
1382                         return;
1383                 }
1384                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1385                 if (fd != -1 || errno != EEXIST) break;
1386         }
1387         if (fd != -1) {
1388                 ssize_t ret = write(fd, data, len);
1389                 if (ret != len)
1390                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1391                 close(fd);
1392                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1393         }
1394         SAFE_FREE(fname);
1395 }
1396
1397 /****************************************************************************
1398  Prepare everything for calling the actual request function, and potentially
1399  call the request function via the "new" interface.
1400
1401  Return False if the "legacy" function needs to be called, everything is
1402  prepared.
1403
1404  Return True if we're done.
1405
1406  I know this API sucks, but it is the one with the least code change I could
1407  find.
1408 ****************************************************************************/
1409
1410 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1411 {
1412         int flags;
1413         uint16 session_tag;
1414         connection_struct *conn = NULL;
1415         struct smbd_server_connection *sconn = req->sconn;
1416
1417         errno = 0;
1418
1419         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1420          * so subtract 4 from it. */
1421         if (!valid_smb_header(req->inbuf)
1422             || (size < (smb_size - 4))) {
1423                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1424                          smb_len(req->inbuf)));
1425                 exit_server_cleanly("Non-SMB packet");
1426         }
1427
1428         if (smb_messages[type].fn == NULL) {
1429                 DEBUG(0,("Unknown message type %d!\n",type));
1430                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1431                 reply_unknown_new(req, type);
1432                 return NULL;
1433         }
1434
1435         flags = smb_messages[type].flags;
1436
1437         /* In share mode security we must ignore the vuid. */
1438         session_tag = (lp_security() == SEC_SHARE)
1439                 ? UID_FIELD_INVALID : req->vuid;
1440         conn = req->conn;
1441
1442         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1443                  (int)sys_getpid(), (unsigned long)conn));
1444
1445         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1446
1447         /* Ensure this value is replaced in the incoming packet. */
1448         SSVAL(req->inbuf,smb_uid,session_tag);
1449
1450         /*
1451          * Ensure the correct username is in current_user_info.  This is a
1452          * really ugly bugfix for problems with multiple session_setup_and_X's
1453          * being done and allowing %U and %G substitutions to work correctly.
1454          * There is a reason this code is done here, don't move it unless you
1455          * know what you're doing... :-).
1456          * JRA.
1457          */
1458
1459         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1460                 user_struct *vuser = NULL;
1461
1462                 sconn->smb1.sessions.last_session_tag = session_tag;
1463                 if(session_tag != UID_FIELD_INVALID) {
1464                         vuser = get_valid_user_struct(sconn, session_tag);
1465                         if (vuser) {
1466                                 set_current_user_info(
1467                                         vuser->server_info->sanitized_username,
1468                                         vuser->server_info->unix_name,
1469                                         vuser->server_info->info3->base.domain.string);
1470                         }
1471                 }
1472         }
1473
1474         /* Does this call need to be run as the connected user? */
1475         if (flags & AS_USER) {
1476
1477                 /* Does this call need a valid tree connection? */
1478                 if (!conn) {
1479                         /*
1480                          * Amazingly, the error code depends on the command
1481                          * (from Samba4).
1482                          */
1483                         if (type == SMBntcreateX) {
1484                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1485                         } else {
1486                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1487                         }
1488                         return NULL;
1489                 }
1490
1491                 if (!change_to_user(conn,session_tag)) {
1492                         DEBUG(0, ("Error: Could not change to user. Removing "
1493                                 "deferred open, mid=%llu.\n",
1494                                 (unsigned long long)req->mid));
1495                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1496                         return conn;
1497                 }
1498
1499                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1500
1501                 /* Does it need write permission? */
1502                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1503                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1504                         return conn;
1505                 }
1506
1507                 /* IPC services are limited */
1508                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1509                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1510                         return conn;
1511                 }
1512         } else {
1513                 /* This call needs to be run as root */
1514                 change_to_root_user();
1515         }
1516
1517         /* load service specific parameters */
1518         if (conn) {
1519                 if (req->encrypted) {
1520                         conn->encrypted_tid = true;
1521                         /* encrypted required from now on. */
1522                         conn->encrypt_level = Required;
1523                 } else if (ENCRYPTION_REQUIRED(conn)) {
1524                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1525                                 exit_server_cleanly("encryption required "
1526                                         "on connection");
1527                                 return conn;
1528                         }
1529                 }
1530
1531                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1532                                          (flags & (AS_USER|DO_CHDIR)
1533                                           ?True:False))) {
1534                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1535                         return conn;
1536                 }
1537                 conn->num_smb_operations++;
1538         }
1539
1540         /* does this protocol need to be run as guest? */
1541         if ((flags & AS_GUEST)
1542             && (!change_to_guest() ||
1543                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1544                               lp_hostsdeny(-1)))) {
1545                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1546                 return conn;
1547         }
1548
1549         smb_messages[type].fn(req);
1550         return req->conn;
1551 }
1552
1553 /****************************************************************************
1554  Construct a reply to the incoming packet.
1555 ****************************************************************************/
1556
1557 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1558                             uint32_t seqnum, bool encrypted,
1559                             struct smb_perfcount_data *deferred_pcd)
1560 {
1561         connection_struct *conn;
1562         struct smb_request *req;
1563
1564         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1565                 smb_panic("could not allocate smb_request");
1566         }
1567
1568         if (!init_smb_request(req, smbd_server_conn, (uint8 *)inbuf,
1569                               unread_bytes, encrypted, seqnum)) {
1570                 exit_server_cleanly("Invalid SMB request");
1571         }
1572
1573         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1574
1575         /* we popped this message off the queue - keep original perf data */
1576         if (deferred_pcd)
1577                 req->pcd = *deferred_pcd;
1578         else {
1579                 SMB_PERFCOUNT_START(&req->pcd);
1580                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1581                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1582         }
1583
1584         conn = switch_message(req->cmd, req, size);
1585
1586         if (req->unread_bytes) {
1587                 /* writeX failed. drain socket. */
1588                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1589                                 req->unread_bytes) {
1590                         smb_panic("failed to drain pending bytes");
1591                 }
1592                 req->unread_bytes = 0;
1593         }
1594
1595         if (req->done) {
1596                 TALLOC_FREE(req);
1597                 return;
1598         }
1599
1600         if (req->outbuf == NULL) {
1601                 return;
1602         }
1603
1604         if (CVAL(req->outbuf,0) == 0) {
1605                 show_msg((char *)req->outbuf);
1606         }
1607
1608         if (!srv_send_smb(smbd_server_fd(),
1609                         (char *)req->outbuf,
1610                         true, req->seqnum+1,
1611                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1612                         &req->pcd)) {
1613                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1614         }
1615
1616         TALLOC_FREE(req);
1617
1618         return;
1619 }
1620
1621 /****************************************************************************
1622  Process an smb from the client
1623 ****************************************************************************/
1624 static void process_smb(struct smbd_server_connection *conn,
1625                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1626                         uint32_t seqnum, bool encrypted,
1627                         struct smb_perfcount_data *deferred_pcd)
1628 {
1629         int msg_type = CVAL(inbuf,0);
1630
1631         DO_PROFILE_INC(smb_count);
1632
1633         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1634                     smb_len(inbuf) ) );
1635         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1636                                 (int)nread,
1637                                 (unsigned int)unread_bytes ));
1638
1639         if (msg_type != 0) {
1640                 /*
1641                  * NetBIOS session request, keepalive, etc.
1642                  */
1643                 reply_special(conn, (char *)inbuf);
1644                 goto done;
1645         }
1646
1647         if (smbd_server_conn->using_smb2) {
1648                 /* At this point we're not really using smb2,
1649                  * we make the decision here.. */
1650                 if (smbd_is_smb2_header(inbuf, nread)) {
1651                         smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1652                         return;
1653                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1654                                 && CVAL(inbuf, smb_com) != 0x72) {
1655                         /* This is a non-negprot SMB1 packet.
1656                            Disable SMB2 from now on. */
1657                         smbd_server_conn->using_smb2 = false;
1658                 }
1659         }
1660
1661         show_msg((char *)inbuf);
1662
1663         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1664         trans_num++;
1665
1666 done:
1667         conn->smb1.num_requests++;
1668
1669         /* The timeout_processing function isn't run nearly
1670            often enough to implement 'max log size' without
1671            overrunning the size of the file by many megabytes.
1672            This is especially true if we are running at debug
1673            level 10.  Checking every 50 SMBs is a nice
1674            tradeoff of performance vs log file size overrun. */
1675
1676         if ((conn->smb1.num_requests % 50) == 0 &&
1677             need_to_check_log_size()) {
1678                 change_to_root_user();
1679                 check_log_size();
1680         }
1681 }
1682
1683 /****************************************************************************
1684  Return a string containing the function name of a SMB command.
1685 ****************************************************************************/
1686
1687 const char *smb_fn_name(int type)
1688 {
1689         const char *unknown_name = "SMBunknown";
1690
1691         if (smb_messages[type].name == NULL)
1692                 return(unknown_name);
1693
1694         return(smb_messages[type].name);
1695 }
1696
1697 /****************************************************************************
1698  Helper functions for contruct_reply.
1699 ****************************************************************************/
1700
1701 void add_to_common_flags2(uint32 v)
1702 {
1703         common_flags2 |= v;
1704 }
1705
1706 void remove_from_common_flags2(uint32 v)
1707 {
1708         common_flags2 &= ~v;
1709 }
1710
1711 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1712                                    char *outbuf)
1713 {
1714         srv_set_message(outbuf,0,0,false);
1715
1716         SCVAL(outbuf, smb_com, req->cmd);
1717         SIVAL(outbuf,smb_rcls,0);
1718         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1719         SSVAL(outbuf,smb_flg2,
1720                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1721                 common_flags2);
1722         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1723
1724         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1725         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1726         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1727         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1728 }
1729
1730 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1731 {
1732         construct_reply_common(req, (char *)req->inbuf, outbuf);
1733 }
1734
1735 /*
1736  * How many bytes have we already accumulated up to the current wct field
1737  * offset?
1738  */
1739
1740 size_t req_wct_ofs(struct smb_request *req)
1741 {
1742         size_t buf_size;
1743
1744         if (req->chain_outbuf == NULL) {
1745                 return smb_wct - 4;
1746         }
1747         buf_size = talloc_get_size(req->chain_outbuf);
1748         if ((buf_size % 4) != 0) {
1749                 buf_size += (4 - (buf_size % 4));
1750         }
1751         return buf_size - 4;
1752 }
1753
1754 /*
1755  * Hack around reply_nterror & friends not being aware of chained requests,
1756  * generating illegal (i.e. wct==0) chain replies.
1757  */
1758
1759 static void fixup_chain_error_packet(struct smb_request *req)
1760 {
1761         uint8_t *outbuf = req->outbuf;
1762         req->outbuf = NULL;
1763         reply_outbuf(req, 2, 0);
1764         memcpy(req->outbuf, outbuf, smb_wct);
1765         TALLOC_FREE(outbuf);
1766         SCVAL(req->outbuf, smb_vwv0, 0xff);
1767 }
1768
1769 /**
1770  * @brief Find the smb_cmd offset of the last command pushed
1771  * @param[in] buf       The buffer we're building up
1772  * @retval              Where can we put our next andx cmd?
1773  *
1774  * While chaining requests, the "next" request we're looking at needs to put
1775  * its SMB_Command before the data the previous request already built up added
1776  * to the chain. Find the offset to the place where we have to put our cmd.
1777  */
1778
1779 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1780 {
1781         uint8_t cmd;
1782         size_t ofs;
1783
1784         cmd = CVAL(buf, smb_com);
1785
1786         SMB_ASSERT(is_andx_req(cmd));
1787
1788         ofs = smb_vwv0;
1789
1790         while (CVAL(buf, ofs) != 0xff) {
1791
1792                 if (!is_andx_req(CVAL(buf, ofs))) {
1793                         return false;
1794                 }
1795
1796                 /*
1797                  * ofs is from start of smb header, so add the 4 length
1798                  * bytes. The next cmd is right after the wct field.
1799                  */
1800                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1801
1802                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1803         }
1804
1805         *pofs = ofs;
1806         return true;
1807 }
1808
1809 /**
1810  * @brief Do the smb chaining at a buffer level
1811  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1812  * @param[in] smb_command       The command that we want to issue
1813  * @param[in] wct               How many words?
1814  * @param[in] vwv               The words, already in network order
1815  * @param[in] bytes_alignment   How shall we align "bytes"?
1816  * @param[in] num_bytes         How many bytes?
1817  * @param[in] bytes             The data the request ships
1818  *
1819  * smb_splice_chain() adds the vwv and bytes to the request already present in
1820  * *poutbuf.
1821  */
1822
1823 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1824                              uint8_t wct, const uint16_t *vwv,
1825                              size_t bytes_alignment,
1826                              uint32_t num_bytes, const uint8_t *bytes)
1827 {
1828         uint8_t *outbuf;
1829         size_t old_size, new_size;
1830         size_t ofs;
1831         size_t chain_padding = 0;
1832         size_t bytes_padding = 0;
1833         bool first_request;
1834
1835         old_size = talloc_get_size(*poutbuf);
1836
1837         /*
1838          * old_size == smb_wct means we're pushing the first request in for
1839          * libsmb/
1840          */
1841
1842         first_request = (old_size == smb_wct);
1843
1844         if (!first_request && ((old_size % 4) != 0)) {
1845                 /*
1846                  * Align the wct field of subsequent requests to a 4-byte
1847                  * boundary
1848                  */
1849                 chain_padding = 4 - (old_size % 4);
1850         }
1851
1852         /*
1853          * After the old request comes the new wct field (1 byte), the vwv's
1854          * and the num_bytes field. After at we might need to align the bytes
1855          * given to us to "bytes_alignment", increasing the num_bytes value.
1856          */
1857
1858         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1859
1860         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1861                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1862         }
1863
1864         new_size += bytes_padding + num_bytes;
1865
1866         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1867                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1868                           (unsigned)new_size));
1869                 return false;
1870         }
1871
1872         outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1873         if (outbuf == NULL) {
1874                 DEBUG(0, ("talloc failed\n"));
1875                 return false;
1876         }
1877         *poutbuf = outbuf;
1878
1879         if (first_request) {
1880                 SCVAL(outbuf, smb_com, smb_command);
1881         } else {
1882                 size_t andx_cmd_ofs;
1883
1884                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1885                         DEBUG(1, ("invalid command chain\n"));
1886                         *poutbuf = TALLOC_REALLOC_ARRAY(
1887                                 NULL, *poutbuf, uint8_t, old_size);
1888                         return false;
1889                 }
1890
1891                 if (chain_padding != 0) {
1892                         memset(outbuf + old_size, 0, chain_padding);
1893                         old_size += chain_padding;
1894                 }
1895
1896                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1897                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1898         }
1899
1900         ofs = old_size;
1901
1902         /*
1903          * Push the chained request:
1904          *
1905          * wct field
1906          */
1907
1908         SCVAL(outbuf, ofs, wct);
1909         ofs += 1;
1910
1911         /*
1912          * vwv array
1913          */
1914
1915         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1916         ofs += sizeof(uint16_t) * wct;
1917
1918         /*
1919          * bcc (byte count)
1920          */
1921
1922         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1923         ofs += sizeof(uint16_t);
1924
1925         /*
1926          * padding
1927          */
1928
1929         if (bytes_padding != 0) {
1930                 memset(outbuf + ofs, 0, bytes_padding);
1931                 ofs += bytes_padding;
1932         }
1933
1934         /*
1935          * The bytes field
1936          */
1937
1938         memcpy(outbuf + ofs, bytes, num_bytes);
1939
1940         return true;
1941 }
1942
1943 /****************************************************************************
1944  Construct a chained reply and add it to the already made reply
1945 ****************************************************************************/
1946
1947 void chain_reply(struct smb_request *req)
1948 {
1949         size_t smblen = smb_len(req->inbuf);
1950         size_t already_used, length_needed;
1951         uint8_t chain_cmd;
1952         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1953
1954         uint8_t wct;
1955         uint16_t *vwv;
1956         uint16_t buflen;
1957         uint8_t *buf;
1958
1959         if (IVAL(req->outbuf, smb_rcls) != 0) {
1960                 fixup_chain_error_packet(req);
1961         }
1962
1963         /*
1964          * Any of the AndX requests and replies have at least a wct of
1965          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1966          * beginning of the SMB header to the next wct field.
1967          *
1968          * None of the AndX requests put anything valuable in vwv[0] and [1],
1969          * so we can overwrite it here to form the chain.
1970          */
1971
1972         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1973                 if (req->chain_outbuf == NULL) {
1974                         req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1975                                 req, req->outbuf, uint8_t,
1976                                 smb_len(req->outbuf) + 4);
1977                         if (req->chain_outbuf == NULL) {
1978                                 smb_panic("talloc failed");
1979                         }
1980                 }
1981                 req->outbuf = NULL;
1982                 goto error;
1983         }
1984
1985         /*
1986          * Here we assume that this is the end of the chain. For that we need
1987          * to set "next command" to 0xff and the offset to 0. If we later find
1988          * more commands in the chain, this will be overwritten again.
1989          */
1990
1991         SCVAL(req->outbuf, smb_vwv0, 0xff);
1992         SCVAL(req->outbuf, smb_vwv0+1, 0);
1993         SSVAL(req->outbuf, smb_vwv1, 0);
1994
1995         if (req->chain_outbuf == NULL) {
1996                 /*
1997                  * In req->chain_outbuf we collect all the replies. Start the
1998                  * chain by copying in the first reply.
1999                  *
2000                  * We do the realloc because later on we depend on
2001                  * talloc_get_size to determine the length of
2002                  * chain_outbuf. The reply_xxx routines might have
2003                  * over-allocated (reply_pipe_read_and_X used to be such an
2004                  * example).
2005                  */
2006                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
2007                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
2008                 if (req->chain_outbuf == NULL) {
2009                         smb_panic("talloc failed");
2010                 }
2011                 req->outbuf = NULL;
2012         } else {
2013                 /*
2014                  * Update smb headers where subsequent chained commands
2015                  * may have updated them.
2016                  */
2017                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
2018                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
2019
2020                 if (!smb_splice_chain(&req->chain_outbuf,
2021                                       CVAL(req->outbuf, smb_com),
2022                                       CVAL(req->outbuf, smb_wct),
2023                                       (uint16_t *)(req->outbuf + smb_vwv),
2024                                       0, smb_buflen(req->outbuf),
2025                                       (uint8_t *)smb_buf(req->outbuf))) {
2026                         goto error;
2027                 }
2028                 TALLOC_FREE(req->outbuf);
2029         }
2030
2031         /*
2032          * We use the old request's vwv field to grab the next chained command
2033          * and offset into the chained fields.
2034          */
2035
2036         chain_cmd = CVAL(req->vwv+0, 0);
2037         chain_offset = SVAL(req->vwv+1, 0);
2038
2039         if (chain_cmd == 0xff) {
2040                 /*
2041                  * End of chain, no more requests from the client. So ship the
2042                  * replies.
2043                  */
2044                 smb_setlen((char *)(req->chain_outbuf),
2045                            talloc_get_size(req->chain_outbuf) - 4);
2046
2047                 if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2048                                   true, req->seqnum+1,
2049                                   IS_CONN_ENCRYPTED(req->conn)
2050                                   ||req->encrypted,
2051                                   &req->pcd)) {
2052                         exit_server_cleanly("chain_reply: srv_send_smb "
2053                                             "failed.");
2054                 }
2055                 TALLOC_FREE(req->chain_outbuf);
2056                 req->done = true;
2057                 return;
2058         }
2059
2060         /* add a new perfcounter for this element of chain */
2061         SMB_PERFCOUNT_ADD(&req->pcd);
2062         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2063         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2064
2065         /*
2066          * Check if the client tries to fool us. The request so far uses the
2067          * space to the end of the byte buffer in the request just
2068          * processed. The chain_offset can't point into that area. If that was
2069          * the case, we could end up with an endless processing of the chain,
2070          * we would always handle the same request.
2071          */
2072
2073         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2074         if (chain_offset < already_used) {
2075                 goto error;
2076         }
2077
2078         /*
2079          * Next check: Make sure the chain offset does not point beyond the
2080          * overall smb request length.
2081          */
2082
2083         length_needed = chain_offset+1; /* wct */
2084         if (length_needed > smblen) {
2085                 goto error;
2086         }
2087
2088         /*
2089          * Now comes the pointer magic. Goal here is to set up req->vwv and
2090          * req->buf correctly again to be able to call the subsequent
2091          * switch_message(). The chain offset (the former vwv[1]) points at
2092          * the new wct field.
2093          */
2094
2095         wct = CVAL(smb_base(req->inbuf), chain_offset);
2096
2097         /*
2098          * Next consistency check: Make the new vwv array fits in the overall
2099          * smb request.
2100          */
2101
2102         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2103         if (length_needed > smblen) {
2104                 goto error;
2105         }
2106         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2107
2108         /*
2109          * Now grab the new byte buffer....
2110          */
2111
2112         buflen = SVAL(vwv+wct, 0);
2113
2114         /*
2115          * .. and check that it fits.
2116          */
2117
2118         length_needed += buflen;
2119         if (length_needed > smblen) {
2120                 goto error;
2121         }
2122         buf = (uint8_t *)(vwv+wct+1);
2123
2124         req->cmd = chain_cmd;
2125         req->wct = wct;
2126         req->vwv = vwv;
2127         req->buflen = buflen;
2128         req->buf = buf;
2129
2130         switch_message(chain_cmd, req, smblen);
2131
2132         if (req->outbuf == NULL) {
2133                 /*
2134                  * This happens if the chained command has suspended itself or
2135                  * if it has called srv_send_smb() itself.
2136                  */
2137                 return;
2138         }
2139
2140         /*
2141          * We end up here if the chained command was not itself chained or
2142          * suspended, but for example a close() command. We now need to splice
2143          * the chained commands' outbuf into the already built up chain_outbuf
2144          * and ship the result.
2145          */
2146         goto done;
2147
2148  error:
2149         /*
2150          * We end up here if there's any error in the chain syntax. Report a
2151          * DOS error, just like Windows does.
2152          */
2153         reply_force_doserror(req, ERRSRV, ERRerror);
2154         fixup_chain_error_packet(req);
2155
2156  done:
2157         /*
2158          * This scary statement intends to set the
2159          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2160          * to the value req->outbuf carries
2161          */
2162         SSVAL(req->chain_outbuf, smb_flg2,
2163               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2164               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2165
2166         /*
2167          * Transfer the error codes from the subrequest to the main one
2168          */
2169         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2170         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2171
2172         if (!smb_splice_chain(&req->chain_outbuf,
2173                               CVAL(req->outbuf, smb_com),
2174                               CVAL(req->outbuf, smb_wct),
2175                               (uint16_t *)(req->outbuf + smb_vwv),
2176                               0, smb_buflen(req->outbuf),
2177                               (uint8_t *)smb_buf(req->outbuf))) {
2178                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2179         }
2180         TALLOC_FREE(req->outbuf);
2181
2182         smb_setlen((char *)(req->chain_outbuf),
2183                    talloc_get_size(req->chain_outbuf) - 4);
2184
2185         show_msg((char *)(req->chain_outbuf));
2186
2187         if (!srv_send_smb(smbd_server_fd(), (char *)req->chain_outbuf,
2188                           true, req->seqnum+1,
2189                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2190                           &req->pcd)) {
2191                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
2192         }
2193         TALLOC_FREE(req->chain_outbuf);
2194         req->done = true;
2195 }
2196
2197 /****************************************************************************
2198  Check if services need reloading.
2199 ****************************************************************************/
2200
2201 void check_reload(time_t t)
2202 {
2203         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2204
2205         if(last_smb_conf_reload_time == 0) {
2206                 last_smb_conf_reload_time = t;
2207                 /* Our printing subsystem might not be ready at smbd start up.
2208                    Then no printer is available till the first printers check
2209                    is performed.  A lower initial interval circumvents this. */
2210                 if ( printcap_cache_time > 60 )
2211                         last_printer_reload_time = t - printcap_cache_time + 60;
2212                 else
2213                         last_printer_reload_time = t;
2214         }
2215
2216         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2217                 /* randomize over 60 second the printcap reload to avoid all
2218                  * process hitting cupsd at the same time */
2219                 int time_range = 60;
2220
2221                 last_printer_reload_time += random() % time_range;
2222                 mypid = getpid();
2223         }
2224
2225         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2226                 reload_services(True);
2227                 last_smb_conf_reload_time = t;
2228         }
2229
2230         /* 'printcap cache time = 0' disable the feature */
2231
2232         if ( printcap_cache_time != 0 )
2233         {
2234                 /* see if it's time to reload or if the clock has been set back */
2235
2236                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2237                         || (t-last_printer_reload_time  < 0) )
2238                 {
2239                         DEBUG( 3,( "Printcap cache time expired.\n"));
2240                         reload_printers(smbd_messaging_context());
2241                         last_printer_reload_time = t;
2242                 }
2243         }
2244 }
2245
2246 static bool fd_is_readable(int fd)
2247 {
2248         fd_set fds;
2249         struct timeval timeout = {0, };
2250         int ret;
2251
2252         FD_ZERO(&fds);
2253         FD_SET(fd, &fds);
2254
2255         ret = sys_select(fd+1, &fds, NULL, NULL, &timeout);
2256         if (ret == -1) {
2257                 return false;
2258         }
2259         return FD_ISSET(fd, &fds);
2260 }
2261
2262 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2263 {
2264         /* TODO: make write nonblocking */
2265 }
2266
2267 static void smbd_server_connection_read_handler(
2268         struct smbd_server_connection *conn, int fd)
2269 {
2270         uint8_t *inbuf = NULL;
2271         size_t inbuf_len = 0;
2272         size_t unread_bytes = 0;
2273         bool encrypted = false;
2274         TALLOC_CTX *mem_ctx = talloc_tos();
2275         NTSTATUS status;
2276         uint32_t seqnum;
2277
2278         bool from_client = (smbd_server_fd() == fd)?true:false;
2279
2280         if (from_client) {
2281                 smbd_lock_socket(conn);
2282
2283                 if (!fd_is_readable(smbd_server_fd())) {
2284                         DEBUG(10,("the echo listener was faster\n"));
2285                         smbd_unlock_socket(conn);
2286                         return;
2287                 }
2288
2289                 /* TODO: make this completely nonblocking */
2290                 status = receive_smb_talloc(mem_ctx, fd,
2291                                             (char **)(void *)&inbuf,
2292                                             0, /* timeout */
2293                                             &unread_bytes,
2294                                             &encrypted,
2295                                             &inbuf_len, &seqnum,
2296                                             false /* trusted channel */);
2297                 smbd_unlock_socket(conn);
2298         } else {
2299                 /* TODO: make this completely nonblocking */
2300                 status = receive_smb_talloc(mem_ctx, fd,
2301                                             (char **)(void *)&inbuf,
2302                                             0, /* timeout */
2303                                             &unread_bytes,
2304                                             &encrypted,
2305                                             &inbuf_len, &seqnum,
2306                                             true /* trusted channel */);
2307         }
2308
2309         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2310                 goto process;
2311         }
2312         if (NT_STATUS_IS_ERR(status)) {
2313                 exit_server_cleanly("failed to receive smb request");
2314         }
2315         if (!NT_STATUS_IS_OK(status)) {
2316                 return;
2317         }
2318
2319 process:
2320         process_smb(conn, inbuf, inbuf_len, unread_bytes,
2321                     seqnum, encrypted, NULL);
2322 }
2323
2324 static void smbd_server_connection_handler(struct event_context *ev,
2325                                            struct fd_event *fde,
2326                                            uint16_t flags,
2327                                            void *private_data)
2328 {
2329         struct smbd_server_connection *conn = talloc_get_type(private_data,
2330                                               struct smbd_server_connection);
2331
2332         if (flags & EVENT_FD_WRITE) {
2333                 smbd_server_connection_write_handler(conn);
2334         } else if (flags & EVENT_FD_READ) {
2335                 smbd_server_connection_read_handler(conn, smbd_server_fd());
2336         }
2337 }
2338
2339 static void smbd_server_echo_handler(struct event_context *ev,
2340                                      struct fd_event *fde,
2341                                      uint16_t flags,
2342                                      void *private_data)
2343 {
2344         struct smbd_server_connection *conn = talloc_get_type(private_data,
2345                                               struct smbd_server_connection);
2346
2347         if (flags & EVENT_FD_WRITE) {
2348                 smbd_server_connection_write_handler(conn);
2349         } else if (flags & EVENT_FD_READ) {
2350                 smbd_server_connection_read_handler(
2351                         conn, conn->smb1.echo_handler.trusted_fd);
2352         }
2353 }
2354
2355 /****************************************************************************
2356 received when we should release a specific IP
2357 ****************************************************************************/
2358 static void release_ip(const char *ip, void *priv)
2359 {
2360         char addr[INET6_ADDRSTRLEN];
2361         char *p = addr;
2362
2363         client_socket_addr(get_client_fd(),addr,sizeof(addr));
2364
2365         if (strncmp("::ffff:", addr, 7) == 0) {
2366                 p = addr + 7;
2367         }
2368
2369         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2370                 /* we can't afford to do a clean exit - that involves
2371                    database writes, which would potentially mean we
2372                    are still running after the failover has finished -
2373                    we have to get rid of this process ID straight
2374                    away */
2375                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2376                         ip));
2377                 /* note we must exit with non-zero status so the unclean handler gets
2378                    called in the parent, so that the brl database is tickled */
2379                 _exit(1);
2380         }
2381 }
2382
2383 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2384                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2385 {
2386         release_ip((char *)data->data, NULL);
2387 }
2388
2389 #ifdef CLUSTER_SUPPORT
2390 static int client_get_tcp_info(struct sockaddr_storage *server,
2391                                struct sockaddr_storage *client)
2392 {
2393         socklen_t length;
2394         if (server_fd == -1) {
2395                 return -1;
2396         }
2397         length = sizeof(*server);
2398         if (getsockname(server_fd, (struct sockaddr *)server, &length) != 0) {
2399                 return -1;
2400         }
2401         length = sizeof(*client);
2402         if (getpeername(server_fd, (struct sockaddr *)client, &length) != 0) {
2403                 return -1;
2404         }
2405         return 0;
2406 }
2407 #endif
2408
2409 /*
2410  * Send keepalive packets to our client
2411  */
2412 static bool keepalive_fn(const struct timeval *now, void *private_data)
2413 {
2414         struct smbd_server_connection *sconn = smbd_server_conn;
2415         bool ret;
2416
2417         if (sconn->using_smb2) {
2418                 /* Don't do keepalives on an SMB2 connection. */
2419                 return false;
2420         }
2421
2422         smbd_lock_socket(smbd_server_conn);
2423         ret = send_keepalive(smbd_server_fd());
2424         smbd_unlock_socket(smbd_server_conn);
2425
2426         if (!ret) {
2427                 DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
2428                 return False;
2429         }
2430         return True;
2431 }
2432
2433 /*
2434  * Do the recurring check if we're idle
2435  */
2436 static bool deadtime_fn(const struct timeval *now, void *private_data)
2437 {
2438         struct smbd_server_connection *sconn =
2439                 (struct smbd_server_connection *)private_data;
2440
2441         if (sconn->using_smb2) {
2442                 /* TODO: implement real idle check */
2443                 if (sconn->smb2.sessions.list) {
2444                         return true;
2445                 }
2446                 DEBUG( 2, ( "Closing idle SMB2 connection\n" ) );
2447                 messaging_send(sconn->msg_ctx, procid_self(),
2448                                MSG_SHUTDOWN, &data_blob_null);
2449                 return false;
2450         }
2451
2452         if ((conn_num_open(sconn) == 0)
2453             || (conn_idle_all(sconn, now->tv_sec))) {
2454                 DEBUG( 2, ( "Closing idle SMB1 connection\n" ) );
2455                 messaging_send(sconn->msg_ctx, procid_self(),
2456                                MSG_SHUTDOWN, &data_blob_null);
2457                 return False;
2458         }
2459
2460         return True;
2461 }
2462
2463 /*
2464  * Do the recurring log file and smb.conf reload checks.
2465  */
2466
2467 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2468 {
2469         change_to_root_user();
2470
2471         /* update printer queue caches if necessary */
2472         update_monitored_printq_cache();
2473
2474         /* check if we need to reload services */
2475         check_reload(time(NULL));
2476
2477         /* Change machine password if neccessary. */
2478         attempt_machine_password_change();
2479
2480         /*
2481          * Force a log file check.
2482          */
2483         force_check_log_size();
2484         check_log_size();
2485         return true;
2486 }
2487
2488 static int create_unlink_tmp(const char *dir)
2489 {
2490         char *fname;
2491         int fd;
2492
2493         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2494         if (fname == NULL) {
2495                 errno = ENOMEM;
2496                 return -1;
2497         }
2498         fd = mkstemp(fname);
2499         if (fd == -1) {
2500                 TALLOC_FREE(fname);
2501                 return -1;
2502         }
2503         if (unlink(fname) == -1) {
2504                 int sys_errno = errno;
2505                 close(fd);
2506                 TALLOC_FREE(fname);
2507                 errno = sys_errno;
2508                 return -1;
2509         }
2510         TALLOC_FREE(fname);
2511         return fd;
2512 }
2513
2514 struct smbd_echo_state {
2515         struct tevent_context *ev;
2516         struct iovec *pending;
2517         struct smbd_server_connection *sconn;
2518         int parent_pipe;
2519
2520         struct tevent_fd *parent_fde;
2521
2522         struct tevent_fd *read_fde;
2523         struct tevent_req *write_req;
2524 };
2525
2526 static void smbd_echo_writer_done(struct tevent_req *req);
2527
2528 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2529 {
2530         int num_pending;
2531
2532         if (state->write_req != NULL) {
2533                 return;
2534         }
2535
2536         num_pending = talloc_array_length(state->pending);
2537         if (num_pending == 0) {
2538                 return;
2539         }
2540
2541         state->write_req = writev_send(state, state->ev, NULL,
2542                                        state->parent_pipe, false,
2543                                        state->pending, num_pending);
2544         if (state->write_req == NULL) {
2545                 DEBUG(1, ("writev_send failed\n"));
2546                 exit(1);
2547         }
2548
2549         talloc_steal(state->write_req, state->pending);
2550         state->pending = NULL;
2551
2552         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2553                                 state);
2554 }
2555
2556 static void smbd_echo_writer_done(struct tevent_req *req)
2557 {
2558         struct smbd_echo_state *state = tevent_req_callback_data(
2559                 req, struct smbd_echo_state);
2560         ssize_t written;
2561         int err;
2562
2563         written = writev_recv(req, &err);
2564         TALLOC_FREE(req);
2565         state->write_req = NULL;
2566         if (written == -1) {
2567                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2568                 exit(1);
2569         }
2570         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2571         smbd_echo_activate_writer(state);
2572 }
2573
2574 static bool smbd_echo_reply(int fd,
2575                             uint8_t *inbuf, size_t inbuf_len,
2576                             uint32_t seqnum)
2577 {
2578         struct smb_request req;
2579         uint16_t num_replies;
2580         size_t out_len;
2581         char *outbuf;
2582         bool ok;
2583
2584         if (inbuf_len < smb_size) {
2585                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2586                 return false;
2587         }
2588         if (!valid_smb_header(inbuf)) {
2589                 DEBUG(10, ("Got invalid SMB header\n"));
2590                 return false;
2591         }
2592
2593         if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2594                               seqnum)) {
2595                 return false;
2596         }
2597         req.inbuf = inbuf;
2598
2599         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2600                    smb_messages[req.cmd].name
2601                    ? smb_messages[req.cmd].name : "unknown"));
2602
2603         if (req.cmd != SMBecho) {
2604                 return false;
2605         }
2606         if (req.wct < 1) {
2607                 return false;
2608         }
2609
2610         num_replies = SVAL(req.vwv+0, 0);
2611         if (num_replies != 1) {
2612                 /* Not a Windows "Hey, you're still there?" request */
2613                 return false;
2614         }
2615
2616         if (!create_outbuf(talloc_tos(), &req, (char *)req.inbuf, &outbuf,
2617                            1, req.buflen)) {
2618                 DEBUG(10, ("create_outbuf failed\n"));
2619                 return false;
2620         }
2621         req.outbuf = (uint8_t *)outbuf;
2622
2623         SSVAL(req.outbuf, smb_vwv0, num_replies);
2624
2625         if (req.buflen > 0) {
2626                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2627         }
2628
2629         out_len = smb_len(req.outbuf) + 4;
2630
2631         ok = srv_send_smb(smbd_server_fd(),
2632                           (char *)outbuf,
2633                           true, seqnum+1,
2634                           false, &req.pcd);
2635         TALLOC_FREE(outbuf);
2636         if (!ok) {
2637                 exit(1);
2638         }
2639
2640         return true;
2641 }
2642
2643 static void smbd_echo_exit(struct tevent_context *ev,
2644                            struct tevent_fd *fde, uint16_t flags,
2645                            void *private_data)
2646 {
2647         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2648         exit(0);
2649 }
2650
2651 static void smbd_echo_reader(struct tevent_context *ev,
2652                              struct tevent_fd *fde, uint16_t flags,
2653                              void *private_data)
2654 {
2655         struct smbd_echo_state *state = talloc_get_type_abort(
2656                 private_data, struct smbd_echo_state);
2657         struct smbd_server_connection *sconn = state->sconn;
2658         size_t unread, num_pending;
2659         NTSTATUS status;
2660         struct iovec *tmp;
2661         uint32_t seqnum = 0;
2662         bool reply;
2663         bool ok;
2664         bool encrypted = false;
2665
2666         ok = smbd_lock_socket_internal(sconn);
2667         if (!ok) {
2668                 DEBUG(0, ("%s: failed to lock socket\n",
2669                         __location__));
2670                 exit(1);
2671         }
2672
2673         if (!fd_is_readable(smbd_server_fd())) {
2674                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2675                           (int)sys_getpid()));
2676                 ok = smbd_unlock_socket_internal(sconn);
2677                 if (!ok) {
2678                         DEBUG(1, ("%s: failed to unlock socket in\n",
2679                                 __location__));
2680                         exit(1);
2681                 }
2682                 return;
2683         }
2684
2685         num_pending = talloc_array_length(state->pending);
2686         tmp = talloc_realloc(state, state->pending, struct iovec,
2687                              num_pending+1);
2688         if (tmp == NULL) {
2689                 DEBUG(1, ("talloc_realloc failed\n"));
2690                 exit(1);
2691         }
2692         state->pending = tmp;
2693
2694         DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2695
2696         status = receive_smb_talloc(state->pending, smbd_server_fd(),
2697                                     (char **)(void *)&state->pending[num_pending].iov_base,
2698                                     0 /* timeout */,
2699                                     &unread,
2700                                     &encrypted,
2701                                     &state->pending[num_pending].iov_len,
2702                                     &seqnum,
2703                                     false /* trusted_channel*/);
2704         if (!NT_STATUS_IS_OK(status)) {
2705                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2706                           (int)sys_getpid(), nt_errstr(status)));
2707                 exit(1);
2708         }
2709
2710         ok = smbd_unlock_socket_internal(sconn);
2711         if (!ok) {
2712                 DEBUG(1, ("%s: failed to unlock socket in\n",
2713                         __location__));
2714                 exit(1);
2715         }
2716
2717         /*
2718          * place the seqnum in the packet so that the main process can reply
2719          * with signing
2720          */
2721         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field, seqnum);
2722         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2723
2724         reply = smbd_echo_reply(smbd_server_fd(),
2725                                 (uint8_t *)state->pending[num_pending].iov_base,
2726                                 state->pending[num_pending].iov_len,
2727                                 seqnum);
2728         if (reply) {
2729                 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2730                 /* no check, shrinking by some bytes does not fail */
2731                 state->pending = talloc_realloc(state, state->pending,
2732                                                 struct iovec,
2733                                                 num_pending);
2734         } else {
2735                 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2736                 smbd_echo_activate_writer(state);
2737         }
2738 }
2739
2740 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2741                            int parent_pipe)
2742 {
2743         struct smbd_echo_state *state;
2744
2745         state = talloc_zero(sconn, struct smbd_echo_state);
2746         if (state == NULL) {
2747                 DEBUG(1, ("talloc failed\n"));
2748                 return;
2749         }
2750         state->sconn = sconn;
2751         state->parent_pipe = parent_pipe;
2752         state->ev = s3_tevent_context_init(state);
2753         if (state->ev == NULL) {
2754                 DEBUG(1, ("tevent_context_init failed\n"));
2755                 TALLOC_FREE(state);
2756                 return;
2757         }
2758         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2759                                         TEVENT_FD_READ, smbd_echo_exit,
2760                                         state);
2761         if (state->parent_fde == NULL) {
2762                 DEBUG(1, ("tevent_add_fd failed\n"));
2763                 TALLOC_FREE(state);
2764                 return;
2765         }
2766         state->read_fde = tevent_add_fd(state->ev, state, smbd_server_fd(),
2767                                         TEVENT_FD_READ, smbd_echo_reader,
2768                                         state);
2769         if (state->read_fde == NULL) {
2770                 DEBUG(1, ("tevent_add_fd failed\n"));
2771                 TALLOC_FREE(state);
2772                 return;
2773         }
2774
2775         while (true) {
2776                 if (tevent_loop_once(state->ev) == -1) {
2777                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2778                                   strerror(errno)));
2779                         break;
2780                 }
2781         }
2782         TALLOC_FREE(state);
2783 }
2784
2785 /*
2786  * Handle SMBecho requests in a forked child process
2787  */
2788 static bool fork_echo_handler(struct smbd_server_connection *sconn)
2789 {
2790         int listener_pipe[2];
2791         int res;
2792         pid_t child;
2793
2794         res = pipe(listener_pipe);
2795         if (res == -1) {
2796                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2797                 return false;
2798         }
2799         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2800         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2801                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2802                 goto fail;
2803         }
2804
2805         child = sys_fork();
2806         if (child == 0) {
2807                 NTSTATUS status;
2808
2809                 close(listener_pipe[0]);
2810
2811                 status = reinit_after_fork(sconn->msg_ctx,
2812                                            smbd_event_context(),
2813                                            procid_self(), false);
2814                 if (!NT_STATUS_IS_OK(status)) {
2815                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2816                                   nt_errstr(status)));
2817                         exit(1);
2818                 }
2819                 smbd_echo_loop(sconn, listener_pipe[1]);
2820                 exit(0);
2821         }
2822         close(listener_pipe[1]);
2823         listener_pipe[1] = -1;
2824         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2825
2826         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2827
2828         /*
2829          * Without smb signing this is the same as the normal smbd
2830          * listener. This needs to change once signing comes in.
2831          */
2832         sconn->smb1.echo_handler.trusted_fde = event_add_fd(smbd_event_context(),
2833                                         sconn,
2834                                         sconn->smb1.echo_handler.trusted_fd,
2835                                         EVENT_FD_READ,
2836                                         smbd_server_echo_handler,
2837                                         sconn);
2838         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2839                 DEBUG(1, ("event_add_fd failed\n"));
2840                 goto fail;
2841         }
2842
2843         return true;
2844
2845 fail:
2846         if (listener_pipe[0] != -1) {
2847                 close(listener_pipe[0]);
2848         }
2849         if (listener_pipe[1] != -1) {
2850                 close(listener_pipe[1]);
2851         }
2852         sconn->smb1.echo_handler.trusted_fd = -1;
2853         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2854                 close(sconn->smb1.echo_handler.socket_lock_fd);
2855         }
2856         sconn->smb1.echo_handler.trusted_fd = -1;
2857         sconn->smb1.echo_handler.socket_lock_fd = -1;
2858         return false;
2859 }
2860
2861 static bool spoolss_init_cb(void *ptr)
2862 {
2863         return nt_printing_tdb_migrate(smbd_messaging_context());
2864 }
2865
2866 /****************************************************************************
2867  Process commands from the client
2868 ****************************************************************************/
2869
2870 void smbd_process(void)
2871 {
2872         TALLOC_CTX *frame = talloc_stackframe();
2873         struct sockaddr_storage ss;
2874         struct sockaddr *sa = NULL;
2875         socklen_t sa_len;
2876         struct tsocket_address *local_address = NULL;
2877         struct tsocket_address *remote_address = NULL;
2878         const char *remaddr = NULL;
2879         int ret;
2880         struct rpc_srv_callbacks spoolss_cb;
2881
2882         if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2883             lp_security() != SEC_SHARE &&
2884             !lp_async_smb_echo_handler()) {
2885                 /*
2886                  * We're not making the desion here,
2887                  * we're just allowing the client
2888                  * to decide between SMB1 and SMB2
2889                  * with the first negprot
2890                  * packet.
2891                  */
2892                 smbd_server_conn->using_smb2 = true;
2893         }
2894
2895         /* Ensure child is set to blocking mode */
2896         set_blocking(smbd_server_fd(),True);
2897
2898         set_socket_options(smbd_server_fd(),"SO_KEEPALIVE");
2899         set_socket_options(smbd_server_fd(), lp_socket_options());
2900
2901         sa = (struct sockaddr *)(void *)&ss;
2902         sa_len = sizeof(ss);
2903         ret = getpeername(smbd_server_fd(), sa, &sa_len);
2904         if (ret != 0) {
2905                 int level = (errno == ENOTCONN)?2:0;
2906                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2907                 exit_server_cleanly("getpeername() failed.\n");
2908         }
2909         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2910                                                 sa, sa_len,
2911                                                 &remote_address);
2912         if (ret != 0) {
2913                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2914                         __location__, strerror(errno)));
2915                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2916         }
2917
2918         sa = (struct sockaddr *)(void *)&ss;
2919         sa_len = sizeof(ss);
2920         ret = getsockname(smbd_server_fd(), sa, &sa_len);
2921         if (ret != 0) {
2922                 int level = (errno == ENOTCONN)?2:0;
2923                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2924                 exit_server_cleanly("getsockname() failed.\n");
2925         }
2926         ret = tsocket_address_bsd_from_sockaddr(smbd_server_conn,
2927                                                 sa, sa_len,
2928                                                 &local_address);
2929         if (ret != 0) {
2930                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2931                         __location__, strerror(errno)));
2932                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2933         }
2934
2935         smbd_server_conn->local_address = local_address;
2936         smbd_server_conn->remote_address = remote_address;
2937
2938         if (tsocket_address_is_inet(remote_address, "ip")) {
2939                 remaddr = tsocket_address_inet_addr_string(
2940                                 smbd_server_conn->remote_address,
2941                                 talloc_tos());
2942                 if (remaddr == NULL) {
2943
2944                 }
2945         } else {
2946                 remaddr = "0.0.0.0";
2947         }
2948
2949         /* this is needed so that we get decent entries
2950            in smbstatus for port 445 connects */
2951         set_remote_machine_name(remaddr, false);
2952         reload_services(true);
2953
2954         /*
2955          * Before the first packet, check the global hosts allow/ hosts deny
2956          * parameters before doing any parsing of packets passed to us by the
2957          * client. This prevents attacks on our parsing code from hosts not in
2958          * the hosts allow list.
2959          */
2960
2961         if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
2962                           lp_hostsdeny(-1))) {
2963                 /*
2964                  * send a negative session response "not listening on calling
2965                  * name"
2966                  */
2967                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
2968                 DEBUG( 1, ("Connection denied from %s to %s\n",
2969                            tsocket_address_string(remote_address, talloc_tos()),
2970                            tsocket_address_string(local_address, talloc_tos())));
2971                 (void)srv_send_smb(smbd_server_fd(),(char *)buf, false,
2972                                    0, false, NULL);
2973                 exit_server_cleanly("connection denied");
2974         }
2975
2976         DEBUG(10, ("Connection allowed from %s to %s\n",
2977                    tsocket_address_string(remote_address, talloc_tos()),
2978                    tsocket_address_string(local_address, talloc_tos())));
2979
2980         init_modules();
2981
2982         smb_perfcount_init();
2983
2984         if (!init_account_policy()) {
2985                 exit_server("Could not open account policy tdb.\n");
2986         }
2987
2988         if (*lp_rootdir()) {
2989                 if (chroot(lp_rootdir()) != 0) {
2990                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
2991                         exit_server("Failed to chroot()");
2992                 }
2993                 if (chdir("/") == -1) {
2994                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
2995                         exit_server("Failed to chroot()");
2996                 }
2997                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
2998         }
2999
3000         if (!srv_init_signing(smbd_server_conn)) {
3001                 exit_server("Failed to init smb_signing");
3002         }
3003
3004         if (lp_async_smb_echo_handler() && !fork_echo_handler(smbd_server_conn)) {
3005                 exit_server("Failed to fork echo handler");
3006         }
3007
3008         /* Setup oplocks */
3009         if (!init_oplocks(smbd_messaging_context()))
3010                 exit_server("Failed to init oplocks");
3011
3012         /* register our message handlers */
3013         messaging_register(smbd_messaging_context(), NULL,
3014                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3015         messaging_register(smbd_messaging_context(), NULL,
3016                            MSG_SMB_RELEASE_IP, msg_release_ip);
3017         messaging_register(smbd_messaging_context(), NULL,
3018                            MSG_SMB_CLOSE_FILE, msg_close_file);
3019
3020         /*
3021          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3022          * MSGs to all child processes
3023          */
3024         messaging_deregister(smbd_messaging_context(),
3025                              MSG_DEBUG, NULL);
3026         messaging_register(smbd_messaging_context(), NULL,
3027                            MSG_DEBUG, debug_message);
3028
3029         if ((lp_keepalive() != 0)
3030             && !(event_add_idle(smbd_event_context(), NULL,
3031                                 timeval_set(lp_keepalive(), 0),
3032                                 "keepalive", keepalive_fn,
3033                                 NULL))) {
3034                 DEBUG(0, ("Could not add keepalive event\n"));
3035                 exit(1);
3036         }
3037
3038         if (!(event_add_idle(smbd_event_context(), NULL,
3039                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3040                              "deadtime", deadtime_fn, smbd_server_conn))) {
3041                 DEBUG(0, ("Could not add deadtime event\n"));
3042                 exit(1);
3043         }
3044
3045         if (!(event_add_idle(smbd_event_context(), NULL,
3046                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
3047                              "housekeeping", housekeeping_fn, NULL))) {
3048                 DEBUG(0, ("Could not add housekeeping event\n"));
3049                 exit(1);
3050         }
3051
3052 #ifdef CLUSTER_SUPPORT
3053
3054         if (lp_clustering()) {
3055                 /*
3056                  * We need to tell ctdb about our client's TCP
3057                  * connection, so that for failover ctdbd can send
3058                  * tickle acks, triggering a reconnection by the
3059                  * client.
3060                  */
3061
3062                 struct sockaddr_storage srv, clnt;
3063
3064                 if (client_get_tcp_info(&srv, &clnt) == 0) {
3065
3066                         NTSTATUS status;
3067
3068                         status = ctdbd_register_ips(
3069                                 messaging_ctdbd_connection(procid_self()),
3070                                 &srv, &clnt, release_ip, NULL);
3071
3072                         if (!NT_STATUS_IS_OK(status)) {
3073                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3074                                           nt_errstr(status)));
3075                         }
3076                 } else
3077                 {
3078                         DEBUG(0,("Unable to get tcp info for "
3079                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3080                                  strerror(errno)));
3081                 }
3082         }
3083
3084 #endif
3085
3086         smbd_server_conn->nbt.got_session = false;
3087
3088         smbd_server_conn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3089
3090         smbd_server_conn->smb1.sessions.done_sesssetup = false;
3091         smbd_server_conn->smb1.sessions.max_send = BUFFER_SIZE;
3092         smbd_server_conn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3093         /* users from session setup */
3094         smbd_server_conn->smb1.sessions.session_userlist = NULL;
3095         /* workgroup from session setup. */
3096         smbd_server_conn->smb1.sessions.session_workgroup = NULL;
3097         /* this holds info on user ids that are already validated for this VC */
3098         smbd_server_conn->smb1.sessions.validated_users = NULL;
3099         smbd_server_conn->smb1.sessions.next_vuid = VUID_OFFSET;
3100         smbd_server_conn->smb1.sessions.num_validated_vuids = 0;
3101
3102         conn_init(smbd_server_conn);
3103         if (!init_dptrs(smbd_server_conn)) {
3104                 exit_server("init_dptrs() failed");
3105         }
3106
3107         smbd_server_conn->smb1.fde = event_add_fd(smbd_event_context(),
3108                                                   smbd_server_conn,
3109                                                   smbd_server_fd(),
3110                                                   EVENT_FD_READ,
3111                                                   smbd_server_connection_handler,
3112                                                   smbd_server_conn);
3113         if (!smbd_server_conn->smb1.fde) {
3114                 exit_server("failed to create smbd_server_connection fde");
3115         }
3116
3117         /*
3118          * Initialize spoolss with an init function to convert printers first.
3119          * static_init_rpc will try to initialize the spoolss server too but you
3120          * can't register it twice.
3121          */
3122         spoolss_cb.init = spoolss_init_cb;
3123         spoolss_cb.shutdown = NULL;
3124
3125
3126         if (!NT_STATUS_IS_OK(rpc_winreg_init(NULL))) {
3127                 exit(1);
3128         }
3129
3130         if (!NT_STATUS_IS_OK(rpc_spoolss_init(&spoolss_cb))) {
3131                 exit(1);
3132         }
3133
3134         static_init_rpc;
3135
3136         TALLOC_FREE(frame);
3137
3138         while (True) {
3139                 NTSTATUS status;
3140
3141                 frame = talloc_stackframe_pool(8192);
3142
3143                 errno = 0;
3144
3145                 status = smbd_server_connection_loop_once(smbd_server_conn);
3146                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3147                     !NT_STATUS_IS_OK(status)) {
3148                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3149                                   " exiting\n", nt_errstr(status)));
3150                         break;
3151                 }
3152
3153                 TALLOC_FREE(frame);
3154         }
3155
3156         exit_server_cleanly(NULL);
3157 }
3158
3159 bool req_is_in_chain(struct smb_request *req)
3160 {
3161         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
3162                 /*
3163                  * We're right now handling a subsequent request, so we must
3164                  * be in a chain
3165                  */
3166                 return true;
3167         }
3168
3169         if (!is_andx_req(req->cmd)) {
3170                 return false;
3171         }
3172
3173         if (req->wct < 2) {
3174                 /*
3175                  * Okay, an illegal request, but definitely not chained :-)
3176                  */
3177                 return false;
3178         }
3179
3180         return (CVAL(req->vwv+0, 0) != 0xFF);
3181 }