source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern struct auth_context *negprot_global_auth_context;
  24 extern int smb_echo_count;
  25
  26 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
  27 static enum smb_read_errors smb_read_error = SMB_READ_OK;
  28
  29 /*
  30  * Size of data we can send to client. Set
  31  *  by the client for all protocols above CORE.
  32  *  Set by us for CORE protocol.
  33  */
  34 int max_send = BUFFER_SIZE;
  35 /*
  36  * Size of the data we can receive. Set by us.
  37  * Can be modified by the max xmit parameter.
  38  */
  39 int max_recv = BUFFER_SIZE;
  40
  41 extern int last_message;
  42 SIG_ATOMIC_T reload_after_sighup = 0;
  43 SIG_ATOMIC_T got_sig_term = 0;
  44 extern bool global_machine_password_needs_changing;
  45 extern int max_send;
  46
  47 /* Accessor function for smb_read_error for smbd functions. */
  48
  49 enum smb_read_errors *get_srv_read_error(void)
  50 {
  51         return &smb_read_error;
  52 }
  53
  54 /* Socket functions for smbd packet processing. */
  55
  56 static bool valid_packet_size(size_t len)
  57 {
  58         /*
  59          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
  60          * of header. Don't print the error if this fits.... JRA.
  61          */
  62
  63         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
  64                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
  65                                         (unsigned long)len));
  66                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
  67
  68                         /*
  69                          * Correct fix. smb_read_error may have already been
  70                          * set. Only set it here if not already set. Global
  71                          * variables still suck :-). JRA.
  72                          */
  73
  74                         cond_set_smb_read_error(get_srv_read_error(),
  75                                                 SMB_READ_ERROR);
  76                         return false;
  77                 }
  78         }
  79         return true;
  80 }
  81
  82 static ssize_t read_packet_remainder(int fd,
  83                                         char *buffer,
  84                                         unsigned int timeout,
  85                                         ssize_t len)
  86 {
  87         ssize_t ret;
  88
  89         if(len <= 0) {
  90                 return len;
  91         }
  92
  93         if (timeout > 0) {
  94                 ret = read_socket_with_timeout(fd,
  95                                                 buffer,
  96                                                 len,
  97                                                 len,
  98                                                 timeout,
  99                                                 get_srv_read_error());
 100         } else {
 101                 ret = read_data(fd, buffer, len, get_srv_read_error());
 102         }
 103
 104         if (ret != len) {
 105                 cond_set_smb_read_error(get_srv_read_error(),
 106                                         SMB_READ_ERROR);
 107                 return -1;
 108         }
 109
 110         return len;
 111 }
 112
 113 /****************************************************************************
 114  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 115 ****************************************************************************/
 116
 117 /*
 118  * Unfortunately, earlier versions of smbclient/libsmbclient
 119  * don't send this "standard" writeX header. I've fixed this
 120  * for 3.2 but we'll use the old method with earlier versions.
 121  * Windows and CIFSFS at least use this standard size. Not
 122  * sure about MacOSX.
 123  */
 124
 125 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 126                                 (2*14) + /* word count (including bcc) */ \
 127                                 1 /* pad byte */)
 128
 129 ssize_t receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 130                                         const char lenbuf[4],
 131                                         int fd,
 132                                         char **buffer,
 133                                         unsigned int timeout,
 134                                         size_t *p_unread)
 135 {
 136         /* Size of a WRITEX call (+4 byte len). */
 137         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 138         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 139         ssize_t toread;
 140         ssize_t ret;
 141
 142         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 143
 144         if (timeout > 0) {
 145                 ret = read_socket_with_timeout(fd,
 146                                         writeX_header + 4,
 147                                         STANDARD_WRITE_AND_X_HEADER_SIZE,
 148                                         STANDARD_WRITE_AND_X_HEADER_SIZE,
 149                                         timeout,
 150                                         get_srv_read_error());
 151         } else {
 152                 ret = read_data(fd,
 153                                 writeX_header+4,
 154                                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 155                                 get_srv_read_error());
 156         }
 157
 158         if (ret != STANDARD_WRITE_AND_X_HEADER_SIZE) {
 159                 cond_set_smb_read_error(get_srv_read_error(),
 160                                         SMB_READ_ERROR);
 161                 return -1;
 162         }
 163
 164         /*
 165          * Ok - now try and see if this is a possible
 166          * valid writeX call.
 167          */
 168
 169         if (is_valid_writeX_buffer(writeX_header)) {
 170                 /*
 171                  * If the data offset is beyond what
 172                  * we've read, drain the extra bytes.
 173                  */
 174                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 175                 ssize_t newlen;
 176
 177                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 178                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 179                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 180                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 181                                         " failed to drain pending bytes");
 182                         }
 183                 } else {
 184                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 185                 }
 186
 187                 /* Spoof down the length and null out the bcc. */
 188                 set_message_bcc(writeX_header, 0);
 189                 newlen = smb_len(writeX_header);
 190
 191                 /* Copy the header we've written. */
 192
 193                 *buffer = TALLOC_MEMDUP(mem_ctx,
 194                                 writeX_header,
 195                                 sizeof(writeX_header));
 196
 197                 if (*buffer == NULL) {
 198                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 199                                   (int)sizeof(writeX_header)));
 200                         cond_set_smb_read_error(get_srv_read_error(),
 201                                                 SMB_READ_ERROR);
 202                         return -1;
 203                 }
 204
 205                 /* Work out the remaining bytes. */
 206                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 207
 208                 return newlen + 4;
 209         }
 210
 211         if (!valid_packet_size(len)) {
 212                 return -1;
 213         }
 214
 215         /*
 216          * Not a valid writeX call. Just do the standard
 217          * talloc and return.
 218          */
 219
 220         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 221
 222         if (*buffer == NULL) {
 223                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 224                           (int)len+4));
 225                 cond_set_smb_read_error(get_srv_read_error(),
 226                                         SMB_READ_ERROR);
 227                 return -1;
 228         }
 229
 230         /* Copy in what we already read. */
 231         memcpy(*buffer,
 232                 writeX_header,
 233                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 234         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 235
 236         if(toread > 0) {
 237                 ret = read_packet_remainder(fd,
 238                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 239                                         timeout,
 240                                         toread);
 241                 if (ret != toread) {
 242                         return -1;
 243                 }
 244         }
 245
 246         return len + 4;
 247 }
 248
 249 static ssize_t receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 250                                         int fd,
 251                                         char **buffer,
 252                                         unsigned int timeout,
 253                                         size_t *p_unread)
 254 {
 255         char lenbuf[4];
 256         ssize_t len,ret;
 257         int min_recv_size = lp_min_receive_file_size();
 258
 259         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 260         *p_unread = 0;
 261
 262         len = read_smb_length_return_keepalive(fd, lenbuf,
 263                         timeout, get_srv_read_error());
 264         if (len < 0) {
 265                 DEBUG(10,("receive_smb_raw: length < 0!\n"));
 266
 267                 /*
 268                  * Correct fix. smb_read_error may have already been
 269                  * set. Only set it here if not already set. Global
 270                  * variables still suck :-). JRA.
 271                  */
 272
 273                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 274                 return -1;
 275         }
 276
 277         if (CVAL(lenbuf,0) != SMBkeepalive &&
 278                         min_recv_size &&
 279                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 280                         !srv_is_signing_active()) {
 281
 282                 return receive_smb_raw_talloc_partial_read(mem_ctx,
 283                                                         lenbuf,
 284                                                         fd,
 285                                                         buffer,
 286                                                         timeout,
 287                                                         p_unread);
 288         }
 289
 290         if (!valid_packet_size(len)) {
 291                 return -1;
 292         }
 293
 294         /*
 295          * The +4 here can't wrap, we've checked the length above already.
 296          */
 297
 298         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 299
 300         if (*buffer == NULL) {
 301                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 302                           (int)len+4));
 303                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 304                 return -1;
 305         }
 306
 307         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 308
 309         ret = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 310         if (ret != len) {
 311                 return -1;
 312         }
 313
 314         return len + 4;
 315 }
 316
 317 ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd, char **buffer,
 318                            unsigned int timeout, size_t *p_unread)
 319 {
 320         ssize_t len;
 321
 322         len = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout, p_unread);
 323
 324         if (len < 0) {
 325                 return -1;
 326         }
 327
 328         /* Check the incoming SMB signature. */
 329         if (!srv_check_sign_mac(*buffer, true)) {
 330                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 331                           "incoming packet!\n"));
 332                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_BAD_SIG);
 333                 return -1;
 334         }
 335
 336         return len;
 337 }
 338
 339 /*
 340  * Initialize a struct smb_request from an inbuf
 341  */
 342
 343 void init_smb_request(struct smb_request *req,
 344                         const uint8 *inbuf,
 345                         size_t unread_bytes)
 346 {
 347         size_t req_size = smb_len(inbuf) + 4;
 348         /* Ensure we have at least smb_size bytes. */
 349         if (req_size < smb_size) {
 350                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 351                         (unsigned int)req_size ));
 352                 exit_server_cleanly("Invalid SMB request");
 353         }
 354         req->flags2 = SVAL(inbuf, smb_flg2);
 355         req->smbpid = SVAL(inbuf, smb_pid);
 356         req->mid    = SVAL(inbuf, smb_mid);
 357         req->vuid   = SVAL(inbuf, smb_uid);
 358         req->tid    = SVAL(inbuf, smb_tid);
 359         req->wct    = CVAL(inbuf, smb_wct);
 360         req->unread_bytes = unread_bytes;
 361
 362         /* Ensure we have at least wct words and 2 bytes of bcc. */
 363         if (smb_size + req->wct*2 > req_size) {
 364                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 365                         (unsigned int)req->wct,
 366                         (unsigned int)req_size));
 367                 exit_server_cleanly("Invalid SMB request");
 368         }
 369         /* Ensure bcc is correct. */
 370         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 371                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 372                         "(wct = %u, size %u)\n",
 373                         (unsigned int)smb_buflen(inbuf),
 374                         (unsigned int)req->wct,
 375                         (unsigned int)req_size));
 376                 exit_server_cleanly("Invalid SMB request");
 377         }
 378         req->inbuf  = inbuf;
 379         req->outbuf = NULL;
 380 }
 381
 382 /****************************************************************************
 383  structure to hold a linked list of queued messages.
 384  for processing.
 385 ****************************************************************************/
 386
 387 static struct pending_message_list *deferred_open_queue;
 388
 389 /****************************************************************************
 390  Function to push a message onto the tail of a linked list of smb messages ready
 391  for processing.
 392 ****************************************************************************/
 393
 394 static bool push_queued_message(struct smb_request *req,
 395                                 struct timeval request_time,
 396                                 struct timeval end_time,
 397                                 char *private_data, size_t private_len)
 398 {
 399         int msg_len = smb_len(req->inbuf) + 4;
 400         struct pending_message_list *msg;
 401
 402         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 403
 404         if(msg == NULL) {
 405                 DEBUG(0,("push_message: malloc fail (1)\n"));
 406                 return False;
 407         }
 408
 409         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 410         if(msg->buf.data == NULL) {
 411                 DEBUG(0,("push_message: malloc fail (2)\n"));
 412                 TALLOC_FREE(msg);
 413                 return False;
 414         }
 415
 416         msg->request_time = request_time;
 417         msg->end_time = end_time;
 418
 419         if (private_data) {
 420                 msg->private_data = data_blob_talloc(msg, private_data,
 421                                                      private_len);
 422                 if (msg->private_data.data == NULL) {
 423                         DEBUG(0,("push_message: malloc fail (3)\n"));
 424                         TALLOC_FREE(msg);
 425                         return False;
 426                 }
 427         }
 428
 429         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 430
 431         DEBUG(10,("push_message: pushed message length %u on "
 432                   "deferred_open_queue\n", (unsigned int)msg_len));
 433
 434         return True;
 435 }
 436
 437 /****************************************************************************
 438  Function to delete a sharing violation open message by mid.
 439 ****************************************************************************/
 440
 441 void remove_deferred_open_smb_message(uint16 mid)
 442 {
 443         struct pending_message_list *pml;
 444
 445         for (pml = deferred_open_queue; pml; pml = pml->next) {
 446                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 447                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 448                                   "deleting mid %u len %u\n",
 449                                   (unsigned int)mid,
 450                                   (unsigned int)pml->buf.length ));
 451                         DLIST_REMOVE(deferred_open_queue, pml);
 452                         TALLOC_FREE(pml);
 453                         return;
 454                 }
 455         }
 456 }
 457
 458 /****************************************************************************
 459  Move a sharing violation open retry message to the front of the list and
 460  schedule it for immediate processing.
 461 ****************************************************************************/
 462
 463 void schedule_deferred_open_smb_message(uint16 mid)
 464 {
 465         struct pending_message_list *pml;
 466         int i = 0;
 467
 468         for (pml = deferred_open_queue; pml; pml = pml->next) {
 469                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 470                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 471                         (unsigned int)msg_mid ));
 472                 if (mid == msg_mid) {
 473                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 474                                 mid ));
 475                         pml->end_time.tv_sec = 0;
 476                         pml->end_time.tv_usec = 0;
 477                         DLIST_PROMOTE(deferred_open_queue, pml);
 478                         return;
 479                 }
 480         }
 481
 482         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 483                 mid ));
 484 }
 485
 486 /****************************************************************************
 487  Return true if this mid is on the deferred queue.
 488 ****************************************************************************/
 489
 490 bool open_was_deferred(uint16 mid)
 491 {
 492         struct pending_message_list *pml;
 493
 494         for (pml = deferred_open_queue; pml; pml = pml->next) {
 495                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 496                         return True;
 497                 }
 498         }
 499         return False;
 500 }
 501
 502 /****************************************************************************
 503  Return the message queued by this mid.
 504 ****************************************************************************/
 505
 506 struct pending_message_list *get_open_deferred_message(uint16 mid)
 507 {
 508         struct pending_message_list *pml;
 509
 510         for (pml = deferred_open_queue; pml; pml = pml->next) {
 511                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 512                         return pml;
 513                 }
 514         }
 515         return NULL;
 516 }
 517
 518 /****************************************************************************
 519  Function to push a deferred open smb message onto a linked list of local smb
 520  messages ready for processing.
 521 ****************************************************************************/
 522
 523 bool push_deferred_smb_message(struct smb_request *req,
 524                                struct timeval request_time,
 525                                struct timeval timeout,
 526                                char *private_data, size_t priv_len)
 527 {
 528         struct timeval end_time;
 529
 530         if (req->unread_bytes) {
 531                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 532                         "unread_bytes = %u\n",
 533                         (unsigned int)req->unread_bytes ));
 534                 smb_panic("push_deferred_smb_message: "
 535                         "logic error unread_bytes != 0" );
 536         }
 537
 538         end_time = timeval_sum(&request_time, &timeout);
 539
 540         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 541                   "timeout time [%u.%06u]\n",
 542                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 543                   (unsigned int)end_time.tv_sec,
 544                   (unsigned int)end_time.tv_usec));
 545
 546         return push_queued_message(req, request_time, end_time,
 547                                    private_data, priv_len);
 548 }
 549
 550 struct idle_event {
 551         struct timed_event *te;
 552         struct timeval interval;
 553         char *name;
 554         bool (*handler)(const struct timeval *now, void *private_data);
 555         void *private_data;
 556 };
 557
 558 static void idle_event_handler(struct event_context *ctx,
 559                                struct timed_event *te,
 560                                const struct timeval *now,
 561                                void *private_data)
 562 {
 563         struct idle_event *event =
 564                 talloc_get_type_abort(private_data, struct idle_event);
 565
 566         TALLOC_FREE(event->te);
 567
 568         if (!event->handler(now, event->private_data)) {
 569                 /* Don't repeat, delete ourselves */
 570                 TALLOC_FREE(event);
 571                 return;
 572         }
 573
 574         event->te = event_add_timed(ctx, event,
 575                                     timeval_sum(now, &event->interval),
 576                                     event->name,
 577                                     idle_event_handler, event);
 578
 579         /* We can't do much but fail here. */
 580         SMB_ASSERT(event->te != NULL);
 581 }
 582
 583 struct idle_event *event_add_idle(struct event_context *event_ctx,
 584                                   TALLOC_CTX *mem_ctx,
 585                                   struct timeval interval,
 586                                   const char *name,
 587                                   bool (*handler)(const struct timeval *now,
 588                                                   void *private_data),
 589                                   void *private_data)
 590 {
 591         struct idle_event *result;
 592         struct timeval now = timeval_current();
 593
 594         result = TALLOC_P(mem_ctx, struct idle_event);
 595         if (result == NULL) {
 596                 DEBUG(0, ("talloc failed\n"));
 597                 return NULL;
 598         }
 599
 600         result->interval = interval;
 601         result->handler = handler;
 602         result->private_data = private_data;
 603
 604         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 605                 DEBUG(0, ("talloc failed\n"));
 606                 TALLOC_FREE(result);
 607                 return NULL;
 608         }
 609
 610         result->te = event_add_timed(event_ctx, result,
 611                                      timeval_sum(&now, &interval),
 612                                      result->name,
 613                                      idle_event_handler, result);
 614         if (result->te == NULL) {
 615                 DEBUG(0, ("event_add_timed failed\n"));
 616                 TALLOC_FREE(result);
 617                 return NULL;
 618         }
 619
 620         return result;
 621 }
 622
 623 /****************************************************************************
 624  Do all async processing in here. This includes kernel oplock messages, change
 625  notify events etc.
 626 ****************************************************************************/
 627
 628 static void async_processing(fd_set *pfds)
 629 {
 630         DEBUG(10,("async_processing: Doing async processing.\n"));
 631
 632         process_aio_queue();
 633
 634         process_kernel_oplocks(smbd_messaging_context(), pfds);
 635
 636         /* Do the aio check again after receive_local_message as it does a
 637            select and may have eaten our signal. */
 638         /* Is this till true? -- vl */
 639         process_aio_queue();
 640
 641         if (got_sig_term) {
 642                 exit_server_cleanly("termination signal");
 643         }
 644
 645         /* check for sighup processing */
 646         if (reload_after_sighup) {
 647                 change_to_root_user();
 648                 DEBUG(1,("Reloading services after SIGHUP\n"));
 649                 reload_services(False);
 650                 reload_after_sighup = 0;
 651         }
 652 }
 653
 654 /****************************************************************************
 655  Add a fd to the set we will be select(2)ing on.
 656 ****************************************************************************/
 657
 658 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 659 {
 660         if (fd != -1) {
 661                 FD_SET(fd, fds);
 662                 maxfd = MAX(maxfd, fd);
 663         }
 664
 665         return maxfd;
 666 }
 667
 668 /****************************************************************************
 669   Do a select on an two fd's - with timeout.
 670
 671   If a local udp message has been pushed onto the
 672   queue (this can only happen during oplock break
 673   processing) call async_processing()
 674
 675   If a pending smb message has been pushed onto the
 676   queue (this can only happen during oplock break
 677   processing) return this next.
 678
 679   If the first smbfd is ready then read an smb from it.
 680   if the second (loopback UDP) fd is ready then read a message
 681   from it and setup the buffer header to identify the length
 682   and from address.
 683   Returns False on timeout or error.
 684   Else returns True.
 685
 686 The timeout is in milliseconds
 687 ****************************************************************************/
 688
 689 static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 690                                 char **buffer,
 691                                 size_t *buffer_len,
 692                                 int timeout,
 693                                 size_t *p_unread)
 694 {
 695         fd_set r_fds, w_fds;
 696         int selrtn;
 697         struct timeval to;
 698         int maxfd = 0;
 699         ssize_t len;
 700
 701         *p_unread = 0;
 702         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 703
 704  again:
 705
 706         if (timeout >= 0) {
 707                 to.tv_sec = timeout / 1000;
 708                 to.tv_usec = (timeout % 1000) * 1000;
 709         } else {
 710                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 711                 to.tv_usec = 0;
 712         }
 713
 714         /*
 715          * Note that this call must be before processing any SMB
 716          * messages as we need to synchronously process any messages
 717          * we may have sent to ourselves from the previous SMB.
 718          */
 719         message_dispatch(smbd_messaging_context());
 720
 721         /*
 722          * Check to see if we already have a message on the deferred open queue
 723          * and it's time to schedule.
 724          */
 725         if(deferred_open_queue != NULL) {
 726                 bool pop_message = False;
 727                 struct pending_message_list *msg = deferred_open_queue;
 728
 729                 if (timeval_is_zero(&msg->end_time)) {
 730                         pop_message = True;
 731                 } else {
 732                         struct timeval tv;
 733                         SMB_BIG_INT tdif;
 734
 735                         GetTimeOfDay(&tv);
 736                         tdif = usec_time_diff(&msg->end_time, &tv);
 737                         if (tdif <= 0) {
 738                                 /* Timed out. Schedule...*/
 739                                 pop_message = True;
 740                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 741                         } else {
 742                                 /* Make a more accurate select timeout. */
 743                                 to.tv_sec = tdif / 1000000;
 744                                 to.tv_usec = tdif % 1000000;
 745                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 746                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 747                         }
 748                 }
 749
 750                 if (pop_message) {
 751
 752                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 753                                                         msg->buf.length);
 754                         if (*buffer == NULL) {
 755                                 DEBUG(0, ("talloc failed\n"));
 756                                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 757                                 return False;
 758                         }
 759                         *buffer_len = msg->buf.length;
 760
 761                         /* We leave this message on the queue so the open code can
 762                            know this is a retry. */
 763                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 764                         return True;
 765                 }
 766         }
 767
 768         /*
 769          * Setup the select fd sets.
 770          */
 771
 772         FD_ZERO(&r_fds);
 773         FD_ZERO(&w_fds);
 774
 775         /*
 776          * Ensure we process oplock break messages by preference.
 777          * We have to do this before the select, after the select
 778          * and if the select returns EINTR. This is due to the fact
 779          * that the selects called from async_processing can eat an EINTR
 780          * caused by a signal (we can't take the break message there).
 781          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 782          */
 783
 784         if (oplock_message_waiting(&r_fds)) {
 785                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 786                 async_processing(&r_fds);
 787                 /*
 788                  * After async processing we must go and do the select again, as
 789                  * the state of the flag in fds for the server file descriptor is
 790                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 791                  */
 792                 goto again;
 793         }
 794
 795         /*
 796          * Are there any timed events waiting ? If so, ensure we don't
 797          * select for longer than it would take to wait for them.
 798          */
 799
 800         {
 801                 struct timeval now;
 802                 GetTimeOfDay(&now);
 803
 804                 event_add_to_select_args(smbd_event_context(), &now,
 805                                          &r_fds, &w_fds, &to, &maxfd);
 806         }
 807
 808         if (timeval_is_zero(&to)) {
 809                 /* Process a timed event now... */
 810                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 811                         goto again;
 812                 }
 813         }
 814
 815         {
 816                 int sav;
 817                 START_PROFILE(smbd_idle);
 818
 819                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 820                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 821
 822                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 823                 sav = errno;
 824
 825                 END_PROFILE(smbd_idle);
 826                 errno = sav;
 827         }
 828
 829         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 830                 goto again;
 831         }
 832
 833         /* if we get EINTR then maybe we have received an oplock
 834            signal - treat this as select returning 1. This is ugly, but
 835            is the best we can do until the oplock code knows more about
 836            signals */
 837         if (selrtn == -1 && errno == EINTR) {
 838                 async_processing(&r_fds);
 839                 /*
 840                  * After async processing we must go and do the select again, as
 841                  * the state of the flag in fds for the server file descriptor is
 842                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 843                  */
 844                 goto again;
 845         }
 846
 847         /* Check if error */
 848         if (selrtn == -1) {
 849                 /* something is wrong. Maybe the socket is dead? */
 850                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 851                 return False;
 852         }
 853
 854         /* Did we timeout ? */
 855         if (selrtn == 0) {
 856                 set_smb_read_error(get_srv_read_error(),SMB_READ_TIMEOUT);
 857                 return False;
 858         }
 859
 860         /*
 861          * Ensure we process oplock break messages by preference.
 862          * This is IMPORTANT ! Otherwise we can starve other processes
 863          * sending us an oplock break message. JRA.
 864          */
 865
 866         if (oplock_message_waiting(&r_fds)) {
 867                 async_processing(&r_fds);
 868                 /*
 869                  * After async processing we must go and do the select again, as
 870                  * the state of the flag in fds for the server file descriptor is
 871                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 872                  */
 873                 goto again;
 874         }
 875
 876         len = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0, p_unread);
 877
 878         if (len == -1) {
 879                 return False;
 880         }
 881
 882         *buffer_len = (size_t)len;
 883
 884         return True;
 885 }
 886
 887 /*
 888  * Only allow 5 outstanding trans requests. We're allocating memory, so
 889  * prevent a DoS.
 890  */
 891
 892 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 893 {
 894         int count = 0;
 895         for (; list != NULL; list = list->next) {
 896
 897                 if (list->mid == mid) {
 898                         return NT_STATUS_INVALID_PARAMETER;
 899                 }
 900
 901                 count += 1;
 902         }
 903         if (count > 5) {
 904                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 905         }
 906
 907         return NT_STATUS_OK;
 908 }
 909
 910 /****************************************************************************
 911  We're terminating and have closed all our files/connections etc.
 912  If there are any pending local messages we need to respond to them
 913  before termination so that other smbds don't think we just died whilst
 914  holding oplocks.
 915 ****************************************************************************/
 916
 917 void respond_to_all_remaining_local_messages(void)
 918 {
 919         /*
 920          * Assert we have no exclusive open oplocks.
 921          */
 922
 923         if(get_number_of_exclusive_open_oplocks()) {
 924                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 925                         get_number_of_exclusive_open_oplocks() ));
 926                 return;
 927         }
 928
 929         process_kernel_oplocks(smbd_messaging_context(), NULL);
 930
 931         return;
 932 }
 933
 934
 935 /*
 936 These flags determine some of the permissions required to do an operation
 937
 938 Note that I don't set NEED_WRITE on some write operations because they
 939 are used by some brain-dead clients when printing, and I don't want to
 940 force write permissions on print services.
 941 */
 942 #define AS_USER (1<<0)
 943 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 944 #define TIME_INIT (1<<2)
 945 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 946 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 947 #define DO_CHDIR (1<<6)
 948
 949 /*
 950    define a list of possible SMB messages and their corresponding
 951    functions. Any message that has a NULL function is unimplemented -
 952    please feel free to contribute implementations!
 953 */
 954 static const struct smb_message_struct {
 955         const char *name;
 956         void (*fn_new)(connection_struct *conn, struct smb_request *req);
 957         int flags;
 958 } smb_messages[256] = {
 959
 960 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 961 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 962 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 963 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 964 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 965 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 966 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 967 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 968 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 969 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 970 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 971 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 972 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 973 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 974 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 975 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 976 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 977 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 978 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 979 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 980 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 981 /* 0x15 */ { NULL, NULL, 0 },
 982 /* 0x16 */ { NULL, NULL, 0 },
 983 /* 0x17 */ { NULL, NULL, 0 },
 984 /* 0x18 */ { NULL, NULL, 0 },
 985 /* 0x19 */ { NULL, NULL, 0 },
 986 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 987 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 988 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
 989 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 990 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 991 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 992 /* 0x20 */ { "SMBwritec", NULL,0},
 993 /* 0x21 */ { NULL, NULL, 0 },
 994 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 995 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 996 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 997 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 998 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 999 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1000 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1001 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1002 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1003 /* 0x2b */ { "SMBecho",reply_echo,0},
1004 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1005 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1006 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1007 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1008 /* 0x30 */ { NULL, NULL, 0 },
1009 /* 0x31 */ { NULL, NULL, 0 },
1010 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1011 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1012 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1013 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1014 /* 0x36 */ { NULL, NULL, 0 },
1015 /* 0x37 */ { NULL, NULL, 0 },
1016 /* 0x38 */ { NULL, NULL, 0 },
1017 /* 0x39 */ { NULL, NULL, 0 },
1018 /* 0x3a */ { NULL, NULL, 0 },
1019 /* 0x3b */ { NULL, NULL, 0 },
1020 /* 0x3c */ { NULL, NULL, 0 },
1021 /* 0x3d */ { NULL, NULL, 0 },
1022 /* 0x3e */ { NULL, NULL, 0 },
1023 /* 0x3f */ { NULL, NULL, 0 },
1024 /* 0x40 */ { NULL, NULL, 0 },
1025 /* 0x41 */ { NULL, NULL, 0 },
1026 /* 0x42 */ { NULL, NULL, 0 },
1027 /* 0x43 */ { NULL, NULL, 0 },
1028 /* 0x44 */ { NULL, NULL, 0 },
1029 /* 0x45 */ { NULL, NULL, 0 },
1030 /* 0x46 */ { NULL, NULL, 0 },
1031 /* 0x47 */ { NULL, NULL, 0 },
1032 /* 0x48 */ { NULL, NULL, 0 },
1033 /* 0x49 */ { NULL, NULL, 0 },
1034 /* 0x4a */ { NULL, NULL, 0 },
1035 /* 0x4b */ { NULL, NULL, 0 },
1036 /* 0x4c */ { NULL, NULL, 0 },
1037 /* 0x4d */ { NULL, NULL, 0 },
1038 /* 0x4e */ { NULL, NULL, 0 },
1039 /* 0x4f */ { NULL, NULL, 0 },
1040 /* 0x50 */ { NULL, NULL, 0 },
1041 /* 0x51 */ { NULL, NULL, 0 },
1042 /* 0x52 */ { NULL, NULL, 0 },
1043 /* 0x53 */ { NULL, NULL, 0 },
1044 /* 0x54 */ { NULL, NULL, 0 },
1045 /* 0x55 */ { NULL, NULL, 0 },
1046 /* 0x56 */ { NULL, NULL, 0 },
1047 /* 0x57 */ { NULL, NULL, 0 },
1048 /* 0x58 */ { NULL, NULL, 0 },
1049 /* 0x59 */ { NULL, NULL, 0 },
1050 /* 0x5a */ { NULL, NULL, 0 },
1051 /* 0x5b */ { NULL, NULL, 0 },
1052 /* 0x5c */ { NULL, NULL, 0 },
1053 /* 0x5d */ { NULL, NULL, 0 },
1054 /* 0x5e */ { NULL, NULL, 0 },
1055 /* 0x5f */ { NULL, NULL, 0 },
1056 /* 0x60 */ { NULL, NULL, 0 },
1057 /* 0x61 */ { NULL, NULL, 0 },
1058 /* 0x62 */ { NULL, NULL, 0 },
1059 /* 0x63 */ { NULL, NULL, 0 },
1060 /* 0x64 */ { NULL, NULL, 0 },
1061 /* 0x65 */ { NULL, NULL, 0 },
1062 /* 0x66 */ { NULL, NULL, 0 },
1063 /* 0x67 */ { NULL, NULL, 0 },
1064 /* 0x68 */ { NULL, NULL, 0 },
1065 /* 0x69 */ { NULL, NULL, 0 },
1066 /* 0x6a */ { NULL, NULL, 0 },
1067 /* 0x6b */ { NULL, NULL, 0 },
1068 /* 0x6c */ { NULL, NULL, 0 },
1069 /* 0x6d */ { NULL, NULL, 0 },
1070 /* 0x6e */ { NULL, NULL, 0 },
1071 /* 0x6f */ { NULL, NULL, 0 },
1072 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1073 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1074 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1075 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1076 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1077 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1078 /* 0x76 */ { NULL, NULL, 0 },
1079 /* 0x77 */ { NULL, NULL, 0 },
1080 /* 0x78 */ { NULL, NULL, 0 },
1081 /* 0x79 */ { NULL, NULL, 0 },
1082 /* 0x7a */ { NULL, NULL, 0 },
1083 /* 0x7b */ { NULL, NULL, 0 },
1084 /* 0x7c */ { NULL, NULL, 0 },
1085 /* 0x7d */ { NULL, NULL, 0 },
1086 /* 0x7e */ { NULL, NULL, 0 },
1087 /* 0x7f */ { NULL, NULL, 0 },
1088 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1089 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1090 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1091 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1092 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1093 /* 0x85 */ { NULL, NULL, 0 },
1094 /* 0x86 */ { NULL, NULL, 0 },
1095 /* 0x87 */ { NULL, NULL, 0 },
1096 /* 0x88 */ { NULL, NULL, 0 },
1097 /* 0x89 */ { NULL, NULL, 0 },
1098 /* 0x8a */ { NULL, NULL, 0 },
1099 /* 0x8b */ { NULL, NULL, 0 },
1100 /* 0x8c */ { NULL, NULL, 0 },
1101 /* 0x8d */ { NULL, NULL, 0 },
1102 /* 0x8e */ { NULL, NULL, 0 },
1103 /* 0x8f */ { NULL, NULL, 0 },
1104 /* 0x90 */ { NULL, NULL, 0 },
1105 /* 0x91 */ { NULL, NULL, 0 },
1106 /* 0x92 */ { NULL, NULL, 0 },
1107 /* 0x93 */ { NULL, NULL, 0 },
1108 /* 0x94 */ { NULL, NULL, 0 },
1109 /* 0x95 */ { NULL, NULL, 0 },
1110 /* 0x96 */ { NULL, NULL, 0 },
1111 /* 0x97 */ { NULL, NULL, 0 },
1112 /* 0x98 */ { NULL, NULL, 0 },
1113 /* 0x99 */ { NULL, NULL, 0 },
1114 /* 0x9a */ { NULL, NULL, 0 },
1115 /* 0x9b */ { NULL, NULL, 0 },
1116 /* 0x9c */ { NULL, NULL, 0 },
1117 /* 0x9d */ { NULL, NULL, 0 },
1118 /* 0x9e */ { NULL, NULL, 0 },
1119 /* 0x9f */ { NULL, NULL, 0 },
1120 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1121 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1122 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1123 /* 0xa3 */ { NULL, NULL, 0 },
1124 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1125 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1126 /* 0xa6 */ { NULL, NULL, 0 },
1127 /* 0xa7 */ { NULL, NULL, 0 },
1128 /* 0xa8 */ { NULL, NULL, 0 },
1129 /* 0xa9 */ { NULL, NULL, 0 },
1130 /* 0xaa */ { NULL, NULL, 0 },
1131 /* 0xab */ { NULL, NULL, 0 },
1132 /* 0xac */ { NULL, NULL, 0 },
1133 /* 0xad */ { NULL, NULL, 0 },
1134 /* 0xae */ { NULL, NULL, 0 },
1135 /* 0xaf */ { NULL, NULL, 0 },
1136 /* 0xb0 */ { NULL, NULL, 0 },
1137 /* 0xb1 */ { NULL, NULL, 0 },
1138 /* 0xb2 */ { NULL, NULL, 0 },
1139 /* 0xb3 */ { NULL, NULL, 0 },
1140 /* 0xb4 */ { NULL, NULL, 0 },
1141 /* 0xb5 */ { NULL, NULL, 0 },
1142 /* 0xb6 */ { NULL, NULL, 0 },
1143 /* 0xb7 */ { NULL, NULL, 0 },
1144 /* 0xb8 */ { NULL, NULL, 0 },
1145 /* 0xb9 */ { NULL, NULL, 0 },
1146 /* 0xba */ { NULL, NULL, 0 },
1147 /* 0xbb */ { NULL, NULL, 0 },
1148 /* 0xbc */ { NULL, NULL, 0 },
1149 /* 0xbd */ { NULL, NULL, 0 },
1150 /* 0xbe */ { NULL, NULL, 0 },
1151 /* 0xbf */ { NULL, NULL, 0 },
1152 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1153 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1154 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1155 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1156 /* 0xc4 */ { NULL, NULL, 0 },
1157 /* 0xc5 */ { NULL, NULL, 0 },
1158 /* 0xc6 */ { NULL, NULL, 0 },
1159 /* 0xc7 */ { NULL, NULL, 0 },
1160 /* 0xc8 */ { NULL, NULL, 0 },
1161 /* 0xc9 */ { NULL, NULL, 0 },
1162 /* 0xca */ { NULL, NULL, 0 },
1163 /* 0xcb */ { NULL, NULL, 0 },
1164 /* 0xcc */ { NULL, NULL, 0 },
1165 /* 0xcd */ { NULL, NULL, 0 },
1166 /* 0xce */ { NULL, NULL, 0 },
1167 /* 0xcf */ { NULL, NULL, 0 },
1168 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1169 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1170 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1171 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1172 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1173 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1174 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1175 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1176 /* 0xd8 */ { NULL, NULL, 0 },
1177 /* 0xd9 */ { NULL, NULL, 0 },
1178 /* 0xda */ { NULL, NULL, 0 },
1179 /* 0xdb */ { NULL, NULL, 0 },
1180 /* 0xdc */ { NULL, NULL, 0 },
1181 /* 0xdd */ { NULL, NULL, 0 },
1182 /* 0xde */ { NULL, NULL, 0 },
1183 /* 0xdf */ { NULL, NULL, 0 },
1184 /* 0xe0 */ { NULL, NULL, 0 },
1185 /* 0xe1 */ { NULL, NULL, 0 },
1186 /* 0xe2 */ { NULL, NULL, 0 },
1187 /* 0xe3 */ { NULL, NULL, 0 },
1188 /* 0xe4 */ { NULL, NULL, 0 },
1189 /* 0xe5 */ { NULL, NULL, 0 },
1190 /* 0xe6 */ { NULL, NULL, 0 },
1191 /* 0xe7 */ { NULL, NULL, 0 },
1192 /* 0xe8 */ { NULL, NULL, 0 },
1193 /* 0xe9 */ { NULL, NULL, 0 },
1194 /* 0xea */ { NULL, NULL, 0 },
1195 /* 0xeb */ { NULL, NULL, 0 },
1196 /* 0xec */ { NULL, NULL, 0 },
1197 /* 0xed */ { NULL, NULL, 0 },
1198 /* 0xee */ { NULL, NULL, 0 },
1199 /* 0xef */ { NULL, NULL, 0 },
1200 /* 0xf0 */ { NULL, NULL, 0 },
1201 /* 0xf1 */ { NULL, NULL, 0 },
1202 /* 0xf2 */ { NULL, NULL, 0 },
1203 /* 0xf3 */ { NULL, NULL, 0 },
1204 /* 0xf4 */ { NULL, NULL, 0 },
1205 /* 0xf5 */ { NULL, NULL, 0 },
1206 /* 0xf6 */ { NULL, NULL, 0 },
1207 /* 0xf7 */ { NULL, NULL, 0 },
1208 /* 0xf8 */ { NULL, NULL, 0 },
1209 /* 0xf9 */ { NULL, NULL, 0 },
1210 /* 0xfa */ { NULL, NULL, 0 },
1211 /* 0xfb */ { NULL, NULL, 0 },
1212 /* 0xfc */ { NULL, NULL, 0 },
1213 /* 0xfd */ { NULL, NULL, 0 },
1214 /* 0xfe */ { NULL, NULL, 0 },
1215 /* 0xff */ { NULL, NULL, 0 }
1216
1217 };
1218
1219 /*******************************************************************
1220  allocate and initialize a reply packet
1221 ********************************************************************/
1222
1223 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1224 {
1225         /*
1226          * Protect against integer wrap
1227          */
1228         if ((num_bytes > 0xffffff)
1229             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1230                 char *msg;
1231                 asprintf(&msg, "num_bytes too large: %u",
1232                          (unsigned)num_bytes);
1233                 smb_panic(msg);
1234         }
1235
1236         if (!(req->outbuf = TALLOC_ARRAY(
1237                       req, uint8,
1238                       smb_size + num_words*2 + num_bytes))) {
1239                 smb_panic("could not allocate output buffer\n");
1240         }
1241
1242         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1243         set_message((char *)req->outbuf, num_words, num_bytes, False);
1244         /*
1245          * Zero out the word area, the caller has to take care of the bcc area
1246          * himself
1247          */
1248         if (num_words != 0) {
1249                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1250         }
1251
1252         return;
1253 }
1254
1255
1256 /*******************************************************************
1257  Dump a packet to a file.
1258 ********************************************************************/
1259
1260 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1261 {
1262         int fd, i;
1263         pstring fname;
1264         if (DEBUGLEVEL < 50) return;
1265
1266         if (len < 4) len = smb_len(data)+4;
1267         for (i=1;i<100;i++) {
1268                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
1269                                 type ? "req" : "resp");
1270                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1271                 if (fd != -1 || errno != EEXIST) break;
1272         }
1273         if (fd != -1) {
1274                 ssize_t ret = write(fd, data, len);
1275                 if (ret != len)
1276                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1277                 close(fd);
1278                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1279         }
1280 }
1281
1282 /****************************************************************************
1283  Prepare everything for calling the actual request function, and potentially
1284  call the request function via the "new" interface.
1285
1286  Return False if the "legacy" function needs to be called, everything is
1287  prepared.
1288
1289  Return True if we're done.
1290
1291  I know this API sucks, but it is the one with the least code change I could
1292  find.
1293 ****************************************************************************/
1294
1295 static void switch_message(uint8 type, struct smb_request *req, int size)
1296 {
1297         int flags;
1298         uint16 session_tag;
1299         connection_struct *conn;
1300
1301         static uint16 last_session_tag = UID_FIELD_INVALID;
1302
1303         errno = 0;
1304
1305         last_message = type;
1306
1307         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1308          * so subtract 4 from it. */
1309         if ((strncmp(smb_base(req->inbuf),"\377SMB",4) != 0)
1310             || (size < (smb_size - 4))) {
1311                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1312                          smb_len(req->inbuf)));
1313                 exit_server_cleanly("Non-SMB packet");
1314         }
1315
1316         if (smb_messages[type].fn_new == NULL) {
1317                 DEBUG(0,("Unknown message type %d!\n",type));
1318                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1319                 reply_unknown_new(req, type);
1320                 return;
1321         }
1322
1323         flags = smb_messages[type].flags;
1324
1325         /* In share mode security we must ignore the vuid. */
1326         session_tag = (lp_security() == SEC_SHARE)
1327                 ? UID_FIELD_INVALID : req->vuid;
1328         conn = conn_find(req->tid);
1329
1330         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1331                  (int)sys_getpid(), (unsigned long)conn));
1332
1333         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1334
1335         /* Ensure this value is replaced in the incoming packet. */
1336         SSVAL(req->inbuf,smb_uid,session_tag);
1337
1338         /*
1339          * Ensure the correct username is in current_user_info.  This is a
1340          * really ugly bugfix for problems with multiple session_setup_and_X's
1341          * being done and allowing %U and %G substitutions to work correctly.
1342          * There is a reason this code is done here, don't move it unless you
1343          * know what you're doing... :-).
1344          * JRA.
1345          */
1346
1347         if (session_tag != last_session_tag) {
1348                 user_struct *vuser = NULL;
1349
1350                 last_session_tag = session_tag;
1351                 if(session_tag != UID_FIELD_INVALID) {
1352                         vuser = get_valid_user_struct(session_tag);
1353                         if (vuser) {
1354                                 set_current_user_info(&vuser->user);
1355                         }
1356                 }
1357         }
1358
1359         /* Does this call need to be run as the connected user? */
1360         if (flags & AS_USER) {
1361
1362                 /* Does this call need a valid tree connection? */
1363                 if (!conn) {
1364                         /*
1365                          * Amazingly, the error code depends on the command
1366                          * (from Samba4).
1367                          */
1368                         if (type == SMBntcreateX) {
1369                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1370                         } else {
1371                                 reply_doserror(req, ERRSRV, ERRinvnid);
1372                         }
1373                         return;
1374                 }
1375
1376                 if (!change_to_user(conn,session_tag)) {
1377                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1378                         return;
1379                 }
1380
1381                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1382
1383                 /* Does it need write permission? */
1384                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1385                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1386                         return;
1387                 }
1388
1389                 /* IPC services are limited */
1390                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1391                         reply_doserror(req, ERRSRV,ERRaccess);
1392                         return;
1393                 }
1394         } else {
1395                 /* This call needs to be run as root */
1396                 change_to_root_user();
1397         }
1398
1399         /* load service specific parameters */
1400         if (conn) {
1401                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1402                                          (flags & (AS_USER|DO_CHDIR)
1403                                           ?True:False))) {
1404                         reply_doserror(req, ERRSRV, ERRaccess);
1405                         return;
1406                 }
1407                 conn->num_smb_operations++;
1408         }
1409
1410         /* does this protocol need to be run as guest? */
1411         if ((flags & AS_GUEST)
1412             && (!change_to_guest() ||
1413                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1414                               lp_hostsdeny(-1)))) {
1415                 reply_doserror(req, ERRSRV, ERRaccess);
1416                 return;
1417         }
1418
1419         smb_messages[type].fn_new(conn, req);
1420 }
1421
1422 /****************************************************************************
1423  Construct a reply to the incoming packet.
1424 ****************************************************************************/
1425
1426 static void construct_reply(char *inbuf, int size, size_t unread_bytes)
1427 {
1428         uint8 type = CVAL(inbuf,smb_com);
1429         struct smb_request *req;
1430
1431         chain_size = 0;
1432         file_chain_reset();
1433         reset_chain_p();
1434
1435         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1436                 smb_panic("could not allocate smb_request");
1437         }
1438         init_smb_request(req, (uint8 *)inbuf, unread_bytes);
1439
1440         switch_message(type, req, size);
1441
1442         if (req->unread_bytes) {
1443                 /* writeX failed. drain socket. */
1444                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1445                                 req->unread_bytes) {
1446                         smb_panic("failed to drain pending bytes");
1447                 }
1448                 req->unread_bytes = 0;
1449         }
1450
1451         if (req->outbuf == NULL) {
1452                 return;
1453         }
1454
1455         if (CVAL(req->outbuf,0) == 0) {
1456                 show_msg((char *)req->outbuf);
1457         }
1458
1459         if (!send_smb(smbd_server_fd(), (char *)req->outbuf)) {
1460                 exit_server_cleanly("construct_reply: send_smb failed.");
1461         }
1462
1463         TALLOC_FREE(req);
1464
1465         return;
1466 }
1467
1468 /****************************************************************************
1469  Process an smb from the client
1470 ****************************************************************************/
1471
1472 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes)
1473 {
1474         static int trans_num;
1475         int msg_type = CVAL(inbuf,0);
1476
1477         DO_PROFILE_INC(smb_count);
1478
1479         if (trans_num == 0) {
1480                 char addr[INET6_ADDRSTRLEN];
1481
1482                 /* on the first packet, check the global hosts allow/ hosts
1483                 deny parameters before doing any parsing of the packet
1484                 passed to us by the client.  This prevents attacks on our
1485                 parsing code from hosts not in the hosts allow list */
1486
1487                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1488                                   lp_hostsdeny(-1))) {
1489                         /* send a negative session response "not listening on calling name" */
1490                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1491                         DEBUG( 1, ( "Connection denied from %s\n",
1492                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1493                         (void)send_smb(smbd_server_fd(),(char *)buf);
1494                         exit_server_cleanly("connection denied");
1495                 }
1496         }
1497
1498         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1499                     smb_len(inbuf) ) );
1500         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1501                                 (int)nread,
1502                                 (unsigned int)unread_bytes ));
1503
1504         if (msg_type != 0) {
1505                 /*
1506                  * NetBIOS session request, keepalive, etc.
1507                  */
1508                 reply_special(inbuf);
1509                 return;
1510         }
1511
1512         show_msg(inbuf);
1513
1514         construct_reply(inbuf,nread,unread_bytes);
1515
1516         trans_num++;
1517 }
1518
1519 /****************************************************************************
1520  Return a string containing the function name of a SMB command.
1521 ****************************************************************************/
1522
1523 const char *smb_fn_name(int type)
1524 {
1525         const char *unknown_name = "SMBunknown";
1526
1527         if (smb_messages[type].name == NULL)
1528                 return(unknown_name);
1529
1530         return(smb_messages[type].name);
1531 }
1532
1533 /****************************************************************************
1534  Helper functions for contruct_reply.
1535 ****************************************************************************/
1536
1537 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1538
1539 void add_to_common_flags2(uint32 v)
1540 {
1541         common_flags2 |= v;
1542 }
1543
1544 void remove_from_common_flags2(uint32 v)
1545 {
1546         common_flags2 &= ~v;
1547 }
1548
1549 void construct_reply_common(const char *inbuf, char *outbuf)
1550 {
1551         set_message(outbuf,0,0,False);
1552
1553         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1554         SIVAL(outbuf,smb_rcls,0);
1555         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1556         SSVAL(outbuf,smb_flg2,
1557                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1558                 common_flags2);
1559         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1560
1561         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1562         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1563         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1564         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1565 }
1566
1567 /****************************************************************************
1568  Construct a chained reply and add it to the already made reply
1569 ****************************************************************************/
1570
1571 void chain_reply(struct smb_request *req)
1572 {
1573         static char *orig_inbuf;
1574
1575         /*
1576          * Dirty little const_discard: We mess with req->inbuf, which is
1577          * declared as const. If maybe at some point this routine gets
1578          * rewritten, this const_discard could go away.
1579          */
1580         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1581         int size = smb_len(req->inbuf)+4;
1582
1583         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1584         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1585         char *inbuf2;
1586         int outsize2;
1587         int new_size;
1588         char inbuf_saved[smb_wct];
1589         char *outbuf = (char *)req->outbuf;
1590         size_t outsize = smb_len(outbuf) + 4;
1591         size_t outsize_padded;
1592         size_t ofs, to_move;
1593
1594         struct smb_request *req2;
1595         size_t caller_outputlen;
1596         char *caller_output;
1597
1598         /* Maybe its not chained, or it's an error packet. */
1599         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1600                 SCVAL(outbuf,smb_vwv0,0xFF);
1601                 return;
1602         }
1603
1604         if (chain_size == 0) {
1605                 /* this is the first part of the chain */
1606                 orig_inbuf = inbuf;
1607         }
1608
1609         /*
1610          * We need to save the output the caller added to the chain so that we
1611          * can splice it into the final output buffer later.
1612          */
1613
1614         caller_outputlen = outsize - smb_wct;
1615
1616         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1617
1618         if (caller_output == NULL) {
1619                 /* TODO: NT_STATUS_NO_MEMORY */
1620                 smb_panic("could not dup outbuf");
1621         }
1622
1623         /*
1624          * The original Win95 redirector dies on a reply to
1625          * a lockingX and read chain unless the chain reply is
1626          * 4 byte aligned. JRA.
1627          */
1628
1629         outsize_padded = (outsize + 3) & ~3;
1630
1631         /*
1632          * remember how much the caller added to the chain, only counting
1633          * stuff after the parameter words
1634          */
1635         chain_size += outsize_padded - smb_wct;
1636
1637         /*
1638          * work out pointers into the original packets. The
1639          * headers on these need to be filled in
1640          */
1641         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1642
1643         /* remember the original command type */
1644         smb_com1 = CVAL(orig_inbuf,smb_com);
1645
1646         /* save the data which will be overwritten by the new headers */
1647         memcpy(inbuf_saved,inbuf2,smb_wct);
1648
1649         /* give the new packet the same header as the last part of the SMB */
1650         memmove(inbuf2,inbuf,smb_wct);
1651
1652         /* create the in buffer */
1653         SCVAL(inbuf2,smb_com,smb_com2);
1654
1655         /* work out the new size for the in buffer. */
1656         new_size = size - (inbuf2 - inbuf);
1657         if (new_size < 0) {
1658                 DEBUG(0,("chain_reply: chain packet size incorrect "
1659                          "(orig size = %d, offset = %d)\n",
1660                          size, (int)(inbuf2 - inbuf) ));
1661                 exit_server_cleanly("Bad chained packet");
1662                 return;
1663         }
1664
1665         /* And set it in the header. */
1666         smb_setlen(inbuf2, new_size - 4);
1667
1668         DEBUG(3,("Chained message\n"));
1669         show_msg(inbuf2);
1670
1671         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1672                 smb_panic("could not allocate smb_request");
1673         }
1674         init_smb_request(req2, (uint8 *)inbuf2,0);
1675
1676         /* process the request */
1677         switch_message(smb_com2, req2, new_size);
1678
1679         /*
1680          * We don't accept deferred operations in chained requests.
1681          */
1682         SMB_ASSERT(req2->outbuf != NULL);
1683         outsize2 = smb_len(req2->outbuf)+4;
1684
1685         /*
1686          * Move away the new command output so that caller_output fits in,
1687          * copy in the caller_output saved above.
1688          */
1689
1690         SMB_ASSERT(outsize_padded >= smb_wct);
1691
1692         /*
1693          * "ofs" is the space we need for caller_output. Equal to
1694          * caller_outputlen plus the padding.
1695          */
1696
1697         ofs = outsize_padded - smb_wct;
1698
1699         /*
1700          * "to_move" is the amount of bytes the secondary routine gave us
1701          */
1702
1703         to_move = outsize2 - smb_wct;
1704
1705         if (to_move + ofs + smb_wct + chain_size > max_send) {
1706                 smb_panic("replies too large -- would have to cut");
1707         }
1708
1709         /*
1710          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1711          * the first request in the chain. So we have to re-allocate it. In
1712          * the "old" API the only outbuf ever used is the global OutBuffer
1713          * which is always large enough.
1714          */
1715
1716         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1717                                       to_move + ofs + smb_wct);
1718         if (outbuf == NULL) {
1719                 smb_panic("could not realloc outbuf");
1720         }
1721
1722         req->outbuf = (uint8 *)outbuf;
1723
1724         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1725         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1726
1727         /*
1728          * copy the new reply header over the old one but preserve the smb_com
1729          * field
1730          */
1731         memmove(outbuf, req2->outbuf, smb_wct);
1732         SCVAL(outbuf, smb_com, smb_com1);
1733
1734         /*
1735          * We've just copied in the whole "wct" area from the secondary
1736          * function. Fix up the chaining: com2 and the offset need to be
1737          * readjusted.
1738          */
1739
1740         SCVAL(outbuf, smb_vwv0, smb_com2);
1741         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1742
1743         if (outsize_padded > outsize) {
1744
1745                 /*
1746                  * Due to padding we have some uninitialized bytes after the
1747                  * caller's output
1748                  */
1749
1750                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1751         }
1752
1753         smb_setlen(outbuf, outsize2 + chain_size - 4);
1754
1755         /*
1756          * restore the saved data, being careful not to overwrite any data
1757          * from the reply header
1758          */
1759         memcpy(inbuf2,inbuf_saved,smb_wct);
1760
1761         SAFE_FREE(caller_output);
1762         TALLOC_FREE(req2);
1763
1764         return;
1765 }
1766
1767 /****************************************************************************
1768  Setup the needed select timeout in milliseconds.
1769 ****************************************************************************/
1770
1771 static int setup_select_timeout(void)
1772 {
1773         int select_timeout;
1774
1775         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1776
1777         if (print_notify_messages_pending()) {
1778                 select_timeout = MIN(select_timeout, 1000);
1779         }
1780
1781         return select_timeout;
1782 }
1783
1784 /****************************************************************************
1785  Check if services need reloading.
1786 ****************************************************************************/
1787
1788 void check_reload(time_t t)
1789 {
1790         static pid_t mypid = 0;
1791         static time_t last_smb_conf_reload_time = 0;
1792         static time_t last_printer_reload_time = 0;
1793         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1794
1795         if(last_smb_conf_reload_time == 0) {
1796                 last_smb_conf_reload_time = t;
1797                 /* Our printing subsystem might not be ready at smbd start up.
1798                    Then no printer is available till the first printers check
1799                    is performed.  A lower initial interval circumvents this. */
1800                 if ( printcap_cache_time > 60 )
1801                         last_printer_reload_time = t - printcap_cache_time + 60;
1802                 else
1803                         last_printer_reload_time = t;
1804         }
1805
1806         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1807                 /* randomize over 60 second the printcap reload to avoid all
1808                  * process hitting cupsd at the same time */
1809                 int time_range = 60;
1810
1811                 last_printer_reload_time += random() % time_range;
1812                 mypid = getpid();
1813         }
1814
1815         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1816                 reload_services(True);
1817                 reload_after_sighup = False;
1818                 last_smb_conf_reload_time = t;
1819         }
1820
1821         /* 'printcap cache time = 0' disable the feature */
1822
1823         if ( printcap_cache_time != 0 )
1824         {
1825                 /* see if it's time to reload or if the clock has been set back */
1826
1827                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1828                         || (t-last_printer_reload_time  < 0) )
1829                 {
1830                         DEBUG( 3,( "Printcap cache time expired.\n"));
1831                         reload_printers();
1832                         last_printer_reload_time = t;
1833                 }
1834         }
1835 }
1836
1837 /****************************************************************************
1838  Process any timeout housekeeping. Return False if the caller should exit.
1839 ****************************************************************************/
1840
1841 static bool timeout_processing(int *select_timeout,
1842                                time_t *last_timeout_processing_time)
1843 {
1844         time_t t;
1845
1846         if (*get_srv_read_error() == SMB_READ_EOF) {
1847                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1848                 return false;
1849         }
1850
1851         if (*get_srv_read_error() == SMB_READ_ERROR) {
1852                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1853                         strerror(errno)));
1854                 return false;
1855         }
1856
1857         if (*get_srv_read_error() == SMB_READ_BAD_SIG) {
1858                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1859                 return false;
1860         }
1861
1862         *last_timeout_processing_time = t = time(NULL);
1863
1864         /* become root again if waiting */
1865         change_to_root_user();
1866
1867         /* check if we need to reload services */
1868         check_reload(t);
1869
1870         if(global_machine_password_needs_changing &&
1871                         /* for ADS we need to do a regular ADS password change, not a domain
1872                                         password change */
1873                         lp_security() == SEC_DOMAIN) {
1874
1875                 unsigned char trust_passwd_hash[16];
1876                 time_t lct;
1877
1878                 /*
1879                  * We're in domain level security, and the code that
1880                  * read the machine password flagged that the machine
1881                  * password needs changing.
1882                  */
1883
1884                 /*
1885                  * First, open the machine password file with an exclusive lock.
1886                  */
1887
1888                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1889                         DEBUG(0,("process: unable to lock the machine account password for \
1890 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1891                         return True;
1892                 }
1893
1894                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1895                         DEBUG(0,("process: unable to read the machine account password for \
1896 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1897                         secrets_lock_trust_account_password(lp_workgroup(), False);
1898                         return True;
1899                 }
1900
1901                 /*
1902                  * Make sure someone else hasn't already done this.
1903                  */
1904
1905                 if(t < lct + lp_machine_password_timeout()) {
1906                         global_machine_password_needs_changing = False;
1907                         secrets_lock_trust_account_password(lp_workgroup(), False);
1908                         return True;
1909                 }
1910
1911                 /* always just contact the PDC here */
1912
1913                 change_trust_account_password( lp_workgroup(), NULL);
1914                 global_machine_password_needs_changing = False;
1915                 secrets_lock_trust_account_password(lp_workgroup(), False);
1916         }
1917
1918         /* update printer queue caches if necessary */
1919
1920         update_monitored_printq_cache();
1921
1922         /*
1923          * Now we are root, check if the log files need pruning.
1924          * Force a log file check.
1925          */
1926         force_check_log_size();
1927         check_log_size();
1928
1929         /* Send any queued printer notify message to interested smbd's. */
1930
1931         print_notify_send_messages(smbd_messaging_context(), 0);
1932
1933         /*
1934          * Modify the select timeout depending upon
1935          * what we have remaining in our queues.
1936          */
1937
1938         *select_timeout = setup_select_timeout();
1939
1940         return True;
1941 }
1942
1943 /****************************************************************************
1944  Process commands from the client
1945 ****************************************************************************/
1946
1947 void smbd_process(void)
1948 {
1949         time_t last_timeout_processing_time = time(NULL);
1950         unsigned int num_smbs = 0;
1951         size_t unread_bytes = 0;
1952
1953         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1954
1955         while (True) {
1956                 int select_timeout = setup_select_timeout();
1957                 int num_echos;
1958                 char *inbuf;
1959                 size_t inbuf_len;
1960                 TALLOC_CTX *frame = talloc_stackframe();
1961
1962                 errno = 0;
1963
1964                 /* Did someone ask for immediate checks on things like blocking locks ? */
1965                 if (select_timeout == 0) {
1966                         if(!timeout_processing(&select_timeout,
1967                                                &last_timeout_processing_time))
1968                                 return;
1969                         num_smbs = 0; /* Reset smb counter. */
1970                 }
1971
1972                 run_events(smbd_event_context(), 0, NULL, NULL);
1973
1974                 while (!receive_message_or_smb(NULL, &inbuf, &inbuf_len,
1975                                                select_timeout, &unread_bytes)) {
1976                         if(!timeout_processing(&select_timeout,
1977                                                &last_timeout_processing_time))
1978                                 return;
1979                         num_smbs = 0; /* Reset smb counter. */
1980                 }
1981
1982
1983                 /*
1984                  * Ensure we do timeout processing if the SMB we just got was
1985                  * only an echo request. This allows us to set the select
1986                  * timeout in 'receive_message_or_smb()' to any value we like
1987                  * without worrying that the client will send echo requests
1988                  * faster than the select timeout, thus starving out the
1989                  * essential processing (change notify, blocking locks) that
1990                  * the timeout code does. JRA.
1991                  */
1992                 num_echos = smb_echo_count;
1993
1994                 process_smb(inbuf, inbuf_len, unread_bytes);
1995
1996                 TALLOC_FREE(inbuf);
1997
1998                 if (smb_echo_count != num_echos) {
1999                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
2000                                 return;
2001                         num_smbs = 0; /* Reset smb counter. */
2002                 }
2003
2004                 num_smbs++;
2005
2006                 /*
2007                  * If we are getting smb requests in a constant stream
2008                  * with no echos, make sure we attempt timeout processing
2009                  * every select_timeout milliseconds - but only check for this
2010                  * every 200 smb requests.
2011                  */
2012
2013                 if ((num_smbs % 200) == 0) {
2014                         time_t new_check_time = time(NULL);
2015                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2016                                 if(!timeout_processing(
2017                                            &select_timeout,
2018                                            &last_timeout_processing_time))
2019                                         return;
2020                                 num_smbs = 0; /* Reset smb counter. */
2021                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2022                         }
2023                 }
2024
2025                 /* The timeout_processing function isn't run nearly
2026                    often enough to implement 'max log size' without
2027                    overrunning the size of the file by many megabytes.
2028                    This is especially true if we are running at debug
2029                    level 10.  Checking every 50 SMBs is a nice
2030                    tradeoff of performance vs log file size overrun. */
2031
2032                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2033                         change_to_root_user();
2034                         check_log_size();
2035                 }
2036                 TALLOC_FREE(frame);
2037         }
2038 }