r4232: added server support for multi-part SMBtrans requests, while
[samba.git] / source4 / smb_server / smb_server.c
index 8769a6f3f13449d1e68cbeb46aa987cc80b8afa0..2ebb927f1ea0b32e12cf7cdeb066e3b700a03ea1 100644 (file)
@@ -3,6 +3,7 @@
    process incoming packets - main loop
    Copyright (C) Andrew Tridgell 1992-2003
    Copyright (C) James J Myers 2003 <myersjj@samba.org>
+   Copyright (C) Stefan Metzmacher 2004
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
 */
 
 #include "includes.h"
+#include "events.h"
+#include "system/time.h"
+#include "dlinklist.h"
+#include "smb_server/smb_server.h"
 
 
 /*
   send an oplock break request to a client
 */
-BOOL req_send_oplock_break(struct tcon_context *conn, uint16 fnum, uint8 level)
+BOOL req_send_oplock_break(struct smbsrv_tcon *tcon, uint16_t fnum, uint8_t level)
 {
-       struct request_context *req;
+       struct smbsrv_request *req;
 
-       req = init_smb_request(conn->smb);
+       req = init_smb_request(tcon->smb_conn);
 
        req_setup_reply(req, 8, 0);
        
        SCVAL(req->out.hdr,HDR_COM,SMBlockingX);
-       SSVAL(req->out.hdr,HDR_TID,conn->cnum);
+       SSVAL(req->out.hdr,HDR_TID,tcon->cnum);
        SSVAL(req->out.hdr,HDR_PID,0xFFFF);
        SSVAL(req->out.hdr,HDR_UID,0);
        SSVAL(req->out.hdr,HDR_MID,0xFFFF);
@@ -44,7 +49,8 @@ BOOL req_send_oplock_break(struct tcon_context *conn, uint16 fnum, uint8 level)
        SSVAL(req->out.vwv, VWV(0), SMB_CHAIN_NONE);
        SSVAL(req->out.vwv, VWV(1), 0);
        SSVAL(req->out.vwv, VWV(2), fnum);
-       SSVAL(req->out.vwv, VWV(3), level);
+       SCVAL(req->out.vwv, VWV(3), LOCKING_ANDX_OPLOCK_RELEASE);
+       SCVAL(req->out.vwv, VWV(3)+1, level);
        SIVAL(req->out.vwv, VWV(4), 0);
        SSVAL(req->out.vwv, VWV(6), 0);
        SSVAL(req->out.vwv, VWV(7), 0);
@@ -53,40 +59,87 @@ BOOL req_send_oplock_break(struct tcon_context *conn, uint16 fnum, uint8 level)
        return True;
 }
 
+
+static void construct_reply(struct smbsrv_request *req);
+
 /****************************************************************************
-receive a SMB request from the wire, forming a request_context from the result
+receive a SMB request header from the wire, forming a request_context
+from the result
 ****************************************************************************/
-static struct request_context *receive_smb_request(struct server_context *smb)
+static NTSTATUS receive_smb_request(struct smbsrv_connection *smb_conn, struct timeval t)
 {
-       ssize_t len, len2;
-       char header[4];
-       struct request_context *req;
+       NTSTATUS status;
+       ssize_t len;
+       struct smbsrv_request *req;
+       size_t nread;
+
+       /* allocate the request if needed */
+       if (smb_conn->partial_req == NULL) {
+               req = init_smb_request(smb_conn);
+               if (req == NULL) {
+                       return NT_STATUS_NO_MEMORY;
+               }
 
-       len = read_data(smb->socket.fd, header, 4);
-       if (len != 4) {
-               return NULL;
+               req->in.buffer = talloc_array_p(req, uint8_t, NBT_HDR_SIZE);
+               if (req->in.buffer == NULL) {
+                       talloc_free(req);
+                       return NT_STATUS_NO_MEMORY;
+               }
+               req->in.size = 0;
+               smb_conn->partial_req = req;
        }
 
-       len = smb_len(header);
+       req = smb_conn->partial_req;
+
+       /* read in the header */
+       if (req->in.size < NBT_HDR_SIZE) {
+               status = socket_recv(smb_conn->connection->socket, 
+                                    req->in.buffer + req->in.size,
+                                    NBT_HDR_SIZE - req->in.size, 
+                                    &nread, 0);
+               if (NT_STATUS_IS_ERR(status)) {
+                       return status;
+               }
+               if (nread == 0) {
+                       return NT_STATUS_OK;
+               }
+               req->in.size += nread;
+
+               /* when we have a full NBT header, then allocate the packet */
+               if (req->in.size == NBT_HDR_SIZE) {
+                       len = smb_len(req->in.buffer) + NBT_HDR_SIZE;
+                       req->in.buffer = talloc_realloc(req, req->in.buffer, len);
+                       if (req->in.buffer == NULL) {
+                               return NT_STATUS_NO_MEMORY;
+                       }
+               } else {
+                       return NT_STATUS_OK;
+               }
+       }
 
-       req = init_smb_request(smb);
+       /* read in the main packet */
+       len = smb_len(req->in.buffer) + NBT_HDR_SIZE;
 
-       GetTimeOfDay(&req->request_time);
-       req->chained_fnum = -1;
-       
-       /* allocate the incoming buffer at the right size */
-       req->in.buffer = talloc(req->mem_ctx, len + NBT_HDR_SIZE);
+       status = socket_recv(smb_conn->connection->socket, 
+                            req->in.buffer + req->in.size,
+                            len - req->in.size, 
+                            &nread, 0);
+       if (NT_STATUS_IS_ERR(status)) {
+               return status;
+       }
+       if (nread == 0) {
+               return NT_STATUS_OK;
+       }
 
-       /* fill in the already received header */
-       memcpy(req->in.buffer, header, 4);
+       req->in.size += nread;
 
-       len2 = read_data(smb->socket.fd, req->in.buffer + NBT_HDR_SIZE, len);
-       if (len2 != len) {
-               return NULL;
+       if (req->in.size != len) {
+               return NT_STATUS_OK;
        }
 
-       /* fill in the rest of the req->in structure */
-       req->in.size = len + NBT_HDR_SIZE;
+       /* we have a full packet */
+       req->request_time = t;
+       req->chained_fnum = -1;
        req->in.allocated = req->in.size;
        req->in.hdr = req->in.buffer + NBT_HDR_SIZE;
        req->in.vwv = req->in.hdr + HDR_VWV;
@@ -109,37 +162,17 @@ static struct request_context *receive_smb_request(struct server_context *smb)
                }
        }
 
-       return req;
-}
-
-/*
-  setup the user_ctx element of a request
-*/
-static void setup_user_context(struct request_context *req)
-{
-       struct user_context *ctx;
+       smb_conn->partial_req = NULL;
 
-       ctx = talloc(req->mem_ctx, sizeof(*ctx));
-       ctx->vuid = SVAL(req->in.hdr, HDR_UID);
-       ctx->vuser = get_valid_user_struct(req->smb, ctx->vuid);
+       construct_reply(req);
 
-       req->user_ctx = ctx;
+       return NT_STATUS_OK;
 }
 
-
 /*
-These flags determine some of the permissions required to do an operation 
-
-Note that I don't set NEED_WRITE on some write operations because they
-are used by some brain-dead clients when printing, and I don't want to
-force write permissions on print services.
+  These flags determine some of the permissions required to do an operation 
 */
 #define AS_USER (1<<0)
-#define NEED_WRITE (1<<1)
-#define TIME_INIT (1<<2)
-#define CAN_IPC (1<<3)
-#define AS_GUEST (1<<5)
-#define USE_MUTEX (1<<7)
 
 /* 
    define a list of possible SMB messages and their corresponding
@@ -149,22 +182,22 @@ force write permissions on print services.
 static const struct smb_message_struct
 {
        const char *name;
-       void (*fn)(struct request_context *);
+       void (*fn)(struct smbsrv_request *);
        int flags;
 }
  smb_messages[256] = {
-/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
-/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
-/* 0x02 */ { "SMBopen",reply_open,AS_USER },
+/* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER},
+/* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER},
+/* 0x02 */ { "SMBopen",reply_open,AS_USER},
 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
-/* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
+/* 0x04 */ { "SMBclose",reply_close,AS_USER},
 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
-/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
-/* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
+/* 0x06 */ { "SMBunlink",reply_unlink,AS_USER},
+/* 0x07 */ { "SMBmv",reply_mv,AS_USER},
 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
-/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
+/* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER},
 /* 0x0a */ { "SMBread",reply_read,AS_USER},
-/* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
+/* 0x0b */ { "SMBwrite",reply_write,AS_USER},
 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
@@ -187,23 +220,23 @@ static const struct smb_message_struct
 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 /* 0x20 */ { "SMBwritec",NULL,0},
 /* 0x21 */ { NULL, NULL, 0 },
-/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
-/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
-/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
-/* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
-/* 0x26 */ { "SMBtranss",NULL,AS_USER | CAN_IPC},
+/* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER},
+/* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER},
+/* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER},
+/* 0x25 */ { "SMBtrans",reply_trans,AS_USER},
+/* 0x26 */ { "SMBtranss",reply_transs,AS_USER},
 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
-/* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
-/* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
+/* 0x29 */ { "SMBcopy",reply_copy,AS_USER},
+/* 0x2a */ { "SMBmove",NULL,AS_USER},
 /* 0x2b */ { "SMBecho",reply_echo,0},
 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
-/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
-/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
-/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
+/* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER},
+/* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER},
+/* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER},
 /* 0x30 */ { NULL, NULL, 0 },
 /* 0x31 */ { NULL, NULL, 0 },
-/* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
+/* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER},
 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
@@ -265,12 +298,12 @@ static const struct smb_message_struct
 /* 0x6d */ { NULL, NULL, 0 },
 /* 0x6e */ { NULL, NULL, 0 },
 /* 0x6f */ { NULL, NULL, 0 },
-/* 0x70 */ { "SMBtcon",reply_tcon,USE_MUTEX},
+/* 0x70 */ { "SMBtcon",reply_tcon,0},
 /* 0x71 */ { "SMBtdis",reply_tdis,0},
-/* 0x72 */ { "SMBnegprot",reply_negprot,USE_MUTEX},
-/* 0x73 */ { "SMBsesssetupX",reply_sesssetup,USE_MUTEX},
+/* 0x72 */ { "SMBnegprot",reply_negprot,0},
+/* 0x73 */ { "SMBsesssetupX",reply_sesssetup,0},
 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
-/* 0x75 */ { "SMBtconX",reply_tcon_and_X,USE_MUTEX},
+/* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 /* 0x76 */ { NULL, NULL, 0 },
 /* 0x77 */ { NULL, NULL, 0 },
 /* 0x78 */ { NULL, NULL, 0 },
@@ -313,9 +346,9 @@ static const struct smb_message_struct
 /* 0x9d */ { NULL, NULL, 0 },
 /* 0x9e */ { NULL, NULL, 0 },
 /* 0x9f */ { NULL, NULL, 0 },
-/* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
-/* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
-/* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
+/* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER},
+/* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER},
+/* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER},
 /* 0xa3 */ { NULL, NULL, 0 },
 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 /* 0xa5 */ { "SMBntrename", reply_ntrename, 0 },
@@ -361,14 +394,14 @@ static const struct smb_message_struct
 /* 0xcd */ { NULL, NULL, 0 },
 /* 0xce */ { NULL, NULL, 0 },
 /* 0xcf */ { NULL, NULL, 0 },
-/* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
-/* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
-/* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
-/* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
-/* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
-/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
-/* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
-/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
+/* 0xd0 */ { "SMBsends",reply_sends,0},
+/* 0xd1 */ { "SMBsendb",NULL,0},
+/* 0xd2 */ { "SMBfwdname",NULL,0},
+/* 0xd3 */ { "SMBcancelf",NULL,0},
+/* 0xd4 */ { "SMBgetmac",NULL,0},
+/* 0xd5 */ { "SMBsendstrt",reply_sendstrt,0},
+/* 0xd6 */ { "SMBsendend",reply_sendend,0},
+/* 0xd7 */ { "SMBsendtxt",reply_sendtxt,0},
 /* 0xd8 */ { NULL, NULL, 0 },
 /* 0xd9 */ { NULL, NULL, 0 },
 /* 0xda */ { NULL, NULL, 0 },
@@ -414,7 +447,7 @@ static const struct smb_message_struct
 /****************************************************************************
 return a string containing the function name of a SMB command
 ****************************************************************************/
-static const char *smb_fn_name(uint8 type)
+static const char *smb_fn_name(uint8_t type)
 {
        const char *unknown_name = "SMBunknown";
 
@@ -432,11 +465,11 @@ for sending the reply themselves, rather than returning a size to this function
 The reply functions may also choose to delay the processing by pushing the message
 onto the message queue
 ****************************************************************************/
-static void switch_message(int type, struct request_context *req)
+static void switch_message(int type, struct smbsrv_request *req)
 {
        int flags;
-       uint16 session_tag;
-       struct server_context *smb = req->smb;
+       struct smbsrv_connection *smb_conn = req->smb_conn;
+       uint16_t session_tag;
 
        type &= 0xff;
 
@@ -450,98 +483,52 @@ static void switch_message(int type, struct request_context *req)
 
        flags = smb_messages[type].flags;
 
-       /* In share mode security we must ignore the vuid. */
-       session_tag = (lp_security() == SEC_SHARE) ? 
-               UID_FIELD_INVALID : 
-               SVAL(req->in.hdr,HDR_UID);
+       req->tcon = conn_find(smb_conn, SVAL(req->in.hdr,HDR_TID));
 
-       req->conn = conn_find(req->smb, SVAL(req->in.hdr,HDR_TID));
+       if (req->session == NULL) {
+               /* setup the user context for this request if it
+                  hasn't already been initialised (to cope with SMB
+                  chaining) */
 
-       /* setup the user context for this request */
-       setup_user_context(req);
-
-       /* Ensure this value is replaced in the incoming packet. */
-       SSVAL(req->in.hdr,HDR_UID,session_tag);
+               /* In share mode security we must ignore the vuid. */
+               if (lp_security() == SEC_SHARE) {
+                       session_tag = UID_FIELD_INVALID;
+               } else {
+                       session_tag = SVAL(req->in.hdr,HDR_UID);
+               }
 
-       if (req->user_ctx) {
-               req->user_ctx->vuid = session_tag;
+               req->session = smbsrv_session_find(req->smb_conn, session_tag);
+               if (req->session) {
+                       req->session->vuid = session_tag;
+               }
+       } else {
+               session_tag = req->session->vuid;
        }
-       DEBUG(3,("switch message %s (task_id %d)\n",smb_fn_name(type), smb->model_ops->get_id(req)));
 
-       /* does this protocol need to be run as root? */
-       if (!(flags & AS_USER)) {
-               change_to_root_user();
-       }
-       
+       DEBUG(3,("switch message %s (task_id %d)\n",smb_fn_name(type), smb_conn->connection->service->model_ops->get_id(req)));
+
        /* does this protocol need a valid tree connection? */
-       if ((flags & AS_USER) && !req->conn) {
-               req_reply_error(req, NT_STATUS_NETWORK_NAME_DELETED);
+       if ((flags & AS_USER) && !req->tcon) {
+               req_reply_error(req, NT_STATUS_INVALID_HANDLE);
                return;
        }
 
-       /* does this protocol need to be run as the connected user? */
-#if HACK_REWRITE
-       if ((flags & AS_USER) && !change_to_user(req->conn,session_tag)) {
-               if (!(flags & AS_GUEST)) {
-                       req_reply_error(req, NT_STATUS_ACCESS_DENIED);
-                       return;
-               }
-
-               /* we'll run it as guest */
-               flags &= ~AS_USER;
-       }
-#endif
-
-       /* this code is to work around a bug is MS client 3 without
-          introducing a security hole - it needs to be able to do
-          print queue checks as guest if it isn't logged in properly */
-       if (flags & AS_USER) {
-               flags &= ~AS_GUEST;
-       }
-       
-       /* does it need write permission? */
-       if ((flags & NEED_WRITE) && !CAN_WRITE(req->conn)) {
-               req_reply_error(req, NT_STATUS_ACCESS_DENIED);
-               return;
-       }
-       
-       /* ipc services are limited */
-       if (req->conn && req->conn->type == NTVFS_IPC && (flags & AS_USER) && !(flags & CAN_IPC)) {
-               req_reply_error(req, NT_STATUS_ACCESS_DENIED);
-               return;
-       }
-       
-       /* load service specific parameters */
-       if (req->conn && !set_current_service(req->conn,(flags & AS_USER)?True:False)) {
-               req_reply_error(req, NT_STATUS_ACCESS_DENIED);
-               return;
-       }
-       
-       /* does this protocol need to be run as guest? */
-#if HACK_REWRITE
-       if ((flags & AS_GUEST) && 
-           !change_to_guest()) {
-               req_reply_error(req, NT_STATUS_ACCESS_DENIED);
+       /* see if the vuid is valid */
+       if ((flags & AS_USER) && !req->session) {
+               req_reply_error(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
                return;
        }
-#endif
-       /* THREAD TESTING: use mutex to serialize calls to critical functions with global state */
-       if (flags & USE_MUTEX) {
-               MUTEX_LOCK_BY_ID(MUTEX_SMBD);
-       }
+
        smb_messages[type].fn(req);
-       if (flags & USE_MUTEX) {
-               MUTEX_UNLOCK_BY_ID(MUTEX_SMBD);
-       }
 }
 
 
 /****************************************************************************
  Construct a reply to the incoming packet.
 ****************************************************************************/
-static void construct_reply(struct request_context *req)
+static void construct_reply(struct smbsrv_request *req)
 {
-       uint8 type = CVAL(req->in.hdr,HDR_COM);
+       uint8_t type = CVAL(req->in.hdr,HDR_COM);
 
        /* see if its a special NBT packet */
        if (CVAL(req->in.buffer,0) != 0) {
@@ -549,31 +536,34 @@ static void construct_reply(struct request_context *req)
                return;
        }
 
-
        /* Make sure this is an SMB packet */   
        if (memcmp(req->in.hdr,"\377SMB",4) != 0) {
                DEBUG(2,("Non-SMB packet of length %d. Terminating connection\n", 
                         req->in.size));
-               exit_server(req->smb, "Non-SMB packet");
+               smbsrv_terminate_connection(req->smb_conn, "Non-SMB packet");
                return;
        }
 
        if (NBT_HDR_SIZE + MIN_SMB_SIZE + 2*req->in.wct > req->in.size) {
                DEBUG(2,("Invalid SMB word count %d\n", req->in.wct));
-               exit_server(req->smb, "Invalid SMB packet");
+               smbsrv_terminate_connection(req->smb_conn, "Invalid SMB packet");
                return;
        }
 
        if (NBT_HDR_SIZE + MIN_SMB_SIZE + 2*req->in.wct + req->in.data_size > req->in.size) {
                DEBUG(2,("Invalid SMB buffer length count %d\n", req->in.data_size));
-               exit_server(req->smb, "Invalid SMB packet");
+               smbsrv_terminate_connection(req->smb_conn, "Invalid SMB packet");
                return;
        }
 
-
-       req->smbpid = SVAL(req->in.hdr,HDR_PID);        
        req->flags = CVAL(req->in.hdr, HDR_FLG);
        req->flags2 = SVAL(req->in.hdr, HDR_FLG2);
+       req->smbpid = SVAL(req->in.hdr,HDR_PID);
+
+       if (!req_signing_check_incoming(req)) {
+               req_reply_error(req, NT_STATUS_ACCESS_DENIED);
+               return;
+       }
 
        switch_message(type, req);
 }
@@ -583,12 +573,12 @@ static void construct_reply(struct request_context *req)
   we call this when first first part of a possibly chained request has been completed
   and we need to call the 2nd part, if any
 */
-void chain_reply(struct request_context *req)
+void chain_reply(struct smbsrv_request *req)
 {
-       uint16 chain_cmd, chain_offset;
-       char *vwv, *data;
-       uint16 wct;
-       uint16 data_size;
+       uint16_t chain_cmd, chain_offset;
+       uint8_t *vwv, *data;
+       uint16_t wct;
+       uint16_t data_size;
 
        if (req->in.wct < 2 || req->out.wct < 2) {
                req_reply_dos_error(req, ERRSRV, ERRerror);
@@ -638,8 +628,7 @@ void chain_reply(struct request_context *req)
 
        /* the current request in the chain might have used an async reply,
           but that doesn't mean the next element needs to */
-       ZERO_STRUCT(req->async);
-       req->control_flags &= ~REQ_CONTROL_ASYNC;
+       ZERO_STRUCTP(req->async_states);
 
        switch_message(chain_cmd, req);
        return;
@@ -654,38 +643,160 @@ error:
 /*
   close the socket and shutdown a server_context
 */
-void server_terminate(struct server_context *smb)
+void smbsrv_terminate_connection(struct smbsrv_connection *smb_conn, const char *reason)
+{
+       server_terminate_connection(smb_conn->connection, reason);
+}
+
+/*
+  called on a fatal error that should cause this server to terminate
+*/
+static void smbsrv_exit(struct server_service *service, const char *reason)
 {
-       close(smb->socket.fd);
-       event_remove_fd_all(smb->events, smb->socket.fd);
+       DEBUG(1,("smbsrv_exit\n"));
+       return;
+}
 
-       conn_close_all(smb);
+/*
+  add a socket address to the list of events, one event per port
+*/
+static void add_socket(struct server_service *service, 
+                      const struct model_ops *model_ops,
+                      struct socket_context *socket_ctx, 
+                      struct ipv4_addr *ifip)
+{
+       const char **ports = lp_smb_ports();
+       int i;
+       char *ip_str = talloc_strdup(service, sys_inet_ntoa(*ifip));
+
+       for (i=0;ports[i];i++) {
+               uint16_t port = atoi(ports[i]);
+               if (port == 0) continue;
+               service_setup_socket(service, model_ops, "ipv4", ip_str, &port);
+       }
 
-       talloc_destroy(smb->mem_ctx);
+       talloc_free(ip_str);
 }
 
+/****************************************************************************
+ Open the socket communication.
+****************************************************************************/
+static void smbsrv_init(struct server_service *service, const struct model_ops *model_ops)
+{      
+       DEBUG(1,("smbsrv_init\n"));
+
+       if (lp_interfaces() && lp_bind_interfaces_only()) {
+               int num_interfaces = iface_count();
+               int i;
+
+               /* We have been given an interfaces line, and been 
+                  told to only bind to those interfaces. Create a
+                  socket per interface and bind to only these.
+               */
+               for(i = 0; i < num_interfaces; i++) {
+                       struct ipv4_addr *ifip = iface_n_ip(i);
+
+                       if (ifip == NULL) {
+                               DEBUG(0,("open_sockets_smbd: interface %d has NULL IP address !\n", i));
+                               continue;
+                       }
+
+                       add_socket(service, model_ops, NULL, ifip);
+               }
+       } else {
+               struct ipv4_addr ifip;
+               /* Just bind to lp_socket_address() (usually 0.0.0.0) */
+               ifip = interpret_addr2(lp_socket_address());
+               add_socket(service, model_ops, NULL, &ifip);
+       }
+}
 
 /*
   called when a SMB socket becomes readable
 */
-void smbd_read_handler(struct event_context *ev, struct fd_event *fde, 
-                      time_t t, uint16 flags)
+static void smbsrv_recv(struct server_connection *conn, struct timeval t, uint16_t flags)
 {
-       struct request_context *req;
-       struct server_context *smb = fde->private;
-       
-       req = receive_smb_request(smb);
-       if (!req) {
-               smb->model_ops->terminate_connection(smb, "receive error");
+       struct smbsrv_connection *smb_conn = conn->private_data;
+       NTSTATUS status;
+
+       DEBUG(10,("smbsrv_recv\n"));
+
+       status = receive_smb_request(smb_conn, t);
+       if (NT_STATUS_IS_ERR(status)) {
+               conn->event.fde->flags = 0;
+               smbsrv_terminate_connection(smb_conn, nt_errstr(status));
                return;
        }
 
-       construct_reply(req);
-
        /* free up temporary memory */
        lp_talloc_free();
 }
 
+/*
+  called when a SMB socket becomes writable
+*/
+static void smbsrv_send(struct server_connection *conn, struct timeval t, uint16_t flags)
+{
+       struct smbsrv_connection *smb_conn = conn->private_data;
+
+       while (smb_conn->pending_send) {
+               struct smbsrv_request *req = smb_conn->pending_send;
+               DATA_BLOB blob;
+               NTSTATUS status;
+               size_t sendlen;
+
+               blob.data = req->out.buffer;
+               blob.length = req->out.size;
+
+               /* send as much of this request as we can */
+               status = socket_send(conn->socket, &blob, &sendlen, 0);
+               if (NT_STATUS_IS_ERR(status)) {
+                       smbsrv_terminate_connection(req->smb_conn, nt_errstr(status));
+                       return;
+               }
+               if (sendlen == 0) {
+                       break;
+               }
+
+               req->out.buffer += sendlen;
+               req->out.size -= sendlen;
+
+               /* is the whole request gone? */
+               if (req->out.size == 0) {
+                       DLIST_REMOVE(smb_conn->pending_send, req);
+                       req_destroy(req);
+               }
+       }
+
+       /* if no more requests are pending to be sent then
+          we should stop select for write */
+       if (smb_conn->pending_send == NULL) {
+               conn->event.fde->flags &= ~EVENT_FD_WRITE;
+       }
+}
+
+/*
+  called when connection is idle
+*/
+static void smbsrv_idle(struct server_connection *conn, struct timeval t)
+{
+       DEBUG(10,("smbsrv_idle: not implemented!\n"));
+       conn->event.idle->next_event = timeval_add(&t, 5, 0);
+       return;
+}
+
+static void smbsrv_close(struct server_connection *conn, const char *reason)
+{
+       struct smbsrv_connection *smb_conn = conn->private_data;
+
+       DEBUG(5,("smbsrv_close: %s\n",reason));
+
+       conn_close_all(smb_conn);
+
+       talloc_free(smb_conn);
+
+       return;
+}
 
 /*
   process a message from an SMB socket while still processing a
@@ -693,17 +804,14 @@ void smbd_read_handler(struct event_context *ev, struct fd_event *fde,
   new messages from clients are still processed while they are
   performing long operations
 */
-void smbd_process_async(struct server_context *smb)
+void smbd_process_async(struct smbsrv_connection *smb_conn)
 {
-       struct request_context *req;
+       NTSTATUS status;
        
-       req = receive_smb_request(smb);
-       if (!req) {
-               smb->model_ops->terminate_connection(smb, "receive error");
-               return;
+       status = receive_smb_request(smb_conn, timeval_current());
+       if (NT_STATUS_IS_ERR(status)) {
+               smbsrv_terminate_connection(smb_conn, nt_errstr(status));
        }
-
-       construct_reply(req);
 }
 
 
@@ -711,59 +819,65 @@ void smbd_process_async(struct server_context *smb)
   initialise a server_context from a open socket and register a event handler
   for reading from that socket
 */
-void init_smbsession(struct event_context *ev, struct model_ops *model_ops, int fd,
-                    void (*read_handler)(struct event_context *, struct fd_event *, time_t, uint16))
+void smbsrv_accept(struct server_connection *conn)
 {
-       struct server_context *smb;
-       TALLOC_CTX *mem_ctx;
-       struct fd_event fde;
-       char *socket_addr;
-
-       set_socket_options(fd,"SO_KEEPALIVE");
-       set_socket_options(fd, lp_socket_options());
+       struct smbsrv_connection *smb_conn;
+       int fd;
 
-       mem_ctx = talloc_init("server_context");
+       DEBUG(5,("smbsrv_accept\n"));
 
-       smb = (struct server_context *)talloc(mem_ctx, sizeof(*smb));
-       if (!smb) return;
+       smb_conn = talloc_zero_p(conn, struct smbsrv_connection);
+       if (!smb_conn) return;
 
-       ZERO_STRUCTP(smb);
+       smb_conn->pid = getpid();
 
-       smb->mem_ctx = mem_ctx;
-       smb->socket.fd = fd;
-       smb->pid = getpid();
-
-       sub_set_context(&smb->substitute);
-
-       /* set an initial client name based on its IP address. This will be replaced with
-          the netbios name later if it gives us one */
-       socket_addr = get_socket_addr(smb->mem_ctx, fd);
-       sub_set_remote_machine(socket_addr);
-       smb->socket.client_addr = socket_addr;
+       sub_set_context(&smb_conn->substitute);
 
        /* now initialise a few default values associated with this smb socket */
-       smb->negotiate.max_send = 0xFFFF;
+       smb_conn->negotiate.max_send = 0xFFFF;
 
        /* this is the size that w2k uses, and it appears to be important for
           good performance */
-       smb->negotiate.max_recv = lp_max_xmit();
+       smb_conn->negotiate.max_recv = lp_max_xmit();
 
-       smb->users.next_vuid = VUID_OFFSET;
-       
-       smb->events = ev;
-       smb->model_ops = model_ops;
+       smb_conn->negotiate.zone_offset = get_time_zone(time(NULL));
+
+       smb_conn->sessions.next_vuid = VUID_OFFSET;
 
-       conn_init(smb);
+       srv_init_signing(smb_conn);
 
-       /* setup a event handler for this socket. We are initially
-          only interested in reading from the socket */
-       fde.fd = fd;
-       fde.handler = read_handler;
-       fde.private = smb;
-       fde.flags = EVENT_FD_READ;
+       conn_init(smb_conn);
 
-       event_add_fd(ev, &fde);
+       smb_conn->connection = conn;
+
+       conn->private_data = smb_conn;
+
+       fd = socket_get_fd(conn->socket);
+       set_blocking(fd, True);
 
        /* setup the DCERPC server subsystem */
-       dcesrv_init_context(&smb->dcesrv);
+       dcesrv_init_context(smb_conn, &smb_conn->dcesrv);
+
+       return;
+}
+
+static const struct server_service_ops smb_server_ops = {
+       .name                   = "smb",
+       .service_init           = smbsrv_init,
+       .accept_connection      = smbsrv_accept,
+       .recv_handler           = smbsrv_recv,
+       .send_handler           = smbsrv_send,
+       .idle_handler           = smbsrv_idle,
+       .close_connection       = smbsrv_close,
+       .service_exit           = smbsrv_exit,  
+};
+
+const struct server_service_ops *smbsrv_get_ops(void)
+{
+       return &smb_server_ops;
+}
+
+NTSTATUS server_service_smb_init(void)
+{
+       return NT_STATUS_OK;    
 }