source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/globals.h"
  23 #include "librpc/gen_ndr/netlogon.h"
  24 #include "librpc/gen_ndr/messaging.h"
  25 #include "../lib/async_req/async_sock.h"
  26 #include "ctdbd_conn.h"
  27 #include "../lib/util/select.h"
  28
  29 extern bool global_machine_password_needs_changing;
  30
  31 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  32                                    char *outbuf);
  33 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid);
  34
  35 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  36 {
  37         bool ok;
  38
  39         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  40                 return true;
  41         }
  42
  43         sconn->smb1.echo_handler.ref_count++;
  44
  45         if (sconn->smb1.echo_handler.ref_count > 1) {
  46                 return true;
  47         }
  48
  49         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  50
  51         ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
  52                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  53         if (!ok) {
  54                 return false;
  55         }
  56
  57         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  58
  59         return true;
  60 }
  61
  62 void smbd_lock_socket(struct smbd_server_connection *sconn)
  63 {
  64         if (!smbd_lock_socket_internal(sconn)) {
  65                 exit_server_cleanly("failed to lock socket");
  66         }
  67 }
  68
  69 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  70 {
  71         bool ok;
  72
  73         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  74                 return true;
  75         }
  76
  77         sconn->smb1.echo_handler.ref_count--;
  78
  79         if (sconn->smb1.echo_handler.ref_count > 0) {
  80                 return true;
  81         }
  82
  83         ok = fcntl_lock(sconn->smb1.echo_handler.socket_lock_fd,
  84                         SMB_F_SETLKW, 0, 0, F_UNLCK);
  85         if (!ok) {
  86                 return false;
  87         }
  88
  89         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
  90
  91         return true;
  92 }
  93
  94 void smbd_unlock_socket(struct smbd_server_connection *sconn)
  95 {
  96         if (!smbd_unlock_socket_internal(sconn)) {
  97                 exit_server_cleanly("failed to unlock socket");
  98         }
  99 }
 100
 101 /* Accessor function for smb_read_error for smbd functions. */
 102
 103 /****************************************************************************
 104  Send an smb to a fd.
 105 ****************************************************************************/
 106
 107 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 108                   bool do_signing, uint32_t seqnum,
 109                   bool do_encrypt,
 110                   struct smb_perfcount_data *pcd)
 111 {
 112         size_t len = 0;
 113         size_t nwritten=0;
 114         ssize_t ret;
 115         char *buf_out = buffer;
 116
 117         smbd_lock_socket(sconn);
 118
 119         if (do_signing) {
 120                 /* Sign the outgoing packet if required. */
 121                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 122         }
 123
 124         if (do_encrypt) {
 125                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 126                 if (!NT_STATUS_IS_OK(status)) {
 127                         DEBUG(0, ("send_smb: SMB encryption failed "
 128                                 "on outgoing packet! Error %s\n",
 129                                 nt_errstr(status) ));
 130                         goto out;
 131                 }
 132         }
 133
 134         len = smb_len(buf_out) + 4;
 135
 136         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
 137         if (ret <= 0) {
 138
 139                 char addr[INET6_ADDRSTRLEN];
 140                 /*
 141                  * Try and give an error message saying what
 142                  * client failed.
 143                  */
 144                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 145                          (int)sys_getpid(), (int)len,
 146                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 147                          (int)ret, strerror(errno) ));
 148
 149                 srv_free_enc_buffer(buf_out);
 150                 goto out;
 151         }
 152
 153         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 154         srv_free_enc_buffer(buf_out);
 155 out:
 156         SMB_PERFCOUNT_END(pcd);
 157
 158         smbd_unlock_socket(sconn);
 159         return true;
 160 }
 161
 162 /*******************************************************************
 163  Setup the word count and byte count for a smb message.
 164 ********************************************************************/
 165
 166 int srv_set_message(char *buf,
 167                         int num_words,
 168                         int num_bytes,
 169                         bool zero)
 170 {
 171         if (zero && (num_words || num_bytes)) {
 172                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 173         }
 174         SCVAL(buf,smb_wct,num_words);
 175         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 176         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 177         return (smb_size + num_words*2 + num_bytes);
 178 }
 179
 180 static bool valid_smb_header(const uint8_t *inbuf)
 181 {
 182         if (is_encrypted_packet(inbuf)) {
 183                 return true;
 184         }
 185         /*
 186          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 187          * but it just looks weird to call strncmp for this one.
 188          */
 189         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 190 }
 191
 192 /* Socket functions for smbd packet processing. */
 193
 194 static bool valid_packet_size(size_t len)
 195 {
 196         /*
 197          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 198          * of header. Don't print the error if this fits.... JRA.
 199          */
 200
 201         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 202                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 203                                         (unsigned long)len));
 204                 return false;
 205         }
 206         return true;
 207 }
 208
 209 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 210                                       unsigned int timeout, ssize_t len)
 211 {
 212         NTSTATUS status;
 213
 214         if (len <= 0) {
 215                 return NT_STATUS_OK;
 216         }
 217
 218         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 219         if (!NT_STATUS_IS_OK(status)) {
 220                 char addr[INET6_ADDRSTRLEN];
 221                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 222                           "error = %s.\n",
 223                           get_peer_addr(fd, addr, sizeof(addr)),
 224                           nt_errstr(status)));
 225         }
 226         return status;
 227 }
 228
 229 /****************************************************************************
 230  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 231 ****************************************************************************/
 232
 233 /*
 234  * Unfortunately, earlier versions of smbclient/libsmbclient
 235  * don't send this "standard" writeX header. I've fixed this
 236  * for 3.2 but we'll use the old method with earlier versions.
 237  * Windows and CIFSFS at least use this standard size. Not
 238  * sure about MacOSX.
 239  */
 240
 241 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 242                                 (2*14) + /* word count (including bcc) */ \
 243                                 1 /* pad byte */)
 244
 245 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 246                                                     const char lenbuf[4],
 247                                                     int fd, char **buffer,
 248                                                     unsigned int timeout,
 249                                                     size_t *p_unread,
 250                                                     size_t *len_ret)
 251 {
 252         /* Size of a WRITEX call (+4 byte len). */
 253         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 254         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 255         ssize_t toread;
 256         NTSTATUS status;
 257
 258         memcpy(writeX_header, lenbuf, 4);
 259
 260         status = read_fd_with_timeout(
 261                 fd, writeX_header + 4,
 262                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 263                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 264                 timeout, NULL);
 265
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 char addr[INET6_ADDRSTRLEN];
 268                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 269                           "error = %s.\n",
 270                           get_peer_addr(fd, addr, sizeof(addr)),
 271                           nt_errstr(status)));
 272                 return status;
 273         }
 274
 275         /*
 276          * Ok - now try and see if this is a possible
 277          * valid writeX call.
 278          */
 279
 280         if (is_valid_writeX_buffer(smbd_server_conn,
 281                                    (uint8_t *)writeX_header)) {
 282                 /*
 283                  * If the data offset is beyond what
 284                  * we've read, drain the extra bytes.
 285                  */
 286                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 287                 ssize_t newlen;
 288
 289                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 290                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 291                         if (drain_socket(fd, drain) != drain) {
 292                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 293                                         " failed to drain pending bytes");
 294                         }
 295                 } else {
 296                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 297                 }
 298
 299                 /* Spoof down the length and null out the bcc. */
 300                 set_message_bcc(writeX_header, 0);
 301                 newlen = smb_len(writeX_header);
 302
 303                 /* Copy the header we've written. */
 304
 305                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 306                                 writeX_header,
 307                                 sizeof(writeX_header));
 308
 309                 if (*buffer == NULL) {
 310                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 311                                   (int)sizeof(writeX_header)));
 312                         return NT_STATUS_NO_MEMORY;
 313                 }
 314
 315                 /* Work out the remaining bytes. */
 316                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 317                 *len_ret = newlen + 4;
 318                 return NT_STATUS_OK;
 319         }
 320
 321         if (!valid_packet_size(len)) {
 322                 return NT_STATUS_INVALID_PARAMETER;
 323         }
 324
 325         /*
 326          * Not a valid writeX call. Just do the standard
 327          * talloc and return.
 328          */
 329
 330         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 331
 332         if (*buffer == NULL) {
 333                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 334                           (int)len+4));
 335                 return NT_STATUS_NO_MEMORY;
 336         }
 337
 338         /* Copy in what we already read. */
 339         memcpy(*buffer,
 340                 writeX_header,
 341                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 342         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 343
 344         if(toread > 0) {
 345                 status = read_packet_remainder(
 346                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 347                         timeout, toread);
 348
 349                 if (!NT_STATUS_IS_OK(status)) {
 350                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 351                                    nt_errstr(status)));
 352                         return status;
 353                 }
 354         }
 355
 356         *len_ret = len + 4;
 357         return NT_STATUS_OK;
 358 }
 359
 360 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 361                                        char **buffer, unsigned int timeout,
 362                                        size_t *p_unread, size_t *plen)
 363 {
 364         char lenbuf[4];
 365         size_t len;
 366         int min_recv_size = lp_min_receive_file_size();
 367         NTSTATUS status;
 368
 369         *p_unread = 0;
 370
 371         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 372         if (!NT_STATUS_IS_OK(status)) {
 373                 return status;
 374         }
 375
 376         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 377             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 378                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 379             !srv_is_signing_active(smbd_server_conn) &&
 380             smbd_server_conn->smb1.echo_handler.trusted_fde == NULL) {
 381
 382                 return receive_smb_raw_talloc_partial_read(
 383                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, plen);
 384         }
 385
 386         if (!valid_packet_size(len)) {
 387                 return NT_STATUS_INVALID_PARAMETER;
 388         }
 389
 390         /*
 391          * The +4 here can't wrap, we've checked the length above already.
 392          */
 393
 394         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 395
 396         if (*buffer == NULL) {
 397                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 398                           (int)len+4));
 399                 return NT_STATUS_NO_MEMORY;
 400         }
 401
 402         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 403
 404         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 405         if (!NT_STATUS_IS_OK(status)) {
 406                 return status;
 407         }
 408
 409         *plen = len + 4;
 410         return NT_STATUS_OK;
 411 }
 412
 413 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 414                                    char **buffer, unsigned int timeout,
 415                                    size_t *p_unread, bool *p_encrypted,
 416                                    size_t *p_len,
 417                                    uint32_t *seqnum,
 418                                    bool trusted_channel)
 419 {
 420         size_t len = 0;
 421         NTSTATUS status;
 422
 423         *p_encrypted = false;
 424
 425         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 426                                         p_unread, &len);
 427         if (!NT_STATUS_IS_OK(status)) {
 428                 char addr[INET6_ADDRSTRLEN];
 429                 DEBUG(1, ("read_smb_length_return_keepalive failed for "
 430                           "client %s read error = %s.\n",
 431                           get_peer_addr(fd, addr, sizeof(addr)),
 432                           nt_errstr(status)));
 433                 return status;
 434         }
 435
 436         if (is_encrypted_packet((uint8_t *)*buffer)) {
 437                 status = srv_decrypt_buffer(*buffer);
 438                 if (!NT_STATUS_IS_OK(status)) {
 439                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 440                                 "incoming packet! Error %s\n",
 441                                 nt_errstr(status) ));
 442                         return status;
 443                 }
 444                 *p_encrypted = true;
 445         }
 446
 447         /* Check the incoming SMB signature. */
 448         if (!srv_check_sign_mac(smbd_server_conn, *buffer, seqnum, trusted_channel)) {
 449                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 450                           "incoming packet!\n"));
 451                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 452         }
 453
 454         *p_len = len;
 455         return NT_STATUS_OK;
 456 }
 457
 458 /*
 459  * Initialize a struct smb_request from an inbuf
 460  */
 461
 462 static bool init_smb_request(struct smb_request *req,
 463                              struct smbd_server_connection *sconn,
 464                              const uint8 *inbuf,
 465                              size_t unread_bytes, bool encrypted,
 466                              uint32_t seqnum)
 467 {
 468         size_t req_size = smb_len(inbuf) + 4;
 469         /* Ensure we have at least smb_size bytes. */
 470         if (req_size < smb_size) {
 471                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 472                         (unsigned int)req_size ));
 473                 return false;
 474         }
 475         req->cmd    = CVAL(inbuf, smb_com);
 476         req->flags2 = SVAL(inbuf, smb_flg2);
 477         req->smbpid = SVAL(inbuf, smb_pid);
 478         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 479         req->seqnum = seqnum;
 480         req->vuid   = SVAL(inbuf, smb_uid);
 481         req->tid    = SVAL(inbuf, smb_tid);
 482         req->wct    = CVAL(inbuf, smb_wct);
 483         req->vwv    = (uint16_t *)(inbuf+smb_vwv);
 484         req->buflen = smb_buflen(inbuf);
 485         req->buf    = (const uint8_t *)smb_buf(inbuf);
 486         req->unread_bytes = unread_bytes;
 487         req->encrypted = encrypted;
 488         req->sconn = sconn;
 489         req->conn = conn_find(sconn,req->tid);
 490         req->chain_fsp = NULL;
 491         req->chain_outbuf = NULL;
 492         req->done = false;
 493         req->smb2req = NULL;
 494         smb_init_perfcount_data(&req->pcd);
 495
 496         /* Ensure we have at least wct words and 2 bytes of bcc. */
 497         if (smb_size + req->wct*2 > req_size) {
 498                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 499                         (unsigned int)req->wct,
 500                         (unsigned int)req_size));
 501                 return false;
 502         }
 503         /* Ensure bcc is correct. */
 504         if (((uint8 *)smb_buf(inbuf)) + req->buflen > inbuf + req_size) {
 505                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 506                         "(wct = %u, size %u)\n",
 507                         (unsigned int)req->buflen,
 508                         (unsigned int)req->wct,
 509                         (unsigned int)req_size));
 510                 return false;
 511         }
 512
 513         req->outbuf = NULL;
 514         return true;
 515 }
 516
 517 static void process_smb(struct smbd_server_connection *conn,
 518                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 519                         uint32_t seqnum, bool encrypted,
 520                         struct smb_perfcount_data *deferred_pcd);
 521
 522 static void smbd_deferred_open_timer(struct event_context *ev,
 523                                      struct timed_event *te,
 524                                      struct timeval _tval,
 525                                      void *private_data)
 526 {
 527         struct pending_message_list *msg = talloc_get_type(private_data,
 528                                            struct pending_message_list);
 529         TALLOC_CTX *mem_ctx = talloc_tos();
 530         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 531         uint8_t *inbuf;
 532
 533         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 534                                          msg->buf.length);
 535         if (inbuf == NULL) {
 536                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 537                 return;
 538         }
 539
 540         /* We leave this message on the queue so the open code can
 541            know this is a retry. */
 542         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 543                 (unsigned long long)mid ));
 544
 545         /* Mark the message as processed so this is not
 546          * re-processed in error. */
 547         msg->processed = true;
 548
 549         process_smb(smbd_server_conn, inbuf,
 550                     msg->buf.length, 0,
 551                     msg->seqnum, msg->encrypted, &msg->pcd);
 552
 553         /* If it's still there and was processed, remove it. */
 554         msg = get_deferred_open_message_smb(mid);
 555         if (msg && msg->processed) {
 556                 remove_deferred_open_message_smb(mid);
 557         }
 558 }
 559
 560 /****************************************************************************
 561  Function to push a message onto the tail of a linked list of smb messages ready
 562  for processing.
 563 ****************************************************************************/
 564
 565 static bool push_queued_message(struct smb_request *req,
 566                                 struct timeval request_time,
 567                                 struct timeval end_time,
 568                                 char *private_data, size_t private_len)
 569 {
 570         int msg_len = smb_len(req->inbuf) + 4;
 571         struct pending_message_list *msg;
 572
 573         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 574
 575         if(msg == NULL) {
 576                 DEBUG(0,("push_message: malloc fail (1)\n"));
 577                 return False;
 578         }
 579
 580         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 581         if(msg->buf.data == NULL) {
 582                 DEBUG(0,("push_message: malloc fail (2)\n"));
 583                 TALLOC_FREE(msg);
 584                 return False;
 585         }
 586
 587         msg->request_time = request_time;
 588         msg->seqnum = req->seqnum;
 589         msg->encrypted = req->encrypted;
 590         msg->processed = false;
 591         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 592
 593         if (private_data) {
 594                 msg->private_data = data_blob_talloc(msg, private_data,
 595                                                      private_len);
 596                 if (msg->private_data.data == NULL) {
 597                         DEBUG(0,("push_message: malloc fail (3)\n"));
 598                         TALLOC_FREE(msg);
 599                         return False;
 600                 }
 601         }
 602
 603         msg->te = event_add_timed(smbd_event_context(),
 604                                   msg,
 605                                   end_time,
 606                                   smbd_deferred_open_timer,
 607                                   msg);
 608         if (!msg->te) {
 609                 DEBUG(0,("push_message: event_add_timed failed\n"));
 610                 TALLOC_FREE(msg);
 611                 return false;
 612         }
 613
 614         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 615
 616         DEBUG(10,("push_message: pushed message length %u on "
 617                   "deferred_open_queue\n", (unsigned int)msg_len));
 618
 619         return True;
 620 }
 621
 622 /****************************************************************************
 623  Function to delete a sharing violation open message by mid.
 624 ****************************************************************************/
 625
 626 void remove_deferred_open_message_smb(uint64_t mid)
 627 {
 628         struct pending_message_list *pml;
 629
 630         if (smbd_server_conn->using_smb2) {
 631                 remove_deferred_open_message_smb2(smbd_server_conn, mid);
 632                 return;
 633         }
 634
 635         for (pml = deferred_open_queue; pml; pml = pml->next) {
 636                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 637                         DEBUG(10,("remove_deferred_open_message_smb: "
 638                                   "deleting mid %llu len %u\n",
 639                                   (unsigned long long)mid,
 640                                   (unsigned int)pml->buf.length ));
 641                         DLIST_REMOVE(deferred_open_queue, pml);
 642                         TALLOC_FREE(pml);
 643                         return;
 644                 }
 645         }
 646 }
 647
 648 /****************************************************************************
 649  Move a sharing violation open retry message to the front of the list and
 650  schedule it for immediate processing.
 651 ****************************************************************************/
 652
 653 void schedule_deferred_open_message_smb(uint64_t mid)
 654 {
 655         struct pending_message_list *pml;
 656         int i = 0;
 657
 658         if (smbd_server_conn->using_smb2) {
 659                 schedule_deferred_open_message_smb2(smbd_server_conn, mid);
 660                 return;
 661         }
 662
 663         for (pml = deferred_open_queue; pml; pml = pml->next) {
 664                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 665
 666                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 667                         "msg_mid = %llu\n",
 668                         i++,
 669                         (unsigned long long)msg_mid ));
 670
 671                 if (mid == msg_mid) {
 672                         struct timed_event *te;
 673
 674                         if (pml->processed) {
 675                                 /* A processed message should not be
 676                                  * rescheduled. */
 677                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 678                                         "message mid %llu was already processed\n",
 679                                         (unsigned long long)msg_mid ));
 680                                 continue;
 681                         }
 682
 683                         DEBUG(10,("schedule_deferred_open_message_smb: "
 684                                 "scheduling mid %llu\n",
 685                                 (unsigned long long)mid ));
 686
 687                         te = event_add_timed(smbd_event_context(),
 688                                              pml,
 689                                              timeval_zero(),
 690                                              smbd_deferred_open_timer,
 691                                              pml);
 692                         if (!te) {
 693                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 694                                         "event_add_timed() failed, "
 695                                         "skipping mid %llu\n",
 696                                         (unsigned long long)msg_mid ));
 697                         }
 698
 699                         TALLOC_FREE(pml->te);
 700                         pml->te = te;
 701                         DLIST_PROMOTE(deferred_open_queue, pml);
 702                         return;
 703                 }
 704         }
 705
 706         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 707                 "find message mid %llu\n",
 708                 (unsigned long long)mid ));
 709 }
 710
 711 /****************************************************************************
 712  Return true if this mid is on the deferred queue and was not yet processed.
 713 ****************************************************************************/
 714
 715 bool open_was_deferred(uint64_t mid)
 716 {
 717         struct pending_message_list *pml;
 718
 719         if (smbd_server_conn->using_smb2) {
 720                 return open_was_deferred_smb2(smbd_server_conn, mid);
 721         }
 722
 723         for (pml = deferred_open_queue; pml; pml = pml->next) {
 724                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 725                         return True;
 726                 }
 727         }
 728         return False;
 729 }
 730
 731 /****************************************************************************
 732  Return the message queued by this mid.
 733 ****************************************************************************/
 734
 735 static struct pending_message_list *get_deferred_open_message_smb(uint64_t mid)
 736 {
 737         struct pending_message_list *pml;
 738
 739         for (pml = deferred_open_queue; pml; pml = pml->next) {
 740                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 741                         return pml;
 742                 }
 743         }
 744         return NULL;
 745 }
 746
 747 /****************************************************************************
 748  Get the state data queued by this mid.
 749 ****************************************************************************/
 750
 751 bool get_deferred_open_message_state(struct smb_request *smbreq,
 752                                 struct timeval *p_request_time,
 753                                 void **pp_state)
 754 {
 755         struct pending_message_list *pml;
 756
 757         if (smbd_server_conn->using_smb2) {
 758                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 759                                         p_request_time,
 760                                         pp_state);
 761         }
 762
 763         pml = get_deferred_open_message_smb(smbreq->mid);
 764         if (!pml) {
 765                 return false;
 766         }
 767         if (p_request_time) {
 768                 *p_request_time = pml->request_time;
 769         }
 770         if (pp_state) {
 771                 *pp_state = (void *)pml->private_data.data;
 772         }
 773         return true;
 774 }
 775
 776 /****************************************************************************
 777  Function to push a deferred open smb message onto a linked list of local smb
 778  messages ready for processing.
 779 ****************************************************************************/
 780
 781 bool push_deferred_open_message_smb(struct smb_request *req,
 782                                struct timeval request_time,
 783                                struct timeval timeout,
 784                                struct file_id id,
 785                                char *private_data, size_t priv_len)
 786 {
 787         struct timeval end_time;
 788
 789         if (req->smb2req) {
 790                 return push_deferred_open_message_smb2(req->smb2req,
 791                                                 request_time,
 792                                                 timeout,
 793                                                 id,
 794                                                 private_data,
 795                                                 priv_len);
 796         }
 797
 798         if (req->unread_bytes) {
 799                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 800                         "unread_bytes = %u\n",
 801                         (unsigned int)req->unread_bytes ));
 802                 smb_panic("push_deferred_open_message_smb: "
 803                         "logic error unread_bytes != 0" );
 804         }
 805
 806         end_time = timeval_sum(&request_time, &timeout);
 807
 808         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 809                 "len %u mid %llu timeout time [%u.%06u]\n",
 810                 (unsigned int) smb_len(req->inbuf)+4,
 811                 (unsigned long long)req->mid,
 812                 (unsigned int)end_time.tv_sec,
 813                 (unsigned int)end_time.tv_usec));
 814
 815         return push_queued_message(req, request_time, end_time,
 816                                    private_data, priv_len);
 817 }
 818
 819 struct idle_event {
 820         struct timed_event *te;
 821         struct timeval interval;
 822         char *name;
 823         bool (*handler)(const struct timeval *now, void *private_data);
 824         void *private_data;
 825 };
 826
 827 static void smbd_idle_event_handler(struct event_context *ctx,
 828                                     struct timed_event *te,
 829                                     struct timeval now,
 830                                     void *private_data)
 831 {
 832         struct idle_event *event =
 833                 talloc_get_type_abort(private_data, struct idle_event);
 834
 835         TALLOC_FREE(event->te);
 836
 837         DEBUG(10,("smbd_idle_event_handler: %s %p called\n",
 838                   event->name, event->te));
 839
 840         if (!event->handler(&now, event->private_data)) {
 841                 DEBUG(10,("smbd_idle_event_handler: %s %p stopped\n",
 842                           event->name, event->te));
 843                 /* Don't repeat, delete ourselves */
 844                 TALLOC_FREE(event);
 845                 return;
 846         }
 847
 848         DEBUG(10,("smbd_idle_event_handler: %s %p rescheduled\n",
 849                   event->name, event->te));
 850
 851         event->te = event_add_timed(ctx, event,
 852                                     timeval_sum(&now, &event->interval),
 853                                     smbd_idle_event_handler, event);
 854
 855         /* We can't do much but fail here. */
 856         SMB_ASSERT(event->te != NULL);
 857 }
 858
 859 struct idle_event *event_add_idle(struct event_context *event_ctx,
 860                                   TALLOC_CTX *mem_ctx,
 861                                   struct timeval interval,
 862                                   const char *name,
 863                                   bool (*handler)(const struct timeval *now,
 864                                                   void *private_data),
 865                                   void *private_data)
 866 {
 867         struct idle_event *result;
 868         struct timeval now = timeval_current();
 869
 870         result = TALLOC_P(mem_ctx, struct idle_event);
 871         if (result == NULL) {
 872                 DEBUG(0, ("talloc failed\n"));
 873                 return NULL;
 874         }
 875
 876         result->interval = interval;
 877         result->handler = handler;
 878         result->private_data = private_data;
 879
 880         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 881                 DEBUG(0, ("talloc failed\n"));
 882                 TALLOC_FREE(result);
 883                 return NULL;
 884         }
 885
 886         result->te = event_add_timed(event_ctx, result,
 887                                      timeval_sum(&now, &interval),
 888                                      smbd_idle_event_handler, result);
 889         if (result->te == NULL) {
 890                 DEBUG(0, ("event_add_timed failed\n"));
 891                 TALLOC_FREE(result);
 892                 return NULL;
 893         }
 894
 895         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
 896         return result;
 897 }
 898
 899 static void smbd_sig_term_handler(struct tevent_context *ev,
 900                                   struct tevent_signal *se,
 901                                   int signum,
 902                                   int count,
 903                                   void *siginfo,
 904                                   void *private_data)
 905 {
 906         exit_server_cleanly("termination signal");
 907 }
 908
 909 void smbd_setup_sig_term_handler(void)
 910 {
 911         struct tevent_signal *se;
 912
 913         se = tevent_add_signal(smbd_event_context(),
 914                                smbd_event_context(),
 915                                SIGTERM, 0,
 916                                smbd_sig_term_handler,
 917                                NULL);
 918         if (!se) {
 919                 exit_server("failed to setup SIGTERM handler");
 920         }
 921 }
 922
 923 static void smbd_sig_hup_handler(struct tevent_context *ev,
 924                                   struct tevent_signal *se,
 925                                   int signum,
 926                                   int count,
 927                                   void *siginfo,
 928                                   void *private_data)
 929 {
 930         struct messaging_context *msg_ctx = talloc_get_type_abort(
 931                 private_data, struct messaging_context);
 932         change_to_root_user();
 933         DEBUG(1,("Reloading services after SIGHUP\n"));
 934         reload_services(msg_ctx, smbd_server_conn->sock, False);
 935 }
 936
 937 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
 938                                 struct messaging_context *msg_ctx)
 939 {
 940         struct tevent_signal *se;
 941
 942         se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
 943                                msg_ctx);
 944         if (!se) {
 945                 exit_server("failed to setup SIGHUP handler");
 946         }
 947 }
 948
 949 static NTSTATUS smbd_server_connection_loop_once(struct smbd_server_connection *conn)
 950 {
 951         fd_set r_fds, w_fds;
 952         int selrtn;
 953         struct timeval to;
 954         int maxfd = 0;
 955
 956         to.tv_sec = SMBD_SELECT_TIMEOUT;
 957         to.tv_usec = 0;
 958
 959         /*
 960          * Setup the select fd sets.
 961          */
 962
 963         FD_ZERO(&r_fds);
 964         FD_ZERO(&w_fds);
 965
 966         /*
 967          * Are there any timed events waiting ? If so, ensure we don't
 968          * select for longer than it would take to wait for them.
 969          */
 970
 971         {
 972                 struct timeval now;
 973                 GetTimeOfDay(&now);
 974
 975                 event_add_to_select_args(smbd_event_context(), &now,
 976                                          &r_fds, &w_fds, &to, &maxfd);
 977         }
 978
 979         /* Process a signal and timed events now... */
 980         if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 981                 return NT_STATUS_RETRY;
 982         }
 983
 984         {
 985                 int sav;
 986                 START_PROFILE(smbd_idle);
 987
 988                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 989                 sav = errno;
 990
 991                 END_PROFILE(smbd_idle);
 992                 errno = sav;
 993         }
 994
 995         /* Check if error */
 996         if (selrtn == -1) {
 997                 /* something is wrong. Maybe the socket is dead? */
 998                 return map_nt_error_from_unix(errno);
 999         }
1000
1001         if ((conn->smb1.echo_handler.trusted_fd != -1)
1002             && FD_ISSET(conn->sock, &r_fds)
1003             && FD_ISSET(conn->smb1.echo_handler.trusted_fd, &r_fds)) {
1004                 /*
1005                  * Prefer to read pending requests from the echo handler. To
1006                  * quote Jeremy (da70f8ab1): This is a hack of monstrous
1007                  * proportions...
1008                  */
1009                 FD_CLR(conn->sock, &r_fds);
1010         }
1011
1012         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
1013                 return NT_STATUS_RETRY;
1014         }
1015
1016         /* Did we timeout ? */
1017         if (selrtn == 0) {
1018                 return NT_STATUS_RETRY;
1019         }
1020
1021         /* should not be reached */
1022         return NT_STATUS_INTERNAL_ERROR;
1023 }
1024
1025 /*
1026  * Only allow 5 outstanding trans requests. We're allocating memory, so
1027  * prevent a DoS.
1028  */
1029
1030 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1031 {
1032         int count = 0;
1033         for (; list != NULL; list = list->next) {
1034
1035                 if (list->mid == mid) {
1036                         return NT_STATUS_INVALID_PARAMETER;
1037                 }
1038
1039                 count += 1;
1040         }
1041         if (count > 5) {
1042                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1043         }
1044
1045         return NT_STATUS_OK;
1046 }
1047
1048 /*
1049 These flags determine some of the permissions required to do an operation
1050
1051 Note that I don't set NEED_WRITE on some write operations because they
1052 are used by some brain-dead clients when printing, and I don't want to
1053 force write permissions on print services.
1054 */
1055 #define AS_USER (1<<0)
1056 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1057 #define TIME_INIT (1<<2)
1058 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1059 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1060 #define DO_CHDIR (1<<6)
1061
1062 /*
1063    define a list of possible SMB messages and their corresponding
1064    functions. Any message that has a NULL function is unimplemented -
1065    please feel free to contribute implementations!
1066 */
1067 static const struct smb_message_struct {
1068         const char *name;
1069         void (*fn)(struct smb_request *req);
1070         int flags;
1071 } smb_messages[256] = {
1072
1073 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1074 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1075 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1076 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1077 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1078 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1079 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1080 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1081 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1082 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1083 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1084 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1085 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1086 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1087 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1088 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1089 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1090 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1091 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1092 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1093 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1094 /* 0x15 */ { NULL, NULL, 0 },
1095 /* 0x16 */ { NULL, NULL, 0 },
1096 /* 0x17 */ { NULL, NULL, 0 },
1097 /* 0x18 */ { NULL, NULL, 0 },
1098 /* 0x19 */ { NULL, NULL, 0 },
1099 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1100 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1101 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1102 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1103 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1104 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1105 /* 0x20 */ { "SMBwritec", NULL,0},
1106 /* 0x21 */ { NULL, NULL, 0 },
1107 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1108 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1109 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1110 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1111 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1112 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1113 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1114 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1115 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1116 /* 0x2b */ { "SMBecho",reply_echo,0},
1117 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1118 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1119 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1120 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1121 /* 0x30 */ { NULL, NULL, 0 },
1122 /* 0x31 */ { NULL, NULL, 0 },
1123 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1124 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1125 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1126 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1127 /* 0x36 */ { NULL, NULL, 0 },
1128 /* 0x37 */ { NULL, NULL, 0 },
1129 /* 0x38 */ { NULL, NULL, 0 },
1130 /* 0x39 */ { NULL, NULL, 0 },
1131 /* 0x3a */ { NULL, NULL, 0 },
1132 /* 0x3b */ { NULL, NULL, 0 },
1133 /* 0x3c */ { NULL, NULL, 0 },
1134 /* 0x3d */ { NULL, NULL, 0 },
1135 /* 0x3e */ { NULL, NULL, 0 },
1136 /* 0x3f */ { NULL, NULL, 0 },
1137 /* 0x40 */ { NULL, NULL, 0 },
1138 /* 0x41 */ { NULL, NULL, 0 },
1139 /* 0x42 */ { NULL, NULL, 0 },
1140 /* 0x43 */ { NULL, NULL, 0 },
1141 /* 0x44 */ { NULL, NULL, 0 },
1142 /* 0x45 */ { NULL, NULL, 0 },
1143 /* 0x46 */ { NULL, NULL, 0 },
1144 /* 0x47 */ { NULL, NULL, 0 },
1145 /* 0x48 */ { NULL, NULL, 0 },
1146 /* 0x49 */ { NULL, NULL, 0 },
1147 /* 0x4a */ { NULL, NULL, 0 },
1148 /* 0x4b */ { NULL, NULL, 0 },
1149 /* 0x4c */ { NULL, NULL, 0 },
1150 /* 0x4d */ { NULL, NULL, 0 },
1151 /* 0x4e */ { NULL, NULL, 0 },
1152 /* 0x4f */ { NULL, NULL, 0 },
1153 /* 0x50 */ { NULL, NULL, 0 },
1154 /* 0x51 */ { NULL, NULL, 0 },
1155 /* 0x52 */ { NULL, NULL, 0 },
1156 /* 0x53 */ { NULL, NULL, 0 },
1157 /* 0x54 */ { NULL, NULL, 0 },
1158 /* 0x55 */ { NULL, NULL, 0 },
1159 /* 0x56 */ { NULL, NULL, 0 },
1160 /* 0x57 */ { NULL, NULL, 0 },
1161 /* 0x58 */ { NULL, NULL, 0 },
1162 /* 0x59 */ { NULL, NULL, 0 },
1163 /* 0x5a */ { NULL, NULL, 0 },
1164 /* 0x5b */ { NULL, NULL, 0 },
1165 /* 0x5c */ { NULL, NULL, 0 },
1166 /* 0x5d */ { NULL, NULL, 0 },
1167 /* 0x5e */ { NULL, NULL, 0 },
1168 /* 0x5f */ { NULL, NULL, 0 },
1169 /* 0x60 */ { NULL, NULL, 0 },
1170 /* 0x61 */ { NULL, NULL, 0 },
1171 /* 0x62 */ { NULL, NULL, 0 },
1172 /* 0x63 */ { NULL, NULL, 0 },
1173 /* 0x64 */ { NULL, NULL, 0 },
1174 /* 0x65 */ { NULL, NULL, 0 },
1175 /* 0x66 */ { NULL, NULL, 0 },
1176 /* 0x67 */ { NULL, NULL, 0 },
1177 /* 0x68 */ { NULL, NULL, 0 },
1178 /* 0x69 */ { NULL, NULL, 0 },
1179 /* 0x6a */ { NULL, NULL, 0 },
1180 /* 0x6b */ { NULL, NULL, 0 },
1181 /* 0x6c */ { NULL, NULL, 0 },
1182 /* 0x6d */ { NULL, NULL, 0 },
1183 /* 0x6e */ { NULL, NULL, 0 },
1184 /* 0x6f */ { NULL, NULL, 0 },
1185 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1186 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1187 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1188 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1189 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1190 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1191 /* 0x76 */ { NULL, NULL, 0 },
1192 /* 0x77 */ { NULL, NULL, 0 },
1193 /* 0x78 */ { NULL, NULL, 0 },
1194 /* 0x79 */ { NULL, NULL, 0 },
1195 /* 0x7a */ { NULL, NULL, 0 },
1196 /* 0x7b */ { NULL, NULL, 0 },
1197 /* 0x7c */ { NULL, NULL, 0 },
1198 /* 0x7d */ { NULL, NULL, 0 },
1199 /* 0x7e */ { NULL, NULL, 0 },
1200 /* 0x7f */ { NULL, NULL, 0 },
1201 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1202 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1203 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1204 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1205 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1206 /* 0x85 */ { NULL, NULL, 0 },
1207 /* 0x86 */ { NULL, NULL, 0 },
1208 /* 0x87 */ { NULL, NULL, 0 },
1209 /* 0x88 */ { NULL, NULL, 0 },
1210 /* 0x89 */ { NULL, NULL, 0 },
1211 /* 0x8a */ { NULL, NULL, 0 },
1212 /* 0x8b */ { NULL, NULL, 0 },
1213 /* 0x8c */ { NULL, NULL, 0 },
1214 /* 0x8d */ { NULL, NULL, 0 },
1215 /* 0x8e */ { NULL, NULL, 0 },
1216 /* 0x8f */ { NULL, NULL, 0 },
1217 /* 0x90 */ { NULL, NULL, 0 },
1218 /* 0x91 */ { NULL, NULL, 0 },
1219 /* 0x92 */ { NULL, NULL, 0 },
1220 /* 0x93 */ { NULL, NULL, 0 },
1221 /* 0x94 */ { NULL, NULL, 0 },
1222 /* 0x95 */ { NULL, NULL, 0 },
1223 /* 0x96 */ { NULL, NULL, 0 },
1224 /* 0x97 */ { NULL, NULL, 0 },
1225 /* 0x98 */ { NULL, NULL, 0 },
1226 /* 0x99 */ { NULL, NULL, 0 },
1227 /* 0x9a */ { NULL, NULL, 0 },
1228 /* 0x9b */ { NULL, NULL, 0 },
1229 /* 0x9c */ { NULL, NULL, 0 },
1230 /* 0x9d */ { NULL, NULL, 0 },
1231 /* 0x9e */ { NULL, NULL, 0 },
1232 /* 0x9f */ { NULL, NULL, 0 },
1233 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1234 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1235 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1236 /* 0xa3 */ { NULL, NULL, 0 },
1237 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1238 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1239 /* 0xa6 */ { NULL, NULL, 0 },
1240 /* 0xa7 */ { NULL, NULL, 0 },
1241 /* 0xa8 */ { NULL, NULL, 0 },
1242 /* 0xa9 */ { NULL, NULL, 0 },
1243 /* 0xaa */ { NULL, NULL, 0 },
1244 /* 0xab */ { NULL, NULL, 0 },
1245 /* 0xac */ { NULL, NULL, 0 },
1246 /* 0xad */ { NULL, NULL, 0 },
1247 /* 0xae */ { NULL, NULL, 0 },
1248 /* 0xaf */ { NULL, NULL, 0 },
1249 /* 0xb0 */ { NULL, NULL, 0 },
1250 /* 0xb1 */ { NULL, NULL, 0 },
1251 /* 0xb2 */ { NULL, NULL, 0 },
1252 /* 0xb3 */ { NULL, NULL, 0 },
1253 /* 0xb4 */ { NULL, NULL, 0 },
1254 /* 0xb5 */ { NULL, NULL, 0 },
1255 /* 0xb6 */ { NULL, NULL, 0 },
1256 /* 0xb7 */ { NULL, NULL, 0 },
1257 /* 0xb8 */ { NULL, NULL, 0 },
1258 /* 0xb9 */ { NULL, NULL, 0 },
1259 /* 0xba */ { NULL, NULL, 0 },
1260 /* 0xbb */ { NULL, NULL, 0 },
1261 /* 0xbc */ { NULL, NULL, 0 },
1262 /* 0xbd */ { NULL, NULL, 0 },
1263 /* 0xbe */ { NULL, NULL, 0 },
1264 /* 0xbf */ { NULL, NULL, 0 },
1265 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1266 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1267 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1268 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1269 /* 0xc4 */ { NULL, NULL, 0 },
1270 /* 0xc5 */ { NULL, NULL, 0 },
1271 /* 0xc6 */ { NULL, NULL, 0 },
1272 /* 0xc7 */ { NULL, NULL, 0 },
1273 /* 0xc8 */ { NULL, NULL, 0 },
1274 /* 0xc9 */ { NULL, NULL, 0 },
1275 /* 0xca */ { NULL, NULL, 0 },
1276 /* 0xcb */ { NULL, NULL, 0 },
1277 /* 0xcc */ { NULL, NULL, 0 },
1278 /* 0xcd */ { NULL, NULL, 0 },
1279 /* 0xce */ { NULL, NULL, 0 },
1280 /* 0xcf */ { NULL, NULL, 0 },
1281 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1282 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1283 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1284 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1285 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1286 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1287 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1288 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1289 /* 0xd8 */ { NULL, NULL, 0 },
1290 /* 0xd9 */ { NULL, NULL, 0 },
1291 /* 0xda */ { NULL, NULL, 0 },
1292 /* 0xdb */ { NULL, NULL, 0 },
1293 /* 0xdc */ { NULL, NULL, 0 },
1294 /* 0xdd */ { NULL, NULL, 0 },
1295 /* 0xde */ { NULL, NULL, 0 },
1296 /* 0xdf */ { NULL, NULL, 0 },
1297 /* 0xe0 */ { NULL, NULL, 0 },
1298 /* 0xe1 */ { NULL, NULL, 0 },
1299 /* 0xe2 */ { NULL, NULL, 0 },
1300 /* 0xe3 */ { NULL, NULL, 0 },
1301 /* 0xe4 */ { NULL, NULL, 0 },
1302 /* 0xe5 */ { NULL, NULL, 0 },
1303 /* 0xe6 */ { NULL, NULL, 0 },
1304 /* 0xe7 */ { NULL, NULL, 0 },
1305 /* 0xe8 */ { NULL, NULL, 0 },
1306 /* 0xe9 */ { NULL, NULL, 0 },
1307 /* 0xea */ { NULL, NULL, 0 },
1308 /* 0xeb */ { NULL, NULL, 0 },
1309 /* 0xec */ { NULL, NULL, 0 },
1310 /* 0xed */ { NULL, NULL, 0 },
1311 /* 0xee */ { NULL, NULL, 0 },
1312 /* 0xef */ { NULL, NULL, 0 },
1313 /* 0xf0 */ { NULL, NULL, 0 },
1314 /* 0xf1 */ { NULL, NULL, 0 },
1315 /* 0xf2 */ { NULL, NULL, 0 },
1316 /* 0xf3 */ { NULL, NULL, 0 },
1317 /* 0xf4 */ { NULL, NULL, 0 },
1318 /* 0xf5 */ { NULL, NULL, 0 },
1319 /* 0xf6 */ { NULL, NULL, 0 },
1320 /* 0xf7 */ { NULL, NULL, 0 },
1321 /* 0xf8 */ { NULL, NULL, 0 },
1322 /* 0xf9 */ { NULL, NULL, 0 },
1323 /* 0xfa */ { NULL, NULL, 0 },
1324 /* 0xfb */ { NULL, NULL, 0 },
1325 /* 0xfc */ { NULL, NULL, 0 },
1326 /* 0xfd */ { NULL, NULL, 0 },
1327 /* 0xfe */ { NULL, NULL, 0 },
1328 /* 0xff */ { NULL, NULL, 0 }
1329
1330 };
1331
1332 /*******************************************************************
1333  allocate and initialize a reply packet
1334 ********************************************************************/
1335
1336 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1337                           const char *inbuf, char **outbuf, uint8_t num_words,
1338                           uint32_t num_bytes)
1339 {
1340         /*
1341          * Protect against integer wrap
1342          */
1343         if ((num_bytes > 0xffffff)
1344             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1345                 char *msg;
1346                 if (asprintf(&msg, "num_bytes too large: %u",
1347                              (unsigned)num_bytes) == -1) {
1348                         msg = CONST_DISCARD(char *, "num_bytes too large");
1349                 }
1350                 smb_panic(msg);
1351         }
1352
1353         *outbuf = TALLOC_ARRAY(mem_ctx, char,
1354                                smb_size + num_words*2 + num_bytes);
1355         if (*outbuf == NULL) {
1356                 return false;
1357         }
1358
1359         construct_reply_common(req, inbuf, *outbuf);
1360         srv_set_message(*outbuf, num_words, num_bytes, false);
1361         /*
1362          * Zero out the word area, the caller has to take care of the bcc area
1363          * himself
1364          */
1365         if (num_words != 0) {
1366                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1367         }
1368
1369         return true;
1370 }
1371
1372 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1373 {
1374         char *outbuf;
1375         if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
1376                            num_bytes)) {
1377                 smb_panic("could not allocate output buffer\n");
1378         }
1379         req->outbuf = (uint8_t *)outbuf;
1380 }
1381
1382
1383 /*******************************************************************
1384  Dump a packet to a file.
1385 ********************************************************************/
1386
1387 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1388 {
1389         int fd, i;
1390         char *fname = NULL;
1391         if (DEBUGLEVEL < 50) {
1392                 return;
1393         }
1394
1395         if (len < 4) len = smb_len(data)+4;
1396         for (i=1;i<100;i++) {
1397                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1398                              type ? "req" : "resp") == -1) {
1399                         return;
1400                 }
1401                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1402                 if (fd != -1 || errno != EEXIST) break;
1403         }
1404         if (fd != -1) {
1405                 ssize_t ret = write(fd, data, len);
1406                 if (ret != len)
1407                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1408                 close(fd);
1409                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1410         }
1411         SAFE_FREE(fname);
1412 }
1413
1414 /****************************************************************************
1415  Prepare everything for calling the actual request function, and potentially
1416  call the request function via the "new" interface.
1417
1418  Return False if the "legacy" function needs to be called, everything is
1419  prepared.
1420
1421  Return True if we're done.
1422
1423  I know this API sucks, but it is the one with the least code change I could
1424  find.
1425 ****************************************************************************/
1426
1427 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1428 {
1429         int flags;
1430         uint16 session_tag;
1431         connection_struct *conn = NULL;
1432         struct smbd_server_connection *sconn = req->sconn;
1433
1434         errno = 0;
1435
1436         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1437          * so subtract 4 from it. */
1438         if (!valid_smb_header(req->inbuf)
1439             || (size < (smb_size - 4))) {
1440                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1441                          smb_len(req->inbuf)));
1442                 exit_server_cleanly("Non-SMB packet");
1443         }
1444
1445         if (smb_messages[type].fn == NULL) {
1446                 DEBUG(0,("Unknown message type %d!\n",type));
1447                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1448                 reply_unknown_new(req, type);
1449                 return NULL;
1450         }
1451
1452         flags = smb_messages[type].flags;
1453
1454         /* In share mode security we must ignore the vuid. */
1455         session_tag = (lp_security() == SEC_SHARE)
1456                 ? UID_FIELD_INVALID : req->vuid;
1457         conn = req->conn;
1458
1459         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1460                  (int)sys_getpid(), (unsigned long)conn));
1461
1462         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1463
1464         /* Ensure this value is replaced in the incoming packet. */
1465         SSVAL(req->inbuf,smb_uid,session_tag);
1466
1467         /*
1468          * Ensure the correct username is in current_user_info.  This is a
1469          * really ugly bugfix for problems with multiple session_setup_and_X's
1470          * being done and allowing %U and %G substitutions to work correctly.
1471          * There is a reason this code is done here, don't move it unless you
1472          * know what you're doing... :-).
1473          * JRA.
1474          */
1475
1476         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1477                 user_struct *vuser = NULL;
1478
1479                 sconn->smb1.sessions.last_session_tag = session_tag;
1480                 if(session_tag != UID_FIELD_INVALID) {
1481                         vuser = get_valid_user_struct(sconn, session_tag);
1482                         if (vuser) {
1483                                 set_current_user_info(
1484                                         vuser->server_info->sanitized_username,
1485                                         vuser->server_info->unix_name,
1486                                         vuser->server_info->info3->base.domain.string);
1487                         }
1488                 }
1489         }
1490
1491         /* Does this call need to be run as the connected user? */
1492         if (flags & AS_USER) {
1493
1494                 /* Does this call need a valid tree connection? */
1495                 if (!conn) {
1496                         /*
1497                          * Amazingly, the error code depends on the command
1498                          * (from Samba4).
1499                          */
1500                         if (type == SMBntcreateX) {
1501                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1502                         } else {
1503                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1504                         }
1505                         return NULL;
1506                 }
1507
1508                 if (!change_to_user(conn,session_tag)) {
1509                         DEBUG(0, ("Error: Could not change to user. Removing "
1510                                 "deferred open, mid=%llu.\n",
1511                                 (unsigned long long)req->mid));
1512                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1513                         return conn;
1514                 }
1515
1516                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1517
1518                 /* Does it need write permission? */
1519                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1520                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1521                         return conn;
1522                 }
1523
1524                 /* IPC services are limited */
1525                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1526                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1527                         return conn;
1528                 }
1529         } else {
1530                 /* This call needs to be run as root */
1531                 change_to_root_user();
1532         }
1533
1534         /* load service specific parameters */
1535         if (conn) {
1536                 if (req->encrypted) {
1537                         conn->encrypted_tid = true;
1538                         /* encrypted required from now on. */
1539                         conn->encrypt_level = Required;
1540                 } else if (ENCRYPTION_REQUIRED(conn)) {
1541                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1542                                 exit_server_cleanly("encryption required "
1543                                         "on connection");
1544                                 return conn;
1545                         }
1546                 }
1547
1548                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1549                                          (flags & (AS_USER|DO_CHDIR)
1550                                           ?True:False))) {
1551                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1552                         return conn;
1553                 }
1554                 conn->num_smb_operations++;
1555         }
1556
1557         /* does this protocol need to be run as guest? */
1558         if ((flags & AS_GUEST)
1559             && (!change_to_guest() ||
1560                 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1561                               sconn->client_id.name,
1562                               sconn->client_id.addr))) {
1563                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1564                 return conn;
1565         }
1566
1567         smb_messages[type].fn(req);
1568         return req->conn;
1569 }
1570
1571 /****************************************************************************
1572  Construct a reply to the incoming packet.
1573 ****************************************************************************/
1574
1575 static void construct_reply(char *inbuf, int size, size_t unread_bytes,
1576                             uint32_t seqnum, bool encrypted,
1577                             struct smb_perfcount_data *deferred_pcd)
1578 {
1579         connection_struct *conn;
1580         struct smb_request *req;
1581
1582         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1583                 smb_panic("could not allocate smb_request");
1584         }
1585
1586         if (!init_smb_request(req, smbd_server_conn, (uint8 *)inbuf,
1587                               unread_bytes, encrypted, seqnum)) {
1588                 exit_server_cleanly("Invalid SMB request");
1589         }
1590
1591         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1592
1593         /* we popped this message off the queue - keep original perf data */
1594         if (deferred_pcd)
1595                 req->pcd = *deferred_pcd;
1596         else {
1597                 SMB_PERFCOUNT_START(&req->pcd);
1598                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1599                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1600         }
1601
1602         conn = switch_message(req->cmd, req, size);
1603
1604         if (req->unread_bytes) {
1605                 /* writeX failed. drain socket. */
1606                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1607                                 req->unread_bytes) {
1608                         smb_panic("failed to drain pending bytes");
1609                 }
1610                 req->unread_bytes = 0;
1611         }
1612
1613         if (req->done) {
1614                 TALLOC_FREE(req);
1615                 return;
1616         }
1617
1618         if (req->outbuf == NULL) {
1619                 return;
1620         }
1621
1622         if (CVAL(req->outbuf,0) == 0) {
1623                 show_msg((char *)req->outbuf);
1624         }
1625
1626         if (!srv_send_smb(req->sconn,
1627                         (char *)req->outbuf,
1628                         true, req->seqnum+1,
1629                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1630                         &req->pcd)) {
1631                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1632         }
1633
1634         TALLOC_FREE(req);
1635
1636         return;
1637 }
1638
1639 /****************************************************************************
1640  Process an smb from the client
1641 ****************************************************************************/
1642 static void process_smb(struct smbd_server_connection *conn,
1643                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1644                         uint32_t seqnum, bool encrypted,
1645                         struct smb_perfcount_data *deferred_pcd)
1646 {
1647         int msg_type = CVAL(inbuf,0);
1648
1649         DO_PROFILE_INC(smb_count);
1650
1651         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1652                     smb_len(inbuf) ) );
1653         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1654                   conn->trans_num, (int)nread, (unsigned int)unread_bytes));
1655
1656         if (msg_type != 0) {
1657                 /*
1658                  * NetBIOS session request, keepalive, etc.
1659                  */
1660                 reply_special(conn, (char *)inbuf, nread);
1661                 goto done;
1662         }
1663
1664         if (smbd_server_conn->using_smb2) {
1665                 /* At this point we're not really using smb2,
1666                  * we make the decision here.. */
1667                 if (smbd_is_smb2_header(inbuf, nread)) {
1668                         smbd_smb2_first_negprot(smbd_server_conn, inbuf, nread);
1669                         return;
1670                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1671                                 && CVAL(inbuf, smb_com) != 0x72) {
1672                         /* This is a non-negprot SMB1 packet.
1673                            Disable SMB2 from now on. */
1674                         smbd_server_conn->using_smb2 = false;
1675                 }
1676         }
1677
1678         show_msg((char *)inbuf);
1679
1680         construct_reply((char *)inbuf,nread,unread_bytes,seqnum,encrypted,deferred_pcd);
1681         conn->trans_num++;
1682
1683 done:
1684         conn->smb1.num_requests++;
1685
1686         /* The timeout_processing function isn't run nearly
1687            often enough to implement 'max log size' without
1688            overrunning the size of the file by many megabytes.
1689            This is especially true if we are running at debug
1690            level 10.  Checking every 50 SMBs is a nice
1691            tradeoff of performance vs log file size overrun. */
1692
1693         if ((conn->smb1.num_requests % 50) == 0 &&
1694             need_to_check_log_size()) {
1695                 change_to_root_user();
1696                 check_log_size();
1697         }
1698 }
1699
1700 /****************************************************************************
1701  Return a string containing the function name of a SMB command.
1702 ****************************************************************************/
1703
1704 const char *smb_fn_name(int type)
1705 {
1706         const char *unknown_name = "SMBunknown";
1707
1708         if (smb_messages[type].name == NULL)
1709                 return(unknown_name);
1710
1711         return(smb_messages[type].name);
1712 }
1713
1714 /****************************************************************************
1715  Helper functions for contruct_reply.
1716 ****************************************************************************/
1717
1718 void add_to_common_flags2(uint32 v)
1719 {
1720         common_flags2 |= v;
1721 }
1722
1723 void remove_from_common_flags2(uint32 v)
1724 {
1725         common_flags2 &= ~v;
1726 }
1727
1728 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1729                                    char *outbuf)
1730 {
1731         srv_set_message(outbuf,0,0,false);
1732
1733         SCVAL(outbuf, smb_com, req->cmd);
1734         SIVAL(outbuf,smb_rcls,0);
1735         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1736         SSVAL(outbuf,smb_flg2,
1737                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1738                 common_flags2);
1739         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1740
1741         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1742         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1743         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1744         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1745 }
1746
1747 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1748 {
1749         construct_reply_common(req, (char *)req->inbuf, outbuf);
1750 }
1751
1752 /*
1753  * How many bytes have we already accumulated up to the current wct field
1754  * offset?
1755  */
1756
1757 size_t req_wct_ofs(struct smb_request *req)
1758 {
1759         size_t buf_size;
1760
1761         if (req->chain_outbuf == NULL) {
1762                 return smb_wct - 4;
1763         }
1764         buf_size = talloc_get_size(req->chain_outbuf);
1765         if ((buf_size % 4) != 0) {
1766                 buf_size += (4 - (buf_size % 4));
1767         }
1768         return buf_size - 4;
1769 }
1770
1771 /*
1772  * Hack around reply_nterror & friends not being aware of chained requests,
1773  * generating illegal (i.e. wct==0) chain replies.
1774  */
1775
1776 static void fixup_chain_error_packet(struct smb_request *req)
1777 {
1778         uint8_t *outbuf = req->outbuf;
1779         req->outbuf = NULL;
1780         reply_outbuf(req, 2, 0);
1781         memcpy(req->outbuf, outbuf, smb_wct);
1782         TALLOC_FREE(outbuf);
1783         SCVAL(req->outbuf, smb_vwv0, 0xff);
1784 }
1785
1786 /**
1787  * @brief Find the smb_cmd offset of the last command pushed
1788  * @param[in] buf       The buffer we're building up
1789  * @retval              Where can we put our next andx cmd?
1790  *
1791  * While chaining requests, the "next" request we're looking at needs to put
1792  * its SMB_Command before the data the previous request already built up added
1793  * to the chain. Find the offset to the place where we have to put our cmd.
1794  */
1795
1796 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1797 {
1798         uint8_t cmd;
1799         size_t ofs;
1800
1801         cmd = CVAL(buf, smb_com);
1802
1803         SMB_ASSERT(is_andx_req(cmd));
1804
1805         ofs = smb_vwv0;
1806
1807         while (CVAL(buf, ofs) != 0xff) {
1808
1809                 if (!is_andx_req(CVAL(buf, ofs))) {
1810                         return false;
1811                 }
1812
1813                 /*
1814                  * ofs is from start of smb header, so add the 4 length
1815                  * bytes. The next cmd is right after the wct field.
1816                  */
1817                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1818
1819                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1820         }
1821
1822         *pofs = ofs;
1823         return true;
1824 }
1825
1826 /**
1827  * @brief Do the smb chaining at a buffer level
1828  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1829  * @param[in] smb_command       The command that we want to issue
1830  * @param[in] wct               How many words?
1831  * @param[in] vwv               The words, already in network order
1832  * @param[in] bytes_alignment   How shall we align "bytes"?
1833  * @param[in] num_bytes         How many bytes?
1834  * @param[in] bytes             The data the request ships
1835  *
1836  * smb_splice_chain() adds the vwv and bytes to the request already present in
1837  * *poutbuf.
1838  */
1839
1840 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1841                              uint8_t wct, const uint16_t *vwv,
1842                              size_t bytes_alignment,
1843                              uint32_t num_bytes, const uint8_t *bytes)
1844 {
1845         uint8_t *outbuf;
1846         size_t old_size, new_size;
1847         size_t ofs;
1848         size_t chain_padding = 0;
1849         size_t bytes_padding = 0;
1850         bool first_request;
1851
1852         old_size = talloc_get_size(*poutbuf);
1853
1854         /*
1855          * old_size == smb_wct means we're pushing the first request in for
1856          * libsmb/
1857          */
1858
1859         first_request = (old_size == smb_wct);
1860
1861         if (!first_request && ((old_size % 4) != 0)) {
1862                 /*
1863                  * Align the wct field of subsequent requests to a 4-byte
1864                  * boundary
1865                  */
1866                 chain_padding = 4 - (old_size % 4);
1867         }
1868
1869         /*
1870          * After the old request comes the new wct field (1 byte), the vwv's
1871          * and the num_bytes field. After at we might need to align the bytes
1872          * given to us to "bytes_alignment", increasing the num_bytes value.
1873          */
1874
1875         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1876
1877         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1878                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1879         }
1880
1881         new_size += bytes_padding + num_bytes;
1882
1883         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1884                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1885                           (unsigned)new_size));
1886                 return false;
1887         }
1888
1889         outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
1890         if (outbuf == NULL) {
1891                 DEBUG(0, ("talloc failed\n"));
1892                 return false;
1893         }
1894         *poutbuf = outbuf;
1895
1896         if (first_request) {
1897                 SCVAL(outbuf, smb_com, smb_command);
1898         } else {
1899                 size_t andx_cmd_ofs;
1900
1901                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1902                         DEBUG(1, ("invalid command chain\n"));
1903                         *poutbuf = TALLOC_REALLOC_ARRAY(
1904                                 NULL, *poutbuf, uint8_t, old_size);
1905                         return false;
1906                 }
1907
1908                 if (chain_padding != 0) {
1909                         memset(outbuf + old_size, 0, chain_padding);
1910                         old_size += chain_padding;
1911                 }
1912
1913                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1914                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1915         }
1916
1917         ofs = old_size;
1918
1919         /*
1920          * Push the chained request:
1921          *
1922          * wct field
1923          */
1924
1925         SCVAL(outbuf, ofs, wct);
1926         ofs += 1;
1927
1928         /*
1929          * vwv array
1930          */
1931
1932         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1933         ofs += sizeof(uint16_t) * wct;
1934
1935         /*
1936          * bcc (byte count)
1937          */
1938
1939         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1940         ofs += sizeof(uint16_t);
1941
1942         /*
1943          * padding
1944          */
1945
1946         if (bytes_padding != 0) {
1947                 memset(outbuf + ofs, 0, bytes_padding);
1948                 ofs += bytes_padding;
1949         }
1950
1951         /*
1952          * The bytes field
1953          */
1954
1955         memcpy(outbuf + ofs, bytes, num_bytes);
1956
1957         return true;
1958 }
1959
1960 /****************************************************************************
1961  Construct a chained reply and add it to the already made reply
1962 ****************************************************************************/
1963
1964 void chain_reply(struct smb_request *req)
1965 {
1966         size_t smblen = smb_len(req->inbuf);
1967         size_t already_used, length_needed;
1968         uint8_t chain_cmd;
1969         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1970
1971         uint8_t wct;
1972         uint16_t *vwv;
1973         uint16_t buflen;
1974         uint8_t *buf;
1975
1976         if (IVAL(req->outbuf, smb_rcls) != 0) {
1977                 fixup_chain_error_packet(req);
1978         }
1979
1980         /*
1981          * Any of the AndX requests and replies have at least a wct of
1982          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1983          * beginning of the SMB header to the next wct field.
1984          *
1985          * None of the AndX requests put anything valuable in vwv[0] and [1],
1986          * so we can overwrite it here to form the chain.
1987          */
1988
1989         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1990                 if (req->chain_outbuf == NULL) {
1991                         req->chain_outbuf = TALLOC_REALLOC_ARRAY(
1992                                 req, req->outbuf, uint8_t,
1993                                 smb_len(req->outbuf) + 4);
1994                         if (req->chain_outbuf == NULL) {
1995                                 smb_panic("talloc failed");
1996                         }
1997                 }
1998                 req->outbuf = NULL;
1999                 goto error;
2000         }
2001
2002         /*
2003          * Here we assume that this is the end of the chain. For that we need
2004          * to set "next command" to 0xff and the offset to 0. If we later find
2005          * more commands in the chain, this will be overwritten again.
2006          */
2007
2008         SCVAL(req->outbuf, smb_vwv0, 0xff);
2009         SCVAL(req->outbuf, smb_vwv0+1, 0);
2010         SSVAL(req->outbuf, smb_vwv1, 0);
2011
2012         if (req->chain_outbuf == NULL) {
2013                 /*
2014                  * In req->chain_outbuf we collect all the replies. Start the
2015                  * chain by copying in the first reply.
2016                  *
2017                  * We do the realloc because later on we depend on
2018                  * talloc_get_size to determine the length of
2019                  * chain_outbuf. The reply_xxx routines might have
2020                  * over-allocated (reply_pipe_read_and_X used to be such an
2021                  * example).
2022                  */
2023                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
2024                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
2025                 if (req->chain_outbuf == NULL) {
2026                         smb_panic("talloc failed");
2027                 }
2028                 req->outbuf = NULL;
2029         } else {
2030                 /*
2031                  * Update smb headers where subsequent chained commands
2032                  * may have updated them.
2033                  */
2034                 SCVAL(req->chain_outbuf, smb_tid, CVAL(req->outbuf, smb_tid));
2035                 SCVAL(req->chain_outbuf, smb_uid, CVAL(req->outbuf, smb_uid));
2036
2037                 if (!smb_splice_chain(&req->chain_outbuf,
2038                                       CVAL(req->outbuf, smb_com),
2039                                       CVAL(req->outbuf, smb_wct),
2040                                       (uint16_t *)(req->outbuf + smb_vwv),
2041                                       0, smb_buflen(req->outbuf),
2042                                       (uint8_t *)smb_buf(req->outbuf))) {
2043                         goto error;
2044                 }
2045                 TALLOC_FREE(req->outbuf);
2046         }
2047
2048         /*
2049          * We use the old request's vwv field to grab the next chained command
2050          * and offset into the chained fields.
2051          */
2052
2053         chain_cmd = CVAL(req->vwv+0, 0);
2054         chain_offset = SVAL(req->vwv+1, 0);
2055
2056         if (chain_cmd == 0xff) {
2057                 /*
2058                  * End of chain, no more requests from the client. So ship the
2059                  * replies.
2060                  */
2061                 smb_setlen((char *)(req->chain_outbuf),
2062                            talloc_get_size(req->chain_outbuf) - 4);
2063
2064                 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2065                                   true, req->seqnum+1,
2066                                   IS_CONN_ENCRYPTED(req->conn)
2067                                   ||req->encrypted,
2068                                   &req->pcd)) {
2069                         exit_server_cleanly("chain_reply: srv_send_smb "
2070                                             "failed.");
2071                 }
2072                 TALLOC_FREE(req->chain_outbuf);
2073                 req->done = true;
2074                 return;
2075         }
2076
2077         /* add a new perfcounter for this element of chain */
2078         SMB_PERFCOUNT_ADD(&req->pcd);
2079         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2080         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2081
2082         /*
2083          * Check if the client tries to fool us. The request so far uses the
2084          * space to the end of the byte buffer in the request just
2085          * processed. The chain_offset can't point into that area. If that was
2086          * the case, we could end up with an endless processing of the chain,
2087          * we would always handle the same request.
2088          */
2089
2090         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2091         if (chain_offset < already_used) {
2092                 goto error;
2093         }
2094
2095         /*
2096          * Next check: Make sure the chain offset does not point beyond the
2097          * overall smb request length.
2098          */
2099
2100         length_needed = chain_offset+1; /* wct */
2101         if (length_needed > smblen) {
2102                 goto error;
2103         }
2104
2105         /*
2106          * Now comes the pointer magic. Goal here is to set up req->vwv and
2107          * req->buf correctly again to be able to call the subsequent
2108          * switch_message(). The chain offset (the former vwv[1]) points at
2109          * the new wct field.
2110          */
2111
2112         wct = CVAL(smb_base(req->inbuf), chain_offset);
2113
2114         /*
2115          * Next consistency check: Make the new vwv array fits in the overall
2116          * smb request.
2117          */
2118
2119         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2120         if (length_needed > smblen) {
2121                 goto error;
2122         }
2123         vwv = (uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2124
2125         /*
2126          * Now grab the new byte buffer....
2127          */
2128
2129         buflen = SVAL(vwv+wct, 0);
2130
2131         /*
2132          * .. and check that it fits.
2133          */
2134
2135         length_needed += buflen;
2136         if (length_needed > smblen) {
2137                 goto error;
2138         }
2139         buf = (uint8_t *)(vwv+wct+1);
2140
2141         req->cmd = chain_cmd;
2142         req->wct = wct;
2143         req->vwv = vwv;
2144         req->buflen = buflen;
2145         req->buf = buf;
2146
2147         switch_message(chain_cmd, req, smblen);
2148
2149         if (req->outbuf == NULL) {
2150                 /*
2151                  * This happens if the chained command has suspended itself or
2152                  * if it has called srv_send_smb() itself.
2153                  */
2154                 return;
2155         }
2156
2157         /*
2158          * We end up here if the chained command was not itself chained or
2159          * suspended, but for example a close() command. We now need to splice
2160          * the chained commands' outbuf into the already built up chain_outbuf
2161          * and ship the result.
2162          */
2163         goto done;
2164
2165  error:
2166         /*
2167          * We end up here if there's any error in the chain syntax. Report a
2168          * DOS error, just like Windows does.
2169          */
2170         reply_force_doserror(req, ERRSRV, ERRerror);
2171         fixup_chain_error_packet(req);
2172
2173  done:
2174         /*
2175          * This scary statement intends to set the
2176          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2177          * to the value req->outbuf carries
2178          */
2179         SSVAL(req->chain_outbuf, smb_flg2,
2180               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2181               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2182
2183         /*
2184          * Transfer the error codes from the subrequest to the main one
2185          */
2186         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2187         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2188
2189         if (!smb_splice_chain(&req->chain_outbuf,
2190                               CVAL(req->outbuf, smb_com),
2191                               CVAL(req->outbuf, smb_wct),
2192                               (uint16_t *)(req->outbuf + smb_vwv),
2193                               0, smb_buflen(req->outbuf),
2194                               (uint8_t *)smb_buf(req->outbuf))) {
2195                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2196         }
2197         TALLOC_FREE(req->outbuf);
2198
2199         smb_setlen((char *)(req->chain_outbuf),
2200                    talloc_get_size(req->chain_outbuf) - 4);
2201
2202         show_msg((char *)(req->chain_outbuf));
2203
2204         if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2205                           true, req->seqnum+1,
2206                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2207                           &req->pcd)) {
2208                 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2209         }
2210         TALLOC_FREE(req->chain_outbuf);
2211         req->done = true;
2212 }
2213
2214 /****************************************************************************
2215  Check if services need reloading.
2216 ****************************************************************************/
2217
2218 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2219 {
2220         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
2221
2222         if(last_smb_conf_reload_time == 0) {
2223                 last_smb_conf_reload_time = t;
2224                 /* Our printing subsystem might not be ready at smbd start up.
2225                    Then no printer is available till the first printers check
2226                    is performed.  A lower initial interval circumvents this. */
2227                 if ( printcap_cache_time > 60 )
2228                         last_printer_reload_time = t - printcap_cache_time + 60;
2229                 else
2230                         last_printer_reload_time = t;
2231         }
2232
2233         if (mypid != getpid()) { /* First time or fork happened meanwhile */
2234                 /* randomize over 60 second the printcap reload to avoid all
2235                  * process hitting cupsd at the same time */
2236                 int time_range = 60;
2237
2238                 last_printer_reload_time += random() % time_range;
2239                 mypid = getpid();
2240         }
2241
2242         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2243                 reload_services(sconn->msg_ctx, sconn->sock, True);
2244                 last_smb_conf_reload_time = t;
2245         }
2246
2247         /* 'printcap cache time = 0' disable the feature */
2248
2249         if ( printcap_cache_time != 0 )
2250         {
2251                 /* see if it's time to reload or if the clock has been set back */
2252
2253                 if ( (t >= last_printer_reload_time+printcap_cache_time)
2254                         || (t-last_printer_reload_time  < 0) )
2255                 {
2256                         DEBUG( 3,( "Printcap cache time expired.\n"));
2257                         reload_printers(sconn->msg_ctx);
2258                         last_printer_reload_time = t;
2259                 }
2260         }
2261 }
2262
2263 static bool fd_is_readable(int fd)
2264 {
2265         fd_set fds;
2266         struct timeval timeout = {0, };
2267         int ret;
2268
2269         FD_ZERO(&fds);
2270         FD_SET(fd, &fds);
2271
2272         ret = sys_select(fd+1, &fds, NULL, NULL, &timeout);
2273         if (ret == -1) {
2274                 return false;
2275         }
2276         return FD_ISSET(fd, &fds);
2277 }
2278
2279 static void smbd_server_connection_write_handler(struct smbd_server_connection *conn)
2280 {
2281         /* TODO: make write nonblocking */
2282 }
2283
2284 static void smbd_server_connection_read_handler(
2285         struct smbd_server_connection *conn, int fd)
2286 {
2287         uint8_t *inbuf = NULL;
2288         size_t inbuf_len = 0;
2289         size_t unread_bytes = 0;
2290         bool encrypted = false;
2291         TALLOC_CTX *mem_ctx = talloc_tos();
2292         NTSTATUS status;
2293         uint32_t seqnum;
2294
2295         bool from_client = (conn->sock == fd);
2296
2297         if (from_client) {
2298                 smbd_lock_socket(conn);
2299
2300                 if (!fd_is_readable(fd)) {
2301                         DEBUG(10,("the echo listener was faster\n"));
2302                         smbd_unlock_socket(conn);
2303                         return;
2304                 }
2305
2306                 /* TODO: make this completely nonblocking */
2307                 status = receive_smb_talloc(mem_ctx, fd,
2308                                             (char **)(void *)&inbuf,
2309                                             0, /* timeout */
2310                                             &unread_bytes,
2311                                             &encrypted,
2312                                             &inbuf_len, &seqnum,
2313                                             false /* trusted channel */);
2314                 smbd_unlock_socket(conn);
2315         } else {
2316                 /* TODO: make this completely nonblocking */
2317                 status = receive_smb_talloc(mem_ctx, fd,
2318                                             (char **)(void *)&inbuf,
2319                                             0, /* timeout */
2320                                             &unread_bytes,
2321                                             &encrypted,
2322                                             &inbuf_len, &seqnum,
2323                                             true /* trusted channel */);
2324         }
2325
2326         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2327                 goto process;
2328         }
2329         if (NT_STATUS_IS_ERR(status)) {
2330                 exit_server_cleanly("failed to receive smb request");
2331         }
2332         if (!NT_STATUS_IS_OK(status)) {
2333                 return;
2334         }
2335
2336 process:
2337         process_smb(conn, inbuf, inbuf_len, unread_bytes,
2338                     seqnum, encrypted, NULL);
2339 }
2340
2341 static void smbd_server_connection_handler(struct event_context *ev,
2342                                            struct fd_event *fde,
2343                                            uint16_t flags,
2344                                            void *private_data)
2345 {
2346         struct smbd_server_connection *conn = talloc_get_type(private_data,
2347                                               struct smbd_server_connection);
2348
2349         if (flags & EVENT_FD_WRITE) {
2350                 smbd_server_connection_write_handler(conn);
2351                 return;
2352         }
2353         if (flags & EVENT_FD_READ) {
2354                 smbd_server_connection_read_handler(conn, conn->sock);
2355                 return;
2356         }
2357 }
2358
2359 static void smbd_server_echo_handler(struct event_context *ev,
2360                                      struct fd_event *fde,
2361                                      uint16_t flags,
2362                                      void *private_data)
2363 {
2364         struct smbd_server_connection *conn = talloc_get_type(private_data,
2365                                               struct smbd_server_connection);
2366
2367         if (flags & EVENT_FD_WRITE) {
2368                 smbd_server_connection_write_handler(conn);
2369                 return;
2370         }
2371         if (flags & EVENT_FD_READ) {
2372                 smbd_server_connection_read_handler(
2373                         conn, conn->smb1.echo_handler.trusted_fd);
2374                 return;
2375         }
2376 }
2377
2378 /****************************************************************************
2379 received when we should release a specific IP
2380 ****************************************************************************/
2381 static void release_ip(const char *ip, void *priv)
2382 {
2383         const char *addr = (const char *)priv;
2384         const char *p = addr;
2385
2386         if (strncmp("::ffff:", addr, 7) == 0) {
2387                 p = addr + 7;
2388         }
2389
2390         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2391                 /* we can't afford to do a clean exit - that involves
2392                    database writes, which would potentially mean we
2393                    are still running after the failover has finished -
2394                    we have to get rid of this process ID straight
2395                    away */
2396                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2397                         ip));
2398                 /* note we must exit with non-zero status so the unclean handler gets
2399                    called in the parent, so that the brl database is tickled */
2400                 _exit(1);
2401         }
2402 }
2403
2404 static void msg_release_ip(struct messaging_context *msg_ctx, void *private_data,
2405                            uint32_t msg_type, struct server_id server_id, DATA_BLOB *data)
2406 {
2407         struct smbd_server_connection *sconn = talloc_get_type_abort(
2408                 private_data, struct smbd_server_connection);
2409
2410         release_ip((char *)data->data, sconn->client_id.addr);
2411 }
2412
2413 #ifdef CLUSTER_SUPPORT
2414 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2415                                struct sockaddr_storage *client)
2416 {
2417         socklen_t length;
2418         length = sizeof(*server);
2419         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2420                 return -1;
2421         }
2422         length = sizeof(*client);
2423         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2424                 return -1;
2425         }
2426         return 0;
2427 }
2428 #endif
2429
2430 /*
2431  * Send keepalive packets to our client
2432  */
2433 static bool keepalive_fn(const struct timeval *now, void *private_data)
2434 {
2435         struct smbd_server_connection *sconn = smbd_server_conn;
2436         bool ret;
2437
2438         if (sconn->using_smb2) {
2439                 /* Don't do keepalives on an SMB2 connection. */
2440                 return false;
2441         }
2442
2443         smbd_lock_socket(smbd_server_conn);
2444         ret = send_keepalive(sconn->sock);
2445         smbd_unlock_socket(smbd_server_conn);
2446
2447         if (!ret) {
2448                 char addr[INET6_ADDRSTRLEN];
2449                 /*
2450                  * Try and give an error message saying what
2451                  * client failed.
2452                  */
2453                 DEBUG(0, ("send_keepalive failed for client %s. "
2454                           "Error %s - exiting\n",
2455                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2456                           strerror(errno)));
2457                 return False;
2458         }
2459         return True;
2460 }
2461
2462 /*
2463  * Do the recurring check if we're idle
2464  */
2465 static bool deadtime_fn(const struct timeval *now, void *private_data)
2466 {
2467         struct smbd_server_connection *sconn =
2468                 (struct smbd_server_connection *)private_data;
2469
2470         if (sconn->using_smb2) {
2471                 /* TODO: implement real idle check */
2472                 if (sconn->smb2.sessions.list) {
2473                         return true;
2474                 }
2475                 DEBUG( 2, ( "Closing idle SMB2 connection\n" ) );
2476                 messaging_send(sconn->msg_ctx,
2477                                messaging_server_id(sconn->msg_ctx),
2478                                MSG_SHUTDOWN, &data_blob_null);
2479                 return false;
2480         }
2481
2482         if ((conn_num_open(sconn) == 0)
2483             || (conn_idle_all(sconn, now->tv_sec))) {
2484                 DEBUG( 2, ( "Closing idle SMB1 connection\n" ) );
2485                 messaging_send(sconn->msg_ctx,
2486                                messaging_server_id(sconn->msg_ctx),
2487                                MSG_SHUTDOWN, &data_blob_null);
2488                 return False;
2489         }
2490
2491         return True;
2492 }
2493
2494 /*
2495  * Do the recurring log file and smb.conf reload checks.
2496  */
2497
2498 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2499 {
2500         struct smbd_server_connection *sconn = talloc_get_type_abort(
2501                 private_data, struct smbd_server_connection);
2502         change_to_root_user();
2503
2504         /* update printer queue caches if necessary */
2505         update_monitored_printq_cache(sconn->msg_ctx);
2506
2507         /* check if we need to reload services */
2508         check_reload(sconn, time(NULL));
2509
2510         /* Change machine password if neccessary. */
2511         attempt_machine_password_change();
2512
2513         /*
2514          * Force a log file check.
2515          */
2516         force_check_log_size();
2517         check_log_size();
2518         return true;
2519 }
2520
2521 static int create_unlink_tmp(const char *dir)
2522 {
2523         char *fname;
2524         int fd;
2525
2526         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2527         if (fname == NULL) {
2528                 errno = ENOMEM;
2529                 return -1;
2530         }
2531         fd = mkstemp(fname);
2532         if (fd == -1) {
2533                 TALLOC_FREE(fname);
2534                 return -1;
2535         }
2536         if (unlink(fname) == -1) {
2537                 int sys_errno = errno;
2538                 close(fd);
2539                 TALLOC_FREE(fname);
2540                 errno = sys_errno;
2541                 return -1;
2542         }
2543         TALLOC_FREE(fname);
2544         return fd;
2545 }
2546
2547 struct smbd_echo_state {
2548         struct tevent_context *ev;
2549         struct iovec *pending;
2550         struct smbd_server_connection *sconn;
2551         int parent_pipe;
2552
2553         struct tevent_fd *parent_fde;
2554
2555         struct tevent_fd *read_fde;
2556         struct tevent_req *write_req;
2557 };
2558
2559 static void smbd_echo_writer_done(struct tevent_req *req);
2560
2561 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2562 {
2563         int num_pending;
2564
2565         if (state->write_req != NULL) {
2566                 return;
2567         }
2568
2569         num_pending = talloc_array_length(state->pending);
2570         if (num_pending == 0) {
2571                 return;
2572         }
2573
2574         state->write_req = writev_send(state, state->ev, NULL,
2575                                        state->parent_pipe, false,
2576                                        state->pending, num_pending);
2577         if (state->write_req == NULL) {
2578                 DEBUG(1, ("writev_send failed\n"));
2579                 exit(1);
2580         }
2581
2582         talloc_steal(state->write_req, state->pending);
2583         state->pending = NULL;
2584
2585         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2586                                 state);
2587 }
2588
2589 static void smbd_echo_writer_done(struct tevent_req *req)
2590 {
2591         struct smbd_echo_state *state = tevent_req_callback_data(
2592                 req, struct smbd_echo_state);
2593         ssize_t written;
2594         int err;
2595
2596         written = writev_recv(req, &err);
2597         TALLOC_FREE(req);
2598         state->write_req = NULL;
2599         if (written == -1) {
2600                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2601                 exit(1);
2602         }
2603         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2604         smbd_echo_activate_writer(state);
2605 }
2606
2607 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2608                             uint32_t seqnum)
2609 {
2610         struct smb_request req;
2611         uint16_t num_replies;
2612         size_t out_len;
2613         char *outbuf;
2614         bool ok;
2615
2616         if (inbuf_len < smb_size) {
2617                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2618                 return false;
2619         }
2620         if (!valid_smb_header(inbuf)) {
2621                 DEBUG(10, ("Got invalid SMB header\n"));
2622                 return false;
2623         }
2624
2625         if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2626                               seqnum)) {
2627                 return false;
2628         }
2629         req.inbuf = inbuf;
2630
2631         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2632                    smb_messages[req.cmd].name
2633                    ? smb_messages[req.cmd].name : "unknown"));
2634
2635         if (req.cmd != SMBecho) {
2636                 return false;
2637         }
2638         if (req.wct < 1) {
2639                 return false;
2640         }
2641
2642         num_replies = SVAL(req.vwv+0, 0);
2643         if (num_replies != 1) {
2644                 /* Not a Windows "Hey, you're still there?" request */
2645                 return false;
2646         }
2647
2648         if (!create_outbuf(talloc_tos(), &req, (char *)req.inbuf, &outbuf,
2649                            1, req.buflen)) {
2650                 DEBUG(10, ("create_outbuf failed\n"));
2651                 return false;
2652         }
2653         req.outbuf = (uint8_t *)outbuf;
2654
2655         SSVAL(req.outbuf, smb_vwv0, num_replies);
2656
2657         if (req.buflen > 0) {
2658                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2659         }
2660
2661         out_len = smb_len(req.outbuf) + 4;
2662
2663         ok = srv_send_smb(req.sconn,
2664                           (char *)outbuf,
2665                           true, seqnum+1,
2666                           false, &req.pcd);
2667         TALLOC_FREE(outbuf);
2668         if (!ok) {
2669                 exit(1);
2670         }
2671
2672         return true;
2673 }
2674
2675 static void smbd_echo_exit(struct tevent_context *ev,
2676                            struct tevent_fd *fde, uint16_t flags,
2677                            void *private_data)
2678 {
2679         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2680         exit(0);
2681 }
2682
2683 static void smbd_echo_reader(struct tevent_context *ev,
2684                              struct tevent_fd *fde, uint16_t flags,
2685                              void *private_data)
2686 {
2687         struct smbd_echo_state *state = talloc_get_type_abort(
2688                 private_data, struct smbd_echo_state);
2689         struct smbd_server_connection *sconn = state->sconn;
2690         size_t unread, num_pending;
2691         NTSTATUS status;
2692         struct iovec *tmp;
2693         size_t iov_len;
2694         uint32_t seqnum = 0;
2695         bool reply;
2696         bool ok;
2697         bool encrypted = false;
2698
2699         smb_msleep(1000);
2700
2701         ok = smbd_lock_socket_internal(sconn);
2702         if (!ok) {
2703                 DEBUG(0, ("%s: failed to lock socket\n",
2704                         __location__));
2705                 exit(1);
2706         }
2707
2708         if (!fd_is_readable(sconn->sock)) {
2709                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2710                           (int)sys_getpid()));
2711                 ok = smbd_unlock_socket_internal(sconn);
2712                 if (!ok) {
2713                         DEBUG(1, ("%s: failed to unlock socket in\n",
2714                                 __location__));
2715                         exit(1);
2716                 }
2717                 return;
2718         }
2719
2720         num_pending = talloc_array_length(state->pending);
2721         tmp = talloc_realloc(state, state->pending, struct iovec,
2722                              num_pending+1);
2723         if (tmp == NULL) {
2724                 DEBUG(1, ("talloc_realloc failed\n"));
2725                 exit(1);
2726         }
2727         state->pending = tmp;
2728
2729         DEBUG(10,("echo_handler[%d]: reading pdu\n", (int)sys_getpid()));
2730
2731         status = receive_smb_talloc(state->pending, sconn->sock,
2732                                     (char **)(void *)&state->pending[num_pending].iov_base,
2733                                     0 /* timeout */,
2734                                     &unread,
2735                                     &encrypted,
2736                                     &iov_len,
2737                                     &seqnum,
2738                                     false /* trusted_channel*/);
2739         if (!NT_STATUS_IS_OK(status)) {
2740                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2741                           (int)sys_getpid(), nt_errstr(status)));
2742                 exit(1);
2743         }
2744         state->pending[num_pending].iov_len = iov_len;
2745
2746         ok = smbd_unlock_socket_internal(sconn);
2747         if (!ok) {
2748                 DEBUG(1, ("%s: failed to unlock socket in\n",
2749                         __location__));
2750                 exit(1);
2751         }
2752
2753         /*
2754          * place the seqnum in the packet so that the main process can reply
2755          * with signing
2756          */
2757         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field, seqnum);
2758         SIVAL((uint8_t *)state->pending[num_pending].iov_base, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2759
2760         reply = smbd_echo_reply((uint8_t *)state->pending[num_pending].iov_base,
2761                                 state->pending[num_pending].iov_len,
2762                                 seqnum);
2763         if (reply) {
2764                 DEBUG(10,("echo_handler[%d]: replied to client\n", (int)sys_getpid()));
2765                 /* no check, shrinking by some bytes does not fail */
2766                 state->pending = talloc_realloc(state, state->pending,
2767                                                 struct iovec,
2768                                                 num_pending);
2769         } else {
2770                 DEBUG(10,("echo_handler[%d]: forward to main\n", (int)sys_getpid()));
2771                 smbd_echo_activate_writer(state);
2772         }
2773 }
2774
2775 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2776                            int parent_pipe)
2777 {
2778         struct smbd_echo_state *state;
2779
2780         state = talloc_zero(sconn, struct smbd_echo_state);
2781         if (state == NULL) {
2782                 DEBUG(1, ("talloc failed\n"));
2783                 return;
2784         }
2785         state->sconn = sconn;
2786         state->parent_pipe = parent_pipe;
2787         state->ev = s3_tevent_context_init(state);
2788         if (state->ev == NULL) {
2789                 DEBUG(1, ("tevent_context_init failed\n"));
2790                 TALLOC_FREE(state);
2791                 return;
2792         }
2793         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2794                                         TEVENT_FD_READ, smbd_echo_exit,
2795                                         state);
2796         if (state->parent_fde == NULL) {
2797                 DEBUG(1, ("tevent_add_fd failed\n"));
2798                 TALLOC_FREE(state);
2799                 return;
2800         }
2801         state->read_fde = tevent_add_fd(state->ev, state, sconn->sock,
2802                                         TEVENT_FD_READ, smbd_echo_reader,
2803                                         state);
2804         if (state->read_fde == NULL) {
2805                 DEBUG(1, ("tevent_add_fd failed\n"));
2806                 TALLOC_FREE(state);
2807                 return;
2808         }
2809
2810         while (true) {
2811                 if (tevent_loop_once(state->ev) == -1) {
2812                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2813                                   strerror(errno)));
2814                         break;
2815                 }
2816         }
2817         TALLOC_FREE(state);
2818 }
2819
2820 /*
2821  * Handle SMBecho requests in a forked child process
2822  */
2823 static bool fork_echo_handler(struct smbd_server_connection *sconn)
2824 {
2825         int listener_pipe[2];
2826         int res;
2827         pid_t child;
2828
2829         res = pipe(listener_pipe);
2830         if (res == -1) {
2831                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2832                 return false;
2833         }
2834         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2835         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2836                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2837                 goto fail;
2838         }
2839
2840         child = sys_fork();
2841         if (child == 0) {
2842                 NTSTATUS status;
2843
2844                 close(listener_pipe[0]);
2845
2846                 status = reinit_after_fork(sconn->msg_ctx,
2847                                            smbd_event_context(),
2848                                            procid_self(), false);
2849                 if (!NT_STATUS_IS_OK(status)) {
2850                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2851                                   nt_errstr(status)));
2852                         exit(1);
2853                 }
2854                 smbd_echo_loop(sconn, listener_pipe[1]);
2855                 exit(0);
2856         }
2857         close(listener_pipe[1]);
2858         listener_pipe[1] = -1;
2859         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2860
2861         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2862
2863         /*
2864          * Without smb signing this is the same as the normal smbd
2865          * listener. This needs to change once signing comes in.
2866          */
2867         sconn->smb1.echo_handler.trusted_fde = event_add_fd(smbd_event_context(),
2868                                         sconn,
2869                                         sconn->smb1.echo_handler.trusted_fd,
2870                                         EVENT_FD_READ,
2871                                         smbd_server_echo_handler,
2872                                         sconn);
2873         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2874                 DEBUG(1, ("event_add_fd failed\n"));
2875                 goto fail;
2876         }
2877
2878         return true;
2879
2880 fail:
2881         if (listener_pipe[0] != -1) {
2882                 close(listener_pipe[0]);
2883         }
2884         if (listener_pipe[1] != -1) {
2885                 close(listener_pipe[1]);
2886         }
2887         sconn->smb1.echo_handler.trusted_fd = -1;
2888         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2889                 close(sconn->smb1.echo_handler.socket_lock_fd);
2890         }
2891         sconn->smb1.echo_handler.trusted_fd = -1;
2892         sconn->smb1.echo_handler.socket_lock_fd = -1;
2893         return false;
2894 }
2895
2896 #if CLUSTER_SUPPORT
2897
2898 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2899                                   struct sockaddr_storage *srv,
2900                                   struct sockaddr_storage *clnt)
2901 {
2902         struct ctdbd_connection *cconn;
2903         char tmp_addr[INET6_ADDRSTRLEN];
2904         char *addr;
2905
2906         cconn = messaging_ctdbd_connection();
2907         if (cconn == NULL) {
2908                 return NT_STATUS_NO_MEMORY;
2909         }
2910
2911         client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2912         addr = talloc_strdup(cconn, tmp_addr);
2913         if (addr == NULL) {
2914                 return NT_STATUS_NO_MEMORY;
2915         }
2916         return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2917 }
2918
2919 #endif
2920
2921 /****************************************************************************
2922  Process commands from the client
2923 ****************************************************************************/
2924
2925 void smbd_process(struct smbd_server_connection *sconn)
2926 {
2927         TALLOC_CTX *frame = talloc_stackframe();
2928         struct sockaddr_storage ss;
2929         struct sockaddr *sa = NULL;
2930         socklen_t sa_socklen;
2931         struct tsocket_address *local_address = NULL;
2932         struct tsocket_address *remote_address = NULL;
2933         const char *remaddr = NULL;
2934         int ret;
2935
2936         if (lp_maxprotocol() == PROTOCOL_SMB2 &&
2937             lp_security() != SEC_SHARE &&
2938             !lp_async_smb_echo_handler()) {
2939                 /*
2940                  * We're not making the desion here,
2941                  * we're just allowing the client
2942                  * to decide between SMB1 and SMB2
2943                  * with the first negprot
2944                  * packet.
2945                  */
2946                 sconn->using_smb2 = true;
2947         }
2948
2949         /* Ensure child is set to blocking mode */
2950         set_blocking(sconn->sock,True);
2951
2952         set_socket_options(sconn->sock, "SO_KEEPALIVE");
2953         set_socket_options(sconn->sock, lp_socket_options());
2954
2955         sa = (struct sockaddr *)(void *)&ss;
2956         sa_socklen = sizeof(ss);
2957         ret = getpeername(sconn->sock, sa, &sa_socklen);
2958         if (ret != 0) {
2959                 int level = (errno == ENOTCONN)?2:0;
2960                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2961                 exit_server_cleanly("getpeername() failed.\n");
2962         }
2963         ret = tsocket_address_bsd_from_sockaddr(sconn,
2964                                                 sa, sa_socklen,
2965                                                 &remote_address);
2966         if (ret != 0) {
2967                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2968                         __location__, strerror(errno)));
2969                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2970         }
2971
2972         sa = (struct sockaddr *)(void *)&ss;
2973         sa_socklen = sizeof(ss);
2974         ret = getsockname(sconn->sock, sa, &sa_socklen);
2975         if (ret != 0) {
2976                 int level = (errno == ENOTCONN)?2:0;
2977                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
2978                 exit_server_cleanly("getsockname() failed.\n");
2979         }
2980         ret = tsocket_address_bsd_from_sockaddr(sconn,
2981                                                 sa, sa_socklen,
2982                                                 &local_address);
2983         if (ret != 0) {
2984                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
2985                         __location__, strerror(errno)));
2986                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
2987         }
2988
2989         sconn->local_address = local_address;
2990         sconn->remote_address = remote_address;
2991
2992         if (tsocket_address_is_inet(remote_address, "ip")) {
2993                 remaddr = tsocket_address_inet_addr_string(
2994                                 sconn->remote_address,
2995                                 talloc_tos());
2996                 if (remaddr == NULL) {
2997
2998                 }
2999         } else {
3000                 remaddr = "0.0.0.0";
3001         }
3002
3003         /* this is needed so that we get decent entries
3004            in smbstatus for port 445 connects */
3005         set_remote_machine_name(remaddr, false);
3006         reload_services(sconn->msg_ctx, sconn->sock, true);
3007
3008         /*
3009          * Before the first packet, check the global hosts allow/ hosts deny
3010          * parameters before doing any parsing of packets passed to us by the
3011          * client. This prevents attacks on our parsing code from hosts not in
3012          * the hosts allow list.
3013          */
3014
3015         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3016                           sconn->client_id.name,
3017                           sconn->client_id.addr)) {
3018                 /*
3019                  * send a negative session response "not listening on calling
3020                  * name"
3021                  */
3022                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3023                 DEBUG( 1, ("Connection denied from %s to %s\n",
3024                            tsocket_address_string(remote_address, talloc_tos()),
3025                            tsocket_address_string(local_address, talloc_tos())));
3026                 (void)srv_send_smb(sconn,(char *)buf, false,
3027                                    0, false, NULL);
3028                 exit_server_cleanly("connection denied");
3029         }
3030
3031         DEBUG(10, ("Connection allowed from %s to %s\n",
3032                    tsocket_address_string(remote_address, talloc_tos()),
3033                    tsocket_address_string(local_address, talloc_tos())));
3034
3035         init_modules();
3036
3037         smb_perfcount_init();
3038
3039         if (!init_account_policy()) {
3040                 exit_server("Could not open account policy tdb.\n");
3041         }
3042
3043         if (*lp_rootdir()) {
3044                 if (chroot(lp_rootdir()) != 0) {
3045                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3046                         exit_server("Failed to chroot()");
3047                 }
3048                 if (chdir("/") == -1) {
3049                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3050                         exit_server("Failed to chroot()");
3051                 }
3052                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3053         }
3054
3055         if (!srv_init_signing(sconn)) {
3056                 exit_server("Failed to init smb_signing");
3057         }
3058
3059         if (lp_async_smb_echo_handler() && !fork_echo_handler(sconn)) {
3060                 exit_server("Failed to fork echo handler");
3061         }
3062
3063         /* Setup oplocks */
3064         if (!init_oplocks(sconn->msg_ctx))
3065                 exit_server("Failed to init oplocks");
3066
3067         /* register our message handlers */
3068         messaging_register(sconn->msg_ctx, NULL,
3069                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3070         messaging_register(sconn->msg_ctx, sconn,
3071                            MSG_SMB_RELEASE_IP, msg_release_ip);
3072         messaging_register(sconn->msg_ctx, NULL,
3073                            MSG_SMB_CLOSE_FILE, msg_close_file);
3074
3075         /*
3076          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3077          * MSGs to all child processes
3078          */
3079         messaging_deregister(sconn->msg_ctx,
3080                              MSG_DEBUG, NULL);
3081         messaging_register(sconn->msg_ctx, NULL,
3082                            MSG_DEBUG, debug_message);
3083
3084         if ((lp_keepalive() != 0)
3085             && !(event_add_idle(smbd_event_context(), NULL,
3086                                 timeval_set(lp_keepalive(), 0),
3087                                 "keepalive", keepalive_fn,
3088                                 NULL))) {
3089                 DEBUG(0, ("Could not add keepalive event\n"));
3090                 exit(1);
3091         }
3092
3093         if (!(event_add_idle(smbd_event_context(), NULL,
3094                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3095                              "deadtime", deadtime_fn, sconn))) {
3096                 DEBUG(0, ("Could not add deadtime event\n"));
3097                 exit(1);
3098         }
3099
3100         if (!(event_add_idle(smbd_event_context(), NULL,
3101                              timeval_set(SMBD_SELECT_TIMEOUT, 0),
3102                              "housekeeping", housekeeping_fn, sconn))) {
3103                 DEBUG(0, ("Could not add housekeeping event\n"));
3104                 exit(1);
3105         }
3106
3107 #ifdef CLUSTER_SUPPORT
3108
3109         if (lp_clustering()) {
3110                 /*
3111                  * We need to tell ctdb about our client's TCP
3112                  * connection, so that for failover ctdbd can send
3113                  * tickle acks, triggering a reconnection by the
3114                  * client.
3115                  */
3116
3117                 struct sockaddr_storage srv, clnt;
3118
3119                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3120                         NTSTATUS status;
3121                         status = smbd_register_ips(sconn, &srv, &clnt);
3122                         if (!NT_STATUS_IS_OK(status)) {
3123                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3124                                           nt_errstr(status)));
3125                         }
3126                 } else
3127                 {
3128                         DEBUG(0,("Unable to get tcp info for "
3129                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3130                                  strerror(errno)));
3131                 }
3132         }
3133
3134 #endif
3135
3136         sconn->nbt.got_session = false;
3137
3138         sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3139
3140         sconn->smb1.sessions.done_sesssetup = false;
3141         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3142         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3143         /* users from session setup */
3144         sconn->smb1.sessions.session_userlist = NULL;
3145         /* workgroup from session setup. */
3146         sconn->smb1.sessions.session_workgroup = NULL;
3147         /* this holds info on user ids that are already validated for this VC */
3148         sconn->smb1.sessions.validated_users = NULL;
3149         sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3150         sconn->smb1.sessions.num_validated_vuids = 0;
3151
3152         conn_init(sconn);
3153         if (!init_dptrs(sconn)) {
3154                 exit_server("init_dptrs() failed");
3155         }
3156
3157         sconn->smb1.fde = event_add_fd(smbd_event_context(),
3158                                                   sconn,
3159                                                   sconn->sock,
3160                                                   EVENT_FD_READ,
3161                                                   smbd_server_connection_handler,
3162                                                   sconn);
3163         if (!sconn->smb1.fde) {
3164                 exit_server("failed to create smbd_server_connection fde");
3165         }
3166
3167         TALLOC_FREE(frame);
3168
3169         while (True) {
3170                 NTSTATUS status;
3171
3172                 frame = talloc_stackframe_pool(8192);
3173
3174                 errno = 0;
3175
3176                 status = smbd_server_connection_loop_once(sconn);
3177                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3178                     !NT_STATUS_IS_OK(status)) {
3179                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3180                                   " exiting\n", nt_errstr(status)));
3181                         break;
3182                 }
3183
3184                 TALLOC_FREE(frame);
3185         }
3186
3187         exit_server_cleanly(NULL);
3188 }
3189
3190 bool req_is_in_chain(struct smb_request *req)
3191 {
3192         if (req->vwv != (uint16_t *)(req->inbuf+smb_vwv)) {
3193                 /*
3194                  * We're right now handling a subsequent request, so we must
3195                  * be in a chain
3196                  */
3197                 return true;
3198         }
3199
3200         if (!is_andx_req(req->cmd)) {
3201                 return false;
3202         }
3203
3204         if (req->wct < 2) {
3205                 /*
3206                  * Okay, an illegal request, but definitely not chained :-)
3207                  */
3208                 return false;
3209         }
3210
3211         return (CVAL(req->vwv+0, 0) != 0xFF);
3212 }