source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39
  40 extern bool global_machine_password_needs_changing;
  41
  42 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  43                                    char *outbuf);
  44 static struct pending_message_list *get_deferred_open_message_smb(
  45         struct smbd_server_connection *sconn, uint64_t mid);
  46
  47 static bool smbd_lock_socket_internal(struct smbd_server_connection *sconn)
  48 {
  49         bool ok;
  50
  51         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  52                 return true;
  53         }
  54
  55         sconn->smb1.echo_handler.ref_count++;
  56
  57         if (sconn->smb1.echo_handler.ref_count > 1) {
  58                 return true;
  59         }
  60
  61         DEBUG(10,("pid[%d] wait for socket lock\n", (int)sys_getpid()));
  62
  63         do {
  64                 ok = fcntl_lock(
  65                         sconn->smb1.echo_handler.socket_lock_fd,
  66                         SMB_F_SETLKW, 0, 0, F_WRLCK);
  67         } while (!ok && (errno == EINTR));
  68
  69         if (!ok) {
  70                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
  71                 return false;
  72         }
  73
  74         DEBUG(10,("pid[%d] got for socket lock\n", (int)sys_getpid()));
  75
  76         return true;
  77 }
  78
  79 void smbd_lock_socket(struct smbd_server_connection *sconn)
  80 {
  81         if (!smbd_lock_socket_internal(sconn)) {
  82                 exit_server_cleanly("failed to lock socket");
  83         }
  84 }
  85
  86 static bool smbd_unlock_socket_internal(struct smbd_server_connection *sconn)
  87 {
  88         bool ok;
  89
  90         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
  91                 return true;
  92         }
  93
  94         sconn->smb1.echo_handler.ref_count--;
  95
  96         if (sconn->smb1.echo_handler.ref_count > 0) {
  97                 return true;
  98         }
  99
 100         do {
 101                 ok = fcntl_lock(
 102                         sconn->smb1.echo_handler.socket_lock_fd,
 103                         SMB_F_SETLKW, 0, 0, F_UNLCK);
 104         } while (!ok && (errno == EINTR));
 105
 106         if (!ok) {
 107                 DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 108                 return false;
 109         }
 110
 111         DEBUG(10,("pid[%d] unlocked socket\n", (int)sys_getpid()));
 112
 113         return true;
 114 }
 115
 116 void smbd_unlock_socket(struct smbd_server_connection *sconn)
 117 {
 118         if (!smbd_unlock_socket_internal(sconn)) {
 119                 exit_server_cleanly("failed to unlock socket");
 120         }
 121 }
 122
 123 /* Accessor function for smb_read_error for smbd functions. */
 124
 125 /****************************************************************************
 126  Send an smb to a fd.
 127 ****************************************************************************/
 128
 129 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
 130                   bool do_signing, uint32_t seqnum,
 131                   bool do_encrypt,
 132                   struct smb_perfcount_data *pcd)
 133 {
 134         size_t len = 0;
 135         size_t nwritten=0;
 136         ssize_t ret;
 137         char *buf_out = buffer;
 138
 139         smbd_lock_socket(sconn);
 140
 141         if (do_signing) {
 142                 /* Sign the outgoing packet if required. */
 143                 srv_calculate_sign_mac(sconn, buf_out, seqnum);
 144         }
 145
 146         if (do_encrypt) {
 147                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
 148                 if (!NT_STATUS_IS_OK(status)) {
 149                         DEBUG(0, ("send_smb: SMB encryption failed "
 150                                 "on outgoing packet! Error %s\n",
 151                                 nt_errstr(status) ));
 152                         goto out;
 153                 }
 154         }
 155
 156         len = smb_len(buf_out) + 4;
 157
 158         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
 159         if (ret <= 0) {
 160
 161                 char addr[INET6_ADDRSTRLEN];
 162                 /*
 163                  * Try and give an error message saying what
 164                  * client failed.
 165                  */
 166                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 167                          (int)sys_getpid(), (int)len,
 168                          get_peer_addr(sconn->sock, addr, sizeof(addr)),
 169                          (int)ret, strerror(errno) ));
 170
 171                 srv_free_enc_buffer(buf_out);
 172                 goto out;
 173         }
 174
 175         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 176         srv_free_enc_buffer(buf_out);
 177 out:
 178         SMB_PERFCOUNT_END(pcd);
 179
 180         smbd_unlock_socket(sconn);
 181         return true;
 182 }
 183
 184 /*******************************************************************
 185  Setup the word count and byte count for a smb message.
 186 ********************************************************************/
 187
 188 int srv_set_message(char *buf,
 189                         int num_words,
 190                         int num_bytes,
 191                         bool zero)
 192 {
 193         if (zero && (num_words || num_bytes)) {
 194                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 195         }
 196         SCVAL(buf,smb_wct,num_words);
 197         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 198         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 199         return (smb_size + num_words*2 + num_bytes);
 200 }
 201
 202 static bool valid_smb_header(const uint8_t *inbuf)
 203 {
 204         if (is_encrypted_packet(inbuf)) {
 205                 return true;
 206         }
 207         /*
 208          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 209          * but it just looks weird to call strncmp for this one.
 210          */
 211         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 212 }
 213
 214 /* Socket functions for smbd packet processing. */
 215
 216 static bool valid_packet_size(size_t len)
 217 {
 218         /*
 219          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 220          * of header. Don't print the error if this fits.... JRA.
 221          */
 222
 223         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 224                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 225                                         (unsigned long)len));
 226                 return false;
 227         }
 228         return true;
 229 }
 230
 231 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 232                                       unsigned int timeout, ssize_t len)
 233 {
 234         NTSTATUS status;
 235
 236         if (len <= 0) {
 237                 return NT_STATUS_OK;
 238         }
 239
 240         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 241         if (!NT_STATUS_IS_OK(status)) {
 242                 char addr[INET6_ADDRSTRLEN];
 243                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 244                           "error = %s.\n",
 245                           get_peer_addr(fd, addr, sizeof(addr)),
 246                           nt_errstr(status)));
 247         }
 248         return status;
 249 }
 250
 251 /****************************************************************************
 252  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 253 ****************************************************************************/
 254
 255 /*
 256  * Unfortunately, earlier versions of smbclient/libsmbclient
 257  * don't send this "standard" writeX header. I've fixed this
 258  * for 3.2 but we'll use the old method with earlier versions.
 259  * Windows and CIFSFS at least use this standard size. Not
 260  * sure about MacOSX.
 261  */
 262
 263 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 264                                 (2*14) + /* word count (including bcc) */ \
 265                                 1 /* pad byte */)
 266
 267 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 268                                                     const char lenbuf[4],
 269                                                     struct smbd_server_connection *sconn,
 270                                                     int sock,
 271                                                     char **buffer,
 272                                                     unsigned int timeout,
 273                                                     size_t *p_unread,
 274                                                     size_t *len_ret)
 275 {
 276         /* Size of a WRITEX call (+4 byte len). */
 277         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 278         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 279         ssize_t toread;
 280         NTSTATUS status;
 281
 282         memcpy(writeX_header, lenbuf, 4);
 283
 284         status = read_fd_with_timeout(
 285                 sock, writeX_header + 4,
 286                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 287                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 288                 timeout, NULL);
 289
 290         if (!NT_STATUS_IS_OK(status)) {
 291                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 292                           "error = %s.\n",
 293                           tsocket_address_string(sconn->remote_address,
 294                                                  talloc_tos()),
 295                           nt_errstr(status)));
 296                 return status;
 297         }
 298
 299         /*
 300          * Ok - now try and see if this is a possible
 301          * valid writeX call.
 302          */
 303
 304         if (is_valid_writeX_buffer(sconn, (uint8_t *)writeX_header)) {
 305                 /*
 306                  * If the data offset is beyond what
 307                  * we've read, drain the extra bytes.
 308                  */
 309                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 310                 ssize_t newlen;
 311
 312                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 313                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 314                         if (drain_socket(sock, drain) != drain) {
 315                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 316                                         " failed to drain pending bytes");
 317                         }
 318                 } else {
 319                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 320                 }
 321
 322                 /* Spoof down the length and null out the bcc. */
 323                 set_message_bcc(writeX_header, 0);
 324                 newlen = smb_len(writeX_header);
 325
 326                 /* Copy the header we've written. */
 327
 328                 *buffer = (char *)talloc_memdup(mem_ctx,
 329                                 writeX_header,
 330                                 sizeof(writeX_header));
 331
 332                 if (*buffer == NULL) {
 333                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 334                                   (int)sizeof(writeX_header)));
 335                         return NT_STATUS_NO_MEMORY;
 336                 }
 337
 338                 /* Work out the remaining bytes. */
 339                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 340                 *len_ret = newlen + 4;
 341                 return NT_STATUS_OK;
 342         }
 343
 344         if (!valid_packet_size(len)) {
 345                 return NT_STATUS_INVALID_PARAMETER;
 346         }
 347
 348         /*
 349          * Not a valid writeX call. Just do the standard
 350          * talloc and return.
 351          */
 352
 353         *buffer = talloc_array(mem_ctx, char, len+4);
 354
 355         if (*buffer == NULL) {
 356                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 357                           (int)len+4));
 358                 return NT_STATUS_NO_MEMORY;
 359         }
 360
 361         /* Copy in what we already read. */
 362         memcpy(*buffer,
 363                 writeX_header,
 364                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 365         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 366
 367         if(toread > 0) {
 368                 status = read_packet_remainder(
 369                         sock,
 370                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 371                         timeout, toread);
 372
 373                 if (!NT_STATUS_IS_OK(status)) {
 374                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 375                                    nt_errstr(status)));
 376                         return status;
 377                 }
 378         }
 379
 380         *len_ret = len + 4;
 381         return NT_STATUS_OK;
 382 }
 383
 384 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 385                                        struct smbd_server_connection *sconn,
 386                                        int sock,
 387                                        char **buffer, unsigned int timeout,
 388                                        size_t *p_unread, size_t *plen)
 389 {
 390         char lenbuf[4];
 391         size_t len;
 392         int min_recv_size = lp_min_receive_file_size();
 393         NTSTATUS status;
 394
 395         *p_unread = 0;
 396
 397         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 398                                                   &len);
 399         if (!NT_STATUS_IS_OK(status)) {
 400                 return status;
 401         }
 402
 403         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 404             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 405                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 406             !srv_is_signing_active(sconn) &&
 407             sconn->smb1.echo_handler.trusted_fde == NULL) {
 408
 409                 return receive_smb_raw_talloc_partial_read(
 410                         mem_ctx, lenbuf, sconn, sock, buffer, timeout,
 411                         p_unread, plen);
 412         }
 413
 414         if (!valid_packet_size(len)) {
 415                 return NT_STATUS_INVALID_PARAMETER;
 416         }
 417
 418         /*
 419          * The +4 here can't wrap, we've checked the length above already.
 420          */
 421
 422         *buffer = talloc_array(mem_ctx, char, len+4);
 423
 424         if (*buffer == NULL) {
 425                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 426                           (int)len+4));
 427                 return NT_STATUS_NO_MEMORY;
 428         }
 429
 430         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 431
 432         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 433         if (!NT_STATUS_IS_OK(status)) {
 434                 return status;
 435         }
 436
 437         *plen = len + 4;
 438         return NT_STATUS_OK;
 439 }
 440
 441 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 442                                    struct smbd_server_connection *sconn,
 443                                    int sock,
 444                                    char **buffer, unsigned int timeout,
 445                                    size_t *p_unread, bool *p_encrypted,
 446                                    size_t *p_len,
 447                                    uint32_t *seqnum,
 448                                    bool trusted_channel)
 449 {
 450         size_t len = 0;
 451         NTSTATUS status;
 452
 453         *p_encrypted = false;
 454
 455         status = receive_smb_raw_talloc(mem_ctx, sconn, sock, buffer, timeout,
 456                                         p_unread, &len);
 457         if (!NT_STATUS_IS_OK(status)) {
 458                 DEBUG(1, ("read_smb_length_return_keepalive failed for "
 459                           "client %s read error = %s.\n",
 460                           tsocket_address_string(sconn->remote_address,
 461                                                  talloc_tos()),
 462                           nt_errstr(status)));
 463                 return status;
 464         }
 465
 466         if (is_encrypted_packet((uint8_t *)*buffer)) {
 467                 status = srv_decrypt_buffer(*buffer);
 468                 if (!NT_STATUS_IS_OK(status)) {
 469                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 470                                 "incoming packet! Error %s\n",
 471                                 nt_errstr(status) ));
 472                         return status;
 473                 }
 474                 *p_encrypted = true;
 475         }
 476
 477         /* Check the incoming SMB signature. */
 478         if (!srv_check_sign_mac(sconn, *buffer, seqnum, trusted_channel)) {
 479                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 480                           "incoming packet!\n"));
 481                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 482         }
 483
 484         *p_len = len;
 485         return NT_STATUS_OK;
 486 }
 487
 488 /*
 489  * Initialize a struct smb_request from an inbuf
 490  */
 491
 492 static bool init_smb_request(struct smb_request *req,
 493                              struct smbd_server_connection *sconn,
 494                              const uint8 *inbuf,
 495                              size_t unread_bytes, bool encrypted,
 496                              uint32_t seqnum)
 497 {
 498         size_t req_size = smb_len(inbuf) + 4;
 499         /* Ensure we have at least smb_size bytes. */
 500         if (req_size < smb_size) {
 501                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 502                         (unsigned int)req_size ));
 503                 return false;
 504         }
 505         req->cmd    = CVAL(inbuf, smb_com);
 506         req->flags2 = SVAL(inbuf, smb_flg2);
 507         req->smbpid = SVAL(inbuf, smb_pid);
 508         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 509         req->seqnum = seqnum;
 510         req->vuid   = SVAL(inbuf, smb_uid);
 511         req->tid    = SVAL(inbuf, smb_tid);
 512         req->wct    = CVAL(inbuf, smb_wct);
 513         req->vwv    = discard_const_p(uint16_t, (inbuf+smb_vwv));
 514         req->buflen = smb_buflen(inbuf);
 515         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 516         req->unread_bytes = unread_bytes;
 517         req->encrypted = encrypted;
 518         req->sconn = sconn;
 519         req->conn = conn_find(sconn,req->tid);
 520         req->chain_fsp = NULL;
 521         req->chain_outbuf = NULL;
 522         req->done = false;
 523         req->smb2req = NULL;
 524         smb_init_perfcount_data(&req->pcd);
 525
 526         /* Ensure we have at least wct words and 2 bytes of bcc. */
 527         if (smb_size + req->wct*2 > req_size) {
 528                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 529                         (unsigned int)req->wct,
 530                         (unsigned int)req_size));
 531                 return false;
 532         }
 533         /* Ensure bcc is correct. */
 534         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 535                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 536                         "(wct = %u, size %u)\n",
 537                         (unsigned int)req->buflen,
 538                         (unsigned int)req->wct,
 539                         (unsigned int)req_size));
 540                 return false;
 541         }
 542
 543         req->outbuf = NULL;
 544         return true;
 545 }
 546
 547 static void process_smb(struct smbd_server_connection *conn,
 548                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 549                         uint32_t seqnum, bool encrypted,
 550                         struct smb_perfcount_data *deferred_pcd);
 551
 552 static void smbd_deferred_open_timer(struct event_context *ev,
 553                                      struct timed_event *te,
 554                                      struct timeval _tval,
 555                                      void *private_data)
 556 {
 557         struct pending_message_list *msg = talloc_get_type(private_data,
 558                                            struct pending_message_list);
 559         TALLOC_CTX *mem_ctx = talloc_tos();
 560         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 561         uint8_t *inbuf;
 562
 563         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 564                                          msg->buf.length);
 565         if (inbuf == NULL) {
 566                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 567                 return;
 568         }
 569
 570         /* We leave this message on the queue so the open code can
 571            know this is a retry. */
 572         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 573                 (unsigned long long)mid ));
 574
 575         /* Mark the message as processed so this is not
 576          * re-processed in error. */
 577         msg->processed = true;
 578
 579         process_smb(smbd_server_conn, inbuf,
 580                     msg->buf.length, 0,
 581                     msg->seqnum, msg->encrypted, &msg->pcd);
 582
 583         /* If it's still there and was processed, remove it. */
 584         msg = get_deferred_open_message_smb(smbd_server_conn, mid);
 585         if (msg && msg->processed) {
 586                 remove_deferred_open_message_smb(smbd_server_conn, mid);
 587         }
 588 }
 589
 590 /****************************************************************************
 591  Function to push a message onto the tail of a linked list of smb messages ready
 592  for processing.
 593 ****************************************************************************/
 594
 595 static bool push_queued_message(struct smb_request *req,
 596                                 struct timeval request_time,
 597                                 struct timeval end_time,
 598                                 char *private_data, size_t private_len)
 599 {
 600         int msg_len = smb_len(req->inbuf) + 4;
 601         struct pending_message_list *msg;
 602
 603         msg = talloc_zero(NULL, struct pending_message_list);
 604
 605         if(msg == NULL) {
 606                 DEBUG(0,("push_message: malloc fail (1)\n"));
 607                 return False;
 608         }
 609
 610         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 611         if(msg->buf.data == NULL) {
 612                 DEBUG(0,("push_message: malloc fail (2)\n"));
 613                 TALLOC_FREE(msg);
 614                 return False;
 615         }
 616
 617         msg->request_time = request_time;
 618         msg->seqnum = req->seqnum;
 619         msg->encrypted = req->encrypted;
 620         msg->processed = false;
 621         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 622
 623         if (private_data) {
 624                 msg->private_data = data_blob_talloc(msg, private_data,
 625                                                      private_len);
 626                 if (msg->private_data.data == NULL) {
 627                         DEBUG(0,("push_message: malloc fail (3)\n"));
 628                         TALLOC_FREE(msg);
 629                         return False;
 630                 }
 631         }
 632
 633         msg->te = event_add_timed(server_event_context(),
 634                                   msg,
 635                                   end_time,
 636                                   smbd_deferred_open_timer,
 637                                   msg);
 638         if (!msg->te) {
 639                 DEBUG(0,("push_message: event_add_timed failed\n"));
 640                 TALLOC_FREE(msg);
 641                 return false;
 642         }
 643
 644         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 645                       struct pending_message_list *);
 646
 647         DEBUG(10,("push_message: pushed message length %u on "
 648                   "deferred_open_queue\n", (unsigned int)msg_len));
 649
 650         return True;
 651 }
 652
 653 /****************************************************************************
 654  Function to delete a sharing violation open message by mid.
 655 ****************************************************************************/
 656
 657 void remove_deferred_open_message_smb(struct smbd_server_connection *sconn,
 658                                       uint64_t mid)
 659 {
 660         struct pending_message_list *pml;
 661
 662         if (sconn->using_smb2) {
 663                 remove_deferred_open_message_smb2(sconn, mid);
 664                 return;
 665         }
 666
 667         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 668                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 669                         DEBUG(10,("remove_deferred_open_message_smb: "
 670                                   "deleting mid %llu len %u\n",
 671                                   (unsigned long long)mid,
 672                                   (unsigned int)pml->buf.length ));
 673                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 674                         TALLOC_FREE(pml);
 675                         return;
 676                 }
 677         }
 678 }
 679
 680 /****************************************************************************
 681  Move a sharing violation open retry message to the front of the list and
 682  schedule it for immediate processing.
 683 ****************************************************************************/
 684
 685 void schedule_deferred_open_message_smb(struct smbd_server_connection *sconn,
 686                                         uint64_t mid)
 687 {
 688         struct pending_message_list *pml;
 689         int i = 0;
 690
 691         if (sconn->using_smb2) {
 692                 schedule_deferred_open_message_smb2(sconn, mid);
 693                 return;
 694         }
 695
 696         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 697                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 698
 699                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 700                         "msg_mid = %llu\n",
 701                         i++,
 702                         (unsigned long long)msg_mid ));
 703
 704                 if (mid == msg_mid) {
 705                         struct timed_event *te;
 706
 707                         if (pml->processed) {
 708                                 /* A processed message should not be
 709                                  * rescheduled. */
 710                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 711                                         "message mid %llu was already processed\n",
 712                                         (unsigned long long)msg_mid ));
 713                                 continue;
 714                         }
 715
 716                         DEBUG(10,("schedule_deferred_open_message_smb: "
 717                                 "scheduling mid %llu\n",
 718                                 (unsigned long long)mid ));
 719
 720                         te = event_add_timed(server_event_context(),
 721                                              pml,
 722                                              timeval_zero(),
 723                                              smbd_deferred_open_timer,
 724                                              pml);
 725                         if (!te) {
 726                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 727                                         "event_add_timed() failed, "
 728                                         "skipping mid %llu\n",
 729                                         (unsigned long long)msg_mid ));
 730                         }
 731
 732                         TALLOC_FREE(pml->te);
 733                         pml->te = te;
 734                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 735                         return;
 736                 }
 737         }
 738
 739         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 740                 "find message mid %llu\n",
 741                 (unsigned long long)mid ));
 742 }
 743
 744 /****************************************************************************
 745  Return true if this mid is on the deferred queue and was not yet processed.
 746 ****************************************************************************/
 747
 748 bool open_was_deferred(struct smbd_server_connection *sconn, uint64_t mid)
 749 {
 750         struct pending_message_list *pml;
 751
 752         if (sconn->using_smb2) {
 753                 return open_was_deferred_smb2(sconn, mid);
 754         }
 755
 756         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 757                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 758                         return True;
 759                 }
 760         }
 761         return False;
 762 }
 763
 764 /****************************************************************************
 765  Return the message queued by this mid.
 766 ****************************************************************************/
 767
 768 static struct pending_message_list *get_deferred_open_message_smb(
 769         struct smbd_server_connection *sconn, uint64_t mid)
 770 {
 771         struct pending_message_list *pml;
 772
 773         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 774                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 775                         return pml;
 776                 }
 777         }
 778         return NULL;
 779 }
 780
 781 /****************************************************************************
 782  Get the state data queued by this mid.
 783 ****************************************************************************/
 784
 785 bool get_deferred_open_message_state(struct smb_request *smbreq,
 786                                 struct timeval *p_request_time,
 787                                 void **pp_state)
 788 {
 789         struct pending_message_list *pml;
 790
 791         if (smbd_server_conn->using_smb2) {
 792                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 793                                         p_request_time,
 794                                         pp_state);
 795         }
 796
 797         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 798         if (!pml) {
 799                 return false;
 800         }
 801         if (p_request_time) {
 802                 *p_request_time = pml->request_time;
 803         }
 804         if (pp_state) {
 805                 *pp_state = (void *)pml->private_data.data;
 806         }
 807         return true;
 808 }
 809
 810 /****************************************************************************
 811  Function to push a deferred open smb message onto a linked list of local smb
 812  messages ready for processing.
 813 ****************************************************************************/
 814
 815 bool push_deferred_open_message_smb(struct smb_request *req,
 816                                struct timeval request_time,
 817                                struct timeval timeout,
 818                                struct file_id id,
 819                                char *private_data, size_t priv_len)
 820 {
 821         struct timeval end_time;
 822
 823         if (req->smb2req) {
 824                 return push_deferred_open_message_smb2(req->smb2req,
 825                                                 request_time,
 826                                                 timeout,
 827                                                 id,
 828                                                 private_data,
 829                                                 priv_len);
 830         }
 831
 832         if (req->unread_bytes) {
 833                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 834                         "unread_bytes = %u\n",
 835                         (unsigned int)req->unread_bytes ));
 836                 smb_panic("push_deferred_open_message_smb: "
 837                         "logic error unread_bytes != 0" );
 838         }
 839
 840         end_time = timeval_sum(&request_time, &timeout);
 841
 842         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 843                 "len %u mid %llu timeout time [%u.%06u]\n",
 844                 (unsigned int) smb_len(req->inbuf)+4,
 845                 (unsigned long long)req->mid,
 846                 (unsigned int)end_time.tv_sec,
 847                 (unsigned int)end_time.tv_usec));
 848
 849         return push_queued_message(req, request_time, end_time,
 850                                    private_data, priv_len);
 851 }
 852
 853 static void smbd_sig_term_handler(struct tevent_context *ev,
 854                                   struct tevent_signal *se,
 855                                   int signum,
 856                                   int count,
 857                                   void *siginfo,
 858                                   void *private_data)
 859 {
 860         exit_server_cleanly("termination signal");
 861 }
 862
 863 void smbd_setup_sig_term_handler(void)
 864 {
 865         struct tevent_signal *se;
 866
 867         se = tevent_add_signal(server_event_context(),
 868                                server_event_context(),
 869                                SIGTERM, 0,
 870                                smbd_sig_term_handler,
 871                                NULL);
 872         if (!se) {
 873                 exit_server("failed to setup SIGTERM handler");
 874         }
 875 }
 876
 877 static void smbd_sig_hup_handler(struct tevent_context *ev,
 878                                   struct tevent_signal *se,
 879                                   int signum,
 880                                   int count,
 881                                   void *siginfo,
 882                                   void *private_data)
 883 {
 884         struct messaging_context *msg_ctx = talloc_get_type_abort(
 885                 private_data, struct messaging_context);
 886         change_to_root_user();
 887         DEBUG(1,("Reloading services after SIGHUP\n"));
 888         reload_services(msg_ctx, smbd_server_conn->sock, False);
 889         if (am_parent) {
 890                 printing_subsystem_update(ev, msg_ctx);
 891         }
 892 }
 893
 894 void smbd_setup_sig_hup_handler(struct tevent_context *ev,
 895                                 struct messaging_context *msg_ctx)
 896 {
 897         struct tevent_signal *se;
 898
 899         se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
 900                                msg_ctx);
 901         if (!se) {
 902                 exit_server("failed to setup SIGHUP handler");
 903         }
 904 }
 905
 906 static NTSTATUS smbd_server_connection_loop_once(struct tevent_context *ev_ctx,
 907                                                  struct smbd_server_connection *conn)
 908 {
 909         int timeout;
 910         int num_pfds = 0;
 911         int ret;
 912         bool retry;
 913
 914         timeout = SMBD_SELECT_TIMEOUT * 1000;
 915
 916         /*
 917          * Are there any timed events waiting ? If so, ensure we don't
 918          * select for longer than it would take to wait for them.
 919          */
 920
 921         event_add_to_poll_args(ev_ctx, conn, &conn->pfds, &num_pfds, &timeout);
 922
 923         /* Process a signal and timed events now... */
 924         if (run_events_poll(ev_ctx, 0, NULL, 0)) {
 925                 return NT_STATUS_RETRY;
 926         }
 927
 928         {
 929                 int sav;
 930                 START_PROFILE(smbd_idle);
 931
 932                 ret = sys_poll(conn->pfds, num_pfds, timeout);
 933                 sav = errno;
 934
 935                 END_PROFILE(smbd_idle);
 936                 errno = sav;
 937         }
 938
 939         if (ret == -1) {
 940                 if (errno == EINTR) {
 941                         return NT_STATUS_RETRY;
 942                 }
 943                 return map_nt_error_from_unix(errno);
 944         }
 945
 946         retry = run_events_poll(ev_ctx, ret, conn->pfds, num_pfds);
 947         if (retry) {
 948                 return NT_STATUS_RETRY;
 949         }
 950
 951         /* Did we timeout ? */
 952         if (ret == 0) {
 953                 return NT_STATUS_RETRY;
 954         }
 955
 956         /* should not be reached */
 957         return NT_STATUS_INTERNAL_ERROR;
 958 }
 959
 960 /*
 961  * Only allow 5 outstanding trans requests. We're allocating memory, so
 962  * prevent a DoS.
 963  */
 964
 965 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
 966 {
 967         int count = 0;
 968         for (; list != NULL; list = list->next) {
 969
 970                 if (list->mid == mid) {
 971                         return NT_STATUS_INVALID_PARAMETER;
 972                 }
 973
 974                 count += 1;
 975         }
 976         if (count > 5) {
 977                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 978         }
 979
 980         return NT_STATUS_OK;
 981 }
 982
 983 /*
 984 These flags determine some of the permissions required to do an operation
 985
 986 Note that I don't set NEED_WRITE on some write operations because they
 987 are used by some brain-dead clients when printing, and I don't want to
 988 force write permissions on print services.
 989 */
 990 #define AS_USER (1<<0)
 991 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 992 #define TIME_INIT (1<<2)
 993 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 994 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 995 #define DO_CHDIR (1<<6)
 996
 997 /*
 998    define a list of possible SMB messages and their corresponding
 999    functions. Any message that has a NULL function is unimplemented -
1000    please feel free to contribute implementations!
1001 */
1002 static const struct smb_message_struct {
1003         const char *name;
1004         void (*fn)(struct smb_request *req);
1005         int flags;
1006 } smb_messages[256] = {
1007
1008 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1009 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1010 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1011 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1012 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1013 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1014 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1015 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1016 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1017 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1018 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1019 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1020 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1021 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1022 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1023 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1024 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1025 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1026 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1027 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1028 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1029 /* 0x15 */ { NULL, NULL, 0 },
1030 /* 0x16 */ { NULL, NULL, 0 },
1031 /* 0x17 */ { NULL, NULL, 0 },
1032 /* 0x18 */ { NULL, NULL, 0 },
1033 /* 0x19 */ { NULL, NULL, 0 },
1034 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1035 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1036 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1037 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1038 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1039 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1040 /* 0x20 */ { "SMBwritec", NULL,0},
1041 /* 0x21 */ { NULL, NULL, 0 },
1042 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1043 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1044 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1045 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1046 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1047 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1048 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1049 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1050 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1051 /* 0x2b */ { "SMBecho",reply_echo,0},
1052 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1053 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1054 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1055 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1056 /* 0x30 */ { NULL, NULL, 0 },
1057 /* 0x31 */ { NULL, NULL, 0 },
1058 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1059 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1060 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1061 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1062 /* 0x36 */ { NULL, NULL, 0 },
1063 /* 0x37 */ { NULL, NULL, 0 },
1064 /* 0x38 */ { NULL, NULL, 0 },
1065 /* 0x39 */ { NULL, NULL, 0 },
1066 /* 0x3a */ { NULL, NULL, 0 },
1067 /* 0x3b */ { NULL, NULL, 0 },
1068 /* 0x3c */ { NULL, NULL, 0 },
1069 /* 0x3d */ { NULL, NULL, 0 },
1070 /* 0x3e */ { NULL, NULL, 0 },
1071 /* 0x3f */ { NULL, NULL, 0 },
1072 /* 0x40 */ { NULL, NULL, 0 },
1073 /* 0x41 */ { NULL, NULL, 0 },
1074 /* 0x42 */ { NULL, NULL, 0 },
1075 /* 0x43 */ { NULL, NULL, 0 },
1076 /* 0x44 */ { NULL, NULL, 0 },
1077 /* 0x45 */ { NULL, NULL, 0 },
1078 /* 0x46 */ { NULL, NULL, 0 },
1079 /* 0x47 */ { NULL, NULL, 0 },
1080 /* 0x48 */ { NULL, NULL, 0 },
1081 /* 0x49 */ { NULL, NULL, 0 },
1082 /* 0x4a */ { NULL, NULL, 0 },
1083 /* 0x4b */ { NULL, NULL, 0 },
1084 /* 0x4c */ { NULL, NULL, 0 },
1085 /* 0x4d */ { NULL, NULL, 0 },
1086 /* 0x4e */ { NULL, NULL, 0 },
1087 /* 0x4f */ { NULL, NULL, 0 },
1088 /* 0x50 */ { NULL, NULL, 0 },
1089 /* 0x51 */ { NULL, NULL, 0 },
1090 /* 0x52 */ { NULL, NULL, 0 },
1091 /* 0x53 */ { NULL, NULL, 0 },
1092 /* 0x54 */ { NULL, NULL, 0 },
1093 /* 0x55 */ { NULL, NULL, 0 },
1094 /* 0x56 */ { NULL, NULL, 0 },
1095 /* 0x57 */ { NULL, NULL, 0 },
1096 /* 0x58 */ { NULL, NULL, 0 },
1097 /* 0x59 */ { NULL, NULL, 0 },
1098 /* 0x5a */ { NULL, NULL, 0 },
1099 /* 0x5b */ { NULL, NULL, 0 },
1100 /* 0x5c */ { NULL, NULL, 0 },
1101 /* 0x5d */ { NULL, NULL, 0 },
1102 /* 0x5e */ { NULL, NULL, 0 },
1103 /* 0x5f */ { NULL, NULL, 0 },
1104 /* 0x60 */ { NULL, NULL, 0 },
1105 /* 0x61 */ { NULL, NULL, 0 },
1106 /* 0x62 */ { NULL, NULL, 0 },
1107 /* 0x63 */ { NULL, NULL, 0 },
1108 /* 0x64 */ { NULL, NULL, 0 },
1109 /* 0x65 */ { NULL, NULL, 0 },
1110 /* 0x66 */ { NULL, NULL, 0 },
1111 /* 0x67 */ { NULL, NULL, 0 },
1112 /* 0x68 */ { NULL, NULL, 0 },
1113 /* 0x69 */ { NULL, NULL, 0 },
1114 /* 0x6a */ { NULL, NULL, 0 },
1115 /* 0x6b */ { NULL, NULL, 0 },
1116 /* 0x6c */ { NULL, NULL, 0 },
1117 /* 0x6d */ { NULL, NULL, 0 },
1118 /* 0x6e */ { NULL, NULL, 0 },
1119 /* 0x6f */ { NULL, NULL, 0 },
1120 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1121 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1122 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1123 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1124 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1125 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1126 /* 0x76 */ { NULL, NULL, 0 },
1127 /* 0x77 */ { NULL, NULL, 0 },
1128 /* 0x78 */ { NULL, NULL, 0 },
1129 /* 0x79 */ { NULL, NULL, 0 },
1130 /* 0x7a */ { NULL, NULL, 0 },
1131 /* 0x7b */ { NULL, NULL, 0 },
1132 /* 0x7c */ { NULL, NULL, 0 },
1133 /* 0x7d */ { NULL, NULL, 0 },
1134 /* 0x7e */ { NULL, NULL, 0 },
1135 /* 0x7f */ { NULL, NULL, 0 },
1136 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1137 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1138 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1139 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1140 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1141 /* 0x85 */ { NULL, NULL, 0 },
1142 /* 0x86 */ { NULL, NULL, 0 },
1143 /* 0x87 */ { NULL, NULL, 0 },
1144 /* 0x88 */ { NULL, NULL, 0 },
1145 /* 0x89 */ { NULL, NULL, 0 },
1146 /* 0x8a */ { NULL, NULL, 0 },
1147 /* 0x8b */ { NULL, NULL, 0 },
1148 /* 0x8c */ { NULL, NULL, 0 },
1149 /* 0x8d */ { NULL, NULL, 0 },
1150 /* 0x8e */ { NULL, NULL, 0 },
1151 /* 0x8f */ { NULL, NULL, 0 },
1152 /* 0x90 */ { NULL, NULL, 0 },
1153 /* 0x91 */ { NULL, NULL, 0 },
1154 /* 0x92 */ { NULL, NULL, 0 },
1155 /* 0x93 */ { NULL, NULL, 0 },
1156 /* 0x94 */ { NULL, NULL, 0 },
1157 /* 0x95 */ { NULL, NULL, 0 },
1158 /* 0x96 */ { NULL, NULL, 0 },
1159 /* 0x97 */ { NULL, NULL, 0 },
1160 /* 0x98 */ { NULL, NULL, 0 },
1161 /* 0x99 */ { NULL, NULL, 0 },
1162 /* 0x9a */ { NULL, NULL, 0 },
1163 /* 0x9b */ { NULL, NULL, 0 },
1164 /* 0x9c */ { NULL, NULL, 0 },
1165 /* 0x9d */ { NULL, NULL, 0 },
1166 /* 0x9e */ { NULL, NULL, 0 },
1167 /* 0x9f */ { NULL, NULL, 0 },
1168 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1169 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1170 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1171 /* 0xa3 */ { NULL, NULL, 0 },
1172 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1173 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1174 /* 0xa6 */ { NULL, NULL, 0 },
1175 /* 0xa7 */ { NULL, NULL, 0 },
1176 /* 0xa8 */ { NULL, NULL, 0 },
1177 /* 0xa9 */ { NULL, NULL, 0 },
1178 /* 0xaa */ { NULL, NULL, 0 },
1179 /* 0xab */ { NULL, NULL, 0 },
1180 /* 0xac */ { NULL, NULL, 0 },
1181 /* 0xad */ { NULL, NULL, 0 },
1182 /* 0xae */ { NULL, NULL, 0 },
1183 /* 0xaf */ { NULL, NULL, 0 },
1184 /* 0xb0 */ { NULL, NULL, 0 },
1185 /* 0xb1 */ { NULL, NULL, 0 },
1186 /* 0xb2 */ { NULL, NULL, 0 },
1187 /* 0xb3 */ { NULL, NULL, 0 },
1188 /* 0xb4 */ { NULL, NULL, 0 },
1189 /* 0xb5 */ { NULL, NULL, 0 },
1190 /* 0xb6 */ { NULL, NULL, 0 },
1191 /* 0xb7 */ { NULL, NULL, 0 },
1192 /* 0xb8 */ { NULL, NULL, 0 },
1193 /* 0xb9 */ { NULL, NULL, 0 },
1194 /* 0xba */ { NULL, NULL, 0 },
1195 /* 0xbb */ { NULL, NULL, 0 },
1196 /* 0xbc */ { NULL, NULL, 0 },
1197 /* 0xbd */ { NULL, NULL, 0 },
1198 /* 0xbe */ { NULL, NULL, 0 },
1199 /* 0xbf */ { NULL, NULL, 0 },
1200 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1201 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1202 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1203 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1204 /* 0xc4 */ { NULL, NULL, 0 },
1205 /* 0xc5 */ { NULL, NULL, 0 },
1206 /* 0xc6 */ { NULL, NULL, 0 },
1207 /* 0xc7 */ { NULL, NULL, 0 },
1208 /* 0xc8 */ { NULL, NULL, 0 },
1209 /* 0xc9 */ { NULL, NULL, 0 },
1210 /* 0xca */ { NULL, NULL, 0 },
1211 /* 0xcb */ { NULL, NULL, 0 },
1212 /* 0xcc */ { NULL, NULL, 0 },
1213 /* 0xcd */ { NULL, NULL, 0 },
1214 /* 0xce */ { NULL, NULL, 0 },
1215 /* 0xcf */ { NULL, NULL, 0 },
1216 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1217 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1218 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1219 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1220 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1221 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1222 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1223 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1224 /* 0xd8 */ { NULL, NULL, 0 },
1225 /* 0xd9 */ { NULL, NULL, 0 },
1226 /* 0xda */ { NULL, NULL, 0 },
1227 /* 0xdb */ { NULL, NULL, 0 },
1228 /* 0xdc */ { NULL, NULL, 0 },
1229 /* 0xdd */ { NULL, NULL, 0 },
1230 /* 0xde */ { NULL, NULL, 0 },
1231 /* 0xdf */ { NULL, NULL, 0 },
1232 /* 0xe0 */ { NULL, NULL, 0 },
1233 /* 0xe1 */ { NULL, NULL, 0 },
1234 /* 0xe2 */ { NULL, NULL, 0 },
1235 /* 0xe3 */ { NULL, NULL, 0 },
1236 /* 0xe4 */ { NULL, NULL, 0 },
1237 /* 0xe5 */ { NULL, NULL, 0 },
1238 /* 0xe6 */ { NULL, NULL, 0 },
1239 /* 0xe7 */ { NULL, NULL, 0 },
1240 /* 0xe8 */ { NULL, NULL, 0 },
1241 /* 0xe9 */ { NULL, NULL, 0 },
1242 /* 0xea */ { NULL, NULL, 0 },
1243 /* 0xeb */ { NULL, NULL, 0 },
1244 /* 0xec */ { NULL, NULL, 0 },
1245 /* 0xed */ { NULL, NULL, 0 },
1246 /* 0xee */ { NULL, NULL, 0 },
1247 /* 0xef */ { NULL, NULL, 0 },
1248 /* 0xf0 */ { NULL, NULL, 0 },
1249 /* 0xf1 */ { NULL, NULL, 0 },
1250 /* 0xf2 */ { NULL, NULL, 0 },
1251 /* 0xf3 */ { NULL, NULL, 0 },
1252 /* 0xf4 */ { NULL, NULL, 0 },
1253 /* 0xf5 */ { NULL, NULL, 0 },
1254 /* 0xf6 */ { NULL, NULL, 0 },
1255 /* 0xf7 */ { NULL, NULL, 0 },
1256 /* 0xf8 */ { NULL, NULL, 0 },
1257 /* 0xf9 */ { NULL, NULL, 0 },
1258 /* 0xfa */ { NULL, NULL, 0 },
1259 /* 0xfb */ { NULL, NULL, 0 },
1260 /* 0xfc */ { NULL, NULL, 0 },
1261 /* 0xfd */ { NULL, NULL, 0 },
1262 /* 0xfe */ { NULL, NULL, 0 },
1263 /* 0xff */ { NULL, NULL, 0 }
1264
1265 };
1266
1267 /*******************************************************************
1268  allocate and initialize a reply packet
1269 ********************************************************************/
1270
1271 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1272                           const char *inbuf, char **outbuf, uint8_t num_words,
1273                           uint32_t num_bytes)
1274 {
1275         /*
1276          * Protect against integer wrap
1277          */
1278         if ((num_bytes > 0xffffff)
1279             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1280                 char *msg;
1281                 if (asprintf(&msg, "num_bytes too large: %u",
1282                              (unsigned)num_bytes) == -1) {
1283                         msg = discard_const_p(char, "num_bytes too large");
1284                 }
1285                 smb_panic(msg);
1286         }
1287
1288         *outbuf = talloc_array(mem_ctx, char,
1289                                smb_size + num_words*2 + num_bytes);
1290         if (*outbuf == NULL) {
1291                 return false;
1292         }
1293
1294         construct_reply_common(req, inbuf, *outbuf);
1295         srv_set_message(*outbuf, num_words, num_bytes, false);
1296         /*
1297          * Zero out the word area, the caller has to take care of the bcc area
1298          * himself
1299          */
1300         if (num_words != 0) {
1301                 memset(*outbuf + smb_vwv0, 0, num_words*2);
1302         }
1303
1304         return true;
1305 }
1306
1307 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1308 {
1309         char *outbuf;
1310         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1311                            num_bytes)) {
1312                 smb_panic("could not allocate output buffer\n");
1313         }
1314         req->outbuf = (uint8_t *)outbuf;
1315 }
1316
1317
1318 /*******************************************************************
1319  Dump a packet to a file.
1320 ********************************************************************/
1321
1322 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1323 {
1324         int fd, i;
1325         char *fname = NULL;
1326         if (DEBUGLEVEL < 50) {
1327                 return;
1328         }
1329
1330         if (len < 4) len = smb_len(data)+4;
1331         for (i=1;i<100;i++) {
1332                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1333                              type ? "req" : "resp") == -1) {
1334                         return;
1335                 }
1336                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1337                 if (fd != -1 || errno != EEXIST) break;
1338         }
1339         if (fd != -1) {
1340                 ssize_t ret = write(fd, data, len);
1341                 if (ret != len)
1342                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1343                 close(fd);
1344                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1345         }
1346         SAFE_FREE(fname);
1347 }
1348
1349 /****************************************************************************
1350  Prepare everything for calling the actual request function, and potentially
1351  call the request function via the "new" interface.
1352
1353  Return False if the "legacy" function needs to be called, everything is
1354  prepared.
1355
1356  Return True if we're done.
1357
1358  I know this API sucks, but it is the one with the least code change I could
1359  find.
1360 ****************************************************************************/
1361
1362 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1363 {
1364         int flags;
1365         uint16 session_tag;
1366         connection_struct *conn = NULL;
1367         struct smbd_server_connection *sconn = req->sconn;
1368         char *raddr;
1369
1370         errno = 0;
1371
1372         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1373          * so subtract 4 from it. */
1374         if (!valid_smb_header(req->inbuf)
1375             || (size < (smb_size - 4))) {
1376                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1377                          smb_len(req->inbuf)));
1378                 exit_server_cleanly("Non-SMB packet");
1379         }
1380
1381         if (smb_messages[type].fn == NULL) {
1382                 DEBUG(0,("Unknown message type %d!\n",type));
1383                 smb_dump("Unknown", 1, (const char *)req->inbuf, size);
1384                 reply_unknown_new(req, type);
1385                 return NULL;
1386         }
1387
1388         flags = smb_messages[type].flags;
1389
1390         /* In share mode security we must ignore the vuid. */
1391         session_tag = (lp_security() == SEC_SHARE)
1392                 ? UID_FIELD_INVALID : req->vuid;
1393         conn = req->conn;
1394
1395         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1396                  (int)sys_getpid(), (unsigned long)conn));
1397
1398         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf, size);
1399
1400         /* Ensure this value is replaced in the incoming packet. */
1401         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1402
1403         /*
1404          * Ensure the correct username is in current_user_info.  This is a
1405          * really ugly bugfix for problems with multiple session_setup_and_X's
1406          * being done and allowing %U and %G substitutions to work correctly.
1407          * There is a reason this code is done here, don't move it unless you
1408          * know what you're doing... :-).
1409          * JRA.
1410          */
1411
1412         if (session_tag != sconn->smb1.sessions.last_session_tag) {
1413                 user_struct *vuser = NULL;
1414
1415                 sconn->smb1.sessions.last_session_tag = session_tag;
1416                 if(session_tag != UID_FIELD_INVALID) {
1417                         vuser = get_valid_user_struct(sconn, session_tag);
1418                         if (vuser) {
1419                                 set_current_user_info(
1420                                         vuser->session_info->unix_info->sanitized_username,
1421                                         vuser->session_info->unix_info->unix_name,
1422                                         vuser->session_info->info->domain_name);
1423                         }
1424                 }
1425         }
1426
1427         /* Does this call need to be run as the connected user? */
1428         if (flags & AS_USER) {
1429
1430                 /* Does this call need a valid tree connection? */
1431                 if (!conn) {
1432                         /*
1433                          * Amazingly, the error code depends on the command
1434                          * (from Samba4).
1435                          */
1436                         if (type == SMBntcreateX) {
1437                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1438                         } else {
1439                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1440                         }
1441                         return NULL;
1442                 }
1443
1444                 if (!change_to_user(conn,session_tag)) {
1445                         DEBUG(0, ("Error: Could not change to user. Removing "
1446                                 "deferred open, mid=%llu.\n",
1447                                 (unsigned long long)req->mid));
1448                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1449                         return conn;
1450                 }
1451
1452                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1453
1454                 /* Does it need write permission? */
1455                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1456                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1457                         return conn;
1458                 }
1459
1460                 /* IPC services are limited */
1461                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1462                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1463                         return conn;
1464                 }
1465         } else {
1466                 /* This call needs to be run as root */
1467                 change_to_root_user();
1468         }
1469
1470         /* load service specific parameters */
1471         if (conn) {
1472                 if (req->encrypted) {
1473                         conn->encrypted_tid = true;
1474                         /* encrypted required from now on. */
1475                         conn->encrypt_level = Required;
1476                 } else if (ENCRYPTION_REQUIRED(conn)) {
1477                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1478                                 exit_server_cleanly("encryption required "
1479                                         "on connection");
1480                                 return conn;
1481                         }
1482                 }
1483
1484                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1485                                          (flags & (AS_USER|DO_CHDIR)
1486                                           ?True:False))) {
1487                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1488                         return conn;
1489                 }
1490                 conn->num_smb_operations++;
1491         }
1492
1493         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
1494                                                  talloc_tos());
1495         if (raddr == NULL) {
1496                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1497                 return conn;
1498         }
1499
1500         /* does this protocol need to be run as guest? */
1501         if ((flags & AS_GUEST)
1502             && (!change_to_guest() ||
1503                 !allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
1504                               sconn->remote_hostname,
1505                               raddr))) {
1506                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1507                 return conn;
1508         }
1509
1510         smb_messages[type].fn(req);
1511         return req->conn;
1512 }
1513
1514 /****************************************************************************
1515  Construct a reply to the incoming packet.
1516 ****************************************************************************/
1517
1518 static void construct_reply(struct smbd_server_connection *sconn,
1519                             char *inbuf, int size, size_t unread_bytes,
1520                             uint32_t seqnum, bool encrypted,
1521                             struct smb_perfcount_data *deferred_pcd)
1522 {
1523         connection_struct *conn;
1524         struct smb_request *req;
1525
1526         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1527                 smb_panic("could not allocate smb_request");
1528         }
1529
1530         if (!init_smb_request(req, sconn, (uint8 *)inbuf, unread_bytes,
1531                               encrypted, seqnum)) {
1532                 exit_server_cleanly("Invalid SMB request");
1533         }
1534
1535         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1536
1537         /* we popped this message off the queue - keep original perf data */
1538         if (deferred_pcd)
1539                 req->pcd = *deferred_pcd;
1540         else {
1541                 SMB_PERFCOUNT_START(&req->pcd);
1542                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1543                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1544         }
1545
1546         conn = switch_message(req->cmd, req, size);
1547
1548         if (req->unread_bytes) {
1549                 /* writeX failed. drain socket. */
1550                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
1551                                 req->unread_bytes) {
1552                         smb_panic("failed to drain pending bytes");
1553                 }
1554                 req->unread_bytes = 0;
1555         }
1556
1557         if (req->done) {
1558                 TALLOC_FREE(req);
1559                 return;
1560         }
1561
1562         if (req->outbuf == NULL) {
1563                 return;
1564         }
1565
1566         if (CVAL(req->outbuf,0) == 0) {
1567                 show_msg((char *)req->outbuf);
1568         }
1569
1570         if (!srv_send_smb(req->sconn,
1571                         (char *)req->outbuf,
1572                         true, req->seqnum+1,
1573                         IS_CONN_ENCRYPTED(conn)||req->encrypted,
1574                         &req->pcd)) {
1575                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1576         }
1577
1578         TALLOC_FREE(req);
1579
1580         return;
1581 }
1582
1583 /****************************************************************************
1584  Process an smb from the client
1585 ****************************************************************************/
1586 static void process_smb(struct smbd_server_connection *sconn,
1587                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1588                         uint32_t seqnum, bool encrypted,
1589                         struct smb_perfcount_data *deferred_pcd)
1590 {
1591         int msg_type = CVAL(inbuf,0);
1592
1593         DO_PROFILE_INC(smb_count);
1594
1595         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1596                     smb_len(inbuf) ) );
1597         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1598                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1599
1600         if (msg_type != NBSSmessage) {
1601                 /*
1602                  * NetBIOS session request, keepalive, etc.
1603                  */
1604                 reply_special(sconn, (char *)inbuf, nread);
1605                 goto done;
1606         }
1607
1608         if (sconn->using_smb2) {
1609                 /* At this point we're not really using smb2,
1610                  * we make the decision here.. */
1611                 if (smbd_is_smb2_header(inbuf, nread)) {
1612                         smbd_smb2_first_negprot(sconn, inbuf, nread);
1613                         return;
1614                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1615                                 && CVAL(inbuf, smb_com) != 0x72) {
1616                         /* This is a non-negprot SMB1 packet.
1617                            Disable SMB2 from now on. */
1618                         sconn->using_smb2 = false;
1619                 }
1620         }
1621
1622         show_msg((char *)inbuf);
1623
1624         construct_reply(sconn, (char *)inbuf, nread, unread_bytes, seqnum,
1625                         encrypted, deferred_pcd);
1626         sconn->trans_num++;
1627
1628 done:
1629         sconn->num_requests++;
1630
1631         /* The timeout_processing function isn't run nearly
1632            often enough to implement 'max log size' without
1633            overrunning the size of the file by many megabytes.
1634            This is especially true if we are running at debug
1635            level 10.  Checking every 50 SMBs is a nice
1636            tradeoff of performance vs log file size overrun. */
1637
1638         if ((sconn->num_requests % 50) == 0 &&
1639             need_to_check_log_size()) {
1640                 change_to_root_user();
1641                 check_log_size();
1642         }
1643 }
1644
1645 /****************************************************************************
1646  Return a string containing the function name of a SMB command.
1647 ****************************************************************************/
1648
1649 const char *smb_fn_name(int type)
1650 {
1651         const char *unknown_name = "SMBunknown";
1652
1653         if (smb_messages[type].name == NULL)
1654                 return(unknown_name);
1655
1656         return(smb_messages[type].name);
1657 }
1658
1659 /****************************************************************************
1660  Helper functions for contruct_reply.
1661 ****************************************************************************/
1662
1663 void add_to_common_flags2(uint32 v)
1664 {
1665         common_flags2 |= v;
1666 }
1667
1668 void remove_from_common_flags2(uint32 v)
1669 {
1670         common_flags2 &= ~v;
1671 }
1672
1673 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1674                                    char *outbuf)
1675 {
1676         srv_set_message(outbuf,0,0,false);
1677
1678         SCVAL(outbuf, smb_com, req->cmd);
1679         SIVAL(outbuf,smb_rcls,0);
1680         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1681         SSVAL(outbuf,smb_flg2,
1682                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1683                 common_flags2);
1684         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1685
1686         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1687         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1688         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1689         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1690 }
1691
1692 void construct_reply_common_req(struct smb_request *req, char *outbuf)
1693 {
1694         construct_reply_common(req, (const char *)req->inbuf, outbuf);
1695 }
1696
1697 /*
1698  * How many bytes have we already accumulated up to the current wct field
1699  * offset?
1700  */
1701
1702 size_t req_wct_ofs(struct smb_request *req)
1703 {
1704         size_t buf_size;
1705
1706         if (req->chain_outbuf == NULL) {
1707                 return smb_wct - 4;
1708         }
1709         buf_size = talloc_get_size(req->chain_outbuf);
1710         if ((buf_size % 4) != 0) {
1711                 buf_size += (4 - (buf_size % 4));
1712         }
1713         return buf_size - 4;
1714 }
1715
1716 /*
1717  * Hack around reply_nterror & friends not being aware of chained requests,
1718  * generating illegal (i.e. wct==0) chain replies.
1719  */
1720
1721 static void fixup_chain_error_packet(struct smb_request *req)
1722 {
1723         uint8_t *outbuf = req->outbuf;
1724         req->outbuf = NULL;
1725         reply_outbuf(req, 2, 0);
1726         memcpy(req->outbuf, outbuf, smb_wct);
1727         TALLOC_FREE(outbuf);
1728         SCVAL(req->outbuf, smb_vwv0, 0xff);
1729 }
1730
1731 /**
1732  * @brief Find the smb_cmd offset of the last command pushed
1733  * @param[in] buf       The buffer we're building up
1734  * @retval              Where can we put our next andx cmd?
1735  *
1736  * While chaining requests, the "next" request we're looking at needs to put
1737  * its SMB_Command before the data the previous request already built up added
1738  * to the chain. Find the offset to the place where we have to put our cmd.
1739  */
1740
1741 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
1742 {
1743         uint8_t cmd;
1744         size_t ofs;
1745
1746         cmd = CVAL(buf, smb_com);
1747
1748         SMB_ASSERT(is_andx_req(cmd));
1749
1750         ofs = smb_vwv0;
1751
1752         while (CVAL(buf, ofs) != 0xff) {
1753
1754                 if (!is_andx_req(CVAL(buf, ofs))) {
1755                         return false;
1756                 }
1757
1758                 /*
1759                  * ofs is from start of smb header, so add the 4 length
1760                  * bytes. The next cmd is right after the wct field.
1761                  */
1762                 ofs = SVAL(buf, ofs+2) + 4 + 1;
1763
1764                 SMB_ASSERT(ofs+4 < talloc_get_size(buf));
1765         }
1766
1767         *pofs = ofs;
1768         return true;
1769 }
1770
1771 /**
1772  * @brief Do the smb chaining at a buffer level
1773  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
1774  * @param[in] smb_command       The command that we want to issue
1775  * @param[in] wct               How many words?
1776  * @param[in] vwv               The words, already in network order
1777  * @param[in] bytes_alignment   How shall we align "bytes"?
1778  * @param[in] num_bytes         How many bytes?
1779  * @param[in] bytes             The data the request ships
1780  *
1781  * smb_splice_chain() adds the vwv and bytes to the request already present in
1782  * *poutbuf.
1783  */
1784
1785 static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
1786                              uint8_t wct, const uint16_t *vwv,
1787                              size_t bytes_alignment,
1788                              uint32_t num_bytes, const uint8_t *bytes)
1789 {
1790         uint8_t *outbuf;
1791         size_t old_size, new_size;
1792         size_t ofs;
1793         size_t chain_padding = 0;
1794         size_t bytes_padding = 0;
1795         bool first_request;
1796
1797         old_size = talloc_get_size(*poutbuf);
1798
1799         /*
1800          * old_size == smb_wct means we're pushing the first request in for
1801          * libsmb/
1802          */
1803
1804         first_request = (old_size == smb_wct);
1805
1806         if (!first_request && ((old_size % 4) != 0)) {
1807                 /*
1808                  * Align the wct field of subsequent requests to a 4-byte
1809                  * boundary
1810                  */
1811                 chain_padding = 4 - (old_size % 4);
1812         }
1813
1814         /*
1815          * After the old request comes the new wct field (1 byte), the vwv's
1816          * and the num_bytes field. After at we might need to align the bytes
1817          * given to us to "bytes_alignment", increasing the num_bytes value.
1818          */
1819
1820         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
1821
1822         if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
1823                 bytes_padding = bytes_alignment - (new_size % bytes_alignment);
1824         }
1825
1826         new_size += bytes_padding + num_bytes;
1827
1828         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
1829                 DEBUG(1, ("splice_chain: %u bytes won't fit\n",
1830                           (unsigned)new_size));
1831                 return false;
1832         }
1833
1834         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
1835         if (outbuf == NULL) {
1836                 DEBUG(0, ("talloc failed\n"));
1837                 return false;
1838         }
1839         *poutbuf = outbuf;
1840
1841         if (first_request) {
1842                 SCVAL(outbuf, smb_com, smb_command);
1843         } else {
1844                 size_t andx_cmd_ofs;
1845
1846                 if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
1847                         DEBUG(1, ("invalid command chain\n"));
1848                         *poutbuf = talloc_realloc(
1849                                 NULL, *poutbuf, uint8_t, old_size);
1850                         return false;
1851                 }
1852
1853                 if (chain_padding != 0) {
1854                         memset(outbuf + old_size, 0, chain_padding);
1855                         old_size += chain_padding;
1856                 }
1857
1858                 SCVAL(outbuf, andx_cmd_ofs, smb_command);
1859                 SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
1860         }
1861
1862         ofs = old_size;
1863
1864         /*
1865          * Push the chained request:
1866          *
1867          * wct field
1868          */
1869
1870         SCVAL(outbuf, ofs, wct);
1871         ofs += 1;
1872
1873         /*
1874          * vwv array
1875          */
1876
1877         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
1878         ofs += sizeof(uint16_t) * wct;
1879
1880         /*
1881          * bcc (byte count)
1882          */
1883
1884         SSVAL(outbuf, ofs, num_bytes + bytes_padding);
1885         ofs += sizeof(uint16_t);
1886
1887         /*
1888          * padding
1889          */
1890
1891         if (bytes_padding != 0) {
1892                 memset(outbuf + ofs, 0, bytes_padding);
1893                 ofs += bytes_padding;
1894         }
1895
1896         /*
1897          * The bytes field
1898          */
1899
1900         memcpy(outbuf + ofs, bytes, num_bytes);
1901
1902         return true;
1903 }
1904
1905 /****************************************************************************
1906  Construct a chained reply and add it to the already made reply
1907 ****************************************************************************/
1908
1909 void chain_reply(struct smb_request *req)
1910 {
1911         size_t smblen = smb_len(req->inbuf);
1912         size_t already_used, length_needed;
1913         uint8_t chain_cmd;
1914         uint32_t chain_offset;  /* uint32_t to avoid overflow */
1915
1916         uint8_t wct;
1917         const uint16_t *vwv;
1918         uint16_t buflen;
1919         const uint8_t *buf;
1920
1921         if (IVAL(req->outbuf, smb_rcls) != 0) {
1922                 fixup_chain_error_packet(req);
1923         }
1924
1925         /*
1926          * Any of the AndX requests and replies have at least a wct of
1927          * 2. vwv[0] is the next command, vwv[1] is the offset from the
1928          * beginning of the SMB header to the next wct field.
1929          *
1930          * None of the AndX requests put anything valuable in vwv[0] and [1],
1931          * so we can overwrite it here to form the chain.
1932          */
1933
1934         if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
1935                 if (req->chain_outbuf == NULL) {
1936                         req->chain_outbuf = talloc_realloc(
1937                                 req, req->outbuf, uint8_t,
1938                                 smb_len(req->outbuf) + 4);
1939                         if (req->chain_outbuf == NULL) {
1940                                 smb_panic("talloc failed");
1941                         }
1942                 }
1943                 req->outbuf = NULL;
1944                 goto error;
1945         }
1946
1947         /*
1948          * Here we assume that this is the end of the chain. For that we need
1949          * to set "next command" to 0xff and the offset to 0. If we later find
1950          * more commands in the chain, this will be overwritten again.
1951          */
1952
1953         SCVAL(req->outbuf, smb_vwv0, 0xff);
1954         SCVAL(req->outbuf, smb_vwv0+1, 0);
1955         SSVAL(req->outbuf, smb_vwv1, 0);
1956
1957         if (req->chain_outbuf == NULL) {
1958                 /*
1959                  * In req->chain_outbuf we collect all the replies. Start the
1960                  * chain by copying in the first reply.
1961                  *
1962                  * We do the realloc because later on we depend on
1963                  * talloc_get_size to determine the length of
1964                  * chain_outbuf. The reply_xxx routines might have
1965                  * over-allocated (reply_pipe_read_and_X used to be such an
1966                  * example).
1967                  */
1968                 req->chain_outbuf = talloc_realloc(
1969                         req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
1970                 if (req->chain_outbuf == NULL) {
1971                         smb_panic("talloc failed");
1972                 }
1973                 req->outbuf = NULL;
1974         } else {
1975                 /*
1976                  * Update smb headers where subsequent chained commands
1977                  * may have updated them.
1978                  */
1979                 SSVAL(req->chain_outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1980                 SSVAL(req->chain_outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1981
1982                 if (!smb_splice_chain(&req->chain_outbuf,
1983                                       CVAL(req->outbuf, smb_com),
1984                                       CVAL(req->outbuf, smb_wct),
1985                                       (uint16_t *)(req->outbuf + smb_vwv),
1986                                       0, smb_buflen(req->outbuf),
1987                                       (uint8_t *)smb_buf(req->outbuf))) {
1988                         goto error;
1989                 }
1990                 TALLOC_FREE(req->outbuf);
1991         }
1992
1993         /*
1994          * We use the old request's vwv field to grab the next chained command
1995          * and offset into the chained fields.
1996          */
1997
1998         chain_cmd = CVAL(req->vwv+0, 0);
1999         chain_offset = SVAL(req->vwv+1, 0);
2000
2001         if (chain_cmd == 0xff) {
2002                 /*
2003                  * End of chain, no more requests from the client. So ship the
2004                  * replies.
2005                  */
2006                 smb_setlen((char *)(req->chain_outbuf),
2007                            talloc_get_size(req->chain_outbuf) - 4);
2008
2009                 if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2010                                   true, req->seqnum+1,
2011                                   IS_CONN_ENCRYPTED(req->conn)
2012                                   ||req->encrypted,
2013                                   &req->pcd)) {
2014                         exit_server_cleanly("chain_reply: srv_send_smb "
2015                                             "failed.");
2016                 }
2017                 TALLOC_FREE(req->chain_outbuf);
2018                 req->done = true;
2019                 return;
2020         }
2021
2022         /* add a new perfcounter for this element of chain */
2023         SMB_PERFCOUNT_ADD(&req->pcd);
2024         SMB_PERFCOUNT_SET_OP(&req->pcd, chain_cmd);
2025         SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, smblen);
2026
2027         /*
2028          * Check if the client tries to fool us. The request so far uses the
2029          * space to the end of the byte buffer in the request just
2030          * processed. The chain_offset can't point into that area. If that was
2031          * the case, we could end up with an endless processing of the chain,
2032          * we would always handle the same request.
2033          */
2034
2035         already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
2036         if (chain_offset < already_used) {
2037                 goto error;
2038         }
2039
2040         /*
2041          * Next check: Make sure the chain offset does not point beyond the
2042          * overall smb request length.
2043          */
2044
2045         length_needed = chain_offset+1; /* wct */
2046         if (length_needed > smblen) {
2047                 goto error;
2048         }
2049
2050         /*
2051          * Now comes the pointer magic. Goal here is to set up req->vwv and
2052          * req->buf correctly again to be able to call the subsequent
2053          * switch_message(). The chain offset (the former vwv[1]) points at
2054          * the new wct field.
2055          */
2056
2057         wct = CVAL(smb_base(req->inbuf), chain_offset);
2058
2059         /*
2060          * Next consistency check: Make the new vwv array fits in the overall
2061          * smb request.
2062          */
2063
2064         length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2065         if (length_needed > smblen) {
2066                 goto error;
2067         }
2068         vwv = (const uint16_t *)(smb_base(req->inbuf) + chain_offset + 1);
2069
2070         /*
2071          * Now grab the new byte buffer....
2072          */
2073
2074         buflen = SVAL(vwv+wct, 0);
2075
2076         /*
2077          * .. and check that it fits.
2078          */
2079
2080         length_needed += buflen;
2081         if (length_needed > smblen) {
2082                 goto error;
2083         }
2084         buf = (const uint8_t *)(vwv+wct+1);
2085
2086         req->cmd = chain_cmd;
2087         req->wct = wct;
2088         req->vwv = discard_const_p(uint16_t, vwv);
2089         req->buflen = buflen;
2090         req->buf = buf;
2091
2092         switch_message(chain_cmd, req, smblen);
2093
2094         if (req->outbuf == NULL) {
2095                 /*
2096                  * This happens if the chained command has suspended itself or
2097                  * if it has called srv_send_smb() itself.
2098                  */
2099                 return;
2100         }
2101
2102         /*
2103          * We end up here if the chained command was not itself chained or
2104          * suspended, but for example a close() command. We now need to splice
2105          * the chained commands' outbuf into the already built up chain_outbuf
2106          * and ship the result.
2107          */
2108         goto done;
2109
2110  error:
2111         /*
2112          * We end up here if there's any error in the chain syntax. Report a
2113          * DOS error, just like Windows does.
2114          */
2115         reply_force_doserror(req, ERRSRV, ERRerror);
2116         fixup_chain_error_packet(req);
2117
2118  done:
2119         /*
2120          * This scary statement intends to set the
2121          * FLAGS2_32_BIT_ERROR_CODES flg2 field in req->chain_outbuf
2122          * to the value req->outbuf carries
2123          */
2124         SSVAL(req->chain_outbuf, smb_flg2,
2125               (SVAL(req->chain_outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
2126               | (SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
2127
2128         /*
2129          * Transfer the error codes from the subrequest to the main one
2130          */
2131         SSVAL(req->chain_outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
2132         SSVAL(req->chain_outbuf, smb_err, SVAL(req->outbuf, smb_err));
2133
2134         if (!smb_splice_chain(&req->chain_outbuf,
2135                               CVAL(req->outbuf, smb_com),
2136                               CVAL(req->outbuf, smb_wct),
2137                               (uint16_t *)(req->outbuf + smb_vwv),
2138                               0, smb_buflen(req->outbuf),
2139                               (uint8_t *)smb_buf(req->outbuf))) {
2140                 exit_server_cleanly("chain_reply: smb_splice_chain failed\n");
2141         }
2142         TALLOC_FREE(req->outbuf);
2143
2144         smb_setlen((char *)(req->chain_outbuf),
2145                    talloc_get_size(req->chain_outbuf) - 4);
2146
2147         show_msg((char *)(req->chain_outbuf));
2148
2149         if (!srv_send_smb(req->sconn, (char *)req->chain_outbuf,
2150                           true, req->seqnum+1,
2151                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
2152                           &req->pcd)) {
2153                 exit_server_cleanly("chain_reply: srv_send_smb failed.");
2154         }
2155         TALLOC_FREE(req->chain_outbuf);
2156         req->done = true;
2157 }
2158
2159 /****************************************************************************
2160  Check if services need reloading.
2161 ****************************************************************************/
2162
2163 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2164 {
2165
2166         if (last_smb_conf_reload_time == 0) {
2167                 last_smb_conf_reload_time = t;
2168         }
2169
2170         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2171                 reload_services(sconn->msg_ctx, sconn->sock, True);
2172                 last_smb_conf_reload_time = t;
2173         }
2174 }
2175
2176 static bool fd_is_readable(int fd)
2177 {
2178         int ret, revents;
2179
2180         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2181
2182         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2183
2184 }
2185
2186 static void smbd_server_connection_write_handler(
2187         struct smbd_server_connection *sconn)
2188 {
2189         /* TODO: make write nonblocking */
2190 }
2191
2192 static void smbd_server_connection_read_handler(
2193         struct smbd_server_connection *sconn, int fd)
2194 {
2195         uint8_t *inbuf = NULL;
2196         size_t inbuf_len = 0;
2197         size_t unread_bytes = 0;
2198         bool encrypted = false;
2199         TALLOC_CTX *mem_ctx = talloc_tos();
2200         NTSTATUS status;
2201         uint32_t seqnum;
2202
2203         bool from_client = (sconn->sock == fd);
2204
2205         if (from_client) {
2206                 smbd_lock_socket(sconn);
2207
2208                 if (lp_async_smb_echo_handler()) {
2209
2210                         if (fd_is_readable(sconn->smb1.echo_handler.trusted_fd)) {
2211                                 /*
2212                                  * This is the super-ugly hack to
2213                                  * prefer the packets forwarded by the
2214                                  * echo handler over the ones by the
2215                                  * client directly
2216                                  */
2217                                 fd = sconn->smb1.echo_handler.trusted_fd;
2218                         } else if (!fd_is_readable(fd)) {
2219                                 DEBUG(10,("the echo listener was faster\n"));
2220                                 smbd_unlock_socket(sconn);
2221                                 return;
2222                         }
2223                 }
2224
2225                 /* TODO: make this completely nonblocking */
2226                 status = receive_smb_talloc(mem_ctx, sconn, fd,
2227                                             (char **)(void *)&inbuf,
2228                                             0, /* timeout */
2229                                             &unread_bytes,
2230                                             &encrypted,
2231                                             &inbuf_len, &seqnum,
2232                                             false /* trusted channel */);
2233                 smbd_unlock_socket(sconn);
2234         } else {
2235                 /* TODO: make this completely nonblocking */
2236                 status = receive_smb_talloc(mem_ctx, sconn, fd,
2237                                             (char **)(void *)&inbuf,
2238                                             0, /* timeout */
2239                                             &unread_bytes,
2240                                             &encrypted,
2241                                             &inbuf_len, &seqnum,
2242                                             true /* trusted channel */);
2243         }
2244
2245         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2246                 goto process;
2247         }
2248         if (NT_STATUS_IS_ERR(status)) {
2249                 exit_server_cleanly("failed to receive smb request");
2250         }
2251         if (!NT_STATUS_IS_OK(status)) {
2252                 return;
2253         }
2254
2255 process:
2256         process_smb(sconn, inbuf, inbuf_len, unread_bytes,
2257                     seqnum, encrypted, NULL);
2258 }
2259
2260 static void smbd_server_connection_handler(struct event_context *ev,
2261                                            struct fd_event *fde,
2262                                            uint16_t flags,
2263                                            void *private_data)
2264 {
2265         struct smbd_server_connection *conn = talloc_get_type(private_data,
2266                                               struct smbd_server_connection);
2267
2268         if (flags & EVENT_FD_WRITE) {
2269                 smbd_server_connection_write_handler(conn);
2270                 return;
2271         }
2272         if (flags & EVENT_FD_READ) {
2273                 smbd_server_connection_read_handler(conn, conn->sock);
2274                 return;
2275         }
2276 }
2277
2278 static void smbd_server_echo_handler(struct event_context *ev,
2279                                      struct fd_event *fde,
2280                                      uint16_t flags,
2281                                      void *private_data)
2282 {
2283         struct smbd_server_connection *conn = talloc_get_type(private_data,
2284                                               struct smbd_server_connection);
2285
2286         if (flags & EVENT_FD_WRITE) {
2287                 smbd_server_connection_write_handler(conn);
2288                 return;
2289         }
2290         if (flags & EVENT_FD_READ) {
2291                 smbd_server_connection_read_handler(
2292                         conn, conn->smb1.echo_handler.trusted_fd);
2293                 return;
2294         }
2295 }
2296
2297 #ifdef CLUSTER_SUPPORT
2298 /****************************************************************************
2299 received when we should release a specific IP
2300 ****************************************************************************/
2301 static void release_ip(const char *ip, void *priv)
2302 {
2303         const char *addr = (const char *)priv;
2304         const char *p = addr;
2305
2306         if (strncmp("::ffff:", addr, 7) == 0) {
2307                 p = addr + 7;
2308         }
2309
2310         DEBUG(10, ("Got release IP message for %s, "
2311                    "our address is %s\n", ip, p));
2312
2313         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2314                 /* we can't afford to do a clean exit - that involves
2315                    database writes, which would potentially mean we
2316                    are still running after the failover has finished -
2317                    we have to get rid of this process ID straight
2318                    away */
2319                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2320                         ip));
2321                 /* note we must exit with non-zero status so the unclean handler gets
2322                    called in the parent, so that the brl database is tickled */
2323                 _exit(1);
2324         }
2325 }
2326
2327 static int client_get_tcp_info(int sock, struct sockaddr_storage *server,
2328                                struct sockaddr_storage *client)
2329 {
2330         socklen_t length;
2331         length = sizeof(*server);
2332         if (getsockname(sock, (struct sockaddr *)server, &length) != 0) {
2333                 return -1;
2334         }
2335         length = sizeof(*client);
2336         if (getpeername(sock, (struct sockaddr *)client, &length) != 0) {
2337                 return -1;
2338         }
2339         return 0;
2340 }
2341 #endif
2342
2343 /*
2344  * Send keepalive packets to our client
2345  */
2346 static bool keepalive_fn(const struct timeval *now, void *private_data)
2347 {
2348         struct smbd_server_connection *sconn = smbd_server_conn;
2349         bool ret;
2350
2351         if (sconn->using_smb2) {
2352                 /* Don't do keepalives on an SMB2 connection. */
2353                 return false;
2354         }
2355
2356         smbd_lock_socket(smbd_server_conn);
2357         ret = send_keepalive(sconn->sock);
2358         smbd_unlock_socket(smbd_server_conn);
2359
2360         if (!ret) {
2361                 char addr[INET6_ADDRSTRLEN];
2362                 /*
2363                  * Try and give an error message saying what
2364                  * client failed.
2365                  */
2366                 DEBUG(0, ("send_keepalive failed for client %s. "
2367                           "Error %s - exiting\n",
2368                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
2369                           strerror(errno)));
2370                 return False;
2371         }
2372         return True;
2373 }
2374
2375 /*
2376  * Do the recurring check if we're idle
2377  */
2378 static bool deadtime_fn(const struct timeval *now, void *private_data)
2379 {
2380         struct smbd_server_connection *sconn =
2381                 (struct smbd_server_connection *)private_data;
2382
2383         if ((conn_num_open(sconn) == 0)
2384             || (conn_idle_all(sconn, now->tv_sec))) {
2385                 DEBUG( 2, ( "Closing idle connection\n" ) );
2386                 messaging_send(sconn->msg_ctx,
2387                                messaging_server_id(sconn->msg_ctx),
2388                                MSG_SHUTDOWN, &data_blob_null);
2389                 return False;
2390         }
2391
2392         return True;
2393 }
2394
2395 /*
2396  * Do the recurring log file and smb.conf reload checks.
2397  */
2398
2399 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2400 {
2401         struct smbd_server_connection *sconn = talloc_get_type_abort(
2402                 private_data, struct smbd_server_connection);
2403
2404         DEBUG(5, ("housekeeping\n"));
2405
2406         change_to_root_user();
2407
2408         /* update printer queue caches if necessary */
2409         update_monitored_printq_cache(sconn->msg_ctx);
2410
2411         /* check if we need to reload services */
2412         check_reload(sconn, time_mono(NULL));
2413
2414         /* Change machine password if neccessary. */
2415         attempt_machine_password_change();
2416
2417         /*
2418          * Force a log file check.
2419          */
2420         force_check_log_size();
2421         check_log_size();
2422         return true;
2423 }
2424
2425 static int create_unlink_tmp(const char *dir)
2426 {
2427         char *fname;
2428         int fd;
2429
2430         fname = talloc_asprintf(talloc_tos(), "%s/listenerlock_XXXXXX", dir);
2431         if (fname == NULL) {
2432                 errno = ENOMEM;
2433                 return -1;
2434         }
2435         fd = mkstemp(fname);
2436         if (fd == -1) {
2437                 TALLOC_FREE(fname);
2438                 return -1;
2439         }
2440         if (unlink(fname) == -1) {
2441                 int sys_errno = errno;
2442                 close(fd);
2443                 TALLOC_FREE(fname);
2444                 errno = sys_errno;
2445                 return -1;
2446         }
2447         TALLOC_FREE(fname);
2448         return fd;
2449 }
2450
2451 /*
2452  * Read an smb packet in the echo handler child, giving the parent
2453  * smbd one second to react once the socket becomes readable.
2454  */
2455
2456 struct smbd_echo_read_state {
2457         struct tevent_context *ev;
2458         struct smbd_server_connection *sconn;
2459
2460         char *buf;
2461         size_t buflen;
2462         uint32_t seqnum;
2463 };
2464
2465 static void smbd_echo_read_readable(struct tevent_req *subreq);
2466 static void smbd_echo_read_waited(struct tevent_req *subreq);
2467
2468 static struct tevent_req *smbd_echo_read_send(
2469         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2470         struct smbd_server_connection *sconn)
2471 {
2472         struct tevent_req *req, *subreq;
2473         struct smbd_echo_read_state *state;
2474
2475         req = tevent_req_create(mem_ctx, &state,
2476                                 struct smbd_echo_read_state);
2477         if (req == NULL) {
2478                 return NULL;
2479         }
2480         state->ev = ev;
2481         state->sconn = sconn;
2482
2483         subreq = wait_for_read_send(state, ev, sconn->sock);
2484         if (tevent_req_nomem(subreq, req)) {
2485                 return tevent_req_post(req, ev);
2486         }
2487         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2488         return req;
2489 }
2490
2491 static void smbd_echo_read_readable(struct tevent_req *subreq)
2492 {
2493         struct tevent_req *req = tevent_req_callback_data(
2494                 subreq, struct tevent_req);
2495         struct smbd_echo_read_state *state = tevent_req_data(
2496                 req, struct smbd_echo_read_state);
2497         bool ok;
2498         int err;
2499
2500         ok = wait_for_read_recv(subreq, &err);
2501         TALLOC_FREE(subreq);
2502         if (!ok) {
2503                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2504                 return;
2505         }
2506
2507         /*
2508          * Give the parent smbd one second to step in
2509          */
2510
2511         subreq = tevent_wakeup_send(
2512                 state, state->ev, timeval_current_ofs(1, 0));
2513         if (tevent_req_nomem(subreq, req)) {
2514                 return;
2515         }
2516         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2517 }
2518
2519 static void smbd_echo_read_waited(struct tevent_req *subreq)
2520 {
2521         struct tevent_req *req = tevent_req_callback_data(
2522                 subreq, struct tevent_req);
2523         struct smbd_echo_read_state *state = tevent_req_data(
2524                 req, struct smbd_echo_read_state);
2525         struct smbd_server_connection *sconn = state->sconn;
2526         bool ok;
2527         NTSTATUS status;
2528         size_t unread = 0;
2529         bool encrypted;
2530
2531         ok = tevent_wakeup_recv(subreq);
2532         TALLOC_FREE(subreq);
2533         if (!ok) {
2534                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2535                 return;
2536         }
2537
2538         ok = smbd_lock_socket_internal(sconn);
2539         if (!ok) {
2540                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2541                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2542                 return;
2543         }
2544
2545         if (!fd_is_readable(sconn->sock)) {
2546                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2547                           (int)sys_getpid()));
2548
2549                 ok = smbd_unlock_socket_internal(sconn);
2550                 if (!ok) {
2551                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2552                         DEBUG(1, ("%s: failed to unlock socket\n",
2553                                 __location__));
2554                         return;
2555                 }
2556
2557                 subreq = wait_for_read_send(state, state->ev, sconn->sock);
2558                 if (tevent_req_nomem(subreq, req)) {
2559                         return;
2560                 }
2561                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2562                 return;
2563         }
2564
2565         status = receive_smb_talloc(state, sconn, sconn->sock, &state->buf,
2566                                     0 /* timeout */,
2567                                     &unread,
2568                                     &encrypted,
2569                                     &state->buflen,
2570                                     &state->seqnum,
2571                                     false /* trusted_channel*/);
2572
2573         if (tevent_req_nterror(req, status)) {
2574                 tevent_req_nterror(req, status);
2575                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2576                           (int)sys_getpid(), nt_errstr(status)));
2577                 return;
2578         }
2579
2580         ok = smbd_unlock_socket_internal(sconn);
2581         if (!ok) {
2582                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2583                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2584                 return;
2585         }
2586         tevent_req_done(req);
2587 }
2588
2589 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2590                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2591 {
2592         struct smbd_echo_read_state *state = tevent_req_data(
2593                 req, struct smbd_echo_read_state);
2594         NTSTATUS status;
2595
2596         if (tevent_req_is_nterror(req, &status)) {
2597                 return status;
2598         }
2599         *pbuf = talloc_move(mem_ctx, &state->buf);
2600         *pbuflen = state->buflen;
2601         *pseqnum = state->seqnum;
2602         return NT_STATUS_OK;
2603 }
2604
2605 struct smbd_echo_state {
2606         struct tevent_context *ev;
2607         struct iovec *pending;
2608         struct smbd_server_connection *sconn;
2609         int parent_pipe;
2610
2611         struct tevent_fd *parent_fde;
2612
2613         struct tevent_req *write_req;
2614 };
2615
2616 static void smbd_echo_writer_done(struct tevent_req *req);
2617
2618 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2619 {
2620         int num_pending;
2621
2622         if (state->write_req != NULL) {
2623                 return;
2624         }
2625
2626         num_pending = talloc_array_length(state->pending);
2627         if (num_pending == 0) {
2628                 return;
2629         }
2630
2631         state->write_req = writev_send(state, state->ev, NULL,
2632                                        state->parent_pipe, false,
2633                                        state->pending, num_pending);
2634         if (state->write_req == NULL) {
2635                 DEBUG(1, ("writev_send failed\n"));
2636                 exit(1);
2637         }
2638
2639         talloc_steal(state->write_req, state->pending);
2640         state->pending = NULL;
2641
2642         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
2643                                 state);
2644 }
2645
2646 static void smbd_echo_writer_done(struct tevent_req *req)
2647 {
2648         struct smbd_echo_state *state = tevent_req_callback_data(
2649                 req, struct smbd_echo_state);
2650         ssize_t written;
2651         int err;
2652
2653         written = writev_recv(req, &err);
2654         TALLOC_FREE(req);
2655         state->write_req = NULL;
2656         if (written == -1) {
2657                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
2658                 exit(1);
2659         }
2660         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)sys_getpid()));
2661         smbd_echo_activate_writer(state);
2662 }
2663
2664 static bool smbd_echo_reply(uint8_t *inbuf, size_t inbuf_len,
2665                             uint32_t seqnum)
2666 {
2667         struct smb_request req;
2668         uint16_t num_replies;
2669         size_t out_len;
2670         char *outbuf;
2671         bool ok;
2672
2673         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
2674                 DEBUG(10, ("Got netbios keepalive\n"));
2675                 /*
2676                  * Just swallow it
2677                  */
2678                 return true;
2679         }
2680
2681         if (inbuf_len < smb_size) {
2682                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
2683                 return false;
2684         }
2685         if (!valid_smb_header(inbuf)) {
2686                 DEBUG(10, ("Got invalid SMB header\n"));
2687                 return false;
2688         }
2689
2690         if (!init_smb_request(&req, smbd_server_conn, inbuf, 0, false,
2691                               seqnum)) {
2692                 return false;
2693         }
2694         req.inbuf = inbuf;
2695
2696         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
2697                    smb_messages[req.cmd].name
2698                    ? smb_messages[req.cmd].name : "unknown"));
2699
2700         if (req.cmd != SMBecho) {
2701                 return false;
2702         }
2703         if (req.wct < 1) {
2704                 return false;
2705         }
2706
2707         num_replies = SVAL(req.vwv+0, 0);
2708         if (num_replies != 1) {
2709                 /* Not a Windows "Hey, you're still there?" request */
2710                 return false;
2711         }
2712
2713         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
2714                            1, req.buflen)) {
2715                 DEBUG(10, ("create_outbuf failed\n"));
2716                 return false;
2717         }
2718         req.outbuf = (uint8_t *)outbuf;
2719
2720         SSVAL(req.outbuf, smb_vwv0, num_replies);
2721
2722         if (req.buflen > 0) {
2723                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
2724         }
2725
2726         out_len = smb_len(req.outbuf) + 4;
2727
2728         ok = srv_send_smb(req.sconn,
2729                           (char *)outbuf,
2730                           true, seqnum+1,
2731                           false, &req.pcd);
2732         TALLOC_FREE(outbuf);
2733         if (!ok) {
2734                 exit(1);
2735         }
2736
2737         return true;
2738 }
2739
2740 static void smbd_echo_exit(struct tevent_context *ev,
2741                            struct tevent_fd *fde, uint16_t flags,
2742                            void *private_data)
2743 {
2744         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
2745         exit(0);
2746 }
2747
2748 static void smbd_echo_got_packet(struct tevent_req *req);
2749
2750 static void smbd_echo_loop(struct smbd_server_connection *sconn,
2751                            int parent_pipe)
2752 {
2753         struct smbd_echo_state *state;
2754         struct tevent_req *read_req;
2755
2756         state = talloc_zero(sconn, struct smbd_echo_state);
2757         if (state == NULL) {
2758                 DEBUG(1, ("talloc failed\n"));
2759                 return;
2760         }
2761         state->sconn = sconn;
2762         state->parent_pipe = parent_pipe;
2763         state->ev = s3_tevent_context_init(state);
2764         if (state->ev == NULL) {
2765                 DEBUG(1, ("tevent_context_init failed\n"));
2766                 TALLOC_FREE(state);
2767                 return;
2768         }
2769         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
2770                                         TEVENT_FD_READ, smbd_echo_exit,
2771                                         state);
2772         if (state->parent_fde == NULL) {
2773                 DEBUG(1, ("tevent_add_fd failed\n"));
2774                 TALLOC_FREE(state);
2775                 return;
2776         }
2777
2778         read_req = smbd_echo_read_send(state, state->ev, sconn);
2779         if (read_req == NULL) {
2780                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2781                 TALLOC_FREE(state);
2782                 return;
2783         }
2784         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
2785
2786         while (true) {
2787                 if (tevent_loop_once(state->ev) == -1) {
2788                         DEBUG(1, ("tevent_loop_once failed: %s\n",
2789                                   strerror(errno)));
2790                         break;
2791                 }
2792         }
2793         TALLOC_FREE(state);
2794 }
2795
2796 static void smbd_echo_got_packet(struct tevent_req *req)
2797 {
2798         struct smbd_echo_state *state = tevent_req_callback_data(
2799                 req, struct smbd_echo_state);
2800         NTSTATUS status;
2801         char *buf = NULL;
2802         size_t buflen = 0;
2803         uint32_t seqnum = 0;
2804         bool reply;
2805
2806         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
2807         TALLOC_FREE(req);
2808         if (!NT_STATUS_IS_OK(status)) {
2809                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
2810                           nt_errstr(status)));
2811                 exit(1);
2812         }
2813
2814         reply = smbd_echo_reply((uint8_t *)buf, buflen, seqnum);
2815         if (!reply) {
2816                 size_t num_pending;
2817                 struct iovec *tmp;
2818                 struct iovec *iov;
2819
2820                 num_pending = talloc_array_length(state->pending);
2821                 tmp = talloc_realloc(state, state->pending, struct iovec,
2822                                      num_pending+1);
2823                 if (tmp == NULL) {
2824                         DEBUG(1, ("talloc_realloc failed\n"));
2825                         exit(1);
2826                 }
2827                 state->pending = tmp;
2828
2829                 if (buflen >= smb_size) {
2830                         /*
2831                          * place the seqnum in the packet so that the main process
2832                          * can reply with signing
2833                          */
2834                         SIVAL(buf, smb_ss_field, seqnum);
2835                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
2836                 }
2837
2838                 iov = &state->pending[num_pending];
2839                 iov->iov_base = buf;
2840                 iov->iov_len = buflen;
2841
2842                 DEBUG(10,("echo_handler[%d]: forward to main\n",
2843                           (int)sys_getpid()));
2844                 smbd_echo_activate_writer(state);
2845         }
2846
2847         req = smbd_echo_read_send(state, state->ev, state->sconn);
2848         if (req == NULL) {
2849                 DEBUG(1, ("smbd_echo_read_send failed\n"));
2850                 exit(1);
2851         }
2852         tevent_req_set_callback(req, smbd_echo_got_packet, state);
2853 }
2854
2855
2856 /*
2857  * Handle SMBecho requests in a forked child process
2858  */
2859 bool fork_echo_handler(struct smbd_server_connection *sconn)
2860 {
2861         int listener_pipe[2];
2862         int res;
2863         pid_t child;
2864
2865         res = pipe(listener_pipe);
2866         if (res == -1) {
2867                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
2868                 return false;
2869         }
2870         sconn->smb1.echo_handler.socket_lock_fd = create_unlink_tmp(lp_lockdir());
2871         if (sconn->smb1.echo_handler.socket_lock_fd == -1) {
2872                 DEBUG(1, ("Could not create lock fd: %s\n", strerror(errno)));
2873                 goto fail;
2874         }
2875
2876         child = sys_fork();
2877         if (child == 0) {
2878                 NTSTATUS status;
2879
2880                 close(listener_pipe[0]);
2881                 set_blocking(listener_pipe[1], false);
2882
2883                 status = reinit_after_fork(sconn->msg_ctx,
2884                                            server_event_context(),
2885                                            procid_self(), false);
2886                 if (!NT_STATUS_IS_OK(status)) {
2887                         DEBUG(1, ("reinit_after_fork failed: %s\n",
2888                                   nt_errstr(status)));
2889                         exit(1);
2890                 }
2891                 smbd_echo_loop(sconn, listener_pipe[1]);
2892                 exit(0);
2893         }
2894         close(listener_pipe[1]);
2895         listener_pipe[1] = -1;
2896         sconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
2897
2898         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)sys_getpid(), child));
2899
2900         /*
2901          * Without smb signing this is the same as the normal smbd
2902          * listener. This needs to change once signing comes in.
2903          */
2904         sconn->smb1.echo_handler.trusted_fde = event_add_fd(server_event_context(),
2905                                         sconn,
2906                                         sconn->smb1.echo_handler.trusted_fd,
2907                                         EVENT_FD_READ,
2908                                         smbd_server_echo_handler,
2909                                         sconn);
2910         if (sconn->smb1.echo_handler.trusted_fde == NULL) {
2911                 DEBUG(1, ("event_add_fd failed\n"));
2912                 goto fail;
2913         }
2914
2915         return true;
2916
2917 fail:
2918         if (listener_pipe[0] != -1) {
2919                 close(listener_pipe[0]);
2920         }
2921         if (listener_pipe[1] != -1) {
2922                 close(listener_pipe[1]);
2923         }
2924         sconn->smb1.echo_handler.trusted_fd = -1;
2925         if (sconn->smb1.echo_handler.socket_lock_fd != -1) {
2926                 close(sconn->smb1.echo_handler.socket_lock_fd);
2927         }
2928         sconn->smb1.echo_handler.trusted_fd = -1;
2929         sconn->smb1.echo_handler.socket_lock_fd = -1;
2930         return false;
2931 }
2932
2933 #if CLUSTER_SUPPORT
2934
2935 static NTSTATUS smbd_register_ips(struct smbd_server_connection *sconn,
2936                                   struct sockaddr_storage *srv,
2937                                   struct sockaddr_storage *clnt)
2938 {
2939         struct ctdbd_connection *cconn;
2940         char tmp_addr[INET6_ADDRSTRLEN];
2941         char *addr;
2942
2943         cconn = messaging_ctdbd_connection();
2944         if (cconn == NULL) {
2945                 return NT_STATUS_NO_MEMORY;
2946         }
2947
2948         client_socket_addr(sconn->sock, tmp_addr, sizeof(tmp_addr));
2949         addr = talloc_strdup(cconn, tmp_addr);
2950         if (addr == NULL) {
2951                 return NT_STATUS_NO_MEMORY;
2952         }
2953         return ctdbd_register_ips(cconn, srv, clnt, release_ip, addr);
2954 }
2955
2956 #endif
2957
2958 /****************************************************************************
2959  Process commands from the client
2960 ****************************************************************************/
2961
2962 void smbd_process(struct tevent_context *ev_ctx,
2963                   struct smbd_server_connection *sconn)
2964 {
2965         TALLOC_CTX *frame = talloc_stackframe();
2966         struct sockaddr_storage ss;
2967         struct sockaddr *sa = NULL;
2968         socklen_t sa_socklen;
2969         struct tsocket_address *local_address = NULL;
2970         struct tsocket_address *remote_address = NULL;
2971         const char *remaddr = NULL;
2972         char *rhost;
2973         int ret;
2974
2975         if (lp_maxprotocol() >= PROTOCOL_SMB2_02) {
2976                 /*
2977                  * We're not making the decision here,
2978                  * we're just allowing the client
2979                  * to decide between SMB1 and SMB2
2980                  * with the first negprot
2981                  * packet.
2982                  */
2983                 sconn->using_smb2 = true;
2984         }
2985
2986         /* Ensure child is set to blocking mode */
2987         set_blocking(sconn->sock,True);
2988
2989         set_socket_options(sconn->sock, "SO_KEEPALIVE");
2990         set_socket_options(sconn->sock, lp_socket_options());
2991
2992         sa = (struct sockaddr *)(void *)&ss;
2993         sa_socklen = sizeof(ss);
2994         ret = getpeername(sconn->sock, sa, &sa_socklen);
2995         if (ret != 0) {
2996                 int level = (errno == ENOTCONN)?2:0;
2997                 DEBUG(level,("getpeername() failed - %s\n", strerror(errno)));
2998                 exit_server_cleanly("getpeername() failed.\n");
2999         }
3000         ret = tsocket_address_bsd_from_sockaddr(sconn,
3001                                                 sa, sa_socklen,
3002                                                 &remote_address);
3003         if (ret != 0) {
3004                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3005                         __location__, strerror(errno)));
3006                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3007         }
3008
3009         sa = (struct sockaddr *)(void *)&ss;
3010         sa_socklen = sizeof(ss);
3011         ret = getsockname(sconn->sock, sa, &sa_socklen);
3012         if (ret != 0) {
3013                 int level = (errno == ENOTCONN)?2:0;
3014                 DEBUG(level,("getsockname() failed - %s\n", strerror(errno)));
3015                 exit_server_cleanly("getsockname() failed.\n");
3016         }
3017         ret = tsocket_address_bsd_from_sockaddr(sconn,
3018                                                 sa, sa_socklen,
3019                                                 &local_address);
3020         if (ret != 0) {
3021                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3022                         __location__, strerror(errno)));
3023                 exit_server_cleanly("tsocket_address_bsd_from_sockaddr remote failed.\n");
3024         }
3025
3026         sconn->local_address = local_address;
3027         sconn->remote_address = remote_address;
3028
3029         if (tsocket_address_is_inet(remote_address, "ip")) {
3030                 remaddr = tsocket_address_inet_addr_string(
3031                                 sconn->remote_address,
3032                                 talloc_tos());
3033                 if (remaddr == NULL) {
3034                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3035                                  __location__, strerror(errno)));
3036                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3037                 }
3038         } else {
3039                 remaddr = "0.0.0.0";
3040         }
3041
3042         /* this is needed so that we get decent entries
3043            in smbstatus for port 445 connects */
3044         set_remote_machine_name(remaddr, false);
3045         reload_services(sconn->msg_ctx, sconn->sock, true);
3046
3047         /*
3048          * Before the first packet, check the global hosts allow/ hosts deny
3049          * parameters before doing any parsing of packets passed to us by the
3050          * client. This prevents attacks on our parsing code from hosts not in
3051          * the hosts allow list.
3052          */
3053
3054         ret = get_remote_hostname(remote_address,
3055                                   &rhost,
3056                                   talloc_tos());
3057         if (ret < 0) {
3058                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3059                         __location__, strerror(errno)));
3060                 exit_server_cleanly("get_remote_hostname failed.\n");
3061         }
3062         if (strequal(rhost, "UNKNOWN")) {
3063                 rhost = talloc_strdup(talloc_tos(), remaddr);
3064         }
3065         sconn->remote_hostname = talloc_move(sconn, &rhost);
3066
3067         if (!allow_access(lp_hostsdeny(-1), lp_hostsallow(-1),
3068                           sconn->remote_hostname,
3069                           remaddr)) {
3070                 /*
3071                  * send a negative session response "not listening on calling
3072                  * name"
3073                  */
3074                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3075                 DEBUG( 1, ("Connection denied from %s to %s\n",
3076                            tsocket_address_string(remote_address, talloc_tos()),
3077                            tsocket_address_string(local_address, talloc_tos())));
3078                 (void)srv_send_smb(sconn,(char *)buf, false,
3079                                    0, false, NULL);
3080                 exit_server_cleanly("connection denied");
3081         }
3082
3083         DEBUG(10, ("Connection allowed from %s to %s\n",
3084                    tsocket_address_string(remote_address, talloc_tos()),
3085                    tsocket_address_string(local_address, talloc_tos())));
3086
3087         init_modules();
3088
3089         smb_perfcount_init();
3090
3091         if (!init_account_policy()) {
3092                 exit_server("Could not open account policy tdb.\n");
3093         }
3094
3095         if (*lp_rootdir()) {
3096                 if (chroot(lp_rootdir()) != 0) {
3097                         DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
3098                         exit_server("Failed to chroot()");
3099                 }
3100                 if (chdir("/") == -1) {
3101                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
3102                         exit_server("Failed to chroot()");
3103                 }
3104                 DEBUG(0,("Changed root to %s\n", lp_rootdir()));
3105         }
3106
3107         if (!srv_init_signing(sconn)) {
3108                 exit_server("Failed to init smb_signing");
3109         }
3110
3111         /* Setup oplocks */
3112         if (!init_oplocks(sconn->msg_ctx))
3113                 exit_server("Failed to init oplocks");
3114
3115         /* register our message handlers */
3116         messaging_register(sconn->msg_ctx, NULL,
3117                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3118         messaging_register(sconn->msg_ctx, NULL,
3119                            MSG_SMB_CLOSE_FILE, msg_close_file);
3120
3121         /*
3122          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3123          * MSGs to all child processes
3124          */
3125         messaging_deregister(sconn->msg_ctx,
3126                              MSG_DEBUG, NULL);
3127         messaging_register(sconn->msg_ctx, NULL,
3128                            MSG_DEBUG, debug_message);
3129
3130         if ((lp_keepalive() != 0)
3131             && !(event_add_idle(ev_ctx, NULL,
3132                                 timeval_set(lp_keepalive(), 0),
3133                                 "keepalive", keepalive_fn,
3134                                 NULL))) {
3135                 DEBUG(0, ("Could not add keepalive event\n"));
3136                 exit(1);
3137         }
3138
3139         if (!(event_add_idle(ev_ctx, NULL,
3140                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3141                              "deadtime", deadtime_fn, sconn))) {
3142                 DEBUG(0, ("Could not add deadtime event\n"));
3143                 exit(1);
3144         }
3145
3146         if (!(event_add_idle(ev_ctx, NULL,
3147                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3148                              "housekeeping", housekeeping_fn, sconn))) {
3149                 DEBUG(0, ("Could not add housekeeping event\n"));
3150                 exit(1);
3151         }
3152
3153 #ifdef CLUSTER_SUPPORT
3154
3155         if (lp_clustering()) {
3156                 /*
3157                  * We need to tell ctdb about our client's TCP
3158                  * connection, so that for failover ctdbd can send
3159                  * tickle acks, triggering a reconnection by the
3160                  * client.
3161                  */
3162
3163                 struct sockaddr_storage srv, clnt;
3164
3165                 if (client_get_tcp_info(sconn->sock, &srv, &clnt) == 0) {
3166                         NTSTATUS status;
3167                         status = smbd_register_ips(sconn, &srv, &clnt);
3168                         if (!NT_STATUS_IS_OK(status)) {
3169                                 DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3170                                           nt_errstr(status)));
3171                         }
3172                 } else
3173                 {
3174                         DEBUG(0,("Unable to get tcp info for "
3175                                  "CTDB_CONTROL_TCP_CLIENT: %s\n",
3176                                  strerror(errno)));
3177                 }
3178         }
3179
3180 #endif
3181
3182         sconn->nbt.got_session = false;
3183
3184         sconn->smb1.negprot.max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
3185
3186         sconn->smb1.sessions.done_sesssetup = false;
3187         sconn->smb1.sessions.max_send = BUFFER_SIZE;
3188         sconn->smb1.sessions.last_session_tag = UID_FIELD_INVALID;
3189         /* users from session setup */
3190         sconn->smb1.sessions.session_userlist = NULL;
3191         /* workgroup from session setup. */
3192         sconn->smb1.sessions.session_workgroup = NULL;
3193         /* this holds info on user ids that are already validated for this VC */
3194         sconn->smb1.sessions.validated_users = NULL;
3195         sconn->smb1.sessions.next_vuid = VUID_OFFSET;
3196         sconn->smb1.sessions.num_validated_vuids = 0;
3197
3198         conn_init(sconn);
3199         if (!init_dptrs(sconn)) {
3200                 exit_server("init_dptrs() failed");
3201         }
3202
3203         sconn->smb1.fde = event_add_fd(ev_ctx,
3204                                                   sconn,
3205                                                   sconn->sock,
3206                                                   EVENT_FD_READ,
3207                                                   smbd_server_connection_handler,
3208                                                   sconn);
3209         if (!sconn->smb1.fde) {
3210                 exit_server("failed to create smbd_server_connection fde");
3211         }
3212
3213         TALLOC_FREE(frame);
3214
3215         while (True) {
3216                 NTSTATUS status;
3217
3218                 frame = talloc_stackframe_pool(8192);
3219
3220                 errno = 0;
3221
3222                 status = smbd_server_connection_loop_once(ev_ctx, sconn);
3223                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY) &&
3224                     !NT_STATUS_IS_OK(status)) {
3225                         DEBUG(3, ("smbd_server_connection_loop_once failed: %s,"
3226                                   " exiting\n", nt_errstr(status)));
3227                         break;
3228                 }
3229
3230                 TALLOC_FREE(frame);
3231         }
3232
3233         exit_server_cleanly(NULL);
3234 }
3235
3236 bool req_is_in_chain(struct smb_request *req)
3237 {
3238         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
3239                 /*
3240                  * We're right now handling a subsequent request, so we must
3241                  * be in a chain
3242                  */
3243                 return true;
3244         }
3245
3246         if (!is_andx_req(req->cmd)) {
3247                 return false;
3248         }
3249
3250         if (req->wct < 2) {
3251                 /*
3252                  * Okay, an illegal request, but definitely not chained :-)
3253                  */
3254                 return false;
3255         }
3256
3257         return (CVAL(req->vwv+0, 0) != 0xFF);
3258 }