source/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern int smb_echo_count;
  24
  25 /*
  26  * Size of data we can send to client. Set
  27  *  by the client for all protocols above CORE.
  28  *  Set by us for CORE protocol.
  29  */
  30 int max_send = BUFFER_SIZE;
  31 /*
  32  * Size of the data we can receive. Set by us.
  33  * Can be modified by the max xmit parameter.
  34  */
  35 int max_recv = BUFFER_SIZE;
  36
  37 SIG_ATOMIC_T reload_after_sighup = 0;
  38 SIG_ATOMIC_T got_sig_term = 0;
  39 extern bool global_machine_password_needs_changing;
  40 extern int max_send;
  41
  42 /* Accessor function for smb_read_error for smbd functions. */
  43
  44 /****************************************************************************
  45  Send an smb to a fd.
  46 ****************************************************************************/
  47
  48 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  49 {
  50         size_t len;
  51         size_t nwritten=0;
  52         ssize_t ret;
  53         char *buf_out = buffer;
  54
  55         /* Sign the outgoing packet if required. */
  56         srv_calculate_sign_mac(buf_out);
  57
  58         if (do_encrypt) {
  59                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  60                 if (!NT_STATUS_IS_OK(status)) {
  61                         DEBUG(0, ("send_smb: SMB encryption failed "
  62                                 "on outgoing packet! Error %s\n",
  63                                 nt_errstr(status) ));
  64                         return false;
  65                 }
  66         }
  67
  68         len = smb_len(buf_out) + 4;
  69
  70         while (nwritten < len) {
  71                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  72                 if (ret <= 0) {
  73                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  74                                 (int)len,(int)ret, strerror(errno) ));
  75                         srv_free_enc_buffer(buf_out);
  76                         return false;
  77                 }
  78                 nwritten += ret;
  79         }
  80
  81         srv_free_enc_buffer(buf_out);
  82         return true;
  83 }
  84
  85 /*******************************************************************
  86  Setup the word count and byte count for a smb message.
  87 ********************************************************************/
  88
  89 int srv_set_message(char *buf,
  90                         int num_words,
  91                         int num_bytes,
  92                         bool zero)
  93 {
  94         if (zero && (num_words || num_bytes)) {
  95                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
  96         }
  97         SCVAL(buf,smb_wct,num_words);
  98         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
  99         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 100         return (smb_size + num_words*2 + num_bytes);
 101 }
 102
 103 static bool valid_smb_header(const uint8_t *inbuf)
 104 {
 105         if (is_encrypted_packet(inbuf)) {
 106                 return true;
 107         }
 108         return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
 109 }
 110
 111 /* Socket functions for smbd packet processing. */
 112
 113 static bool valid_packet_size(size_t len)
 114 {
 115         /*
 116          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 117          * of header. Don't print the error if this fits.... JRA.
 118          */
 119
 120         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 121                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 122                                         (unsigned long)len));
 123                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
 124                         return false;
 125                 }
 126         }
 127         return true;
 128 }
 129
 130 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 131                                       unsigned int timeout, ssize_t len)
 132 {
 133         if (len <= 0) {
 134                 return NT_STATUS_OK;
 135         }
 136
 137         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
 138 }
 139
 140 /****************************************************************************
 141  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 142 ****************************************************************************/
 143
 144 /*
 145  * Unfortunately, earlier versions of smbclient/libsmbclient
 146  * don't send this "standard" writeX header. I've fixed this
 147  * for 3.2 but we'll use the old method with earlier versions.
 148  * Windows and CIFSFS at least use this standard size. Not
 149  * sure about MacOSX.
 150  */
 151
 152 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 153                                 (2*14) + /* word count (including bcc) */ \
 154                                 1 /* pad byte */)
 155
 156 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 157                                                     const char lenbuf[4],
 158                                                     int fd, char **buffer,
 159                                                     unsigned int timeout,
 160                                                     size_t *p_unread,
 161                                                     size_t *len_ret)
 162 {
 163         /* Size of a WRITEX call (+4 byte len). */
 164         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 165         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 166         ssize_t toread;
 167         NTSTATUS status;
 168
 169         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 170
 171         status = read_socket_with_timeout(
 172                 fd, writeX_header + 4,
 173                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 174                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 175                 timeout, NULL);
 176
 177         if (!NT_STATUS_IS_OK(status)) {
 178                 return status;
 179         }
 180
 181         /*
 182          * Ok - now try and see if this is a possible
 183          * valid writeX call.
 184          */
 185
 186         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 187                 /*
 188                  * If the data offset is beyond what
 189                  * we've read, drain the extra bytes.
 190                  */
 191                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 192                 ssize_t newlen;
 193
 194                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 195                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 196                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 197                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 198                                         " failed to drain pending bytes");
 199                         }
 200                 } else {
 201                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 202                 }
 203
 204                 /* Spoof down the length and null out the bcc. */
 205                 set_message_bcc(writeX_header, 0);
 206                 newlen = smb_len(writeX_header);
 207
 208                 /* Copy the header we've written. */
 209
 210                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 211                                 writeX_header,
 212                                 sizeof(writeX_header));
 213
 214                 if (*buffer == NULL) {
 215                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 216                                   (int)sizeof(writeX_header)));
 217                         return NT_STATUS_NO_MEMORY;
 218                 }
 219
 220                 /* Work out the remaining bytes. */
 221                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 222                 *len_ret = newlen + 4;
 223                 return NT_STATUS_OK;
 224         }
 225
 226         if (!valid_packet_size(len)) {
 227                 return NT_STATUS_INVALID_PARAMETER;
 228         }
 229
 230         /*
 231          * Not a valid writeX call. Just do the standard
 232          * talloc and return.
 233          */
 234
 235         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 236
 237         if (*buffer == NULL) {
 238                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 239                           (int)len+4));
 240                 return NT_STATUS_NO_MEMORY;
 241         }
 242
 243         /* Copy in what we already read. */
 244         memcpy(*buffer,
 245                 writeX_header,
 246                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 247         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 248
 249         if(toread > 0) {
 250                 status = read_packet_remainder(
 251                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 252                         timeout, toread);
 253
 254                 if (!NT_STATUS_IS_OK(status)) {
 255                         return status;
 256                 }
 257         }
 258
 259         *len_ret = len + 4;
 260         return NT_STATUS_OK;
 261 }
 262
 263 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 264                                        char **buffer, unsigned int timeout,
 265                                        size_t *p_unread, size_t *plen)
 266 {
 267         char lenbuf[4];
 268         size_t len;
 269         int min_recv_size = lp_min_receive_file_size();
 270         NTSTATUS status;
 271
 272         *p_unread = 0;
 273
 274         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 275         if (!NT_STATUS_IS_OK(status)) {
 276                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 277                 return status;
 278         }
 279
 280         if (CVAL(lenbuf,0) == 0 &&
 281                         min_recv_size &&
 282                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 283                         !srv_is_signing_active()) {
 284
 285                 status = receive_smb_raw_talloc_partial_read(
 286                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, &len);
 287
 288                 if (!NT_STATUS_IS_OK(status)) {
 289                         DEBUG(10, ("receive_smb_raw: %s\n",
 290                                    nt_errstr(status)));
 291                         return status;
 292                 }
 293         }
 294
 295         if (!valid_packet_size(len)) {
 296                 return NT_STATUS_INVALID_PARAMETER;
 297         }
 298
 299         /*
 300          * The +4 here can't wrap, we've checked the length above already.
 301          */
 302
 303         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 304
 305         if (*buffer == NULL) {
 306                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 307                           (int)len+4));
 308                 return NT_STATUS_NO_MEMORY;
 309         }
 310
 311         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 312
 313         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 314         if (!NT_STATUS_IS_OK(status)) {
 315                 return status;
 316         }
 317
 318         *plen = len + 4;
 319         return NT_STATUS_OK;
 320 }
 321
 322 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 323                                    char **buffer, unsigned int timeout,
 324                                    size_t *p_unread, bool *p_encrypted,
 325                                    size_t *p_len)
 326 {
 327         size_t len = 0;
 328         NTSTATUS status;
 329
 330         *p_encrypted = false;
 331
 332         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 333                                         p_unread, &len);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 return status;
 336         }
 337
 338         if (is_encrypted_packet((uint8_t *)*buffer)) {
 339                 status = srv_decrypt_buffer(*buffer);
 340                 if (!NT_STATUS_IS_OK(status)) {
 341                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 342                                 "incoming packet! Error %s\n",
 343                                 nt_errstr(status) ));
 344                         return status;
 345                 }
 346                 *p_encrypted = true;
 347         }
 348
 349         /* Check the incoming SMB signature. */
 350         if (!srv_check_sign_mac(*buffer, true)) {
 351                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 352                           "incoming packet!\n"));
 353                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 354         }
 355
 356         *p_len = len;
 357         return NT_STATUS_OK;
 358 }
 359
 360 /*
 361  * Initialize a struct smb_request from an inbuf
 362  */
 363
 364 void init_smb_request(struct smb_request *req,
 365                         const uint8 *inbuf,
 366                         size_t unread_bytes,
 367                         bool encrypted)
 368 {
 369         size_t req_size = smb_len(inbuf) + 4;
 370         /* Ensure we have at least smb_size bytes. */
 371         if (req_size < smb_size) {
 372                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 373                         (unsigned int)req_size ));
 374                 exit_server_cleanly("Invalid SMB request");
 375         }
 376         req->flags2 = SVAL(inbuf, smb_flg2);
 377         req->smbpid = SVAL(inbuf, smb_pid);
 378         req->mid    = SVAL(inbuf, smb_mid);
 379         req->vuid   = SVAL(inbuf, smb_uid);
 380         req->tid    = SVAL(inbuf, smb_tid);
 381         req->wct    = CVAL(inbuf, smb_wct);
 382         req->unread_bytes = unread_bytes;
 383         req->encrypted = encrypted;
 384         req->conn = conn_find(req->tid);
 385
 386         /* Ensure we have at least wct words and 2 bytes of bcc. */
 387         if (smb_size + req->wct*2 > req_size) {
 388                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 389                         (unsigned int)req->wct,
 390                         (unsigned int)req_size));
 391                 exit_server_cleanly("Invalid SMB request");
 392         }
 393         /* Ensure bcc is correct. */
 394         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 395                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 396                         "(wct = %u, size %u)\n",
 397                         (unsigned int)smb_buflen(inbuf),
 398                         (unsigned int)req->wct,
 399                         (unsigned int)req_size));
 400                 exit_server_cleanly("Invalid SMB request");
 401         }
 402         req->inbuf  = inbuf;
 403         req->outbuf = NULL;
 404 }
 405
 406 /****************************************************************************
 407  structure to hold a linked list of queued messages.
 408  for processing.
 409 ****************************************************************************/
 410
 411 static struct pending_message_list *deferred_open_queue;
 412
 413 /****************************************************************************
 414  Function to push a message onto the tail of a linked list of smb messages ready
 415  for processing.
 416 ****************************************************************************/
 417
 418 static bool push_queued_message(struct smb_request *req,
 419                                 struct timeval request_time,
 420                                 struct timeval end_time,
 421                                 char *private_data, size_t private_len)
 422 {
 423         int msg_len = smb_len(req->inbuf) + 4;
 424         struct pending_message_list *msg;
 425
 426         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 427
 428         if(msg == NULL) {
 429                 DEBUG(0,("push_message: malloc fail (1)\n"));
 430                 return False;
 431         }
 432
 433         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 434         if(msg->buf.data == NULL) {
 435                 DEBUG(0,("push_message: malloc fail (2)\n"));
 436                 TALLOC_FREE(msg);
 437                 return False;
 438         }
 439
 440         msg->request_time = request_time;
 441         msg->end_time = end_time;
 442         msg->encrypted = req->encrypted;
 443
 444         if (private_data) {
 445                 msg->private_data = data_blob_talloc(msg, private_data,
 446                                                      private_len);
 447                 if (msg->private_data.data == NULL) {
 448                         DEBUG(0,("push_message: malloc fail (3)\n"));
 449                         TALLOC_FREE(msg);
 450                         return False;
 451                 }
 452         }
 453
 454         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 455
 456         DEBUG(10,("push_message: pushed message length %u on "
 457                   "deferred_open_queue\n", (unsigned int)msg_len));
 458
 459         return True;
 460 }
 461
 462 /****************************************************************************
 463  Function to delete a sharing violation open message by mid.
 464 ****************************************************************************/
 465
 466 void remove_deferred_open_smb_message(uint16 mid)
 467 {
 468         struct pending_message_list *pml;
 469
 470         for (pml = deferred_open_queue; pml; pml = pml->next) {
 471                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 472                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 473                                   "deleting mid %u len %u\n",
 474                                   (unsigned int)mid,
 475                                   (unsigned int)pml->buf.length ));
 476                         DLIST_REMOVE(deferred_open_queue, pml);
 477                         TALLOC_FREE(pml);
 478                         return;
 479                 }
 480         }
 481 }
 482
 483 /****************************************************************************
 484  Move a sharing violation open retry message to the front of the list and
 485  schedule it for immediate processing.
 486 ****************************************************************************/
 487
 488 void schedule_deferred_open_smb_message(uint16 mid)
 489 {
 490         struct pending_message_list *pml;
 491         int i = 0;
 492
 493         for (pml = deferred_open_queue; pml; pml = pml->next) {
 494                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 495                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 496                         (unsigned int)msg_mid ));
 497                 if (mid == msg_mid) {
 498                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 499                                 mid ));
 500                         pml->end_time.tv_sec = 0;
 501                         pml->end_time.tv_usec = 0;
 502                         DLIST_PROMOTE(deferred_open_queue, pml);
 503                         return;
 504                 }
 505         }
 506
 507         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 508                 mid ));
 509 }
 510
 511 /****************************************************************************
 512  Return true if this mid is on the deferred queue.
 513 ****************************************************************************/
 514
 515 bool open_was_deferred(uint16 mid)
 516 {
 517         struct pending_message_list *pml;
 518
 519         for (pml = deferred_open_queue; pml; pml = pml->next) {
 520                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 521                         return True;
 522                 }
 523         }
 524         return False;
 525 }
 526
 527 /****************************************************************************
 528  Return the message queued by this mid.
 529 ****************************************************************************/
 530
 531 struct pending_message_list *get_open_deferred_message(uint16 mid)
 532 {
 533         struct pending_message_list *pml;
 534
 535         for (pml = deferred_open_queue; pml; pml = pml->next) {
 536                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 537                         return pml;
 538                 }
 539         }
 540         return NULL;
 541 }
 542
 543 /****************************************************************************
 544  Function to push a deferred open smb message onto a linked list of local smb
 545  messages ready for processing.
 546 ****************************************************************************/
 547
 548 bool push_deferred_smb_message(struct smb_request *req,
 549                                struct timeval request_time,
 550                                struct timeval timeout,
 551                                char *private_data, size_t priv_len)
 552 {
 553         struct timeval end_time;
 554
 555         if (req->unread_bytes) {
 556                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 557                         "unread_bytes = %u\n",
 558                         (unsigned int)req->unread_bytes ));
 559                 smb_panic("push_deferred_smb_message: "
 560                         "logic error unread_bytes != 0" );
 561         }
 562
 563         end_time = timeval_sum(&request_time, &timeout);
 564
 565         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 566                   "timeout time [%u.%06u]\n",
 567                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 568                   (unsigned int)end_time.tv_sec,
 569                   (unsigned int)end_time.tv_usec));
 570
 571         return push_queued_message(req, request_time, end_time,
 572                                    private_data, priv_len);
 573 }
 574
 575 struct idle_event {
 576         struct timed_event *te;
 577         struct timeval interval;
 578         char *name;
 579         bool (*handler)(const struct timeval *now, void *private_data);
 580         void *private_data;
 581 };
 582
 583 static void idle_event_handler(struct event_context *ctx,
 584                                struct timed_event *te,
 585                                const struct timeval *now,
 586                                void *private_data)
 587 {
 588         struct idle_event *event =
 589                 talloc_get_type_abort(private_data, struct idle_event);
 590
 591         TALLOC_FREE(event->te);
 592
 593         if (!event->handler(now, event->private_data)) {
 594                 /* Don't repeat, delete ourselves */
 595                 TALLOC_FREE(event);
 596                 return;
 597         }
 598
 599         event->te = event_add_timed(ctx, event,
 600                                     timeval_sum(now, &event->interval),
 601                                     event->name,
 602                                     idle_event_handler, event);
 603
 604         /* We can't do much but fail here. */
 605         SMB_ASSERT(event->te != NULL);
 606 }
 607
 608 struct idle_event *event_add_idle(struct event_context *event_ctx,
 609                                   TALLOC_CTX *mem_ctx,
 610                                   struct timeval interval,
 611                                   const char *name,
 612                                   bool (*handler)(const struct timeval *now,
 613                                                   void *private_data),
 614                                   void *private_data)
 615 {
 616         struct idle_event *result;
 617         struct timeval now = timeval_current();
 618
 619         result = TALLOC_P(mem_ctx, struct idle_event);
 620         if (result == NULL) {
 621                 DEBUG(0, ("talloc failed\n"));
 622                 return NULL;
 623         }
 624
 625         result->interval = interval;
 626         result->handler = handler;
 627         result->private_data = private_data;
 628
 629         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 630                 DEBUG(0, ("talloc failed\n"));
 631                 TALLOC_FREE(result);
 632                 return NULL;
 633         }
 634
 635         result->te = event_add_timed(event_ctx, result,
 636                                      timeval_sum(&now, &interval),
 637                                      result->name,
 638                                      idle_event_handler, result);
 639         if (result->te == NULL) {
 640                 DEBUG(0, ("event_add_timed failed\n"));
 641                 TALLOC_FREE(result);
 642                 return NULL;
 643         }
 644
 645         return result;
 646 }
 647
 648 /****************************************************************************
 649  Do all async processing in here. This includes kernel oplock messages, change
 650  notify events etc.
 651 ****************************************************************************/
 652
 653 static void async_processing(fd_set *pfds)
 654 {
 655         DEBUG(10,("async_processing: Doing async processing.\n"));
 656
 657         process_aio_queue();
 658
 659         process_kernel_oplocks(smbd_messaging_context(), pfds);
 660
 661         /* Do the aio check again after receive_local_message as it does a
 662            select and may have eaten our signal. */
 663         /* Is this till true? -- vl */
 664         process_aio_queue();
 665
 666         if (got_sig_term) {
 667                 exit_server_cleanly("termination signal");
 668         }
 669
 670         /* check for sighup processing */
 671         if (reload_after_sighup) {
 672                 change_to_root_user();
 673                 DEBUG(1,("Reloading services after SIGHUP\n"));
 674                 reload_services(False);
 675                 reload_after_sighup = 0;
 676         }
 677 }
 678
 679 /****************************************************************************
 680  Add a fd to the set we will be select(2)ing on.
 681 ****************************************************************************/
 682
 683 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 684 {
 685         if (fd != -1) {
 686                 FD_SET(fd, fds);
 687                 maxfd = MAX(maxfd, fd);
 688         }
 689
 690         return maxfd;
 691 }
 692
 693 /****************************************************************************
 694   Do a select on an two fd's - with timeout.
 695
 696   If a local udp message has been pushed onto the
 697   queue (this can only happen during oplock break
 698   processing) call async_processing()
 699
 700   If a pending smb message has been pushed onto the
 701   queue (this can only happen during oplock break
 702   processing) return this next.
 703
 704   If the first smbfd is ready then read an smb from it.
 705   if the second (loopback UDP) fd is ready then read a message
 706   from it and setup the buffer header to identify the length
 707   and from address.
 708   Returns False on timeout or error.
 709   Else returns True.
 710
 711 The timeout is in milliseconds
 712 ****************************************************************************/
 713
 714 static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer,
 715                                        size_t *buffer_len, int timeout,
 716                                        size_t *p_unread, bool *p_encrypted)
 717 {
 718         fd_set r_fds, w_fds;
 719         int selrtn;
 720         struct timeval to;
 721         int maxfd = 0;
 722         size_t len = 0;
 723         NTSTATUS status;
 724
 725         *p_unread = 0;
 726
 727  again:
 728
 729         if (timeout >= 0) {
 730                 to.tv_sec = timeout / 1000;
 731                 to.tv_usec = (timeout % 1000) * 1000;
 732         } else {
 733                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 734                 to.tv_usec = 0;
 735         }
 736
 737         /*
 738          * Note that this call must be before processing any SMB
 739          * messages as we need to synchronously process any messages
 740          * we may have sent to ourselves from the previous SMB.
 741          */
 742         message_dispatch(smbd_messaging_context());
 743
 744         /*
 745          * Check to see if we already have a message on the deferred open queue
 746          * and it's time to schedule.
 747          */
 748         if(deferred_open_queue != NULL) {
 749                 bool pop_message = False;
 750                 struct pending_message_list *msg = deferred_open_queue;
 751
 752                 if (timeval_is_zero(&msg->end_time)) {
 753                         pop_message = True;
 754                 } else {
 755                         struct timeval tv;
 756                         SMB_BIG_INT tdif;
 757
 758                         GetTimeOfDay(&tv);
 759                         tdif = usec_time_diff(&msg->end_time, &tv);
 760                         if (tdif <= 0) {
 761                                 /* Timed out. Schedule...*/
 762                                 pop_message = True;
 763                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 764                         } else {
 765                                 /* Make a more accurate select timeout. */
 766                                 to.tv_sec = tdif / 1000000;
 767                                 to.tv_usec = tdif % 1000000;
 768                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 769                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 770                         }
 771                 }
 772
 773                 if (pop_message) {
 774
 775                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 776                                                         msg->buf.length);
 777                         if (*buffer == NULL) {
 778                                 DEBUG(0, ("talloc failed\n"));
 779                                 return NT_STATUS_NO_MEMORY;
 780                         }
 781                         *buffer_len = msg->buf.length;
 782                         *p_encrypted = msg->encrypted;
 783
 784                         /* We leave this message on the queue so the open code can
 785                            know this is a retry. */
 786                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 787                         return NT_STATUS_OK;
 788                 }
 789         }
 790
 791         /*
 792          * Setup the select fd sets.
 793          */
 794
 795         FD_ZERO(&r_fds);
 796         FD_ZERO(&w_fds);
 797
 798         /*
 799          * Ensure we process oplock break messages by preference.
 800          * We have to do this before the select, after the select
 801          * and if the select returns EINTR. This is due to the fact
 802          * that the selects called from async_processing can eat an EINTR
 803          * caused by a signal (we can't take the break message there).
 804          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 805          */
 806
 807         if (oplock_message_waiting(&r_fds)) {
 808                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 809                 async_processing(&r_fds);
 810                 /*
 811                  * After async processing we must go and do the select again, as
 812                  * the state of the flag in fds for the server file descriptor is
 813                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 814                  */
 815                 goto again;
 816         }
 817
 818         /*
 819          * Are there any timed events waiting ? If so, ensure we don't
 820          * select for longer than it would take to wait for them.
 821          */
 822
 823         {
 824                 struct timeval now;
 825                 GetTimeOfDay(&now);
 826
 827                 event_add_to_select_args(smbd_event_context(), &now,
 828                                          &r_fds, &w_fds, &to, &maxfd);
 829         }
 830
 831         if (timeval_is_zero(&to)) {
 832                 /* Process a timed event now... */
 833                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 834                         goto again;
 835                 }
 836         }
 837
 838         {
 839                 int sav;
 840                 START_PROFILE(smbd_idle);
 841
 842                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 843                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 844
 845                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 846                 sav = errno;
 847
 848                 END_PROFILE(smbd_idle);
 849                 errno = sav;
 850         }
 851
 852         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 853                 goto again;
 854         }
 855
 856         /* if we get EINTR then maybe we have received an oplock
 857            signal - treat this as select returning 1. This is ugly, but
 858            is the best we can do until the oplock code knows more about
 859            signals */
 860         if (selrtn == -1 && errno == EINTR) {
 861                 async_processing(&r_fds);
 862                 /*
 863                  * After async processing we must go and do the select again, as
 864                  * the state of the flag in fds for the server file descriptor is
 865                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 866                  */
 867                 goto again;
 868         }
 869
 870         /* Check if error */
 871         if (selrtn == -1) {
 872                 /* something is wrong. Maybe the socket is dead? */
 873                 return map_nt_error_from_unix(errno);
 874         }
 875
 876         /* Did we timeout ? */
 877         if (selrtn == 0) {
 878                 return NT_STATUS_IO_TIMEOUT;
 879         }
 880
 881         /*
 882          * Ensure we process oplock break messages by preference.
 883          * This is IMPORTANT ! Otherwise we can starve other processes
 884          * sending us an oplock break message. JRA.
 885          */
 886
 887         if (oplock_message_waiting(&r_fds)) {
 888                 async_processing(&r_fds);
 889                 /*
 890                  * After async processing we must go and do the select again, as
 891                  * the state of the flag in fds for the server file descriptor is
 892                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 893                  */
 894                 goto again;
 895         }
 896
 897         /*
 898          * We've just woken up from a protentially long select sleep.
 899          * Ensure we process local messages as we need to synchronously
 900          * process any messages from other smbd's to avoid file rename race
 901          * conditions. This call is cheap if there are no messages waiting.
 902          * JRA.
 903          */
 904         message_dispatch(smbd_messaging_context());
 905
 906         status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
 907                                     p_unread, p_encrypted, &len);
 908
 909         if (!NT_STATUS_IS_OK(status)) {
 910                 return status;
 911         }
 912
 913         *buffer_len = len;
 914
 915         return NT_STATUS_OK;
 916 }
 917
 918 /*
 919  * Only allow 5 outstanding trans requests. We're allocating memory, so
 920  * prevent a DoS.
 921  */
 922
 923 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 924 {
 925         int count = 0;
 926         for (; list != NULL; list = list->next) {
 927
 928                 if (list->mid == mid) {
 929                         return NT_STATUS_INVALID_PARAMETER;
 930                 }
 931
 932                 count += 1;
 933         }
 934         if (count > 5) {
 935                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 936         }
 937
 938         return NT_STATUS_OK;
 939 }
 940
 941 /****************************************************************************
 942  We're terminating and have closed all our files/connections etc.
 943  If there are any pending local messages we need to respond to them
 944  before termination so that other smbds don't think we just died whilst
 945  holding oplocks.
 946 ****************************************************************************/
 947
 948 void respond_to_all_remaining_local_messages(void)
 949 {
 950         /*
 951          * Assert we have no exclusive open oplocks.
 952          */
 953
 954         if(get_number_of_exclusive_open_oplocks()) {
 955                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 956                         get_number_of_exclusive_open_oplocks() ));
 957                 return;
 958         }
 959
 960         process_kernel_oplocks(smbd_messaging_context(), NULL);
 961
 962         return;
 963 }
 964
 965
 966 /*
 967 These flags determine some of the permissions required to do an operation
 968
 969 Note that I don't set NEED_WRITE on some write operations because they
 970 are used by some brain-dead clients when printing, and I don't want to
 971 force write permissions on print services.
 972 */
 973 #define AS_USER (1<<0)
 974 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 975 #define TIME_INIT (1<<2)
 976 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 977 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 978 #define DO_CHDIR (1<<6)
 979
 980 /*
 981    define a list of possible SMB messages and their corresponding
 982    functions. Any message that has a NULL function is unimplemented -
 983    please feel free to contribute implementations!
 984 */
 985 static const struct smb_message_struct {
 986         const char *name;
 987         void (*fn_new)(struct smb_request *req);
 988         int flags;
 989 } smb_messages[256] = {
 990
 991 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 992 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 993 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 994 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 995 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 996 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 997 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 998 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 999 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1000 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1001 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1002 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1003 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1004 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1005 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1006 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1007 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1008 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1009 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1010 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1011 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1012 /* 0x15 */ { NULL, NULL, 0 },
1013 /* 0x16 */ { NULL, NULL, 0 },
1014 /* 0x17 */ { NULL, NULL, 0 },
1015 /* 0x18 */ { NULL, NULL, 0 },
1016 /* 0x19 */ { NULL, NULL, 0 },
1017 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1018 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1019 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1020 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1021 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1022 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1023 /* 0x20 */ { "SMBwritec", NULL,0},
1024 /* 0x21 */ { NULL, NULL, 0 },
1025 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1026 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1027 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1028 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1029 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1030 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1031 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1032 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1033 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1034 /* 0x2b */ { "SMBecho",reply_echo,0},
1035 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1036 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1037 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1038 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1039 /* 0x30 */ { NULL, NULL, 0 },
1040 /* 0x31 */ { NULL, NULL, 0 },
1041 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1042 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1043 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1044 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1045 /* 0x36 */ { NULL, NULL, 0 },
1046 /* 0x37 */ { NULL, NULL, 0 },
1047 /* 0x38 */ { NULL, NULL, 0 },
1048 /* 0x39 */ { NULL, NULL, 0 },
1049 /* 0x3a */ { NULL, NULL, 0 },
1050 /* 0x3b */ { NULL, NULL, 0 },
1051 /* 0x3c */ { NULL, NULL, 0 },
1052 /* 0x3d */ { NULL, NULL, 0 },
1053 /* 0x3e */ { NULL, NULL, 0 },
1054 /* 0x3f */ { NULL, NULL, 0 },
1055 /* 0x40 */ { NULL, NULL, 0 },
1056 /* 0x41 */ { NULL, NULL, 0 },
1057 /* 0x42 */ { NULL, NULL, 0 },
1058 /* 0x43 */ { NULL, NULL, 0 },
1059 /* 0x44 */ { NULL, NULL, 0 },
1060 /* 0x45 */ { NULL, NULL, 0 },
1061 /* 0x46 */ { NULL, NULL, 0 },
1062 /* 0x47 */ { NULL, NULL, 0 },
1063 /* 0x48 */ { NULL, NULL, 0 },
1064 /* 0x49 */ { NULL, NULL, 0 },
1065 /* 0x4a */ { NULL, NULL, 0 },
1066 /* 0x4b */ { NULL, NULL, 0 },
1067 /* 0x4c */ { NULL, NULL, 0 },
1068 /* 0x4d */ { NULL, NULL, 0 },
1069 /* 0x4e */ { NULL, NULL, 0 },
1070 /* 0x4f */ { NULL, NULL, 0 },
1071 /* 0x50 */ { NULL, NULL, 0 },
1072 /* 0x51 */ { NULL, NULL, 0 },
1073 /* 0x52 */ { NULL, NULL, 0 },
1074 /* 0x53 */ { NULL, NULL, 0 },
1075 /* 0x54 */ { NULL, NULL, 0 },
1076 /* 0x55 */ { NULL, NULL, 0 },
1077 /* 0x56 */ { NULL, NULL, 0 },
1078 /* 0x57 */ { NULL, NULL, 0 },
1079 /* 0x58 */ { NULL, NULL, 0 },
1080 /* 0x59 */ { NULL, NULL, 0 },
1081 /* 0x5a */ { NULL, NULL, 0 },
1082 /* 0x5b */ { NULL, NULL, 0 },
1083 /* 0x5c */ { NULL, NULL, 0 },
1084 /* 0x5d */ { NULL, NULL, 0 },
1085 /* 0x5e */ { NULL, NULL, 0 },
1086 /* 0x5f */ { NULL, NULL, 0 },
1087 /* 0x60 */ { NULL, NULL, 0 },
1088 /* 0x61 */ { NULL, NULL, 0 },
1089 /* 0x62 */ { NULL, NULL, 0 },
1090 /* 0x63 */ { NULL, NULL, 0 },
1091 /* 0x64 */ { NULL, NULL, 0 },
1092 /* 0x65 */ { NULL, NULL, 0 },
1093 /* 0x66 */ { NULL, NULL, 0 },
1094 /* 0x67 */ { NULL, NULL, 0 },
1095 /* 0x68 */ { NULL, NULL, 0 },
1096 /* 0x69 */ { NULL, NULL, 0 },
1097 /* 0x6a */ { NULL, NULL, 0 },
1098 /* 0x6b */ { NULL, NULL, 0 },
1099 /* 0x6c */ { NULL, NULL, 0 },
1100 /* 0x6d */ { NULL, NULL, 0 },
1101 /* 0x6e */ { NULL, NULL, 0 },
1102 /* 0x6f */ { NULL, NULL, 0 },
1103 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1104 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1105 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1106 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1107 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1108 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1109 /* 0x76 */ { NULL, NULL, 0 },
1110 /* 0x77 */ { NULL, NULL, 0 },
1111 /* 0x78 */ { NULL, NULL, 0 },
1112 /* 0x79 */ { NULL, NULL, 0 },
1113 /* 0x7a */ { NULL, NULL, 0 },
1114 /* 0x7b */ { NULL, NULL, 0 },
1115 /* 0x7c */ { NULL, NULL, 0 },
1116 /* 0x7d */ { NULL, NULL, 0 },
1117 /* 0x7e */ { NULL, NULL, 0 },
1118 /* 0x7f */ { NULL, NULL, 0 },
1119 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1120 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1121 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1122 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1123 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1124 /* 0x85 */ { NULL, NULL, 0 },
1125 /* 0x86 */ { NULL, NULL, 0 },
1126 /* 0x87 */ { NULL, NULL, 0 },
1127 /* 0x88 */ { NULL, NULL, 0 },
1128 /* 0x89 */ { NULL, NULL, 0 },
1129 /* 0x8a */ { NULL, NULL, 0 },
1130 /* 0x8b */ { NULL, NULL, 0 },
1131 /* 0x8c */ { NULL, NULL, 0 },
1132 /* 0x8d */ { NULL, NULL, 0 },
1133 /* 0x8e */ { NULL, NULL, 0 },
1134 /* 0x8f */ { NULL, NULL, 0 },
1135 /* 0x90 */ { NULL, NULL, 0 },
1136 /* 0x91 */ { NULL, NULL, 0 },
1137 /* 0x92 */ { NULL, NULL, 0 },
1138 /* 0x93 */ { NULL, NULL, 0 },
1139 /* 0x94 */ { NULL, NULL, 0 },
1140 /* 0x95 */ { NULL, NULL, 0 },
1141 /* 0x96 */ { NULL, NULL, 0 },
1142 /* 0x97 */ { NULL, NULL, 0 },
1143 /* 0x98 */ { NULL, NULL, 0 },
1144 /* 0x99 */ { NULL, NULL, 0 },
1145 /* 0x9a */ { NULL, NULL, 0 },
1146 /* 0x9b */ { NULL, NULL, 0 },
1147 /* 0x9c */ { NULL, NULL, 0 },
1148 /* 0x9d */ { NULL, NULL, 0 },
1149 /* 0x9e */ { NULL, NULL, 0 },
1150 /* 0x9f */ { NULL, NULL, 0 },
1151 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1152 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1153 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1154 /* 0xa3 */ { NULL, NULL, 0 },
1155 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1156 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1157 /* 0xa6 */ { NULL, NULL, 0 },
1158 /* 0xa7 */ { NULL, NULL, 0 },
1159 /* 0xa8 */ { NULL, NULL, 0 },
1160 /* 0xa9 */ { NULL, NULL, 0 },
1161 /* 0xaa */ { NULL, NULL, 0 },
1162 /* 0xab */ { NULL, NULL, 0 },
1163 /* 0xac */ { NULL, NULL, 0 },
1164 /* 0xad */ { NULL, NULL, 0 },
1165 /* 0xae */ { NULL, NULL, 0 },
1166 /* 0xaf */ { NULL, NULL, 0 },
1167 /* 0xb0 */ { NULL, NULL, 0 },
1168 /* 0xb1 */ { NULL, NULL, 0 },
1169 /* 0xb2 */ { NULL, NULL, 0 },
1170 /* 0xb3 */ { NULL, NULL, 0 },
1171 /* 0xb4 */ { NULL, NULL, 0 },
1172 /* 0xb5 */ { NULL, NULL, 0 },
1173 /* 0xb6 */ { NULL, NULL, 0 },
1174 /* 0xb7 */ { NULL, NULL, 0 },
1175 /* 0xb8 */ { NULL, NULL, 0 },
1176 /* 0xb9 */ { NULL, NULL, 0 },
1177 /* 0xba */ { NULL, NULL, 0 },
1178 /* 0xbb */ { NULL, NULL, 0 },
1179 /* 0xbc */ { NULL, NULL, 0 },
1180 /* 0xbd */ { NULL, NULL, 0 },
1181 /* 0xbe */ { NULL, NULL, 0 },
1182 /* 0xbf */ { NULL, NULL, 0 },
1183 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1184 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1185 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1186 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1187 /* 0xc4 */ { NULL, NULL, 0 },
1188 /* 0xc5 */ { NULL, NULL, 0 },
1189 /* 0xc6 */ { NULL, NULL, 0 },
1190 /* 0xc7 */ { NULL, NULL, 0 },
1191 /* 0xc8 */ { NULL, NULL, 0 },
1192 /* 0xc9 */ { NULL, NULL, 0 },
1193 /* 0xca */ { NULL, NULL, 0 },
1194 /* 0xcb */ { NULL, NULL, 0 },
1195 /* 0xcc */ { NULL, NULL, 0 },
1196 /* 0xcd */ { NULL, NULL, 0 },
1197 /* 0xce */ { NULL, NULL, 0 },
1198 /* 0xcf */ { NULL, NULL, 0 },
1199 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1200 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1201 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1202 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1203 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1204 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1205 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1206 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1207 /* 0xd8 */ { NULL, NULL, 0 },
1208 /* 0xd9 */ { NULL, NULL, 0 },
1209 /* 0xda */ { NULL, NULL, 0 },
1210 /* 0xdb */ { NULL, NULL, 0 },
1211 /* 0xdc */ { NULL, NULL, 0 },
1212 /* 0xdd */ { NULL, NULL, 0 },
1213 /* 0xde */ { NULL, NULL, 0 },
1214 /* 0xdf */ { NULL, NULL, 0 },
1215 /* 0xe0 */ { NULL, NULL, 0 },
1216 /* 0xe1 */ { NULL, NULL, 0 },
1217 /* 0xe2 */ { NULL, NULL, 0 },
1218 /* 0xe3 */ { NULL, NULL, 0 },
1219 /* 0xe4 */ { NULL, NULL, 0 },
1220 /* 0xe5 */ { NULL, NULL, 0 },
1221 /* 0xe6 */ { NULL, NULL, 0 },
1222 /* 0xe7 */ { NULL, NULL, 0 },
1223 /* 0xe8 */ { NULL, NULL, 0 },
1224 /* 0xe9 */ { NULL, NULL, 0 },
1225 /* 0xea */ { NULL, NULL, 0 },
1226 /* 0xeb */ { NULL, NULL, 0 },
1227 /* 0xec */ { NULL, NULL, 0 },
1228 /* 0xed */ { NULL, NULL, 0 },
1229 /* 0xee */ { NULL, NULL, 0 },
1230 /* 0xef */ { NULL, NULL, 0 },
1231 /* 0xf0 */ { NULL, NULL, 0 },
1232 /* 0xf1 */ { NULL, NULL, 0 },
1233 /* 0xf2 */ { NULL, NULL, 0 },
1234 /* 0xf3 */ { NULL, NULL, 0 },
1235 /* 0xf4 */ { NULL, NULL, 0 },
1236 /* 0xf5 */ { NULL, NULL, 0 },
1237 /* 0xf6 */ { NULL, NULL, 0 },
1238 /* 0xf7 */ { NULL, NULL, 0 },
1239 /* 0xf8 */ { NULL, NULL, 0 },
1240 /* 0xf9 */ { NULL, NULL, 0 },
1241 /* 0xfa */ { NULL, NULL, 0 },
1242 /* 0xfb */ { NULL, NULL, 0 },
1243 /* 0xfc */ { NULL, NULL, 0 },
1244 /* 0xfd */ { NULL, NULL, 0 },
1245 /* 0xfe */ { NULL, NULL, 0 },
1246 /* 0xff */ { NULL, NULL, 0 }
1247
1248 };
1249
1250 /*******************************************************************
1251  allocate and initialize a reply packet
1252 ********************************************************************/
1253
1254 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1255 {
1256         /*
1257          * Protect against integer wrap
1258          */
1259         if ((num_bytes > 0xffffff)
1260             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1261                 char *msg;
1262                 if (asprintf(&msg, "num_bytes too large: %u",
1263                              (unsigned)num_bytes) == -1) {
1264                         msg = CONST_DISCARD(char *, "num_bytes too large");
1265                 }
1266                 smb_panic(msg);
1267         }
1268
1269         if (!(req->outbuf = TALLOC_ARRAY(
1270                       req, uint8,
1271                       smb_size + num_words*2 + num_bytes))) {
1272                 smb_panic("could not allocate output buffer\n");
1273         }
1274
1275         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1276         srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1277         /*
1278          * Zero out the word area, the caller has to take care of the bcc area
1279          * himself
1280          */
1281         if (num_words != 0) {
1282                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1283         }
1284
1285         return;
1286 }
1287
1288
1289 /*******************************************************************
1290  Dump a packet to a file.
1291 ********************************************************************/
1292
1293 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1294 {
1295         int fd, i;
1296         char *fname = NULL;
1297         if (DEBUGLEVEL < 50) {
1298                 return;
1299         }
1300
1301         if (len < 4) len = smb_len(data)+4;
1302         for (i=1;i<100;i++) {
1303                 if (asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1304                              type ? "req" : "resp") == -1) {
1305                         return;
1306                 }
1307                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1308                 if (fd != -1 || errno != EEXIST) break;
1309         }
1310         if (fd != -1) {
1311                 ssize_t ret = write(fd, data, len);
1312                 if (ret != len)
1313                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1314                 close(fd);
1315                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1316         }
1317         SAFE_FREE(fname);
1318 }
1319
1320 /****************************************************************************
1321  Prepare everything for calling the actual request function, and potentially
1322  call the request function via the "new" interface.
1323
1324  Return False if the "legacy" function needs to be called, everything is
1325  prepared.
1326
1327  Return True if we're done.
1328
1329  I know this API sucks, but it is the one with the least code change I could
1330  find.
1331 ****************************************************************************/
1332
1333 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1334 {
1335         int flags;
1336         uint16 session_tag;
1337         connection_struct *conn = NULL;
1338
1339         static uint16 last_session_tag = UID_FIELD_INVALID;
1340
1341         errno = 0;
1342
1343         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1344          * so subtract 4 from it. */
1345         if (!valid_smb_header(req->inbuf)
1346             || (size < (smb_size - 4))) {
1347                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1348                          smb_len(req->inbuf)));
1349                 exit_server_cleanly("Non-SMB packet");
1350         }
1351
1352         if (smb_messages[type].fn_new == NULL) {
1353                 DEBUG(0,("Unknown message type %d!\n",type));
1354                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1355                 reply_unknown_new(req, type);
1356                 return NULL;
1357         }
1358
1359         flags = smb_messages[type].flags;
1360
1361         /* In share mode security we must ignore the vuid. */
1362         session_tag = (lp_security() == SEC_SHARE)
1363                 ? UID_FIELD_INVALID : req->vuid;
1364         conn = req->conn;
1365
1366         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1367                  (int)sys_getpid(), (unsigned long)conn));
1368
1369         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1370
1371         /* Ensure this value is replaced in the incoming packet. */
1372         SSVAL(req->inbuf,smb_uid,session_tag);
1373
1374         /*
1375          * Ensure the correct username is in current_user_info.  This is a
1376          * really ugly bugfix for problems with multiple session_setup_and_X's
1377          * being done and allowing %U and %G substitutions to work correctly.
1378          * There is a reason this code is done here, don't move it unless you
1379          * know what you're doing... :-).
1380          * JRA.
1381          */
1382
1383         if (session_tag != last_session_tag) {
1384                 user_struct *vuser = NULL;
1385
1386                 last_session_tag = session_tag;
1387                 if(session_tag != UID_FIELD_INVALID) {
1388                         vuser = get_valid_user_struct(session_tag);
1389                         if (vuser) {
1390                                 set_current_user_info(
1391                                         vuser->server_info->sanitized_username,
1392                                         vuser->server_info->unix_name,
1393                                         pdb_get_fullname(vuser->server_info
1394                                                          ->sam_account),
1395                                         pdb_get_domain(vuser->server_info
1396                                                        ->sam_account));
1397                         }
1398                 }
1399         }
1400
1401         /* Does this call need to be run as the connected user? */
1402         if (flags & AS_USER) {
1403
1404                 /* Does this call need a valid tree connection? */
1405                 if (!conn) {
1406                         /*
1407                          * Amazingly, the error code depends on the command
1408                          * (from Samba4).
1409                          */
1410                         if (type == SMBntcreateX) {
1411                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1412                         } else {
1413                                 reply_doserror(req, ERRSRV, ERRinvnid);
1414                         }
1415                         return NULL;
1416                 }
1417
1418                 if (!change_to_user(conn,session_tag)) {
1419                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1420                         return conn;
1421                 }
1422
1423                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1424
1425                 /* Does it need write permission? */
1426                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1427                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1428                         return conn;
1429                 }
1430
1431                 /* IPC services are limited */
1432                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1433                         reply_doserror(req, ERRSRV,ERRaccess);
1434                         return conn;
1435                 }
1436         } else {
1437                 /* This call needs to be run as root */
1438                 change_to_root_user();
1439         }
1440
1441         /* load service specific parameters */
1442         if (conn) {
1443                 if (req->encrypted) {
1444                         conn->encrypted_tid = true;
1445                         /* encrypted required from now on. */
1446                         conn->encrypt_level = Required;
1447                 } else if (ENCRYPTION_REQUIRED(conn)) {
1448                         uint8 com = CVAL(req->inbuf,smb_com);
1449                         if (com != SMBtrans2 && com != SMBtranss2) {
1450                                 exit_server_cleanly("encryption required "
1451                                         "on connection");
1452                                 return conn;
1453                         }
1454                 }
1455
1456                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1457                                          (flags & (AS_USER|DO_CHDIR)
1458                                           ?True:False))) {
1459                         reply_doserror(req, ERRSRV, ERRaccess);
1460                         return conn;
1461                 }
1462                 conn->num_smb_operations++;
1463         }
1464
1465         /* does this protocol need to be run as guest? */
1466         if ((flags & AS_GUEST)
1467             && (!change_to_guest() ||
1468                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1469                               lp_hostsdeny(-1)))) {
1470                 reply_doserror(req, ERRSRV, ERRaccess);
1471                 return conn;
1472         }
1473
1474         smb_messages[type].fn_new(req);
1475         return req->conn;
1476 }
1477
1478 /****************************************************************************
1479  Construct a reply to the incoming packet.
1480 ****************************************************************************/
1481
1482 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1483 {
1484         uint8 type = CVAL(inbuf,smb_com);
1485         connection_struct *conn;
1486         struct smb_request *req;
1487
1488         chain_size = 0;
1489         file_chain_reset();
1490         reset_chain_p();
1491
1492         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1493                 smb_panic("could not allocate smb_request");
1494         }
1495         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1496
1497         conn = switch_message(type, req, size);
1498
1499         if (req->unread_bytes) {
1500                 /* writeX failed. drain socket. */
1501                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1502                                 req->unread_bytes) {
1503                         smb_panic("failed to drain pending bytes");
1504                 }
1505                 req->unread_bytes = 0;
1506         }
1507
1508         if (req->outbuf == NULL) {
1509                 return;
1510         }
1511
1512         if (CVAL(req->outbuf,0) == 0) {
1513                 show_msg((char *)req->outbuf);
1514         }
1515
1516         if (!srv_send_smb(smbd_server_fd(),
1517                         (char *)req->outbuf,
1518                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1519                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1520         }
1521
1522         TALLOC_FREE(req);
1523
1524         return;
1525 }
1526
1527 /****************************************************************************
1528  Process an smb from the client
1529 ****************************************************************************/
1530
1531 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1532 {
1533         static int trans_num;
1534         int msg_type = CVAL(inbuf,0);
1535
1536         DO_PROFILE_INC(smb_count);
1537
1538         if (trans_num == 0) {
1539                 char addr[INET6_ADDRSTRLEN];
1540
1541                 /* on the first packet, check the global hosts allow/ hosts
1542                 deny parameters before doing any parsing of the packet
1543                 passed to us by the client.  This prevents attacks on our
1544                 parsing code from hosts not in the hosts allow list */
1545
1546                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1547                                   lp_hostsdeny(-1))) {
1548                         /* send a negative session response "not listening on calling name" */
1549                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1550                         DEBUG( 1, ( "Connection denied from %s\n",
1551                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1552                         (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1553                         exit_server_cleanly("connection denied");
1554                 }
1555         }
1556
1557         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1558                     smb_len(inbuf) ) );
1559         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1560                                 (int)nread,
1561                                 (unsigned int)unread_bytes ));
1562
1563         if (msg_type != 0) {
1564                 /*
1565                  * NetBIOS session request, keepalive, etc.
1566                  */
1567                 reply_special(inbuf);
1568                 return;
1569         }
1570
1571         show_msg(inbuf);
1572
1573         construct_reply(inbuf,nread,unread_bytes,encrypted);
1574
1575         trans_num++;
1576 }
1577
1578 /****************************************************************************
1579  Return a string containing the function name of a SMB command.
1580 ****************************************************************************/
1581
1582 const char *smb_fn_name(int type)
1583 {
1584         const char *unknown_name = "SMBunknown";
1585
1586         if (smb_messages[type].name == NULL)
1587                 return(unknown_name);
1588
1589         return(smb_messages[type].name);
1590 }
1591
1592 /****************************************************************************
1593  Helper functions for contruct_reply.
1594 ****************************************************************************/
1595
1596 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1597
1598 void add_to_common_flags2(uint32 v)
1599 {
1600         common_flags2 |= v;
1601 }
1602
1603 void remove_from_common_flags2(uint32 v)
1604 {
1605         common_flags2 &= ~v;
1606 }
1607
1608 void construct_reply_common(const char *inbuf, char *outbuf)
1609 {
1610         srv_set_message(outbuf,0,0,false);
1611
1612         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1613         SIVAL(outbuf,smb_rcls,0);
1614         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1615         SSVAL(outbuf,smb_flg2,
1616                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1617                 common_flags2);
1618         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1619
1620         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1621         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1622         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1623         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1624 }
1625
1626 /****************************************************************************
1627  Construct a chained reply and add it to the already made reply
1628 ****************************************************************************/
1629
1630 void chain_reply(struct smb_request *req)
1631 {
1632         static char *orig_inbuf;
1633
1634         /*
1635          * Dirty little const_discard: We mess with req->inbuf, which is
1636          * declared as const. If maybe at some point this routine gets
1637          * rewritten, this const_discard could go away.
1638          */
1639         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1640         int size = smb_len(req->inbuf)+4;
1641
1642         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1643         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1644         char *inbuf2;
1645         int outsize2;
1646         int new_size;
1647         char inbuf_saved[smb_wct];
1648         char *outbuf = (char *)req->outbuf;
1649         size_t outsize = smb_len(outbuf) + 4;
1650         size_t outsize_padded;
1651         size_t ofs, to_move;
1652
1653         struct smb_request *req2;
1654         size_t caller_outputlen;
1655         char *caller_output;
1656
1657         /* Maybe its not chained, or it's an error packet. */
1658         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1659                 SCVAL(outbuf,smb_vwv0,0xFF);
1660                 return;
1661         }
1662
1663         if (chain_size == 0) {
1664                 /* this is the first part of the chain */
1665                 orig_inbuf = inbuf;
1666         }
1667
1668         /*
1669          * We need to save the output the caller added to the chain so that we
1670          * can splice it into the final output buffer later.
1671          */
1672
1673         caller_outputlen = outsize - smb_wct;
1674
1675         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1676
1677         if (caller_output == NULL) {
1678                 /* TODO: NT_STATUS_NO_MEMORY */
1679                 smb_panic("could not dup outbuf");
1680         }
1681
1682         /*
1683          * The original Win95 redirector dies on a reply to
1684          * a lockingX and read chain unless the chain reply is
1685          * 4 byte aligned. JRA.
1686          */
1687
1688         outsize_padded = (outsize + 3) & ~3;
1689
1690         /*
1691          * remember how much the caller added to the chain, only counting
1692          * stuff after the parameter words
1693          */
1694         chain_size += outsize_padded - smb_wct;
1695
1696         /*
1697          * work out pointers into the original packets. The
1698          * headers on these need to be filled in
1699          */
1700         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1701
1702         /* remember the original command type */
1703         smb_com1 = CVAL(orig_inbuf,smb_com);
1704
1705         /* save the data which will be overwritten by the new headers */
1706         memcpy(inbuf_saved,inbuf2,smb_wct);
1707
1708         /* give the new packet the same header as the last part of the SMB */
1709         memmove(inbuf2,inbuf,smb_wct);
1710
1711         /* create the in buffer */
1712         SCVAL(inbuf2,smb_com,smb_com2);
1713
1714         /* work out the new size for the in buffer. */
1715         new_size = size - (inbuf2 - inbuf);
1716         if (new_size < 0) {
1717                 DEBUG(0,("chain_reply: chain packet size incorrect "
1718                          "(orig size = %d, offset = %d)\n",
1719                          size, (int)(inbuf2 - inbuf) ));
1720                 exit_server_cleanly("Bad chained packet");
1721                 return;
1722         }
1723
1724         /* And set it in the header. */
1725         smb_setlen(inbuf2, new_size - 4);
1726
1727         DEBUG(3,("Chained message\n"));
1728         show_msg(inbuf2);
1729
1730         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1731                 smb_panic("could not allocate smb_request");
1732         }
1733         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1734
1735         /* process the request */
1736         switch_message(smb_com2, req2, new_size);
1737
1738         /*
1739          * We don't accept deferred operations in chained requests.
1740          */
1741         SMB_ASSERT(req2->outbuf != NULL);
1742         outsize2 = smb_len(req2->outbuf)+4;
1743
1744         /*
1745          * Move away the new command output so that caller_output fits in,
1746          * copy in the caller_output saved above.
1747          */
1748
1749         SMB_ASSERT(outsize_padded >= smb_wct);
1750
1751         /*
1752          * "ofs" is the space we need for caller_output. Equal to
1753          * caller_outputlen plus the padding.
1754          */
1755
1756         ofs = outsize_padded - smb_wct;
1757
1758         /*
1759          * "to_move" is the amount of bytes the secondary routine gave us
1760          */
1761
1762         to_move = outsize2 - smb_wct;
1763
1764         if (to_move + ofs + smb_wct + chain_size > max_send) {
1765                 smb_panic("replies too large -- would have to cut");
1766         }
1767
1768         /*
1769          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1770          * the first request in the chain. So we have to re-allocate it. In
1771          * the "old" API the only outbuf ever used is the global OutBuffer
1772          * which is always large enough.
1773          */
1774
1775         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1776                                       to_move + ofs + smb_wct);
1777         if (outbuf == NULL) {
1778                 smb_panic("could not realloc outbuf");
1779         }
1780
1781         req->outbuf = (uint8 *)outbuf;
1782
1783         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1784         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1785
1786         /*
1787          * copy the new reply header over the old one but preserve the smb_com
1788          * field
1789          */
1790         memmove(outbuf, req2->outbuf, smb_wct);
1791         SCVAL(outbuf, smb_com, smb_com1);
1792
1793         /*
1794          * We've just copied in the whole "wct" area from the secondary
1795          * function. Fix up the chaining: com2 and the offset need to be
1796          * readjusted.
1797          */
1798
1799         SCVAL(outbuf, smb_vwv0, smb_com2);
1800         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1801
1802         if (outsize_padded > outsize) {
1803
1804                 /*
1805                  * Due to padding we have some uninitialized bytes after the
1806                  * caller's output
1807                  */
1808
1809                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1810         }
1811
1812         smb_setlen(outbuf, outsize2 + chain_size - 4);
1813
1814         /*
1815          * restore the saved data, being careful not to overwrite any data
1816          * from the reply header
1817          */
1818         memcpy(inbuf2,inbuf_saved,smb_wct);
1819
1820         SAFE_FREE(caller_output);
1821         TALLOC_FREE(req2);
1822
1823         return;
1824 }
1825
1826 /****************************************************************************
1827  Setup the needed select timeout in milliseconds.
1828 ****************************************************************************/
1829
1830 static int setup_select_timeout(void)
1831 {
1832         int select_timeout;
1833
1834         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1835
1836         if (print_notify_messages_pending()) {
1837                 select_timeout = MIN(select_timeout, 1000);
1838         }
1839
1840         return select_timeout;
1841 }
1842
1843 /****************************************************************************
1844  Check if services need reloading.
1845 ****************************************************************************/
1846
1847 void check_reload(time_t t)
1848 {
1849         static pid_t mypid = 0;
1850         static time_t last_smb_conf_reload_time = 0;
1851         static time_t last_printer_reload_time = 0;
1852         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1853
1854         if(last_smb_conf_reload_time == 0) {
1855                 last_smb_conf_reload_time = t;
1856                 /* Our printing subsystem might not be ready at smbd start up.
1857                    Then no printer is available till the first printers check
1858                    is performed.  A lower initial interval circumvents this. */
1859                 if ( printcap_cache_time > 60 )
1860                         last_printer_reload_time = t - printcap_cache_time + 60;
1861                 else
1862                         last_printer_reload_time = t;
1863         }
1864
1865         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1866                 /* randomize over 60 second the printcap reload to avoid all
1867                  * process hitting cupsd at the same time */
1868                 int time_range = 60;
1869
1870                 last_printer_reload_time += random() % time_range;
1871                 mypid = getpid();
1872         }
1873
1874         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1875                 reload_services(True);
1876                 reload_after_sighup = False;
1877                 last_smb_conf_reload_time = t;
1878         }
1879
1880         /* 'printcap cache time = 0' disable the feature */
1881
1882         if ( printcap_cache_time != 0 )
1883         {
1884                 /* see if it's time to reload or if the clock has been set back */
1885
1886                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1887                         || (t-last_printer_reload_time  < 0) )
1888                 {
1889                         DEBUG( 3,( "Printcap cache time expired.\n"));
1890                         reload_printers();
1891                         last_printer_reload_time = t;
1892                 }
1893         }
1894 }
1895
1896 /****************************************************************************
1897  Process any timeout housekeeping. Return False if the caller should exit.
1898 ****************************************************************************/
1899
1900 static void timeout_processing(int *select_timeout,
1901                                time_t *last_timeout_processing_time)
1902 {
1903         time_t t;
1904
1905         *last_timeout_processing_time = t = time(NULL);
1906
1907         /* become root again if waiting */
1908         change_to_root_user();
1909
1910         /* check if we need to reload services */
1911         check_reload(t);
1912
1913         if(global_machine_password_needs_changing &&
1914                         /* for ADS we need to do a regular ADS password change, not a domain
1915                                         password change */
1916                         lp_security() == SEC_DOMAIN) {
1917
1918                 unsigned char trust_passwd_hash[16];
1919                 time_t lct;
1920                 void *lock;
1921
1922                 /*
1923                  * We're in domain level security, and the code that
1924                  * read the machine password flagged that the machine
1925                  * password needs changing.
1926                  */
1927
1928                 /*
1929                  * First, open the machine password file with an exclusive lock.
1930                  */
1931
1932                 lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
1933
1934                 if (lock == NULL) {
1935                         DEBUG(0,("process: unable to lock the machine account password for \
1936 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1937                         return;
1938                 }
1939
1940                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1941                         DEBUG(0,("process: unable to read the machine account password for \
1942 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1943                         TALLOC_FREE(lock);
1944                         return;
1945                 }
1946
1947                 /*
1948                  * Make sure someone else hasn't already done this.
1949                  */
1950
1951                 if(t < lct + lp_machine_password_timeout()) {
1952                         global_machine_password_needs_changing = False;
1953                         TALLOC_FREE(lock);
1954                         return;
1955                 }
1956
1957                 /* always just contact the PDC here */
1958
1959                 change_trust_account_password( lp_workgroup(), NULL);
1960                 global_machine_password_needs_changing = False;
1961                 TALLOC_FREE(lock);
1962         }
1963
1964         /* update printer queue caches if necessary */
1965
1966         update_monitored_printq_cache();
1967
1968         /*
1969          * Now we are root, check if the log files need pruning.
1970          * Force a log file check.
1971          */
1972         force_check_log_size();
1973         check_log_size();
1974
1975         /* Send any queued printer notify message to interested smbd's. */
1976
1977         print_notify_send_messages(smbd_messaging_context(), 0);
1978
1979         /*
1980          * Modify the select timeout depending upon
1981          * what we have remaining in our queues.
1982          */
1983
1984         *select_timeout = setup_select_timeout();
1985
1986         return;
1987 }
1988
1989 /****************************************************************************
1990  Process commands from the client
1991 ****************************************************************************/
1992
1993 void smbd_process(void)
1994 {
1995         time_t last_timeout_processing_time = time(NULL);
1996         unsigned int num_smbs = 0;
1997         size_t unread_bytes = 0;
1998
1999         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2000
2001         while (True) {
2002                 int select_timeout = setup_select_timeout();
2003                 int num_echos;
2004                 char *inbuf = NULL;
2005                 size_t inbuf_len = 0;
2006                 bool encrypted = false;
2007                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2008
2009                 errno = 0;
2010
2011                 /* Did someone ask for immediate checks on things like blocking locks ? */
2012                 if (select_timeout == 0) {
2013                         timeout_processing(&select_timeout,
2014                                            &last_timeout_processing_time);
2015                         num_smbs = 0; /* Reset smb counter. */
2016                 }
2017
2018                 run_events(smbd_event_context(), 0, NULL, NULL);
2019
2020                 while (True) {
2021                         NTSTATUS status;
2022
2023                         status = receive_message_or_smb(
2024                                 talloc_tos(), &inbuf, &inbuf_len,
2025                                 select_timeout, &unread_bytes, &encrypted);
2026
2027                         if (NT_STATUS_IS_OK(status)) {
2028                                 break;
2029                         }
2030
2031                         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
2032                                 timeout_processing(
2033                                         &select_timeout,
2034                                         &last_timeout_processing_time);
2035                                 continue;
2036                         }
2037
2038                         DEBUG(3, ("receive_message_or_smb failed: %s, "
2039                                   "exiting\n", nt_errstr(status)));
2040                         return;
2041
2042                         num_smbs = 0; /* Reset smb counter. */
2043                 }
2044
2045
2046                 /*
2047                  * Ensure we do timeout processing if the SMB we just got was
2048                  * only an echo request. This allows us to set the select
2049                  * timeout in 'receive_message_or_smb()' to any value we like
2050                  * without worrying that the client will send echo requests
2051                  * faster than the select timeout, thus starving out the
2052                  * essential processing (change notify, blocking locks) that
2053                  * the timeout code does. JRA.
2054                  */
2055                 num_echos = smb_echo_count;
2056
2057                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2058
2059                 TALLOC_FREE(inbuf);
2060
2061                 if (smb_echo_count != num_echos) {
2062                         timeout_processing(&select_timeout,
2063                                            &last_timeout_processing_time);
2064                         num_smbs = 0; /* Reset smb counter. */
2065                 }
2066
2067                 num_smbs++;
2068
2069                 /*
2070                  * If we are getting smb requests in a constant stream
2071                  * with no echos, make sure we attempt timeout processing
2072                  * every select_timeout milliseconds - but only check for this
2073                  * every 200 smb requests.
2074                  */
2075
2076                 if ((num_smbs % 200) == 0) {
2077                         time_t new_check_time = time(NULL);
2078                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2079                                 timeout_processing(
2080                                         &select_timeout,
2081                                         &last_timeout_processing_time);
2082                                 num_smbs = 0; /* Reset smb counter. */
2083                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2084                         }
2085                 }
2086
2087                 /* The timeout_processing function isn't run nearly
2088                    often enough to implement 'max log size' without
2089                    overrunning the size of the file by many megabytes.
2090                    This is especially true if we are running at debug
2091                    level 10.  Checking every 50 SMBs is a nice
2092                    tradeoff of performance vs log file size overrun. */
2093
2094                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2095                         change_to_root_user();
2096                         check_log_size();
2097                 }
2098                 TALLOC_FREE(frame);
2099         }
2100 }