source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "lib/messages_ctdb.h"
  36 #include "smbprofile.h"
  37 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  38 #include "libsmb/libsmb.h"
  39 #include "../lib/util/tevent_ntstatus.h"
  40 #include "../libcli/security/dom_sid.h"
  41 #include "../libcli/security/security_token.h"
  42 #include "lib/id_cache.h"
  43 #include "lib/util/sys_rw_data.h"
  44 #include "system/threads.h"
  45 #include "lib/pthreadpool/pthreadpool_tevent.h"
  46 #include "util_event.h"
  47
  48 /* Internal message queue for deferred opens. */
  49 struct pending_message_list {
  50         struct pending_message_list *next, *prev;
  51         struct timeval request_time; /* When was this first issued? */
  52         struct smbd_server_connection *sconn;
  53         struct smbXsrv_connection *xconn;
  54         struct tevent_timer *te;
  55         struct smb_perfcount_data pcd;
  56         uint32_t seqnum;
  57         bool encrypted;
  58         bool processed;
  59         DATA_BLOB buf;
  60         struct deferred_open_record *open_rec;
  61 };
  62
  63 static void construct_reply_common(uint8_t cmd, const uint8_t *inbuf,
  64                                    char *outbuf);
  65 static struct pending_message_list *get_deferred_open_message_smb(
  66         struct smbd_server_connection *sconn, uint64_t mid);
  67 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  68
  69 static void smbd_echo_init(struct smbXsrv_connection *xconn)
  70 {
  71         xconn->smb1.echo_handler.trusted_fd = -1;
  72         xconn->smb1.echo_handler.socket_lock_fd = -1;
  73 #ifdef HAVE_ROBUST_MUTEXES
  74         xconn->smb1.echo_handler.socket_mutex = NULL;
  75 #endif
  76 }
  77
  78 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
  79 {
  80         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
  81                 return true;
  82         }
  83
  84 #ifdef HAVE_ROBUST_MUTEXES
  85         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
  86                 return true;
  87         }
  88 #endif
  89
  90         return false;
  91 }
  92
  93 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
  94 {
  95         if (!smbd_echo_active(xconn)) {
  96                 return true;
  97         }
  98
  99         xconn->smb1.echo_handler.ref_count++;
 100
 101         if (xconn->smb1.echo_handler.ref_count > 1) {
 102                 return true;
 103         }
 104
 105         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 106
 107 #ifdef HAVE_ROBUST_MUTEXES
 108         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 109                 int ret = EINTR;
 110
 111                 while (ret == EINTR) {
 112                         ret = pthread_mutex_lock(
 113                                 xconn->smb1.echo_handler.socket_mutex);
 114                         if (ret == 0) {
 115                                 break;
 116                         }
 117                 }
 118                 if (ret != 0) {
 119                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 120                                   strerror(ret)));
 121                         return false;
 122                 }
 123         }
 124 #endif
 125
 126         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 127                 bool ok;
 128
 129                 do {
 130                         ok = fcntl_lock(
 131                                 xconn->smb1.echo_handler.socket_lock_fd,
 132                                 F_SETLKW, 0, 0, F_WRLCK);
 133                 } while (!ok && (errno == EINTR));
 134
 135                 if (!ok) {
 136                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 137                         return false;
 138                 }
 139         }
 140
 141         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 142
 143         return true;
 144 }
 145
 146 void smbd_lock_socket(struct smbXsrv_connection *xconn)
 147 {
 148         if (!smbd_lock_socket_internal(xconn)) {
 149                 exit_server_cleanly("failed to lock socket");
 150         }
 151 }
 152
 153 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
 154 {
 155         if (!smbd_echo_active(xconn)) {
 156                 return true;
 157         }
 158
 159         xconn->smb1.echo_handler.ref_count--;
 160
 161         if (xconn->smb1.echo_handler.ref_count > 0) {
 162                 return true;
 163         }
 164
 165 #ifdef HAVE_ROBUST_MUTEXES
 166         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 167                 int ret;
 168                 ret = pthread_mutex_unlock(
 169                         xconn->smb1.echo_handler.socket_mutex);
 170                 if (ret != 0) {
 171                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 172                                   strerror(ret)));
 173                         return false;
 174                 }
 175         }
 176 #endif
 177
 178         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 179                 bool ok;
 180
 181                 do {
 182                         ok = fcntl_lock(
 183                                 xconn->smb1.echo_handler.socket_lock_fd,
 184                                 F_SETLKW, 0, 0, F_UNLCK);
 185                 } while (!ok && (errno == EINTR));
 186
 187                 if (!ok) {
 188                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 189                         return false;
 190                 }
 191         }
 192
 193         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 194
 195         return true;
 196 }
 197
 198 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
 199 {
 200         if (!smbd_unlock_socket_internal(xconn)) {
 201                 exit_server_cleanly("failed to unlock socket");
 202         }
 203 }
 204
 205 /* Accessor function for smb_read_error for smbd functions. */
 206
 207 /****************************************************************************
 208  Send an smb to a fd.
 209 ****************************************************************************/
 210
 211 bool srv_send_smb(struct smbXsrv_connection *xconn, char *buffer,
 212                   bool do_signing, uint32_t seqnum,
 213                   bool do_encrypt,
 214                   struct smb_perfcount_data *pcd)
 215 {
 216         size_t len = 0;
 217         ssize_t ret;
 218         char *buf_out = buffer;
 219
 220         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 221                 /*
 222                  * we're not supposed to do any io
 223                  */
 224                 return true;
 225         }
 226
 227         smbd_lock_socket(xconn);
 228
 229         if (do_signing) {
 230                 /* Sign the outgoing packet if required. */
 231                 srv_calculate_sign_mac(xconn, buf_out, seqnum);
 232         }
 233
 234         if (do_encrypt) {
 235                 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
 236                 if (!NT_STATUS_IS_OK(status)) {
 237                         DEBUG(0, ("send_smb: SMB encryption failed "
 238                                 "on outgoing packet! Error %s\n",
 239                                 nt_errstr(status) ));
 240                         ret = -1;
 241                         goto out;
 242                 }
 243         }
 244
 245         len = smb_len_large(buf_out) + 4;
 246
 247         ret = write_data(xconn->transport.sock, buf_out, len);
 248         if (ret <= 0) {
 249                 int saved_errno = errno;
 250                 /*
 251                  * Try and give an error message saying what
 252                  * client failed.
 253                  */
 254                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 255                          (int)getpid(), (int)len,
 256                          smbXsrv_connection_dbg(xconn),
 257                          (int)ret, strerror(saved_errno)));
 258                 errno = saved_errno;
 259
 260                 srv_free_enc_buffer(xconn, buf_out);
 261                 goto out;
 262         }
 263
 264         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 265         srv_free_enc_buffer(xconn, buf_out);
 266 out:
 267         SMB_PERFCOUNT_END(pcd);
 268
 269         smbd_unlock_socket(xconn);
 270         return (ret > 0);
 271 }
 272
 273 /*******************************************************************
 274  Setup the word count and byte count for a smb message.
 275 ********************************************************************/
 276
 277 size_t srv_set_message(char *buf,
 278                        size_t num_words,
 279                        size_t num_bytes,
 280                        bool zero)
 281 {
 282         if (zero && (num_words || num_bytes)) {
 283                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 284         }
 285         SCVAL(buf,smb_wct,num_words);
 286         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 287         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 288         return (smb_size + num_words*2 + num_bytes);
 289 }
 290
 291 static bool valid_smb_header(const uint8_t *inbuf)
 292 {
 293         if (is_encrypted_packet(inbuf)) {
 294                 return true;
 295         }
 296         /*
 297          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 298          * but it just looks weird to call strncmp for this one.
 299          */
 300         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 301 }
 302
 303 /* Socket functions for smbd packet processing. */
 304
 305 static bool valid_packet_size(size_t len)
 306 {
 307         /*
 308          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 309          * of header. Don't print the error if this fits.... JRA.
 310          */
 311
 312         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 313                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 314                                         (unsigned long)len));
 315                 return false;
 316         }
 317         return true;
 318 }
 319
 320 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 321                                       unsigned int timeout, ssize_t len)
 322 {
 323         NTSTATUS status;
 324
 325         if (len <= 0) {
 326                 return NT_STATUS_OK;
 327         }
 328
 329         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 330         if (!NT_STATUS_IS_OK(status)) {
 331                 char addr[INET6_ADDRSTRLEN];
 332                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 333                           "error = %s.\n",
 334                           get_peer_addr(fd, addr, sizeof(addr)),
 335                           nt_errstr(status)));
 336         }
 337         return status;
 338 }
 339
 340 /****************************************************************************
 341  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 342 ****************************************************************************/
 343
 344 /*
 345  * Unfortunately, earlier versions of smbclient/libsmbclient
 346  * don't send this "standard" writeX header. I've fixed this
 347  * for 3.2 but we'll use the old method with earlier versions.
 348  * Windows and CIFSFS at least use this standard size. Not
 349  * sure about MacOSX.
 350  */
 351
 352 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 353                                 (2*14) + /* word count (including bcc) */ \
 354                                 1 /* pad byte */)
 355
 356 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 357                                                     const char lenbuf[4],
 358                                                     struct smbXsrv_connection *xconn,
 359                                                     int sock,
 360                                                     char **buffer,
 361                                                     unsigned int timeout,
 362                                                     size_t *p_unread,
 363                                                     size_t *len_ret)
 364 {
 365         /* Size of a WRITEX call (+4 byte len). */
 366         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 367         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 368         ssize_t toread;
 369         NTSTATUS status;
 370
 371         memcpy(writeX_header, lenbuf, 4);
 372
 373         status = read_fd_with_timeout(
 374                 sock, writeX_header + 4,
 375                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 376                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 377                 timeout, NULL);
 378
 379         if (!NT_STATUS_IS_OK(status)) {
 380                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 381                           "error = %s.\n",
 382                           smbXsrv_connection_dbg(xconn),
 383                           nt_errstr(status)));
 384                 return status;
 385         }
 386
 387         /*
 388          * Ok - now try and see if this is a possible
 389          * valid writeX call.
 390          */
 391
 392         if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
 393                 /*
 394                  * If the data offset is beyond what
 395                  * we've read, drain the extra bytes.
 396                  */
 397                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 398                 ssize_t newlen;
 399
 400                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 401                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 402                         if (drain_socket(sock, drain) != drain) {
 403                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 404                                         " failed to drain pending bytes");
 405                         }
 406                 } else {
 407                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 408                 }
 409
 410                 /* Spoof down the length and null out the bcc. */
 411                 set_message_bcc(writeX_header, 0);
 412                 newlen = smb_len(writeX_header);
 413
 414                 /* Copy the header we've written. */
 415
 416                 *buffer = (char *)talloc_memdup(mem_ctx,
 417                                 writeX_header,
 418                                 sizeof(writeX_header));
 419
 420                 if (*buffer == NULL) {
 421                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 422                                   (int)sizeof(writeX_header)));
 423                         return NT_STATUS_NO_MEMORY;
 424                 }
 425
 426                 /* Work out the remaining bytes. */
 427                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 428                 *len_ret = newlen + 4;
 429                 return NT_STATUS_OK;
 430         }
 431
 432         if (!valid_packet_size(len)) {
 433                 return NT_STATUS_INVALID_PARAMETER;
 434         }
 435
 436         /*
 437          * Not a valid writeX call. Just do the standard
 438          * talloc and return.
 439          */
 440
 441         *buffer = talloc_array(mem_ctx, char, len+4);
 442
 443         if (*buffer == NULL) {
 444                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 445                           (int)len+4));
 446                 return NT_STATUS_NO_MEMORY;
 447         }
 448
 449         /* Copy in what we already read. */
 450         memcpy(*buffer,
 451                 writeX_header,
 452                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 453         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 454
 455         if(toread > 0) {
 456                 status = read_packet_remainder(
 457                         sock,
 458                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 459                         timeout, toread);
 460
 461                 if (!NT_STATUS_IS_OK(status)) {
 462                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 463                                    nt_errstr(status)));
 464                         return status;
 465                 }
 466         }
 467
 468         *len_ret = len + 4;
 469         return NT_STATUS_OK;
 470 }
 471
 472 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 473                                        struct smbXsrv_connection *xconn,
 474                                        int sock,
 475                                        char **buffer, unsigned int timeout,
 476                                        size_t *p_unread, size_t *plen)
 477 {
 478         char lenbuf[4];
 479         size_t len;
 480         int min_recv_size = lp_min_receive_file_size();
 481         NTSTATUS status;
 482
 483         *p_unread = 0;
 484
 485         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 486                                                   &len);
 487         if (!NT_STATUS_IS_OK(status)) {
 488                 return status;
 489         }
 490
 491         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 492             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 493                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 494             !srv_is_signing_active(xconn) &&
 495             xconn->smb1.echo_handler.trusted_fde == NULL) {
 496
 497                 return receive_smb_raw_talloc_partial_read(
 498                         mem_ctx, lenbuf, xconn, sock, buffer, timeout,
 499                         p_unread, plen);
 500         }
 501
 502         if (!valid_packet_size(len)) {
 503                 return NT_STATUS_INVALID_PARAMETER;
 504         }
 505
 506         /*
 507          * The +4 here can't wrap, we've checked the length above already.
 508          */
 509
 510         *buffer = talloc_array(mem_ctx, char, len+4);
 511
 512         if (*buffer == NULL) {
 513                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 514                           (int)len+4));
 515                 return NT_STATUS_NO_MEMORY;
 516         }
 517
 518         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 519
 520         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 521         if (!NT_STATUS_IS_OK(status)) {
 522                 return status;
 523         }
 524
 525         *plen = len + 4;
 526         return NT_STATUS_OK;
 527 }
 528
 529 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 530                                    struct smbXsrv_connection *xconn,
 531                                    int sock,
 532                                    char **buffer, unsigned int timeout,
 533                                    size_t *p_unread, bool *p_encrypted,
 534                                    size_t *p_len,
 535                                    uint32_t *seqnum,
 536                                    bool trusted_channel)
 537 {
 538         size_t len = 0;
 539         NTSTATUS status;
 540
 541         *p_encrypted = false;
 542
 543         status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
 544                                         p_unread, &len);
 545         if (!NT_STATUS_IS_OK(status)) {
 546                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 547                       ("receive_smb_raw_talloc failed for client %s "
 548                        "read error = %s.\n",
 549                        smbXsrv_connection_dbg(xconn),
 550                        nt_errstr(status)) );
 551                 return status;
 552         }
 553
 554         if (is_encrypted_packet((uint8_t *)*buffer)) {
 555                 status = srv_decrypt_buffer(xconn, *buffer);
 556                 if (!NT_STATUS_IS_OK(status)) {
 557                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 558                                 "incoming packet! Error %s\n",
 559                                 nt_errstr(status) ));
 560                         return status;
 561                 }
 562                 *p_encrypted = true;
 563         }
 564
 565         /* Check the incoming SMB signature. */
 566         if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
 567                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 568                           "incoming packet!\n"));
 569                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 570         }
 571
 572         *p_len = len;
 573         return NT_STATUS_OK;
 574 }
 575
 576 /*
 577  * Initialize a struct smb_request from an inbuf
 578  */
 579
 580 static bool init_smb_request(struct smb_request *req,
 581                              struct smbd_server_connection *sconn,
 582                              struct smbXsrv_connection *xconn,
 583                              const uint8_t *inbuf,
 584                              size_t unread_bytes, bool encrypted,
 585                              uint32_t seqnum)
 586 {
 587         struct smbXsrv_tcon *tcon;
 588         NTSTATUS status;
 589         NTTIME now;
 590         size_t req_size = smb_len(inbuf) + 4;
 591
 592         /* Ensure we have at least smb_size bytes. */
 593         if (req_size < smb_size) {
 594                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 595                         (unsigned int)req_size ));
 596                 return false;
 597         }
 598
 599         req->request_time = timeval_current();
 600         now = timeval_to_nttime(&req->request_time);
 601
 602         req->cmd    = CVAL(inbuf, smb_com);
 603         req->flags2 = SVAL(inbuf, smb_flg2);
 604         req->smbpid = SVAL(inbuf, smb_pid);
 605         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 606         req->seqnum = seqnum;
 607         req->vuid   = SVAL(inbuf, smb_uid);
 608         req->tid    = SVAL(inbuf, smb_tid);
 609         req->wct    = CVAL(inbuf, smb_wct);
 610         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 611         req->buflen = smb_buflen(inbuf);
 612         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 613         req->unread_bytes = unread_bytes;
 614         req->encrypted = encrypted;
 615         req->sconn = sconn;
 616         req->xconn = xconn;
 617         req->conn = NULL;
 618         if (xconn != NULL) {
 619                 status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
 620                 if (NT_STATUS_IS_OK(status)) {
 621                         req->conn = tcon->compat;
 622                 }
 623         }
 624         req->chain_fsp = NULL;
 625         req->smb2req = NULL;
 626         req->priv_paths = NULL;
 627         req->chain = NULL;
 628         req->posix_pathnames = lp_posix_pathnames();
 629         smb_init_perfcount_data(&req->pcd);
 630
 631         /* Ensure we have at least wct words and 2 bytes of bcc. */
 632         if (smb_size + req->wct*2 > req_size) {
 633                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 634                         (unsigned int)req->wct,
 635                         (unsigned int)req_size));
 636                 return false;
 637         }
 638         /* Ensure bcc is correct. */
 639         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 640                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 641                         "(wct = %u, size %u)\n",
 642                         (unsigned int)req->buflen,
 643                         (unsigned int)req->wct,
 644                         (unsigned int)req_size));
 645                 return false;
 646         }
 647
 648         req->outbuf = NULL;
 649         return true;
 650 }
 651
 652 static void process_smb(struct smbXsrv_connection *xconn,
 653                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 654                         uint32_t seqnum, bool encrypted,
 655                         struct smb_perfcount_data *deferred_pcd);
 656
 657 static void smbd_deferred_open_timer(struct tevent_context *ev,
 658                                      struct tevent_timer *te,
 659                                      struct timeval _tval,
 660                                      void *private_data)
 661 {
 662         struct pending_message_list *msg = talloc_get_type(private_data,
 663                                            struct pending_message_list);
 664         struct smbd_server_connection *sconn = msg->sconn;
 665         struct smbXsrv_connection *xconn = msg->xconn;
 666         TALLOC_CTX *mem_ctx = talloc_tos();
 667         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 668         uint8_t *inbuf;
 669
 670         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 671                                          msg->buf.length);
 672         if (inbuf == NULL) {
 673                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 674                 return;
 675         }
 676
 677         /* We leave this message on the queue so the open code can
 678            know this is a retry. */
 679         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 680                 (unsigned long long)mid ));
 681
 682         /* Mark the message as processed so this is not
 683          * re-processed in error. */
 684         msg->processed = true;
 685
 686         process_smb(xconn, inbuf,
 687                     msg->buf.length, 0,
 688                     msg->seqnum, msg->encrypted, &msg->pcd);
 689
 690         /* If it's still there and was processed, remove it. */
 691         msg = get_deferred_open_message_smb(sconn, mid);
 692         if (msg && msg->processed) {
 693                 remove_deferred_open_message_smb(xconn, mid);
 694         }
 695 }
 696
 697 /****************************************************************************
 698  Function to push a message onto the tail of a linked list of smb messages ready
 699  for processing.
 700 ****************************************************************************/
 701
 702 static bool push_queued_message(struct smb_request *req,
 703                                 struct timeval request_time,
 704                                 struct timeval end_time,
 705                                 struct deferred_open_record *open_rec)
 706 {
 707         int msg_len = smb_len(req->inbuf) + 4;
 708         struct pending_message_list *msg;
 709
 710         msg = talloc_zero(NULL, struct pending_message_list);
 711
 712         if(msg == NULL) {
 713                 DEBUG(0,("push_message: malloc fail (1)\n"));
 714                 return False;
 715         }
 716         msg->sconn = req->sconn;
 717         msg->xconn = req->xconn;
 718
 719         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 720         if(msg->buf.data == NULL) {
 721                 DEBUG(0,("push_message: malloc fail (2)\n"));
 722                 TALLOC_FREE(msg);
 723                 return False;
 724         }
 725
 726         msg->request_time = request_time;
 727         msg->seqnum = req->seqnum;
 728         msg->encrypted = req->encrypted;
 729         msg->processed = false;
 730         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 731
 732         if (open_rec) {
 733                 msg->open_rec = talloc_move(msg, &open_rec);
 734         }
 735
 736 #if 0
 737         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 738                                    msg,
 739                                    end_time,
 740                                    smbd_deferred_open_timer,
 741                                    msg);
 742         if (!msg->te) {
 743                 DEBUG(0,("push_message: event_add_timed failed\n"));
 744                 TALLOC_FREE(msg);
 745                 return false;
 746         }
 747 #endif
 748
 749         DLIST_ADD_END(req->sconn->deferred_open_queue, msg);
 750
 751         DEBUG(10,("push_message: pushed message length %u on "
 752                   "deferred_open_queue\n", (unsigned int)msg_len));
 753
 754         return True;
 755 }
 756
 757 /****************************************************************************
 758  Function to delete a sharing violation open message by mid.
 759 ****************************************************************************/
 760
 761 void remove_deferred_open_message_smb(struct smbXsrv_connection *xconn,
 762                                       uint64_t mid)
 763 {
 764         struct smbd_server_connection *sconn = xconn->client->sconn;
 765         struct pending_message_list *pml;
 766
 767         if (sconn->using_smb2) {
 768                 remove_deferred_open_message_smb2(xconn, mid);
 769                 return;
 770         }
 771
 772         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 773                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 774                         DEBUG(10,("remove_deferred_open_message_smb: "
 775                                   "deleting mid %llu len %u\n",
 776                                   (unsigned long long)mid,
 777                                   (unsigned int)pml->buf.length ));
 778                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 779                         TALLOC_FREE(pml);
 780                         return;
 781                 }
 782         }
 783 }
 784
 785 /****************************************************************************
 786  Move a sharing violation open retry message to the front of the list and
 787  schedule it for immediate processing.
 788 ****************************************************************************/
 789
 790 bool schedule_deferred_open_message_smb(struct smbXsrv_connection *xconn,
 791                                         uint64_t mid)
 792 {
 793         struct smbd_server_connection *sconn = xconn->client->sconn;
 794         struct pending_message_list *pml;
 795         int i = 0;
 796
 797         if (sconn->using_smb2) {
 798                 return schedule_deferred_open_message_smb2(xconn, mid);
 799         }
 800
 801         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 802                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 803
 804                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 805                         "msg_mid = %llu\n",
 806                         i++,
 807                         (unsigned long long)msg_mid ));
 808
 809                 if (mid == msg_mid) {
 810                         struct tevent_timer *te;
 811
 812                         if (pml->processed) {
 813                                 /* A processed message should not be
 814                                  * rescheduled. */
 815                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 816                                         "message mid %llu was already processed\n",
 817                                         (unsigned long long)msg_mid ));
 818                                 continue;
 819                         }
 820
 821                         DEBUG(10,("schedule_deferred_open_message_smb: "
 822                                 "scheduling mid %llu\n",
 823                                 (unsigned long long)mid ));
 824
 825                         /*
 826                          * smbd_deferred_open_timer() calls
 827                          * process_smb() to redispatch the request
 828                          * including the required impersonation.
 829                          *
 830                          * So we can just use the raw tevent_context.
 831                          */
 832                         te = tevent_add_timer(xconn->client->raw_ev_ctx,
 833                                               pml,
 834                                               timeval_zero(),
 835                                               smbd_deferred_open_timer,
 836                                               pml);
 837                         if (!te) {
 838                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 839                                         "event_add_timed() failed, "
 840                                         "skipping mid %llu\n",
 841                                         (unsigned long long)msg_mid ));
 842                         }
 843
 844                         TALLOC_FREE(pml->te);
 845                         pml->te = te;
 846                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 847                         return true;
 848                 }
 849         }
 850
 851         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 852                 "find message mid %llu\n",
 853                 (unsigned long long)mid ));
 854
 855         return false;
 856 }
 857
 858 /****************************************************************************
 859  Return true if this mid is on the deferred queue and was not yet processed.
 860 ****************************************************************************/
 861
 862 bool open_was_deferred(struct smbXsrv_connection *xconn, uint64_t mid)
 863 {
 864         struct smbd_server_connection *sconn = xconn->client->sconn;
 865         struct pending_message_list *pml;
 866
 867         if (sconn->using_smb2) {
 868                 return open_was_deferred_smb2(xconn, mid);
 869         }
 870
 871         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 872                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 873                         return True;
 874                 }
 875         }
 876         return False;
 877 }
 878
 879 /****************************************************************************
 880  Return the message queued by this mid.
 881 ****************************************************************************/
 882
 883 static struct pending_message_list *get_deferred_open_message_smb(
 884         struct smbd_server_connection *sconn, uint64_t mid)
 885 {
 886         struct pending_message_list *pml;
 887
 888         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 889                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 890                         return pml;
 891                 }
 892         }
 893         return NULL;
 894 }
 895
 896 /****************************************************************************
 897  Get the state data queued by this mid.
 898 ****************************************************************************/
 899
 900 bool get_deferred_open_message_state(struct smb_request *smbreq,
 901                                 struct timeval *p_request_time,
 902                                 struct deferred_open_record **open_rec)
 903 {
 904         struct pending_message_list *pml;
 905
 906         if (smbreq->sconn->using_smb2) {
 907                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 908                                         p_request_time,
 909                                         open_rec);
 910         }
 911
 912         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 913         if (!pml) {
 914                 return false;
 915         }
 916         if (p_request_time) {
 917                 *p_request_time = pml->request_time;
 918         }
 919         if (open_rec != NULL) {
 920                 *open_rec = pml->open_rec;
 921         }
 922         return true;
 923 }
 924
 925 /****************************************************************************
 926  Function to push a deferred open smb message onto a linked list of local smb
 927  messages ready for processing.
 928 ****************************************************************************/
 929
 930 bool push_deferred_open_message_smb(struct smb_request *req,
 931                                struct timeval request_time,
 932                                struct timeval timeout,
 933                                struct file_id id,
 934                                struct deferred_open_record *open_rec)
 935 {
 936         struct timeval end_time;
 937
 938         if (req->smb2req) {
 939                 return push_deferred_open_message_smb2(req->smb2req,
 940                                                 request_time,
 941                                                 timeout,
 942                                                 id,
 943                                                 open_rec);
 944         }
 945
 946         if (req->unread_bytes) {
 947                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 948                         "unread_bytes = %u\n",
 949                         (unsigned int)req->unread_bytes ));
 950                 smb_panic("push_deferred_open_message_smb: "
 951                         "logic error unread_bytes != 0" );
 952         }
 953
 954         end_time = timeval_sum(&request_time, &timeout);
 955
 956         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 957                 "len %u mid %llu timeout time [%u.%06u]\n",
 958                 (unsigned int) smb_len(req->inbuf)+4,
 959                 (unsigned long long)req->mid,
 960                 (unsigned int)end_time.tv_sec,
 961                 (unsigned int)end_time.tv_usec));
 962
 963         return push_queued_message(req, request_time, end_time, open_rec);
 964 }
 965
 966 static void smbd_sig_term_handler(struct tevent_context *ev,
 967                                   struct tevent_signal *se,
 968                                   int signum,
 969                                   int count,
 970                                   void *siginfo,
 971                                   void *private_data)
 972 {
 973         exit_server_cleanly("termination signal");
 974 }
 975
 976 static void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 977 {
 978         struct tevent_signal *se;
 979
 980         se = tevent_add_signal(sconn->ev_ctx,
 981                                sconn,
 982                                SIGTERM, 0,
 983                                smbd_sig_term_handler,
 984                                sconn);
 985         if (!se) {
 986                 exit_server("failed to setup SIGTERM handler");
 987         }
 988 }
 989
 990 static void smbd_sig_hup_handler(struct tevent_context *ev,
 991                                   struct tevent_signal *se,
 992                                   int signum,
 993                                   int count,
 994                                   void *siginfo,
 995                                   void *private_data)
 996 {
 997         struct smbd_server_connection *sconn =
 998                 talloc_get_type_abort(private_data,
 999                 struct smbd_server_connection);
1000
1001         change_to_root_user();
1002         DEBUG(1,("Reloading services after SIGHUP\n"));
1003         reload_services(sconn, conn_snum_used, false);
1004 }
1005
1006 static void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1007 {
1008         struct tevent_signal *se;
1009
1010         se = tevent_add_signal(sconn->ev_ctx,
1011                                sconn,
1012                                SIGHUP, 0,
1013                                smbd_sig_hup_handler,
1014                                sconn);
1015         if (!se) {
1016                 exit_server("failed to setup SIGHUP handler");
1017         }
1018 }
1019
1020 static void smbd_conf_updated(struct messaging_context *msg,
1021                               void *private_data,
1022                               uint32_t msg_type,
1023                               struct server_id server_id,
1024                               DATA_BLOB *data)
1025 {
1026         struct smbd_server_connection *sconn =
1027                 talloc_get_type_abort(private_data,
1028                 struct smbd_server_connection);
1029
1030         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1031                   "updated. Reloading.\n"));
1032         change_to_root_user();
1033         reload_services(sconn, conn_snum_used, false);
1034 }
1035
1036 /*
1037  * Only allow 5 outstanding trans requests. We're allocating memory, so
1038  * prevent a DoS.
1039  */
1040
1041 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1042 {
1043         int count = 0;
1044         for (; list != NULL; list = list->next) {
1045
1046                 if (list->mid == mid) {
1047                         return NT_STATUS_INVALID_PARAMETER;
1048                 }
1049
1050                 count += 1;
1051         }
1052         if (count > 5) {
1053                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1054         }
1055
1056         return NT_STATUS_OK;
1057 }
1058
1059 /*
1060 These flags determine some of the permissions required to do an operation
1061
1062 Note that I don't set NEED_WRITE on some write operations because they
1063 are used by some brain-dead clients when printing, and I don't want to
1064 force write permissions on print services.
1065 */
1066 #define AS_USER (1<<0)
1067 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1068 #define TIME_INIT (1<<2)
1069 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1070 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1071 #define DO_CHDIR (1<<6)
1072
1073 /*
1074    define a list of possible SMB messages and their corresponding
1075    functions. Any message that has a NULL function is unimplemented -
1076    please feel free to contribute implementations!
1077 */
1078 static const struct smb_message_struct {
1079         const char *name;
1080         void (*fn)(struct smb_request *req);
1081         int flags;
1082 } smb_messages[256] = {
1083
1084 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1085 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1086 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1087 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1088 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1089 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1090 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1091 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1092 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1093 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1094 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1095 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1096 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1097 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1098 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1099 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1100 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1101 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1102 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1103 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1104 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1105 /* 0x15 */ { NULL, NULL, 0 },
1106 /* 0x16 */ { NULL, NULL, 0 },
1107 /* 0x17 */ { NULL, NULL, 0 },
1108 /* 0x18 */ { NULL, NULL, 0 },
1109 /* 0x19 */ { NULL, NULL, 0 },
1110 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1111 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1112 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1113 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1114 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1115 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1116 /* 0x20 */ { "SMBwritec", NULL,0},
1117 /* 0x21 */ { NULL, NULL, 0 },
1118 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1119 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1120 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1121 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1122 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1123 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1124 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1125 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1126 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1127 /* 0x2b */ { "SMBecho",reply_echo,0},
1128 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1129 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1130 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1131 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1132 /* 0x30 */ { NULL, NULL, 0 },
1133 /* 0x31 */ { NULL, NULL, 0 },
1134 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1135 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1136 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1137 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1138 /* 0x36 */ { NULL, NULL, 0 },
1139 /* 0x37 */ { NULL, NULL, 0 },
1140 /* 0x38 */ { NULL, NULL, 0 },
1141 /* 0x39 */ { NULL, NULL, 0 },
1142 /* 0x3a */ { NULL, NULL, 0 },
1143 /* 0x3b */ { NULL, NULL, 0 },
1144 /* 0x3c */ { NULL, NULL, 0 },
1145 /* 0x3d */ { NULL, NULL, 0 },
1146 /* 0x3e */ { NULL, NULL, 0 },
1147 /* 0x3f */ { NULL, NULL, 0 },
1148 /* 0x40 */ { NULL, NULL, 0 },
1149 /* 0x41 */ { NULL, NULL, 0 },
1150 /* 0x42 */ { NULL, NULL, 0 },
1151 /* 0x43 */ { NULL, NULL, 0 },
1152 /* 0x44 */ { NULL, NULL, 0 },
1153 /* 0x45 */ { NULL, NULL, 0 },
1154 /* 0x46 */ { NULL, NULL, 0 },
1155 /* 0x47 */ { NULL, NULL, 0 },
1156 /* 0x48 */ { NULL, NULL, 0 },
1157 /* 0x49 */ { NULL, NULL, 0 },
1158 /* 0x4a */ { NULL, NULL, 0 },
1159 /* 0x4b */ { NULL, NULL, 0 },
1160 /* 0x4c */ { NULL, NULL, 0 },
1161 /* 0x4d */ { NULL, NULL, 0 },
1162 /* 0x4e */ { NULL, NULL, 0 },
1163 /* 0x4f */ { NULL, NULL, 0 },
1164 /* 0x50 */ { NULL, NULL, 0 },
1165 /* 0x51 */ { NULL, NULL, 0 },
1166 /* 0x52 */ { NULL, NULL, 0 },
1167 /* 0x53 */ { NULL, NULL, 0 },
1168 /* 0x54 */ { NULL, NULL, 0 },
1169 /* 0x55 */ { NULL, NULL, 0 },
1170 /* 0x56 */ { NULL, NULL, 0 },
1171 /* 0x57 */ { NULL, NULL, 0 },
1172 /* 0x58 */ { NULL, NULL, 0 },
1173 /* 0x59 */ { NULL, NULL, 0 },
1174 /* 0x5a */ { NULL, NULL, 0 },
1175 /* 0x5b */ { NULL, NULL, 0 },
1176 /* 0x5c */ { NULL, NULL, 0 },
1177 /* 0x5d */ { NULL, NULL, 0 },
1178 /* 0x5e */ { NULL, NULL, 0 },
1179 /* 0x5f */ { NULL, NULL, 0 },
1180 /* 0x60 */ { NULL, NULL, 0 },
1181 /* 0x61 */ { NULL, NULL, 0 },
1182 /* 0x62 */ { NULL, NULL, 0 },
1183 /* 0x63 */ { NULL, NULL, 0 },
1184 /* 0x64 */ { NULL, NULL, 0 },
1185 /* 0x65 */ { NULL, NULL, 0 },
1186 /* 0x66 */ { NULL, NULL, 0 },
1187 /* 0x67 */ { NULL, NULL, 0 },
1188 /* 0x68 */ { NULL, NULL, 0 },
1189 /* 0x69 */ { NULL, NULL, 0 },
1190 /* 0x6a */ { NULL, NULL, 0 },
1191 /* 0x6b */ { NULL, NULL, 0 },
1192 /* 0x6c */ { NULL, NULL, 0 },
1193 /* 0x6d */ { NULL, NULL, 0 },
1194 /* 0x6e */ { NULL, NULL, 0 },
1195 /* 0x6f */ { NULL, NULL, 0 },
1196 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1197 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1198 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1199 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1200 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1201 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1202 /* 0x76 */ { NULL, NULL, 0 },
1203 /* 0x77 */ { NULL, NULL, 0 },
1204 /* 0x78 */ { NULL, NULL, 0 },
1205 /* 0x79 */ { NULL, NULL, 0 },
1206 /* 0x7a */ { NULL, NULL, 0 },
1207 /* 0x7b */ { NULL, NULL, 0 },
1208 /* 0x7c */ { NULL, NULL, 0 },
1209 /* 0x7d */ { NULL, NULL, 0 },
1210 /* 0x7e */ { NULL, NULL, 0 },
1211 /* 0x7f */ { NULL, NULL, 0 },
1212 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1213 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1214 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1215 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1216 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1217 /* 0x85 */ { NULL, NULL, 0 },
1218 /* 0x86 */ { NULL, NULL, 0 },
1219 /* 0x87 */ { NULL, NULL, 0 },
1220 /* 0x88 */ { NULL, NULL, 0 },
1221 /* 0x89 */ { NULL, NULL, 0 },
1222 /* 0x8a */ { NULL, NULL, 0 },
1223 /* 0x8b */ { NULL, NULL, 0 },
1224 /* 0x8c */ { NULL, NULL, 0 },
1225 /* 0x8d */ { NULL, NULL, 0 },
1226 /* 0x8e */ { NULL, NULL, 0 },
1227 /* 0x8f */ { NULL, NULL, 0 },
1228 /* 0x90 */ { NULL, NULL, 0 },
1229 /* 0x91 */ { NULL, NULL, 0 },
1230 /* 0x92 */ { NULL, NULL, 0 },
1231 /* 0x93 */ { NULL, NULL, 0 },
1232 /* 0x94 */ { NULL, NULL, 0 },
1233 /* 0x95 */ { NULL, NULL, 0 },
1234 /* 0x96 */ { NULL, NULL, 0 },
1235 /* 0x97 */ { NULL, NULL, 0 },
1236 /* 0x98 */ { NULL, NULL, 0 },
1237 /* 0x99 */ { NULL, NULL, 0 },
1238 /* 0x9a */ { NULL, NULL, 0 },
1239 /* 0x9b */ { NULL, NULL, 0 },
1240 /* 0x9c */ { NULL, NULL, 0 },
1241 /* 0x9d */ { NULL, NULL, 0 },
1242 /* 0x9e */ { NULL, NULL, 0 },
1243 /* 0x9f */ { NULL, NULL, 0 },
1244 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1245 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1246 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1247 /* 0xa3 */ { NULL, NULL, 0 },
1248 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1249 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1250 /* 0xa6 */ { NULL, NULL, 0 },
1251 /* 0xa7 */ { NULL, NULL, 0 },
1252 /* 0xa8 */ { NULL, NULL, 0 },
1253 /* 0xa9 */ { NULL, NULL, 0 },
1254 /* 0xaa */ { NULL, NULL, 0 },
1255 /* 0xab */ { NULL, NULL, 0 },
1256 /* 0xac */ { NULL, NULL, 0 },
1257 /* 0xad */ { NULL, NULL, 0 },
1258 /* 0xae */ { NULL, NULL, 0 },
1259 /* 0xaf */ { NULL, NULL, 0 },
1260 /* 0xb0 */ { NULL, NULL, 0 },
1261 /* 0xb1 */ { NULL, NULL, 0 },
1262 /* 0xb2 */ { NULL, NULL, 0 },
1263 /* 0xb3 */ { NULL, NULL, 0 },
1264 /* 0xb4 */ { NULL, NULL, 0 },
1265 /* 0xb5 */ { NULL, NULL, 0 },
1266 /* 0xb6 */ { NULL, NULL, 0 },
1267 /* 0xb7 */ { NULL, NULL, 0 },
1268 /* 0xb8 */ { NULL, NULL, 0 },
1269 /* 0xb9 */ { NULL, NULL, 0 },
1270 /* 0xba */ { NULL, NULL, 0 },
1271 /* 0xbb */ { NULL, NULL, 0 },
1272 /* 0xbc */ { NULL, NULL, 0 },
1273 /* 0xbd */ { NULL, NULL, 0 },
1274 /* 0xbe */ { NULL, NULL, 0 },
1275 /* 0xbf */ { NULL, NULL, 0 },
1276 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1277 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1278 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1279 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1280 /* 0xc4 */ { NULL, NULL, 0 },
1281 /* 0xc5 */ { NULL, NULL, 0 },
1282 /* 0xc6 */ { NULL, NULL, 0 },
1283 /* 0xc7 */ { NULL, NULL, 0 },
1284 /* 0xc8 */ { NULL, NULL, 0 },
1285 /* 0xc9 */ { NULL, NULL, 0 },
1286 /* 0xca */ { NULL, NULL, 0 },
1287 /* 0xcb */ { NULL, NULL, 0 },
1288 /* 0xcc */ { NULL, NULL, 0 },
1289 /* 0xcd */ { NULL, NULL, 0 },
1290 /* 0xce */ { NULL, NULL, 0 },
1291 /* 0xcf */ { NULL, NULL, 0 },
1292 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1293 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1294 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1295 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1296 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1297 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1298 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1299 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1300 /* 0xd8 */ { NULL, NULL, 0 },
1301 /* 0xd9 */ { NULL, NULL, 0 },
1302 /* 0xda */ { NULL, NULL, 0 },
1303 /* 0xdb */ { NULL, NULL, 0 },
1304 /* 0xdc */ { NULL, NULL, 0 },
1305 /* 0xdd */ { NULL, NULL, 0 },
1306 /* 0xde */ { NULL, NULL, 0 },
1307 /* 0xdf */ { NULL, NULL, 0 },
1308 /* 0xe0 */ { NULL, NULL, 0 },
1309 /* 0xe1 */ { NULL, NULL, 0 },
1310 /* 0xe2 */ { NULL, NULL, 0 },
1311 /* 0xe3 */ { NULL, NULL, 0 },
1312 /* 0xe4 */ { NULL, NULL, 0 },
1313 /* 0xe5 */ { NULL, NULL, 0 },
1314 /* 0xe6 */ { NULL, NULL, 0 },
1315 /* 0xe7 */ { NULL, NULL, 0 },
1316 /* 0xe8 */ { NULL, NULL, 0 },
1317 /* 0xe9 */ { NULL, NULL, 0 },
1318 /* 0xea */ { NULL, NULL, 0 },
1319 /* 0xeb */ { NULL, NULL, 0 },
1320 /* 0xec */ { NULL, NULL, 0 },
1321 /* 0xed */ { NULL, NULL, 0 },
1322 /* 0xee */ { NULL, NULL, 0 },
1323 /* 0xef */ { NULL, NULL, 0 },
1324 /* 0xf0 */ { NULL, NULL, 0 },
1325 /* 0xf1 */ { NULL, NULL, 0 },
1326 /* 0xf2 */ { NULL, NULL, 0 },
1327 /* 0xf3 */ { NULL, NULL, 0 },
1328 /* 0xf4 */ { NULL, NULL, 0 },
1329 /* 0xf5 */ { NULL, NULL, 0 },
1330 /* 0xf6 */ { NULL, NULL, 0 },
1331 /* 0xf7 */ { NULL, NULL, 0 },
1332 /* 0xf8 */ { NULL, NULL, 0 },
1333 /* 0xf9 */ { NULL, NULL, 0 },
1334 /* 0xfa */ { NULL, NULL, 0 },
1335 /* 0xfb */ { NULL, NULL, 0 },
1336 /* 0xfc */ { NULL, NULL, 0 },
1337 /* 0xfd */ { NULL, NULL, 0 },
1338 /* 0xfe */ { NULL, NULL, 0 },
1339 /* 0xff */ { NULL, NULL, 0 }
1340
1341 };
1342
1343 /*******************************************************************
1344  allocate and initialize a reply packet
1345 ********************************************************************/
1346
1347 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1348                           const uint8_t *inbuf, char **outbuf,
1349                           uint8_t num_words, uint32_t num_bytes)
1350 {
1351         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1352
1353         /*
1354          * Protect against integer wrap.
1355          * The SMB layer reply can be up to 0xFFFFFF bytes.
1356          */
1357         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1358                 char *msg;
1359                 if (asprintf(&msg, "num_bytes too large: %u",
1360                              (unsigned)num_bytes) == -1) {
1361                         msg = discard_const_p(char, "num_bytes too large");
1362                 }
1363                 smb_panic(msg);
1364         }
1365
1366         /*
1367          * Here we include the NBT header for now.
1368          */
1369         *outbuf = talloc_array(mem_ctx, char,
1370                                NBT_HDR_SIZE + smb_len);
1371         if (*outbuf == NULL) {
1372                 return false;
1373         }
1374
1375         construct_reply_common(req->cmd, inbuf, *outbuf);
1376         srv_set_message(*outbuf, num_words, num_bytes, false);
1377         /*
1378          * Zero out the word area, the caller has to take care of the bcc area
1379          * himself
1380          */
1381         if (num_words != 0) {
1382                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1383         }
1384
1385         return true;
1386 }
1387
1388 void reply_outbuf(struct smb_request *req, uint8_t num_words, uint32_t num_bytes)
1389 {
1390         char *outbuf;
1391         if (!create_outbuf(req, req, req->inbuf, &outbuf, num_words,
1392                            num_bytes)) {
1393                 smb_panic("could not allocate output buffer\n");
1394         }
1395         req->outbuf = (uint8_t *)outbuf;
1396 }
1397
1398
1399 /*******************************************************************
1400  Dump a packet to a file.
1401 ********************************************************************/
1402
1403 static void smb_dump(const char *name, int type, const char *data)
1404 {
1405         size_t len;
1406         int fd, i;
1407         char *fname = NULL;
1408         if (DEBUGLEVEL < 50) {
1409                 return;
1410         }
1411
1412         len = smb_len_tcp(data)+4;
1413         for (i=1;i<100;i++) {
1414                 fname = talloc_asprintf(talloc_tos(),
1415                                 "/tmp/%s.%d.%s",
1416                                 name,
1417                                 i,
1418                                 type ? "req" : "resp");
1419                 if (fname == NULL) {
1420                         return;
1421                 }
1422                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1423                 if (fd != -1 || errno != EEXIST) break;
1424                 TALLOC_FREE(fname);
1425         }
1426         if (fd != -1) {
1427                 ssize_t ret = write(fd, data, len);
1428                 if (ret != len)
1429                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1430                 close(fd);
1431                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1432         }
1433         TALLOC_FREE(fname);
1434 }
1435
1436 static void smb1srv_update_crypto_flags(struct smbXsrv_session *session,
1437                                         struct smb_request *req,
1438                                         uint8_t type,
1439                                         bool *update_session_globalp,
1440                                         bool *update_tcon_globalp)
1441 {
1442         connection_struct *conn = req->conn;
1443         struct smbXsrv_tcon *tcon = conn ? conn->tcon : NULL;
1444         uint8_t encrypt_flag = SMBXSRV_PROCESSED_UNENCRYPTED_PACKET;
1445         uint8_t sign_flag = SMBXSRV_PROCESSED_UNSIGNED_PACKET;
1446         bool update_session = false;
1447         bool update_tcon = false;
1448
1449         if (req->encrypted) {
1450                 encrypt_flag = SMBXSRV_PROCESSED_ENCRYPTED_PACKET;
1451         }
1452
1453         if (srv_is_signing_active(req->xconn)) {
1454                 sign_flag = SMBXSRV_PROCESSED_SIGNED_PACKET;
1455         } else if ((type == SMBecho) || (type == SMBsesssetupX)) {
1456                 /*
1457                  * echo can be unsigned. Sesssion setup except final
1458                  * session setup response too
1459                  */
1460                 sign_flag &= ~SMBXSRV_PROCESSED_UNSIGNED_PACKET;
1461         }
1462
1463         update_session |= smbXsrv_set_crypto_flag(
1464                 &session->global->encryption_flags, encrypt_flag);
1465         update_session |= smbXsrv_set_crypto_flag(
1466                 &session->global->signing_flags, sign_flag);
1467
1468         if (tcon) {
1469                 update_tcon |= smbXsrv_set_crypto_flag(
1470                         &tcon->global->encryption_flags, encrypt_flag);
1471                 update_tcon |= smbXsrv_set_crypto_flag(
1472                         &tcon->global->signing_flags, sign_flag);
1473         }
1474
1475         if (update_session) {
1476                 session->global->channels[0].encryption_cipher = SMB_ENCRYPTION_GSSAPI;
1477         }
1478
1479         *update_session_globalp = update_session;
1480         *update_tcon_globalp = update_tcon;
1481         return;
1482 }
1483
1484 /****************************************************************************
1485  Prepare everything for calling the actual request function, and potentially
1486  call the request function via the "new" interface.
1487
1488  Return False if the "legacy" function needs to be called, everything is
1489  prepared.
1490
1491  Return True if we're done.
1492
1493  I know this API sucks, but it is the one with the least code change I could
1494  find.
1495 ****************************************************************************/
1496
1497 static connection_struct *switch_message(uint8_t type, struct smb_request *req)
1498 {
1499         int flags;
1500         uint64_t session_tag;
1501         connection_struct *conn = NULL;
1502         struct smbXsrv_connection *xconn = req->xconn;
1503         NTTIME now = timeval_to_nttime(&req->request_time);
1504         struct smbXsrv_session *session = NULL;
1505         NTSTATUS status;
1506
1507         errno = 0;
1508
1509         if (!xconn->smb1.negprot.done) {
1510                 switch (type) {
1511                         /*
1512                          * Without a negprot the request must
1513                          * either be a negprot, or one of the
1514                          * evil old SMB mailslot messaging types.
1515                          */
1516                         case SMBnegprot:
1517                         case SMBsendstrt:
1518                         case SMBsendend:
1519                         case SMBsendtxt:
1520                                 break;
1521                         default:
1522                                 exit_server_cleanly("The first request "
1523                                         "should be a negprot");
1524                 }
1525         }
1526
1527         if (smb_messages[type].fn == NULL) {
1528                 DEBUG(0,("Unknown message type %d!\n",type));
1529                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1530                 reply_unknown_new(req, type);
1531                 return NULL;
1532         }
1533
1534         flags = smb_messages[type].flags;
1535
1536         /* In share mode security we must ignore the vuid. */
1537         session_tag = req->vuid;
1538         conn = req->conn;
1539
1540         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1541                  (int)getpid(), (unsigned long)conn));
1542
1543         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1544
1545         /* Ensure this value is replaced in the incoming packet. */
1546         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1547
1548         /*
1549          * Ensure the correct username is in current_user_info.  This is a
1550          * really ugly bugfix for problems with multiple session_setup_and_X's
1551          * being done and allowing %U and %G substitutions to work correctly.
1552          * There is a reason this code is done here, don't move it unless you
1553          * know what you're doing... :-).
1554          * JRA.
1555          */
1556
1557         /*
1558          * lookup an existing session
1559          *
1560          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1561          * here, the main check is still in change_to_user()
1562          */
1563         status = smb1srv_session_lookup(xconn,
1564                                         session_tag,
1565                                         now,
1566                                         &session);
1567         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1568                 switch (type) {
1569                 case SMBsesssetupX:
1570                         status = NT_STATUS_OK;
1571                         break;
1572                 default:
1573                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1574                                  (unsigned long long)session_tag,
1575                                  (unsigned long long)req->mid));
1576                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1577                         return conn;
1578                 }
1579         }
1580
1581         if (session != NULL && !(flags & AS_USER)) {
1582                 struct user_struct *vuser = session->compat;
1583
1584                 /*
1585                  * change_to_user() implies set_current_user_info()
1586                  * and chdir_connect_service().
1587                  *
1588                  * So we only call set_current_user_info if
1589                  * we don't have AS_USER specified.
1590                  */
1591                 if (vuser) {
1592                         set_current_user_info(
1593                                 vuser->session_info->unix_info->sanitized_username,
1594                                 vuser->session_info->unix_info->unix_name,
1595                                 vuser->session_info->info->domain_name);
1596                 }
1597         }
1598
1599         /* Does this call need to be run as the connected user? */
1600         if (flags & AS_USER) {
1601
1602                 /* Does this call need a valid tree connection? */
1603                 if (!conn) {
1604                         /*
1605                          * Amazingly, the error code depends on the command
1606                          * (from Samba4).
1607                          */
1608                         if (type == SMBntcreateX) {
1609                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1610                         } else {
1611                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1612                         }
1613                         return NULL;
1614                 }
1615
1616                 set_current_case_sensitive(conn, SVAL(req->inbuf,smb_flg));
1617
1618                 /*
1619                  * change_to_user() implies set_current_user_info()
1620                  * and chdir_connect_service().
1621                  */
1622                 if (!change_to_user(conn,session_tag)) {
1623                         DEBUG(0, ("Error: Could not change to user. Removing "
1624                                 "deferred open, mid=%llu.\n",
1625                                 (unsigned long long)req->mid));
1626                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1627                         return conn;
1628                 }
1629
1630                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1631
1632                 /* Does it need write permission? */
1633                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1634                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1635                         return conn;
1636                 }
1637
1638                 /* IPC services are limited */
1639                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1640                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1641                         return conn;
1642                 }
1643         } else if (flags & AS_GUEST) {
1644                 /*
1645                  * Does this protocol need to be run as guest? (Only archane
1646                  * messenger service requests have this...)
1647                  */
1648                 if (!change_to_guest()) {
1649                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1650                         return conn;
1651                 }
1652         } else {
1653                 /* This call needs to be run as root */
1654                 change_to_root_user();
1655         }
1656
1657         /* load service specific parameters */
1658         if (conn) {
1659                 if (req->encrypted) {
1660                         conn->encrypted_tid = true;
1661                         /* encrypted required from now on. */
1662                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1663                 } else if (ENCRYPTION_REQUIRED(conn)) {
1664                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1665                                 DEBUG(1,("service[%s] requires encryption"
1666                                         "%s ACCESS_DENIED. mid=%llu\n",
1667                                         lp_servicename(talloc_tos(), SNUM(conn)),
1668                                         smb_fn_name(type),
1669                                         (unsigned long long)req->mid));
1670                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1671                                 return conn;
1672                         }
1673                 }
1674
1675                 if (flags & DO_CHDIR) {
1676                         bool ok;
1677
1678                         ok = chdir_current_service(conn);
1679                         if (!ok) {
1680                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1681                                 return conn;
1682                         }
1683                 }
1684                 conn->num_smb_operations++;
1685         }
1686
1687         /*
1688          * Update encryption and signing state tracking flags that are
1689          * used by smbstatus to display signing and encryption status.
1690          */
1691         if (session != NULL) {
1692                 bool update_session_global = false;
1693                 bool update_tcon_global = false;
1694
1695                 smb1srv_update_crypto_flags(session, req, type,
1696                                             &update_session_global,
1697                                             &update_tcon_global);
1698
1699                 if (update_session_global) {
1700                         status = smbXsrv_session_update(session);
1701                         if (!NT_STATUS_IS_OK(status)) {
1702                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1703                                 return conn;
1704                         }
1705                 }
1706
1707                 if (update_tcon_global) {
1708                         status = smbXsrv_tcon_update(req->conn->tcon);
1709                         if (!NT_STATUS_IS_OK(status)) {
1710                                 reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
1711                                 return conn;
1712                         }
1713                 }
1714         }
1715
1716         smb_messages[type].fn(req);
1717         return req->conn;
1718 }
1719
1720 /****************************************************************************
1721  Construct a reply to the incoming packet.
1722 ****************************************************************************/
1723
1724 static void construct_reply(struct smbXsrv_connection *xconn,
1725                             char *inbuf, int size, size_t unread_bytes,
1726                             uint32_t seqnum, bool encrypted,
1727                             struct smb_perfcount_data *deferred_pcd)
1728 {
1729         struct smbd_server_connection *sconn = xconn->client->sconn;
1730         struct smb_request *req;
1731
1732         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1733                 smb_panic("could not allocate smb_request");
1734         }
1735
1736         if (!init_smb_request(req, sconn, xconn, (uint8_t *)inbuf, unread_bytes,
1737                               encrypted, seqnum)) {
1738                 exit_server_cleanly("Invalid SMB request");
1739         }
1740
1741         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1742
1743         /* we popped this message off the queue - keep original perf data */
1744         if (deferred_pcd)
1745                 req->pcd = *deferred_pcd;
1746         else {
1747                 SMB_PERFCOUNT_START(&req->pcd);
1748                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1749                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1750         }
1751
1752         req->conn = switch_message(req->cmd, req);
1753
1754         if (req->outbuf == NULL) {
1755                 /*
1756                  * Request has suspended itself, will come
1757                  * back here.
1758                  */
1759                 return;
1760         }
1761         if (CVAL(req->outbuf,0) == 0) {
1762                 show_msg((char *)req->outbuf);
1763         }
1764         smb_request_done(req);
1765 }
1766
1767 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1768                                   char *inbuf, int size, uint32_t seqnum,
1769                                   bool encrypted,
1770                                   struct smb_perfcount_data *deferred_pcd)
1771 {
1772         struct smb_request **reqs = NULL;
1773         struct smb_request *req;
1774         unsigned num_reqs;
1775         bool ok;
1776
1777         ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted,
1778                               seqnum, &reqs, &num_reqs);
1779         if (!ok) {
1780                 char errbuf[smb_size];
1781                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1782                              __LINE__, __FILE__);
1783                 if (!srv_send_smb(xconn, errbuf, true, seqnum, encrypted,
1784                                   NULL)) {
1785                         exit_server_cleanly("construct_reply_chain: "
1786                                             "srv_send_smb failed.");
1787                 }
1788                 return;
1789         }
1790
1791         req = reqs[0];
1792         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1793
1794         req->conn = switch_message(req->cmd, req);
1795
1796         if (req->outbuf == NULL) {
1797                 /*
1798                  * Request has suspended itself, will come
1799                  * back here.
1800                  */
1801                 return;
1802         }
1803         smb_request_done(req);
1804 }
1805
1806 /*
1807  * To be called from an async SMB handler that is potentially chained
1808  * when it is finished for shipping.
1809  */
1810
1811 void smb_request_done(struct smb_request *req)
1812 {
1813         struct smb_request **reqs = NULL;
1814         struct smb_request *first_req;
1815         size_t i, num_reqs, next_index;
1816         NTSTATUS status;
1817
1818         if (req->chain == NULL) {
1819                 first_req = req;
1820                 goto shipit;
1821         }
1822
1823         reqs = req->chain;
1824         num_reqs = talloc_array_length(reqs);
1825
1826         for (i=0; i<num_reqs; i++) {
1827                 if (reqs[i] == req) {
1828                         break;
1829                 }
1830         }
1831         if (i == num_reqs) {
1832                 /*
1833                  * Invalid chain, should not happen
1834                  */
1835                 status = NT_STATUS_INTERNAL_ERROR;
1836                 goto error;
1837         }
1838         next_index = i+1;
1839
1840         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1841                 struct smb_request *next = reqs[next_index];
1842                 struct smbXsrv_tcon *tcon;
1843                 NTTIME now = timeval_to_nttime(&req->request_time);
1844
1845                 next->vuid = SVAL(req->outbuf, smb_uid);
1846                 next->tid  = SVAL(req->outbuf, smb_tid);
1847                 status = smb1srv_tcon_lookup(req->xconn, next->tid,
1848                                              now, &tcon);
1849
1850                 if (NT_STATUS_IS_OK(status)) {
1851                         next->conn = tcon->compat;
1852                 } else {
1853                         next->conn = NULL;
1854                 }
1855                 next->chain_fsp = req->chain_fsp;
1856                 next->inbuf = req->inbuf;
1857
1858                 req = next;
1859                 req->conn = switch_message(req->cmd, req);
1860
1861                 if (req->outbuf == NULL) {
1862                         /*
1863                          * Request has suspended itself, will come
1864                          * back here.
1865                          */
1866                         return;
1867                 }
1868                 next_index += 1;
1869         }
1870
1871         first_req = reqs[0];
1872
1873         for (i=1; i<next_index; i++) {
1874                 bool ok;
1875
1876                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1877                 if (!ok) {
1878                         status = NT_STATUS_INTERNAL_ERROR;
1879                         goto error;
1880                 }
1881         }
1882
1883         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1884         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1885
1886         /*
1887          * This scary statement intends to set the
1888          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1889          * to the value last_req->outbuf carries
1890          */
1891         SSVAL(first_req->outbuf, smb_flg2,
1892               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1893               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1894
1895         /*
1896          * Transfer the error codes from the subrequest to the main one
1897          */
1898         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1899         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1900
1901         _smb_setlen_large(
1902                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1903
1904 shipit:
1905         if (!srv_send_smb(first_req->xconn,
1906                           (char *)first_req->outbuf,
1907                           true, first_req->seqnum+1,
1908                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1909                           &first_req->pcd)) {
1910                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1911                                     "failed.");
1912         }
1913         TALLOC_FREE(req);       /* non-chained case */
1914         TALLOC_FREE(reqs);      /* chained case */
1915         return;
1916
1917 error:
1918         {
1919                 char errbuf[smb_size];
1920                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1921                 if (!srv_send_smb(req->xconn, errbuf, true,
1922                                   req->seqnum+1, req->encrypted,
1923                                   NULL)) {
1924                         exit_server_cleanly("construct_reply_chain: "
1925                                             "srv_send_smb failed.");
1926                 }
1927         }
1928         TALLOC_FREE(req);       /* non-chained case */
1929         TALLOC_FREE(reqs);      /* chained case */
1930 }
1931
1932 /****************************************************************************
1933  Process an smb from the client
1934 ****************************************************************************/
1935 static void process_smb(struct smbXsrv_connection *xconn,
1936                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1937                         uint32_t seqnum, bool encrypted,
1938                         struct smb_perfcount_data *deferred_pcd)
1939 {
1940         struct smbd_server_connection *sconn = xconn->client->sconn;
1941         int msg_type = CVAL(inbuf,0);
1942
1943         DO_PROFILE_INC(request);
1944
1945         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1946                     smb_len(inbuf) ) );
1947         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1948                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1949
1950         if (msg_type != NBSSmessage) {
1951                 /*
1952                  * NetBIOS session request, keepalive, etc.
1953                  */
1954                 reply_special(xconn, (char *)inbuf, nread);
1955                 goto done;
1956         }
1957
1958         if (sconn->using_smb2) {
1959                 /* At this point we're not really using smb2,
1960                  * we make the decision here.. */
1961                 if (smbd_is_smb2_header(inbuf, nread)) {
1962                         const uint8_t *inpdu = inbuf + NBT_HDR_SIZE;
1963                         size_t pdulen = nread - NBT_HDR_SIZE;
1964                         smbd_smb2_process_negprot(xconn, 0, inpdu, pdulen);
1965                         return;
1966                 }
1967                 if (nread >= smb_size && valid_smb_header(inbuf)
1968                                 && CVAL(inbuf, smb_com) != 0x72) {
1969                         /* This is a non-negprot SMB1 packet.
1970                            Disable SMB2 from now on. */
1971                         sconn->using_smb2 = false;
1972                 }
1973         }
1974
1975         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1976          * so subtract 4 from it. */
1977         if ((nread < (smb_size - 4)) || !valid_smb_header(inbuf)) {
1978                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1979                          smb_len(inbuf)));
1980
1981                 /* special magic for immediate exit */
1982                 if ((nread == 9) &&
1983                     (IVAL(inbuf, 4) == 0x74697865) &&
1984                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1985                         uint8_t exitcode = CVAL(inbuf, 8);
1986                         DEBUG(1, ("Exiting immediately with code %d\n",
1987                                   (int)exitcode));
1988                         exit(exitcode);
1989                 }
1990
1991                 exit_server_cleanly("Non-SMB packet");
1992         }
1993
1994         show_msg((char *)inbuf);
1995
1996         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1997                 construct_reply_chain(xconn, (char *)inbuf, nread,
1998                                       seqnum, encrypted, deferred_pcd);
1999         } else {
2000                 construct_reply(xconn, (char *)inbuf, nread, unread_bytes,
2001                                 seqnum, encrypted, deferred_pcd);
2002         }
2003
2004         sconn->trans_num++;
2005
2006 done:
2007         sconn->num_requests++;
2008
2009         /* The timeout_processing function isn't run nearly
2010            often enough to implement 'max log size' without
2011            overrunning the size of the file by many megabytes.
2012            This is especially true if we are running at debug
2013            level 10.  Checking every 50 SMBs is a nice
2014            tradeoff of performance vs log file size overrun. */
2015
2016         if ((sconn->num_requests % 50) == 0 &&
2017             need_to_check_log_size()) {
2018                 change_to_root_user();
2019                 check_log_size();
2020         }
2021 }
2022
2023 /****************************************************************************
2024  Return a string containing the function name of a SMB command.
2025 ****************************************************************************/
2026
2027 const char *smb_fn_name(int type)
2028 {
2029         const char *unknown_name = "SMBunknown";
2030
2031         if (smb_messages[type].name == NULL)
2032                 return(unknown_name);
2033
2034         return(smb_messages[type].name);
2035 }
2036
2037 /****************************************************************************
2038  Helper functions for contruct_reply.
2039 ****************************************************************************/
2040
2041 void add_to_common_flags2(uint32_t v)
2042 {
2043         common_flags2 |= v;
2044 }
2045
2046 void remove_from_common_flags2(uint32_t v)
2047 {
2048         common_flags2 &= ~v;
2049 }
2050
2051 static void construct_reply_common(uint8_t cmd, const uint8_t *inbuf,
2052                                    char *outbuf)
2053 {
2054         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
2055         uint16_t out_flags2 = common_flags2;
2056
2057         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
2058         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
2059         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
2060
2061         srv_set_message(outbuf,0,0,false);
2062
2063         SCVAL(outbuf, smb_com, cmd);
2064         SIVAL(outbuf,smb_rcls,0);
2065         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
2066         SSVAL(outbuf,smb_flg2, out_flags2);
2067         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
2068         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
2069
2070         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
2071         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
2072         SSVAL(outbuf,smb_pidhigh,SVAL(inbuf,smb_pidhigh));
2073         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
2074         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
2075 }
2076
2077 void construct_reply_common_req(struct smb_request *req, char *outbuf)
2078 {
2079         construct_reply_common(req->cmd, req->inbuf, outbuf);
2080 }
2081
2082 /**
2083  * @brief Find the smb_cmd offset of the last command pushed
2084  * @param[in] buf       The buffer we're building up
2085  * @retval              Where can we put our next andx cmd?
2086  *
2087  * While chaining requests, the "next" request we're looking at needs to put
2088  * its SMB_Command before the data the previous request already built up added
2089  * to the chain. Find the offset to the place where we have to put our cmd.
2090  */
2091
2092 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2093 {
2094         uint8_t cmd;
2095         size_t ofs;
2096
2097         cmd = CVAL(buf, smb_com);
2098
2099         if (!is_andx_req(cmd)) {
2100                 return false;
2101         }
2102
2103         ofs = smb_vwv0;
2104
2105         while (CVAL(buf, ofs) != 0xff) {
2106
2107                 if (!is_andx_req(CVAL(buf, ofs))) {
2108                         return false;
2109                 }
2110
2111                 /*
2112                  * ofs is from start of smb header, so add the 4 length
2113                  * bytes. The next cmd is right after the wct field.
2114                  */
2115                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2116
2117                 if (ofs+4 >= talloc_get_size(buf)) {
2118                         return false;
2119                 }
2120         }
2121
2122         *pofs = ofs;
2123         return true;
2124 }
2125
2126 /**
2127  * @brief Do the smb chaining at a buffer level
2128  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2129  * @param[in] andx_buf          Buffer to be appended
2130  */
2131
2132 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2133 {
2134         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2135         uint8_t wct             = CVAL(andx_buf, smb_wct);
2136         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2137         uint32_t num_bytes      = smb_buflen(andx_buf);
2138         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2139
2140         uint8_t *outbuf;
2141         size_t old_size, new_size;
2142         size_t ofs;
2143         size_t chain_padding = 0;
2144         size_t andx_cmd_ofs;
2145
2146
2147         old_size = talloc_get_size(*poutbuf);
2148
2149         if ((old_size % 4) != 0) {
2150                 /*
2151                  * Align the wct field of subsequent requests to a 4-byte
2152                  * boundary
2153                  */
2154                 chain_padding = 4 - (old_size % 4);
2155         }
2156
2157         /*
2158          * After the old request comes the new wct field (1 byte), the vwv's
2159          * and the num_bytes field.
2160          */
2161
2162         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2163         new_size += num_bytes;
2164
2165         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2166                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2167                           (unsigned)new_size));
2168                 return false;
2169         }
2170
2171         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2172         if (outbuf == NULL) {
2173                 DEBUG(0, ("talloc failed\n"));
2174                 return false;
2175         }
2176         *poutbuf = outbuf;
2177
2178         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2179                 DEBUG(1, ("invalid command chain\n"));
2180                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2181                 return false;
2182         }
2183
2184         if (chain_padding != 0) {
2185                 memset(outbuf + old_size, 0, chain_padding);
2186                 old_size += chain_padding;
2187         }
2188
2189         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2190         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2191
2192         ofs = old_size;
2193
2194         /*
2195          * Push the chained request:
2196          *
2197          * wct field
2198          */
2199
2200         SCVAL(outbuf, ofs, wct);
2201         ofs += 1;
2202
2203         /*
2204          * vwv array
2205          */
2206
2207         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2208
2209         /*
2210          * HACK ALERT
2211          *
2212          * Read&X has an offset into its data buffer at
2213          * vwv[6]. reply_read_andx has no idea anymore that it's
2214          * running from within a chain, so we have to fix up the
2215          * offset here.
2216          *
2217          * Although it looks disgusting at this place, I want to keep
2218          * it here. The alternative would be to push knowledge about
2219          * the andx chain down into read&x again.
2220          */
2221
2222         if (smb_command == SMBreadX) {
2223                 uint8_t *bytes_addr;
2224
2225                 if (wct < 7) {
2226                         /*
2227                          * Invalid read&x response
2228                          */
2229                         return false;
2230                 }
2231
2232                 bytes_addr = outbuf + ofs        /* vwv start */
2233                         + sizeof(uint16_t) * wct /* vwv array */
2234                         + sizeof(uint16_t)       /* bcc */
2235                         + 1;                     /* padding byte */
2236
2237                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2238                       bytes_addr - outbuf - 4);
2239         }
2240
2241         ofs += sizeof(uint16_t) * wct;
2242
2243         /*
2244          * bcc (byte count)
2245          */
2246
2247         SSVAL(outbuf, ofs, num_bytes);
2248         ofs += sizeof(uint16_t);
2249
2250         /*
2251          * The bytes field
2252          */
2253
2254         memcpy(outbuf + ofs, bytes, num_bytes);
2255
2256         return true;
2257 }
2258
2259 bool smb1_is_chain(const uint8_t *buf)
2260 {
2261         uint8_t cmd, wct, andx_cmd;
2262
2263         cmd = CVAL(buf, smb_com);
2264         if (!is_andx_req(cmd)) {
2265                 return false;
2266         }
2267         wct = CVAL(buf, smb_wct);
2268         if (wct < 2) {
2269                 return false;
2270         }
2271         andx_cmd = CVAL(buf, smb_vwv);
2272         return (andx_cmd != 0xFF);
2273 }
2274
2275 bool smb1_walk_chain(const uint8_t *buf,
2276                      bool (*fn)(uint8_t cmd,
2277                                 uint8_t wct, const uint16_t *vwv,
2278                                 uint16_t num_bytes, const uint8_t *bytes,
2279                                 void *private_data),
2280                      void *private_data)
2281 {
2282         size_t smblen = smb_len(buf);
2283         const char *smb_buf = smb_base(buf);
2284         uint8_t cmd, chain_cmd;
2285         uint8_t wct;
2286         const uint16_t *vwv;
2287         uint16_t num_bytes;
2288         const uint8_t *bytes;
2289
2290         cmd = CVAL(buf, smb_com);
2291         wct = CVAL(buf, smb_wct);
2292         vwv = (const uint16_t *)(buf + smb_vwv);
2293         num_bytes = smb_buflen(buf);
2294         bytes = (const uint8_t *)smb_buf_const(buf);
2295
2296         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2297                 return false;
2298         }
2299
2300         if (!is_andx_req(cmd)) {
2301                 return true;
2302         }
2303         if (wct < 2) {
2304                 return false;
2305         }
2306
2307         chain_cmd = CVAL(vwv, 0);
2308
2309         while (chain_cmd != 0xff) {
2310                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2311                 size_t length_needed;
2312                 ptrdiff_t vwv_offset;
2313
2314                 chain_offset = SVAL(vwv+1, 0);
2315
2316                 /*
2317                  * Check if the client tries to fool us. The chain
2318                  * offset needs to point beyond the current request in
2319                  * the chain, it needs to strictly grow. Otherwise we
2320                  * might be tricked into an endless loop always
2321                  * processing the same request over and over again. We
2322                  * used to assume that vwv and the byte buffer array
2323                  * in a chain are always attached, but OS/2 the
2324                  * Write&X/Read&X chain puts the Read&X vwv array
2325                  * right behind the Write&X vwv chain. The Write&X bcc
2326                  * array is put behind the Read&X vwv array. So now we
2327                  * check whether the chain offset points strictly
2328                  * behind the previous vwv array. req->buf points
2329                  * right after the vwv array of the previous
2330                  * request. See
2331                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2332                  * more information.
2333                  */
2334
2335                 vwv_offset = ((const char *)vwv - smb_buf);
2336                 if (chain_offset <= vwv_offset) {
2337                         return false;
2338                 }
2339
2340                 /*
2341                  * Next check: Make sure the chain offset does not
2342                  * point beyond the overall smb request length.
2343                  */
2344
2345                 length_needed = chain_offset+1; /* wct */
2346                 if (length_needed > smblen) {
2347                         return false;
2348                 }
2349
2350                 /*
2351                  * Now comes the pointer magic. Goal here is to set up
2352                  * vwv and buf correctly again. The chain offset (the
2353                  * former vwv[1]) points at the new wct field.
2354                  */
2355
2356                 wct = CVAL(smb_buf, chain_offset);
2357
2358                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2359                         return false;
2360                 }
2361
2362                 /*
2363                  * Next consistency check: Make the new vwv array fits
2364                  * in the overall smb request.
2365                  */
2366
2367                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2368                 if (length_needed > smblen) {
2369                         return false;
2370                 }
2371                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2372
2373                 /*
2374                  * Now grab the new byte buffer....
2375                  */
2376
2377                 num_bytes = SVAL(vwv+wct, 0);
2378
2379                 /*
2380                  * .. and check that it fits.
2381                  */
2382
2383                 length_needed += num_bytes;
2384                 if (length_needed > smblen) {
2385                         return false;
2386                 }
2387                 bytes = (const uint8_t *)(vwv+wct+1);
2388
2389                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2390                         return false;
2391                 }
2392
2393                 if (!is_andx_req(chain_cmd)) {
2394                         return true;
2395                 }
2396                 chain_cmd = CVAL(vwv, 0);
2397         }
2398         return true;
2399 }
2400
2401 static bool smb1_chain_length_cb(uint8_t cmd,
2402                                  uint8_t wct, const uint16_t *vwv,
2403                                  uint16_t num_bytes, const uint8_t *bytes,
2404                                  void *private_data)
2405 {
2406         unsigned *count = (unsigned *)private_data;
2407         *count += 1;
2408         return true;
2409 }
2410
2411 unsigned smb1_chain_length(const uint8_t *buf)
2412 {
2413         unsigned count = 0;
2414
2415         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2416                 return 0;
2417         }
2418         return count;
2419 }
2420
2421 struct smb1_parse_chain_state {
2422         TALLOC_CTX *mem_ctx;
2423         const uint8_t *buf;
2424         struct smbd_server_connection *sconn;
2425         struct smbXsrv_connection *xconn;
2426         bool encrypted;
2427         uint32_t seqnum;
2428
2429         struct smb_request **reqs;
2430         unsigned num_reqs;
2431 };
2432
2433 static bool smb1_parse_chain_cb(uint8_t cmd,
2434                                 uint8_t wct, const uint16_t *vwv,
2435                                 uint16_t num_bytes, const uint8_t *bytes,
2436                                 void *private_data)
2437 {
2438         struct smb1_parse_chain_state *state =
2439                 (struct smb1_parse_chain_state *)private_data;
2440         struct smb_request **reqs;
2441         struct smb_request *req;
2442         bool ok;
2443
2444         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2445                               struct smb_request *, state->num_reqs+1);
2446         if (reqs == NULL) {
2447                 return false;
2448         }
2449         state->reqs = reqs;
2450
2451         req = talloc(reqs, struct smb_request);
2452         if (req == NULL) {
2453                 return false;
2454         }
2455
2456         ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2457                               state->encrypted, state->seqnum);
2458         if (!ok) {
2459                 return false;
2460         }
2461         req->cmd = cmd;
2462         req->wct = wct;
2463         req->vwv = vwv;
2464         req->buflen = num_bytes;
2465         req->buf = bytes;
2466
2467         reqs[state->num_reqs] = req;
2468         state->num_reqs += 1;
2469         return true;
2470 }
2471
2472 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2473                       struct smbXsrv_connection *xconn,
2474                       bool encrypted, uint32_t seqnum,
2475                       struct smb_request ***reqs, unsigned *num_reqs)
2476 {
2477         struct smbd_server_connection *sconn = NULL;
2478         struct smb1_parse_chain_state state;
2479         unsigned i;
2480
2481         if (xconn != NULL) {
2482                 sconn = xconn->client->sconn;
2483         }
2484
2485         state.mem_ctx = mem_ctx;
2486         state.buf = buf;
2487         state.sconn = sconn;
2488         state.xconn = xconn;
2489         state.encrypted = encrypted;
2490         state.seqnum = seqnum;
2491         state.reqs = NULL;
2492         state.num_reqs = 0;
2493
2494         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2495                 TALLOC_FREE(state.reqs);
2496                 return false;
2497         }
2498         for (i=0; i<state.num_reqs; i++) {
2499                 state.reqs[i]->chain = state.reqs;
2500         }
2501         *reqs = state.reqs;
2502         *num_reqs = state.num_reqs;
2503         return true;
2504 }
2505
2506 /****************************************************************************
2507  Check if services need reloading.
2508 ****************************************************************************/
2509
2510 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2511 {
2512
2513         if (last_smb_conf_reload_time == 0) {
2514                 last_smb_conf_reload_time = t;
2515         }
2516
2517         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2518                 reload_services(sconn, conn_snum_used, true);
2519                 last_smb_conf_reload_time = t;
2520         }
2521 }
2522
2523 static bool fd_is_readable(int fd)
2524 {
2525         int ret, revents;
2526
2527         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2528
2529         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2530
2531 }
2532
2533 static void smbd_server_connection_write_handler(
2534         struct smbXsrv_connection *xconn)
2535 {
2536         /* TODO: make write nonblocking */
2537 }
2538
2539 static void smbd_server_connection_read_handler(
2540         struct smbXsrv_connection *xconn, int fd)
2541 {
2542         uint8_t *inbuf = NULL;
2543         size_t inbuf_len = 0;
2544         size_t unread_bytes = 0;
2545         bool encrypted = false;
2546         TALLOC_CTX *mem_ctx = talloc_tos();
2547         NTSTATUS status;
2548         uint32_t seqnum;
2549
2550         bool async_echo = lp_async_smb_echo_handler();
2551         bool from_client = false;
2552
2553         if (async_echo) {
2554                 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2555                         /*
2556                          * This is the super-ugly hack to prefer the packets
2557                          * forwarded by the echo handler over the ones by the
2558                          * client directly
2559                          */
2560                         fd = xconn->smb1.echo_handler.trusted_fd;
2561                 }
2562         }
2563
2564         from_client = (xconn->transport.sock == fd);
2565
2566         if (async_echo && from_client) {
2567                 smbd_lock_socket(xconn);
2568
2569                 if (!fd_is_readable(fd)) {
2570                         DEBUG(10,("the echo listener was faster\n"));
2571                         smbd_unlock_socket(xconn);
2572                         return;
2573                 }
2574         }
2575
2576         /* TODO: make this completely nonblocking */
2577         status = receive_smb_talloc(mem_ctx, xconn, fd,
2578                                     (char **)(void *)&inbuf,
2579                                     0, /* timeout */
2580                                     &unread_bytes,
2581                                     &encrypted,
2582                                     &inbuf_len, &seqnum,
2583                                     !from_client /* trusted channel */);
2584
2585         if (async_echo && from_client) {
2586                 smbd_unlock_socket(xconn);
2587         }
2588
2589         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2590                 goto process;
2591         }
2592         if (NT_STATUS_IS_ERR(status)) {
2593                 exit_server_cleanly("failed to receive smb request");
2594         }
2595         if (!NT_STATUS_IS_OK(status)) {
2596                 return;
2597         }
2598
2599 process:
2600         process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2601                     seqnum, encrypted, NULL);
2602 }
2603
2604 static void smbd_server_connection_handler(struct tevent_context *ev,
2605                                            struct tevent_fd *fde,
2606                                            uint16_t flags,
2607                                            void *private_data)
2608 {
2609         struct smbXsrv_connection *xconn =
2610                 talloc_get_type_abort(private_data,
2611                 struct smbXsrv_connection);
2612
2613         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2614                 /*
2615                  * we're not supposed to do any io
2616                  */
2617                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2618                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2619                 return;
2620         }
2621
2622         if (flags & TEVENT_FD_WRITE) {
2623                 smbd_server_connection_write_handler(xconn);
2624                 return;
2625         }
2626         if (flags & TEVENT_FD_READ) {
2627                 smbd_server_connection_read_handler(xconn, xconn->transport.sock);
2628                 return;
2629         }
2630 }
2631
2632 static void smbd_server_echo_handler(struct tevent_context *ev,
2633                                      struct tevent_fd *fde,
2634                                      uint16_t flags,
2635                                      void *private_data)
2636 {
2637         struct smbXsrv_connection *xconn =
2638                 talloc_get_type_abort(private_data,
2639                 struct smbXsrv_connection);
2640
2641         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2642                 /*
2643                  * we're not supposed to do any io
2644                  */
2645                 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2646                 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2647                 return;
2648         }
2649
2650         if (flags & TEVENT_FD_WRITE) {
2651                 smbd_server_connection_write_handler(xconn);
2652                 return;
2653         }
2654         if (flags & TEVENT_FD_READ) {
2655                 smbd_server_connection_read_handler(
2656                         xconn, xconn->smb1.echo_handler.trusted_fd);
2657                 return;
2658         }
2659 }
2660
2661 struct smbd_release_ip_state {
2662         struct smbXsrv_connection *xconn;
2663         struct tevent_immediate *im;
2664         char addr[INET6_ADDRSTRLEN];
2665 };
2666
2667 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2668                                       struct tevent_immediate *im,
2669                                       void *private_data)
2670 {
2671         struct smbd_release_ip_state *state =
2672                 talloc_get_type_abort(private_data,
2673                 struct smbd_release_ip_state);
2674         struct smbXsrv_connection *xconn = state->xconn;
2675
2676         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2677                 /*
2678                  * smbd_server_connection_terminate() already triggered ?
2679                  */
2680                 return;
2681         }
2682
2683         smbd_server_connection_terminate(xconn, "CTDB_SRVID_RELEASE_IP");
2684 }
2685
2686 /****************************************************************************
2687 received when we should release a specific IP
2688 ****************************************************************************/
2689 static int release_ip(struct tevent_context *ev,
2690                       uint32_t src_vnn, uint32_t dst_vnn,
2691                       uint64_t dst_srvid,
2692                       const uint8_t *msg, size_t msglen,
2693                       void *private_data)
2694 {
2695         struct smbd_release_ip_state *state =
2696                 talloc_get_type_abort(private_data,
2697                 struct smbd_release_ip_state);
2698         struct smbXsrv_connection *xconn = state->xconn;
2699         const char *ip;
2700         const char *addr = state->addr;
2701         const char *p = addr;
2702
2703         if (msglen == 0) {
2704                 return 0;
2705         }
2706         if (msg[msglen-1] != '\0') {
2707                 return 0;
2708         }
2709
2710         ip = (const char *)msg;
2711
2712         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2713                 /* avoid recursion */
2714                 return 0;
2715         }
2716
2717         if (strncmp("::ffff:", addr, 7) == 0) {
2718                 p = addr + 7;
2719         }
2720
2721         DEBUG(10, ("Got release IP message for %s, "
2722                    "our address is %s\n", ip, p));
2723
2724         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2725                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2726                         ip));
2727                 /*
2728                  * With SMB2 we should do a clean disconnect,
2729                  * the previous_session_id in the session setup
2730                  * will cleanup the old session, tcons and opens.
2731                  *
2732                  * A clean disconnect is needed in order to support
2733                  * durable handles.
2734                  *
2735                  * Note: typically this is never triggered
2736                  *       as we got a TCP RST (triggered by ctdb event scripts)
2737                  *       before we get CTDB_SRVID_RELEASE_IP.
2738                  *
2739                  * We used to call _exit(1) here, but as this was mostly never
2740                  * triggered and has implication on our process model,
2741                  * we can just use smbd_server_connection_terminate()
2742                  * (also for SMB1).
2743                  *
2744                  * We don't call smbd_server_connection_terminate() directly
2745                  * as we might be called from within ctdbd_migrate(),
2746                  * we need to defer our action to the next event loop
2747                  */
2748                 tevent_schedule_immediate(state->im,
2749                                           xconn->client->raw_ev_ctx,
2750                                           smbd_release_ip_immediate,
2751                                           state);
2752
2753                 /*
2754                  * Make sure we don't get any io on the connection.
2755                  */
2756                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2757                 return EADDRNOTAVAIL;
2758         }
2759
2760         return 0;
2761 }
2762
2763 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2764                                   struct sockaddr_storage *srv,
2765                                   struct sockaddr_storage *clnt)
2766 {
2767         struct smbd_release_ip_state *state;
2768         struct ctdbd_connection *cconn;
2769         int ret;
2770
2771         cconn = messaging_ctdb_connection();
2772         if (cconn == NULL) {
2773                 return NT_STATUS_NO_MEMORY;
2774         }
2775
2776         state = talloc_zero(xconn, struct smbd_release_ip_state);
2777         if (state == NULL) {
2778                 return NT_STATUS_NO_MEMORY;
2779         }
2780         state->xconn = xconn;
2781         state->im = tevent_create_immediate(state);
2782         if (state->im == NULL) {
2783                 return NT_STATUS_NO_MEMORY;
2784         }
2785         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2786                 return NT_STATUS_NO_MEMORY;
2787         }
2788
2789         ret = ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2790         if (ret != 0) {
2791                 return map_nt_error_from_unix(ret);
2792         }
2793         return NT_STATUS_OK;
2794 }
2795
2796 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2797                                   void *private_data, uint32_t msg_type,
2798                                   struct server_id server_id, DATA_BLOB *data)
2799 {
2800         struct smbd_server_connection *sconn = talloc_get_type_abort(
2801                 private_data, struct smbd_server_connection);
2802         const char *ip = (char *) data->data;
2803         char *client_ip;
2804
2805         DBG_DEBUG("Got kill request for client IP %s\n", ip);
2806
2807         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2808                                                      talloc_tos());
2809         if (client_ip == NULL) {
2810                 return;
2811         }
2812
2813         if (strequal(ip, client_ip)) {
2814                 DBG_WARNING("Got kill client message for %s - "
2815                             "exiting immediately\n", ip);
2816                 exit_server_cleanly("Forced disconnect for client");
2817         }
2818
2819         TALLOC_FREE(client_ip);
2820 }
2821
2822 /*
2823  * Send keepalive packets to our client
2824  */
2825 static bool keepalive_fn(const struct timeval *now, void *private_data)
2826 {
2827         struct smbd_server_connection *sconn = talloc_get_type_abort(
2828                 private_data, struct smbd_server_connection);
2829         struct smbXsrv_connection *xconn = NULL;
2830         bool ret;
2831
2832         if (sconn->using_smb2) {
2833                 /* Don't do keepalives on an SMB2 connection. */
2834                 return false;
2835         }
2836
2837         /*
2838          * With SMB1 we only have 1 connection
2839          */
2840         xconn = sconn->client->connections;
2841         smbd_lock_socket(xconn);
2842         ret = send_keepalive(xconn->transport.sock);
2843         smbd_unlock_socket(xconn);
2844
2845         if (!ret) {
2846                 int saved_errno = errno;
2847                 /*
2848                  * Try and give an error message saying what
2849                  * client failed.
2850                  */
2851                 DEBUG(0, ("send_keepalive failed for client %s. "
2852                           "Error %s - exiting\n",
2853                           smbXsrv_connection_dbg(xconn),
2854                           strerror(saved_errno)));
2855                 errno = saved_errno;
2856                 return False;
2857         }
2858         return True;
2859 }
2860
2861 /*
2862  * Do the recurring check if we're idle
2863  */
2864 static bool deadtime_fn(const struct timeval *now, void *private_data)
2865 {
2866         struct smbd_server_connection *sconn =
2867                 (struct smbd_server_connection *)private_data;
2868
2869         if ((conn_num_open(sconn) == 0)
2870             || (conn_idle_all(sconn, now->tv_sec))) {
2871                 DEBUG( 2, ( "Closing idle connection\n" ) );
2872                 messaging_send(sconn->msg_ctx,
2873                                messaging_server_id(sconn->msg_ctx),
2874                                MSG_SHUTDOWN, &data_blob_null);
2875                 return False;
2876         }
2877
2878         return True;
2879 }
2880
2881 /*
2882  * Do the recurring log file and smb.conf reload checks.
2883  */
2884
2885 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2886 {
2887         struct smbd_server_connection *sconn = talloc_get_type_abort(
2888                 private_data, struct smbd_server_connection);
2889
2890         DEBUG(5, ("housekeeping\n"));
2891
2892         change_to_root_user();
2893
2894         /* update printer queue caches if necessary */
2895         update_monitored_printq_cache(sconn->msg_ctx);
2896
2897         /* check if we need to reload services */
2898         check_reload(sconn, time_mono(NULL));
2899
2900         /*
2901          * Force a log file check.
2902          */
2903         force_check_log_size();
2904         check_log_size();
2905         return true;
2906 }
2907
2908 /*
2909  * Read an smb packet in the echo handler child, giving the parent
2910  * smbd one second to react once the socket becomes readable.
2911  */
2912
2913 struct smbd_echo_read_state {
2914         struct tevent_context *ev;
2915         struct smbXsrv_connection *xconn;
2916
2917         char *buf;
2918         size_t buflen;
2919         uint32_t seqnum;
2920 };
2921
2922 static void smbd_echo_read_readable(struct tevent_req *subreq);
2923 static void smbd_echo_read_waited(struct tevent_req *subreq);
2924
2925 static struct tevent_req *smbd_echo_read_send(
2926         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2927         struct smbXsrv_connection *xconn)
2928 {
2929         struct tevent_req *req, *subreq;
2930         struct smbd_echo_read_state *state;
2931
2932         req = tevent_req_create(mem_ctx, &state,
2933                                 struct smbd_echo_read_state);
2934         if (req == NULL) {
2935                 return NULL;
2936         }
2937         state->ev = ev;
2938         state->xconn = xconn;
2939
2940         subreq = wait_for_read_send(state, ev, xconn->transport.sock, false);
2941         if (tevent_req_nomem(subreq, req)) {
2942                 return tevent_req_post(req, ev);
2943         }
2944         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2945         return req;
2946 }
2947
2948 static void smbd_echo_read_readable(struct tevent_req *subreq)
2949 {
2950         struct tevent_req *req = tevent_req_callback_data(
2951                 subreq, struct tevent_req);
2952         struct smbd_echo_read_state *state = tevent_req_data(
2953                 req, struct smbd_echo_read_state);
2954         bool ok;
2955         int err;
2956
2957         ok = wait_for_read_recv(subreq, &err);
2958         TALLOC_FREE(subreq);
2959         if (!ok) {
2960                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2961                 return;
2962         }
2963
2964         /*
2965          * Give the parent smbd one second to step in
2966          */
2967
2968         subreq = tevent_wakeup_send(
2969                 state, state->ev, timeval_current_ofs(1, 0));
2970         if (tevent_req_nomem(subreq, req)) {
2971                 return;
2972         }
2973         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2974 }
2975
2976 static void smbd_echo_read_waited(struct tevent_req *subreq)
2977 {
2978         struct tevent_req *req = tevent_req_callback_data(
2979                 subreq, struct tevent_req);
2980         struct smbd_echo_read_state *state = tevent_req_data(
2981                 req, struct smbd_echo_read_state);
2982         struct smbXsrv_connection *xconn = state->xconn;
2983         bool ok;
2984         NTSTATUS status;
2985         size_t unread = 0;
2986         bool encrypted;
2987
2988         ok = tevent_wakeup_recv(subreq);
2989         TALLOC_FREE(subreq);
2990         if (!ok) {
2991                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2992                 return;
2993         }
2994
2995         ok = smbd_lock_socket_internal(xconn);
2996         if (!ok) {
2997                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2998                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2999                 return;
3000         }
3001
3002         if (!fd_is_readable(xconn->transport.sock)) {
3003                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
3004                           (int)getpid()));
3005
3006                 ok = smbd_unlock_socket_internal(xconn);
3007                 if (!ok) {
3008                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
3009                         DEBUG(1, ("%s: failed to unlock socket\n",
3010                                 __location__));
3011                         return;
3012                 }
3013
3014                 subreq = wait_for_read_send(state, state->ev,
3015                                             xconn->transport.sock, false);
3016                 if (tevent_req_nomem(subreq, req)) {
3017                         return;
3018                 }
3019                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
3020                 return;
3021         }
3022
3023         status = receive_smb_talloc(state, xconn,
3024                                     xconn->transport.sock,
3025                                     &state->buf,
3026                                     0 /* timeout */,
3027                                     &unread,
3028                                     &encrypted,
3029                                     &state->buflen,
3030                                     &state->seqnum,
3031                                     false /* trusted_channel*/);
3032
3033         if (tevent_req_nterror(req, status)) {
3034                 tevent_req_nterror(req, status);
3035                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
3036                           (int)getpid(), nt_errstr(status)));
3037                 return;
3038         }
3039
3040         ok = smbd_unlock_socket_internal(xconn);
3041         if (!ok) {
3042                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
3043                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
3044                 return;
3045         }
3046         tevent_req_done(req);
3047 }
3048
3049 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3050                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
3051 {
3052         struct smbd_echo_read_state *state = tevent_req_data(
3053                 req, struct smbd_echo_read_state);
3054         NTSTATUS status;
3055
3056         if (tevent_req_is_nterror(req, &status)) {
3057                 return status;
3058         }
3059         *pbuf = talloc_move(mem_ctx, &state->buf);
3060         *pbuflen = state->buflen;
3061         *pseqnum = state->seqnum;
3062         return NT_STATUS_OK;
3063 }
3064
3065 struct smbd_echo_state {
3066         struct tevent_context *ev;
3067         struct iovec *pending;
3068         struct smbd_server_connection *sconn;
3069         struct smbXsrv_connection *xconn;
3070         int parent_pipe;
3071
3072         struct tevent_fd *parent_fde;
3073
3074         struct tevent_req *write_req;
3075 };
3076
3077 static void smbd_echo_writer_done(struct tevent_req *req);
3078
3079 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
3080 {
3081         int num_pending;
3082
3083         if (state->write_req != NULL) {
3084                 return;
3085         }
3086
3087         num_pending = talloc_array_length(state->pending);
3088         if (num_pending == 0) {
3089                 return;
3090         }
3091
3092         state->write_req = writev_send(state, state->ev, NULL,
3093                                        state->parent_pipe, false,
3094                                        state->pending, num_pending);
3095         if (state->write_req == NULL) {
3096                 DEBUG(1, ("writev_send failed\n"));
3097                 exit(1);
3098         }
3099
3100         talloc_steal(state->write_req, state->pending);
3101         state->pending = NULL;
3102
3103         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
3104                                 state);
3105 }
3106
3107 static void smbd_echo_writer_done(struct tevent_req *req)
3108 {
3109         struct smbd_echo_state *state = tevent_req_callback_data(
3110                 req, struct smbd_echo_state);
3111         ssize_t written;
3112         int err;
3113
3114         written = writev_recv(req, &err);
3115         TALLOC_FREE(req);
3116         state->write_req = NULL;
3117         if (written == -1) {
3118                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3119                 exit(1);
3120         }
3121         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3122         smbd_echo_activate_writer(state);
3123 }
3124
3125 static bool smbd_echo_reply(struct smbd_echo_state *state,
3126                             uint8_t *inbuf, size_t inbuf_len,
3127                             uint32_t seqnum)
3128 {
3129         struct smb_request req;
3130         uint16_t num_replies;
3131         char *outbuf;
3132         bool ok;
3133
3134         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3135                 DEBUG(10, ("Got netbios keepalive\n"));
3136                 /*
3137                  * Just swallow it
3138                  */
3139                 return true;
3140         }
3141
3142         if (inbuf_len < smb_size) {
3143                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3144                 return false;
3145         }
3146         if (!valid_smb_header(inbuf)) {
3147                 DEBUG(10, ("Got invalid SMB header\n"));
3148                 return false;
3149         }
3150
3151         if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3152                               seqnum)) {
3153                 return false;
3154         }
3155         req.inbuf = inbuf;
3156
3157         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3158                    smb_messages[req.cmd].name
3159                    ? smb_messages[req.cmd].name : "unknown"));
3160
3161         if (req.cmd != SMBecho) {
3162                 return false;
3163         }
3164         if (req.wct < 1) {
3165                 return false;
3166         }
3167
3168         num_replies = SVAL(req.vwv+0, 0);
3169         if (num_replies != 1) {
3170                 /* Not a Windows "Hey, you're still there?" request */
3171                 return false;
3172         }
3173
3174         if (!create_outbuf(talloc_tos(), &req, req.inbuf, &outbuf,
3175                            1, req.buflen)) {
3176                 DEBUG(10, ("create_outbuf failed\n"));
3177                 return false;
3178         }
3179         req.outbuf = (uint8_t *)outbuf;
3180
3181         SSVAL(req.outbuf, smb_vwv0, num_replies);
3182
3183         if (req.buflen > 0) {
3184                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3185         }
3186
3187         ok = srv_send_smb(req.xconn,
3188                           (char *)outbuf,
3189                           true, seqnum+1,
3190                           false, &req.pcd);
3191         TALLOC_FREE(outbuf);
3192         if (!ok) {
3193                 exit(1);
3194         }
3195
3196         return true;
3197 }
3198
3199 static void smbd_echo_exit(struct tevent_context *ev,
3200                            struct tevent_fd *fde, uint16_t flags,
3201                            void *private_data)
3202 {
3203         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3204         exit(0);
3205 }
3206
3207 static void smbd_echo_got_packet(struct tevent_req *req);
3208
3209 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
3210                            int parent_pipe)
3211 {
3212         struct smbd_echo_state *state;
3213         struct tevent_req *read_req;
3214
3215         state = talloc_zero(xconn, struct smbd_echo_state);
3216         if (state == NULL) {
3217                 DEBUG(1, ("talloc failed\n"));
3218                 return;
3219         }
3220         state->xconn = xconn;
3221         state->parent_pipe = parent_pipe;
3222         state->ev = samba_tevent_context_init(state);
3223         if (state->ev == NULL) {
3224                 DEBUG(1, ("samba_tevent_context_init failed\n"));
3225                 TALLOC_FREE(state);
3226                 return;
3227         }
3228         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3229                                         TEVENT_FD_READ, smbd_echo_exit,
3230                                         state);
3231         if (state->parent_fde == NULL) {
3232                 DEBUG(1, ("tevent_add_fd failed\n"));
3233                 TALLOC_FREE(state);
3234                 return;
3235         }
3236
3237         read_req = smbd_echo_read_send(state, state->ev, xconn);
3238         if (read_req == NULL) {
3239                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3240                 TALLOC_FREE(state);
3241                 return;
3242         }
3243         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3244
3245         while (true) {
3246                 if (tevent_loop_once(state->ev) == -1) {
3247                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3248                                   strerror(errno)));
3249                         break;
3250                 }
3251         }
3252         TALLOC_FREE(state);
3253 }
3254
3255 static void smbd_echo_got_packet(struct tevent_req *req)
3256 {
3257         struct smbd_echo_state *state = tevent_req_callback_data(
3258                 req, struct smbd_echo_state);
3259         NTSTATUS status;
3260         char *buf = NULL;
3261         size_t buflen = 0;
3262         uint32_t seqnum = 0;
3263         bool reply;
3264
3265         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3266         TALLOC_FREE(req);
3267         if (!NT_STATUS_IS_OK(status)) {
3268                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3269                           nt_errstr(status)));
3270                 exit(1);
3271         }
3272
3273         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3274         if (!reply) {
3275                 size_t num_pending;
3276                 struct iovec *tmp;
3277                 struct iovec *iov;
3278
3279                 num_pending = talloc_array_length(state->pending);
3280                 tmp = talloc_realloc(state, state->pending, struct iovec,
3281                                      num_pending+1);
3282                 if (tmp == NULL) {
3283                         DEBUG(1, ("talloc_realloc failed\n"));
3284                         exit(1);
3285                 }
3286                 state->pending = tmp;
3287
3288                 if (buflen >= smb_size) {
3289                         /*
3290                          * place the seqnum in the packet so that the main process
3291                          * can reply with signing
3292                          */
3293                         SIVAL(buf, smb_ss_field, seqnum);
3294                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3295                 }
3296
3297                 iov = &state->pending[num_pending];
3298                 iov->iov_base = talloc_move(state->pending, &buf);
3299                 iov->iov_len = buflen;
3300
3301                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3302                           (int)getpid()));
3303                 smbd_echo_activate_writer(state);
3304         }
3305
3306         req = smbd_echo_read_send(state, state->ev, state->xconn);
3307         if (req == NULL) {
3308                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3309                 exit(1);
3310         }
3311         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3312 }
3313
3314
3315 /*
3316  * Handle SMBecho requests in a forked child process
3317  */
3318 bool fork_echo_handler(struct smbXsrv_connection *xconn)
3319 {
3320         int listener_pipe[2];
3321         int res;
3322         pid_t child;
3323         bool use_mutex = false;
3324
3325         res = pipe(listener_pipe);
3326         if (res == -1) {
3327                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3328                 return false;
3329         }
3330
3331 #ifdef HAVE_ROBUST_MUTEXES
3332         use_mutex = tdb_runtime_check_for_robust_mutexes();
3333
3334         if (use_mutex) {
3335                 pthread_mutexattr_t a;
3336
3337                 xconn->smb1.echo_handler.socket_mutex =
3338                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3339                 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3340                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3341                                   strerror(errno)));
3342                         goto fail;
3343                 }
3344
3345                 res = pthread_mutexattr_init(&a);
3346                 if (res != 0) {
3347                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3348                                   strerror(res)));
3349                         goto fail;
3350                 }
3351                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3352                 if (res != 0) {
3353                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3354                                   strerror(res)));
3355                         pthread_mutexattr_destroy(&a);
3356                         goto fail;
3357                 }
3358                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3359                 if (res != 0) {
3360                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3361                                   strerror(res)));
3362                         pthread_mutexattr_destroy(&a);
3363                         goto fail;
3364                 }
3365                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3366                 if (res != 0) {
3367                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3368                                   "%s\n", strerror(res)));
3369                         pthread_mutexattr_destroy(&a);
3370                         goto fail;
3371                 }
3372                 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3373                                          &a);
3374                 pthread_mutexattr_destroy(&a);
3375                 if (res != 0) {
3376                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3377                                   strerror(res)));
3378                         goto fail;
3379                 }
3380         }
3381 #endif
3382
3383         if (!use_mutex) {
3384                 xconn->smb1.echo_handler.socket_lock_fd =
3385                         create_unlink_tmp(lp_lock_directory());
3386                 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3387                         DEBUG(1, ("Could not create lock fd: %s\n",
3388                                   strerror(errno)));
3389                         goto fail;
3390                 }
3391         }
3392
3393         child = fork();
3394         if (child == 0) {
3395                 NTSTATUS status;
3396
3397                 close(listener_pipe[0]);
3398                 set_blocking(listener_pipe[1], false);
3399
3400                 status = smbd_reinit_after_fork(xconn->client->msg_ctx,
3401                                                 xconn->client->raw_ev_ctx,
3402                                                 true,
3403                                                 "smbd-echo");
3404                 if (!NT_STATUS_IS_OK(status)) {
3405                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3406                                   nt_errstr(status)));
3407                         exit(1);
3408                 }
3409                 initialize_password_db(true, xconn->client->raw_ev_ctx);
3410                 smbd_echo_loop(xconn, listener_pipe[1]);
3411                 exit(0);
3412         }
3413         close(listener_pipe[1]);
3414         listener_pipe[1] = -1;
3415         xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3416
3417         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3418
3419         /*
3420          * Without smb signing this is the same as the normal smbd
3421          * listener. This needs to change once signing comes in.
3422          */
3423         xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(
3424                                         xconn->client->raw_ev_ctx,
3425                                         xconn,
3426                                         xconn->smb1.echo_handler.trusted_fd,
3427                                         TEVENT_FD_READ,
3428                                         smbd_server_echo_handler,
3429                                         xconn);
3430         if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3431                 DEBUG(1, ("event_add_fd failed\n"));
3432                 goto fail;
3433         }
3434
3435         return true;
3436
3437 fail:
3438         if (listener_pipe[0] != -1) {
3439                 close(listener_pipe[0]);
3440         }
3441         if (listener_pipe[1] != -1) {
3442                 close(listener_pipe[1]);
3443         }
3444         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3445                 close(xconn->smb1.echo_handler.socket_lock_fd);
3446         }
3447 #ifdef HAVE_ROBUST_MUTEXES
3448         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3449                 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3450                 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3451         }
3452 #endif
3453         smbd_echo_init(xconn);
3454
3455         return false;
3456 }
3457
3458 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3459 {
3460         while (user) {
3461                 if (user->session_info &&
3462                     (user->session_info->unix_token->uid == uid)) {
3463                         return true;
3464                 }
3465                 user = user->next;
3466         }
3467         return false;
3468 }
3469
3470 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3471 {
3472         while (user) {
3473                 if (user->session_info != NULL) {
3474                         int i;
3475                         struct security_unix_token *utok;
3476
3477                         utok = user->session_info->unix_token;
3478                         if (utok->gid == gid) {
3479                                 return true;
3480                         }
3481                         for(i=0; i<utok->ngroups; i++) {
3482                                 if (utok->groups[i] == gid) {
3483                                         return true;
3484                                 }
3485                         }
3486                 }
3487                 user = user->next;
3488         }
3489         return false;
3490 }
3491
3492 static bool sid_in_use(const struct user_struct *user,
3493                        const struct dom_sid *psid)
3494 {
3495         while (user) {
3496                 struct security_token *tok;
3497
3498                 if (user->session_info == NULL) {
3499                         continue;
3500                 }
3501                 tok = user->session_info->security_token;
3502                 if (tok == NULL) {
3503                         /*
3504                          * Not sure session_info->security_token can
3505                          * ever be NULL. This check might be not
3506                          * necessary.
3507                          */
3508                         continue;
3509                 }
3510                 if (security_token_has_sid(tok, psid)) {
3511                         return true;
3512                 }
3513                 user = user->next;
3514         }
3515         return false;
3516 }
3517
3518 static bool id_in_use(const struct user_struct *user,
3519                       const struct id_cache_ref *id)
3520 {
3521         switch(id->type) {
3522         case UID:
3523                 return uid_in_use(user, id->id.uid);
3524         case GID:
3525                 return gid_in_use(user, id->id.gid);
3526         case SID:
3527                 return sid_in_use(user, &id->id.sid);
3528         default:
3529                 break;
3530         }
3531         return false;
3532 }
3533
3534 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3535                                void *private_data,
3536                                uint32_t msg_type,
3537                                struct server_id server_id,
3538                                DATA_BLOB* data)
3539 {
3540         const char *msg = (data && data->data)
3541                 ? (const char *)data->data : "<NULL>";
3542         struct id_cache_ref id;
3543         struct smbd_server_connection *sconn =
3544                 talloc_get_type_abort(private_data,
3545                 struct smbd_server_connection);
3546
3547         if (!id_cache_ref_parse(msg, &id)) {
3548                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3549                 return;
3550         }
3551
3552         if (id_in_use(sconn->users, &id)) {
3553                 exit_server_cleanly(msg);
3554         }
3555         id_cache_delete_from_cache(&id);
3556 }
3557
3558 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3559                                         enum protocol_types protocol)
3560 {
3561         NTSTATUS status;
3562
3563         conn->protocol = protocol;
3564
3565         if (conn->client->session_table != NULL) {
3566                 return NT_STATUS_OK;
3567         }
3568
3569         if (protocol >= PROTOCOL_SMB2_02) {
3570                 status = smb2srv_session_table_init(conn);
3571                 if (!NT_STATUS_IS_OK(status)) {
3572                         conn->protocol = PROTOCOL_NONE;
3573                         return status;
3574                 }
3575
3576                 status = smb2srv_open_table_init(conn);
3577                 if (!NT_STATUS_IS_OK(status)) {
3578                         conn->protocol = PROTOCOL_NONE;
3579                         return status;
3580                 }
3581         } else {
3582                 status = smb1srv_session_table_init(conn);
3583                 if (!NT_STATUS_IS_OK(status)) {
3584                         conn->protocol = PROTOCOL_NONE;
3585                         return status;
3586                 }
3587
3588                 status = smb1srv_tcon_table_init(conn);
3589                 if (!NT_STATUS_IS_OK(status)) {
3590                         conn->protocol = PROTOCOL_NONE;
3591                         return status;
3592                 }
3593
3594                 status = smb1srv_open_table_init(conn);
3595                 if (!NT_STATUS_IS_OK(status)) {
3596                         conn->protocol = PROTOCOL_NONE;
3597                         return status;
3598                 }
3599         }
3600
3601         set_Protocol(protocol);
3602         return NT_STATUS_OK;
3603 }
3604
3605 struct smbd_tevent_trace_state {
3606         struct tevent_context *ev;
3607         TALLOC_CTX *frame;
3608         SMBPROFILE_BASIC_ASYNC_STATE(profile_idle);
3609 };
3610
3611 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3612                                        void *private_data)
3613 {
3614         struct smbd_tevent_trace_state *state =
3615                 (struct smbd_tevent_trace_state *)private_data;
3616
3617         switch (point) {
3618         case TEVENT_TRACE_BEFORE_WAIT:
3619                 if (!smbprofile_dump_pending()) {
3620                         /*
3621                          * If there's no dump pending
3622                          * we don't want to schedule a new 1 sec timer.
3623                          *
3624                          * Instead we want to sleep as long as nothing happens.
3625                          */
3626                         smbprofile_dump_setup(NULL);
3627                 }
3628                 SMBPROFILE_BASIC_ASYNC_START(idle, profile_p, state->profile_idle);
3629                 break;
3630         case TEVENT_TRACE_AFTER_WAIT:
3631                 SMBPROFILE_BASIC_ASYNC_END(state->profile_idle);
3632                 if (!smbprofile_dump_pending()) {
3633                         /*
3634                          * We need to flush our state after sleeping
3635                          * (hopefully a long time).
3636                          */
3637                         smbprofile_dump();
3638                         /*
3639                          * future profiling events should trigger timers
3640                          * on our main event context.
3641                          */
3642                         smbprofile_dump_setup(state->ev);
3643                 }
3644                 break;
3645         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3646                 TALLOC_FREE(state->frame);
3647                 state->frame = talloc_stackframe_pool(8192);
3648                 break;
3649         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3650                 TALLOC_FREE(state->frame);
3651                 break;
3652         }
3653
3654         errno = 0;
3655 }
3656
3657 /**
3658  * Create a debug string for the connection
3659  *
3660  * This is allocated to talloc_tos() or a string constant
3661  * in certain corner cases. The returned string should
3662  * hence not be free'd directly but only via the talloc stack.
3663  */
3664 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3665 {
3666         const char *ret;
3667
3668         /*
3669          * TODO: this can be improved later
3670          * maybe including the client guid or more
3671          */
3672         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3673         if (ret == NULL) {
3674                 return "<tsocket_address_string() failed>";
3675         }
3676
3677         return ret;
3678 }
3679
3680 NTSTATUS smbd_add_connection(struct smbXsrv_client *client, int sock_fd,
3681                              struct smbXsrv_connection **_xconn)
3682 {
3683         TALLOC_CTX *frame = talloc_stackframe();
3684         struct smbXsrv_connection *xconn;
3685         struct sockaddr_storage ss_srv;
3686         void *sp_srv = (void *)&ss_srv;
3687         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3688         struct sockaddr_storage ss_clnt;
3689         void *sp_clnt = (void *)&ss_clnt;
3690         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3691         socklen_t sa_socklen;
3692         struct tsocket_address *local_address = NULL;
3693         struct tsocket_address *remote_address = NULL;
3694         const char *remaddr = NULL;
3695         char *p;
3696         const char *rhost = NULL;
3697         int ret;
3698         int tmp;
3699
3700         *_xconn = NULL;
3701
3702         DO_PROFILE_INC(connect);
3703
3704         xconn = talloc_zero(client, struct smbXsrv_connection);
3705         if (xconn == NULL) {
3706                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3707                 TALLOC_FREE(frame);
3708                 return NT_STATUS_NO_MEMORY;
3709         }
3710         talloc_steal(frame, xconn);
3711
3712         xconn->transport.sock = sock_fd;
3713         smbd_echo_init(xconn);
3714         xconn->protocol = PROTOCOL_NONE;
3715
3716         /* Ensure child is set to blocking mode */
3717         set_blocking(sock_fd,True);
3718
3719         set_socket_options(sock_fd, "SO_KEEPALIVE");
3720         set_socket_options(sock_fd, lp_socket_options());
3721
3722         sa_socklen = sizeof(ss_clnt);
3723         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3724         if (ret != 0) {
3725                 int saved_errno = errno;
3726                 int level = (errno == ENOTCONN)?2:0;
3727                 DEBUG(level,("getpeername() failed - %s\n",
3728                       strerror(saved_errno)));
3729                 TALLOC_FREE(frame);
3730                 return map_nt_error_from_unix_common(saved_errno);
3731         }
3732         ret = tsocket_address_bsd_from_sockaddr(xconn,
3733                                                 sa_clnt, sa_socklen,
3734                                                 &remote_address);
3735         if (ret != 0) {
3736                 int saved_errno = errno;
3737                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3738                         __location__, strerror(saved_errno)));
3739                 TALLOC_FREE(frame);
3740                 return map_nt_error_from_unix_common(saved_errno);
3741         }
3742
3743         sa_socklen = sizeof(ss_srv);
3744         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3745         if (ret != 0) {
3746                 int saved_errno = errno;
3747                 int level = (errno == ENOTCONN)?2:0;
3748                 DEBUG(level,("getsockname() failed - %s\n",
3749                       strerror(saved_errno)));
3750                 TALLOC_FREE(frame);
3751                 return map_nt_error_from_unix_common(saved_errno);
3752         }
3753         ret = tsocket_address_bsd_from_sockaddr(xconn,
3754                                                 sa_srv, sa_socklen,
3755                                                 &local_address);
3756         if (ret != 0) {
3757                 int saved_errno = errno;
3758                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3759                         __location__, strerror(saved_errno)));
3760                 TALLOC_FREE(frame);
3761                 return map_nt_error_from_unix_common(saved_errno);
3762         }
3763
3764         if (tsocket_address_is_inet(remote_address, "ip")) {
3765                 remaddr = tsocket_address_inet_addr_string(remote_address,
3766                                                            talloc_tos());
3767                 if (remaddr == NULL) {
3768                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3769                                  __location__, strerror(errno)));
3770                         TALLOC_FREE(frame);
3771                         return NT_STATUS_NO_MEMORY;
3772                 }
3773         } else {
3774                 remaddr = "0.0.0.0";
3775         }
3776
3777         /*
3778          * Before the first packet, check the global hosts allow/ hosts deny
3779          * parameters before doing any parsing of packets passed to us by the
3780          * client. This prevents attacks on our parsing code from hosts not in
3781          * the hosts allow list.
3782          */
3783
3784         ret = get_remote_hostname(remote_address,
3785                                   &p, talloc_tos());
3786         if (ret < 0) {
3787                 int saved_errno = errno;
3788                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3789                         __location__, strerror(saved_errno)));
3790                 TALLOC_FREE(frame);
3791                 return map_nt_error_from_unix_common(saved_errno);
3792         }
3793         rhost = p;
3794         if (strequal(rhost, "UNKNOWN")) {
3795                 rhost = remaddr;
3796         }
3797
3798         xconn->local_address = local_address;
3799         xconn->remote_address = remote_address;
3800         xconn->remote_hostname = talloc_strdup(xconn, rhost);
3801         if (xconn->remote_hostname == NULL) {
3802                 return NT_STATUS_NO_MEMORY;
3803         }
3804
3805         if (!srv_init_signing(xconn)) {
3806                 DEBUG(0, ("Failed to init smb_signing\n"));
3807                 TALLOC_FREE(frame);
3808                 return NT_STATUS_INTERNAL_ERROR;
3809         }
3810
3811         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3812                           xconn->remote_hostname,
3813                           remaddr)) {
3814                 DEBUG( 1, ("Connection denied from %s to %s\n",
3815                            tsocket_address_string(remote_address, talloc_tos()),
3816                            tsocket_address_string(local_address, talloc_tos())));
3817
3818                 /*
3819                  * We return a valid xconn
3820                  * so that the caller can return an error message
3821                  * to the client
3822                  */
3823                 client->connections = xconn;
3824                 xconn->client = client;
3825                 talloc_steal(client, xconn);
3826
3827                 *_xconn = xconn;
3828                 TALLOC_FREE(frame);
3829                 return NT_STATUS_NETWORK_ACCESS_DENIED;
3830         }
3831
3832         DEBUG(10, ("Connection allowed from %s to %s\n",
3833                    tsocket_address_string(remote_address, talloc_tos()),
3834                    tsocket_address_string(local_address, talloc_tos())));
3835
3836         if (lp_clustering()) {
3837                 /*
3838                  * We need to tell ctdb about our client's TCP
3839                  * connection, so that for failover ctdbd can send
3840                  * tickle acks, triggering a reconnection by the
3841                  * client.
3842                  */
3843                 NTSTATUS status;
3844
3845                 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3846                 if (!NT_STATUS_IS_OK(status)) {
3847                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3848                                   nt_errstr(status)));
3849                 }
3850         }
3851
3852         tmp = lp_max_xmit();
3853         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3854         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3855
3856         xconn->smb1.negprot.max_recv = tmp;
3857
3858         xconn->smb1.sessions.done_sesssetup = false;
3859         xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3860
3861         xconn->transport.fde = tevent_add_fd(client->raw_ev_ctx,
3862                                              xconn,
3863                                              sock_fd,
3864                                              TEVENT_FD_READ,
3865                                              smbd_server_connection_handler,
3866                                              xconn);
3867         if (!xconn->transport.fde) {
3868                 TALLOC_FREE(frame);
3869                 return NT_STATUS_NO_MEMORY;
3870         }
3871
3872         /* for now we only have one connection */
3873         DLIST_ADD_END(client->connections, xconn);
3874         xconn->client = client;
3875         talloc_steal(client, xconn);
3876
3877         *_xconn = xconn;
3878         TALLOC_FREE(frame);
3879         return NT_STATUS_OK;
3880 }
3881
3882 /****************************************************************************
3883  Process commands from the client
3884 ****************************************************************************/
3885
3886 void smbd_process(struct tevent_context *ev_ctx,
3887                   struct messaging_context *msg_ctx,
3888                   int sock_fd,
3889                   bool interactive)
3890 {
3891         struct smbd_tevent_trace_state trace_state = {
3892                 .ev = ev_ctx,
3893                 .frame = talloc_stackframe(),
3894         };
3895         struct smbXsrv_client *client = NULL;
3896         struct smbd_server_connection *sconn = NULL;
3897         struct smbXsrv_connection *xconn = NULL;
3898         const char *locaddr = NULL;
3899         const char *remaddr = NULL;
3900         int ret;
3901         NTSTATUS status;
3902         struct timeval tv = timeval_current();
3903         NTTIME now = timeval_to_nttime(&tv);
3904         char *chroot_dir = NULL;
3905         int rc;
3906
3907         status = smbXsrv_client_create(ev_ctx, ev_ctx, msg_ctx, now, &client);
3908         if (!NT_STATUS_IS_OK(status)) {
3909                 DBG_ERR("smbXsrv_client_create(): %s\n", nt_errstr(status));
3910                 exit_server_cleanly("talloc_zero(struct smbXsrv_client).\n");
3911         }
3912
3913         /*
3914          * TODO: remove this...:-)
3915          */
3916         global_smbXsrv_client = client;
3917
3918         sconn = talloc_zero(client, struct smbd_server_connection);
3919         if (sconn == NULL) {
3920                 exit_server("failed to create smbd_server_connection");
3921         }
3922
3923         client->sconn = sconn;
3924         sconn->client = client;
3925
3926         sconn->ev_ctx = ev_ctx;
3927         sconn->raw_ev_ctx = ev_ctx;
3928         sconn->msg_ctx = msg_ctx;
3929
3930         ret = pthreadpool_tevent_init(sconn, lp_aio_max_threads(),
3931                                       &sconn->pool);
3932         if (ret != 0) {
3933                 exit_server("pthreadpool_tevent_init() failed.");
3934         }
3935
3936         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3937                 /*
3938                  * We're not making the decision here,
3939                  * we're just allowing the client
3940                  * to decide between SMB1 and SMB2
3941                  * with the first negprot
3942                  * packet.
3943                  */
3944                 sconn->using_smb2 = true;
3945         }
3946
3947         if (!interactive) {
3948                 smbd_setup_sig_term_handler(sconn);
3949                 smbd_setup_sig_hup_handler(sconn);
3950         }
3951
3952         status = smbd_add_connection(client, sock_fd, &xconn);
3953         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3954                 /*
3955                  * send a negative session response "not listening on calling
3956                  * name"
3957                  */
3958                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3959                 (void)srv_send_smb(xconn,(char *)buf, false,
3960                                    0, false, NULL);
3961                 exit_server_cleanly("connection denied");
3962         } else if (!NT_STATUS_IS_OK(status)) {
3963                 exit_server_cleanly(nt_errstr(status));
3964         }
3965
3966         sconn->local_address =
3967                 tsocket_address_copy(xconn->local_address, sconn);
3968         if (sconn->local_address == NULL) {
3969                 exit_server_cleanly("tsocket_address_copy() failed");
3970         }
3971         sconn->remote_address =
3972                 tsocket_address_copy(xconn->remote_address, sconn);
3973         if (sconn->remote_address == NULL) {
3974                 exit_server_cleanly("tsocket_address_copy() failed");
3975         }
3976         sconn->remote_hostname =
3977                 talloc_strdup(sconn, xconn->remote_hostname);
3978         if (sconn->remote_hostname == NULL) {
3979                 exit_server_cleanly("tsocket_strdup() failed");
3980         }
3981
3982         if (tsocket_address_is_inet(sconn->local_address, "ip")) {
3983                 locaddr = tsocket_address_inet_addr_string(
3984                                 sconn->local_address,
3985                                 talloc_tos());
3986                 if (locaddr == NULL) {
3987                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3988                                  __location__, strerror(errno)));
3989                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3990                 }
3991         } else {
3992                 locaddr = "0.0.0.0";
3993         }
3994
3995         if (tsocket_address_is_inet(sconn->remote_address, "ip")) {
3996                 remaddr = tsocket_address_inet_addr_string(
3997                                 sconn->remote_address,
3998                                 talloc_tos());
3999                 if (remaddr == NULL) {
4000                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
4001                                  __location__, strerror(errno)));
4002                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
4003                 }
4004         } else {
4005                 remaddr = "0.0.0.0";
4006         }
4007
4008         /* this is needed so that we get decent entries
4009            in smbstatus for port 445 connects */
4010         set_remote_machine_name(remaddr, false);
4011         reload_services(sconn, conn_snum_used, true);
4012         sub_set_socket_ids(remaddr,
4013                            sconn->remote_hostname,
4014                            locaddr);
4015
4016         if (lp_preload_modules()) {
4017                 smb_load_all_modules_absoute_path(lp_preload_modules());
4018         }
4019
4020         smb_perfcount_init();
4021
4022         if (!init_account_policy()) {
4023                 exit_server("Could not open account policy tdb.\n");
4024         }
4025
4026         chroot_dir = lp_root_directory(talloc_tos());
4027         if (chroot_dir[0] != '\0') {
4028                 rc = chdir(chroot_dir);
4029                 if (rc != 0) {
4030                         DBG_ERR("Failed to chdir to %s\n", chroot_dir);
4031                         exit_server("Failed to chdir()");
4032                 }
4033
4034                 rc = chroot(chroot_dir);
4035                 if (rc != 0) {
4036                         DBG_ERR("Failed to change root to %s\n", chroot_dir);
4037                         exit_server("Failed to chroot()");
4038                 }
4039                 DBG_WARNING("Changed root to %s\n", chroot_dir);
4040
4041                 TALLOC_FREE(chroot_dir);
4042         }
4043
4044         if (!file_init(sconn)) {
4045                 exit_server("file_init() failed");
4046         }
4047
4048         /* Setup oplocks */
4049         if (!init_oplocks(sconn))
4050                 exit_server("Failed to init oplocks");
4051
4052         /* register our message handlers */
4053         messaging_register(sconn->msg_ctx, sconn,
4054                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
4055         messaging_register(sconn->msg_ctx, sconn,
4056                            MSG_SMB_CLOSE_FILE, msg_close_file);
4057         messaging_register(sconn->msg_ctx, sconn,
4058                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
4059
4060         id_cache_register_msgs(sconn->msg_ctx);
4061         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
4062         messaging_register(sconn->msg_ctx, sconn,
4063                            ID_CACHE_KILL, smbd_id_cache_kill);
4064
4065         messaging_deregister(sconn->msg_ctx,
4066                              MSG_SMB_CONF_UPDATED, sconn->raw_ev_ctx);
4067         messaging_register(sconn->msg_ctx, sconn,
4068                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
4069
4070         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
4071                              NULL);
4072         messaging_register(sconn->msg_ctx, sconn,
4073                            MSG_SMB_KILL_CLIENT_IP,
4074                            msg_kill_client_ip);
4075
4076         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
4077
4078         /*
4079          * Use the default MSG_DEBUG handler to avoid rebroadcasting
4080          * MSGs to all child processes
4081          */
4082         messaging_deregister(sconn->msg_ctx,
4083                              MSG_DEBUG, NULL);
4084         messaging_register(sconn->msg_ctx, NULL,
4085                            MSG_DEBUG, debug_message);
4086
4087         if ((lp_keepalive() != 0)
4088             && !(event_add_idle(ev_ctx, NULL,
4089                                 timeval_set(lp_keepalive(), 0),
4090                                 "keepalive", keepalive_fn,
4091                                 sconn))) {
4092                 DEBUG(0, ("Could not add keepalive event\n"));
4093                 exit(1);
4094         }
4095
4096         if (!(event_add_idle(ev_ctx, NULL,
4097                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
4098                              "deadtime", deadtime_fn, sconn))) {
4099                 DEBUG(0, ("Could not add deadtime event\n"));
4100                 exit(1);
4101         }
4102
4103         if (!(event_add_idle(ev_ctx, NULL,
4104                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
4105                              "housekeeping", housekeeping_fn, sconn))) {
4106                 DEBUG(0, ("Could not add housekeeping event\n"));
4107                 exit(1);
4108         }
4109
4110         smbprofile_dump_setup(ev_ctx);
4111
4112         if (!init_dptrs(sconn)) {
4113                 exit_server("init_dptrs() failed");
4114         }
4115
4116         TALLOC_FREE(trace_state.frame);
4117
4118         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback,
4119                                   &trace_state);
4120
4121         ret = tevent_loop_wait(ev_ctx);
4122         if (ret != 0) {
4123                 DEBUG(1, ("tevent_loop_wait failed: %d, %s,"
4124                           " exiting\n", ret, strerror(errno)));
4125         }
4126
4127         TALLOC_FREE(trace_state.frame);
4128
4129         exit_server_cleanly(NULL);
4130 }
4131
4132 bool req_is_in_chain(const struct smb_request *req)
4133 {
4134         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
4135                 /*
4136                  * We're right now handling a subsequent request, so we must
4137                  * be in a chain
4138                  */
4139                 return true;
4140         }
4141
4142         if (!is_andx_req(req->cmd)) {
4143                 return false;
4144         }
4145
4146         if (req->wct < 2) {
4147                 /*
4148                  * Okay, an illegal request, but definitely not chained :-)
4149                  */
4150                 return false;
4151         }
4152
4153         return (CVAL(req->vwv+0, 0) != 0xFF);
4154 }