source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../lib/tsocket/tsocket.h"
  23 #include "system/filesys.h"
  24 #include "smbd/smbd.h"
  25 #include "smbd/globals.h"
  26 #include "librpc/gen_ndr/netlogon.h"
  27 #include "../lib/async_req/async_sock.h"
  28 #include "ctdbd_conn.h"
  29 #include "../lib/util/select.h"
  30 #include "printing/queue_process.h"
  31 #include "system/select.h"
  32 #include "passdb.h"
  33 #include "auth.h"
  34 #include "messages.h"
  35 #include "smbprofile.h"
  36 #include "rpc_server/spoolss/srv_spoolss_nt.h"
  37 #include "libsmb/libsmb.h"
  38 #include "../lib/util/tevent_ntstatus.h"
  39 #include "../libcli/security/dom_sid.h"
  40 #include "../libcli/security/security_token.h"
  41 #include "lib/id_cache.h"
  42 #include "serverid.h"
  43 #include "system/threads.h"
  44
  45 /* Internal message queue for deferred opens. */
  46 struct pending_message_list {
  47         struct pending_message_list *next, *prev;
  48         struct timeval request_time; /* When was this first issued? */
  49         struct smbd_server_connection *sconn;
  50         struct smbXsrv_connection *xconn;
  51         struct tevent_timer *te;
  52         struct smb_perfcount_data pcd;
  53         uint32_t seqnum;
  54         bool encrypted;
  55         bool processed;
  56         DATA_BLOB buf;
  57         struct deferred_open_record *open_rec;
  58 };
  59
  60 static void construct_reply_common(struct smb_request *req, const char *inbuf,
  61                                    char *outbuf);
  62 static struct pending_message_list *get_deferred_open_message_smb(
  63         struct smbd_server_connection *sconn, uint64_t mid);
  64 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf);
  65
  66 static void smbd_echo_init(struct smbXsrv_connection *xconn)
  67 {
  68         xconn->smb1.echo_handler.trusted_fd = -1;
  69         xconn->smb1.echo_handler.socket_lock_fd = -1;
  70 #ifdef HAVE_ROBUST_MUTEXES
  71         xconn->smb1.echo_handler.socket_mutex = NULL;
  72 #endif
  73 }
  74
  75 static bool smbd_echo_active(struct smbXsrv_connection *xconn)
  76 {
  77         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
  78                 return true;
  79         }
  80
  81 #ifdef HAVE_ROBUST_MUTEXES
  82         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
  83                 return true;
  84         }
  85 #endif
  86
  87         return false;
  88 }
  89
  90 static bool smbd_lock_socket_internal(struct smbXsrv_connection *xconn)
  91 {
  92         if (!smbd_echo_active(xconn)) {
  93                 return true;
  94         }
  95
  96         xconn->smb1.echo_handler.ref_count++;
  97
  98         if (xconn->smb1.echo_handler.ref_count > 1) {
  99                 return true;
 100         }
 101
 102         DEBUG(10,("pid[%d] wait for socket lock\n", (int)getpid()));
 103
 104 #ifdef HAVE_ROBUST_MUTEXES
 105         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 106                 int ret = EINTR;
 107
 108                 while (ret == EINTR) {
 109                         ret = pthread_mutex_lock(
 110                                 xconn->smb1.echo_handler.socket_mutex);
 111                         if (ret == 0) {
 112                                 break;
 113                         }
 114                 }
 115                 if (ret != 0) {
 116                         DEBUG(1, ("pthread_mutex_lock failed: %s\n",
 117                                   strerror(ret)));
 118                         return false;
 119                 }
 120         }
 121 #endif
 122
 123         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 124                 bool ok;
 125
 126                 do {
 127                         ok = fcntl_lock(
 128                                 xconn->smb1.echo_handler.socket_lock_fd,
 129                                 F_SETLKW, 0, 0, F_WRLCK);
 130                 } while (!ok && (errno == EINTR));
 131
 132                 if (!ok) {
 133                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 134                         return false;
 135                 }
 136         }
 137
 138         DEBUG(10,("pid[%d] got socket lock\n", (int)getpid()));
 139
 140         return true;
 141 }
 142
 143 void smbd_lock_socket(struct smbXsrv_connection *xconn)
 144 {
 145         if (!smbd_lock_socket_internal(xconn)) {
 146                 exit_server_cleanly("failed to lock socket");
 147         }
 148 }
 149
 150 static bool smbd_unlock_socket_internal(struct smbXsrv_connection *xconn)
 151 {
 152         if (!smbd_echo_active(xconn)) {
 153                 return true;
 154         }
 155
 156         xconn->smb1.echo_handler.ref_count--;
 157
 158         if (xconn->smb1.echo_handler.ref_count > 0) {
 159                 return true;
 160         }
 161
 162 #ifdef HAVE_ROBUST_MUTEXES
 163         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
 164                 int ret = EINTR;
 165
 166                 while (ret == EINTR) {
 167                         ret = pthread_mutex_unlock(
 168                                 xconn->smb1.echo_handler.socket_mutex);
 169                         if (ret == 0) {
 170                                 break;
 171                         }
 172                 }
 173                 if (ret != 0) {
 174                         DEBUG(1, ("pthread_mutex_unlock failed: %s\n",
 175                                   strerror(ret)));
 176                         return false;
 177                 }
 178         }
 179 #endif
 180
 181         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
 182                 bool ok;
 183
 184                 do {
 185                         ok = fcntl_lock(
 186                                 xconn->smb1.echo_handler.socket_lock_fd,
 187                                 F_SETLKW, 0, 0, F_UNLCK);
 188                 } while (!ok && (errno == EINTR));
 189
 190                 if (!ok) {
 191                         DEBUG(1, ("fcntl_lock failed: %s\n", strerror(errno)));
 192                         return false;
 193                 }
 194         }
 195
 196         DEBUG(10,("pid[%d] unlocked socket\n", (int)getpid()));
 197
 198         return true;
 199 }
 200
 201 void smbd_unlock_socket(struct smbXsrv_connection *xconn)
 202 {
 203         if (!smbd_unlock_socket_internal(xconn)) {
 204                 exit_server_cleanly("failed to unlock socket");
 205         }
 206 }
 207
 208 /* Accessor function for smb_read_error for smbd functions. */
 209
 210 /****************************************************************************
 211  Send an smb to a fd.
 212 ****************************************************************************/
 213
 214 bool srv_send_smb(struct smbXsrv_connection *xconn, char *buffer,
 215                   bool do_signing, uint32_t seqnum,
 216                   bool do_encrypt,
 217                   struct smb_perfcount_data *pcd)
 218 {
 219         size_t len = 0;
 220         ssize_t ret;
 221         char *buf_out = buffer;
 222
 223         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
 224                 /*
 225                  * we're not supposed to do any io
 226                  */
 227                 return true;
 228         }
 229
 230         smbd_lock_socket(xconn);
 231
 232         if (do_signing) {
 233                 /* Sign the outgoing packet if required. */
 234                 srv_calculate_sign_mac(xconn, buf_out, seqnum);
 235         }
 236
 237         if (do_encrypt) {
 238                 NTSTATUS status = srv_encrypt_buffer(xconn, buffer, &buf_out);
 239                 if (!NT_STATUS_IS_OK(status)) {
 240                         DEBUG(0, ("send_smb: SMB encryption failed "
 241                                 "on outgoing packet! Error %s\n",
 242                                 nt_errstr(status) ));
 243                         ret = -1;
 244                         goto out;
 245                 }
 246         }
 247
 248         len = smb_len_large(buf_out) + 4;
 249
 250         ret = write_data(xconn->transport.sock, buf_out, len);
 251         if (ret <= 0) {
 252                 int saved_errno = errno;
 253                 /*
 254                  * Try and give an error message saying what
 255                  * client failed.
 256                  */
 257                 DEBUG(1,("pid[%d] Error writing %d bytes to client %s. %d. (%s)\n",
 258                          (int)getpid(), (int)len,
 259                          smbXsrv_connection_dbg(xconn),
 260                          (int)ret, strerror(saved_errno)));
 261                 errno = saved_errno;
 262
 263                 srv_free_enc_buffer(xconn, buf_out);
 264                 goto out;
 265         }
 266
 267         SMB_PERFCOUNT_SET_MSGLEN_OUT(pcd, len);
 268         srv_free_enc_buffer(xconn, buf_out);
 269 out:
 270         SMB_PERFCOUNT_END(pcd);
 271
 272         smbd_unlock_socket(xconn);
 273         return (ret > 0);
 274 }
 275
 276 /*******************************************************************
 277  Setup the word count and byte count for a smb message.
 278 ********************************************************************/
 279
 280 int srv_set_message(char *buf,
 281                         int num_words,
 282                         int num_bytes,
 283                         bool zero)
 284 {
 285         if (zero && (num_words || num_bytes)) {
 286                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 287         }
 288         SCVAL(buf,smb_wct,num_words);
 289         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 290         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 291         return (smb_size + num_words*2 + num_bytes);
 292 }
 293
 294 static bool valid_smb_header(const uint8_t *inbuf)
 295 {
 296         if (is_encrypted_packet(inbuf)) {
 297                 return true;
 298         }
 299         /*
 300          * This used to be (strncmp(smb_base(inbuf),"\377SMB",4) == 0)
 301          * but it just looks weird to call strncmp for this one.
 302          */
 303         return (IVAL(smb_base(inbuf), 0) == 0x424D53FF);
 304 }
 305
 306 /* Socket functions for smbd packet processing. */
 307
 308 static bool valid_packet_size(size_t len)
 309 {
 310         /*
 311          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 312          * of header. Don't print the error if this fits.... JRA.
 313          */
 314
 315         if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 316                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 317                                         (unsigned long)len));
 318                 return false;
 319         }
 320         return true;
 321 }
 322
 323 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 324                                       unsigned int timeout, ssize_t len)
 325 {
 326         NTSTATUS status;
 327
 328         if (len <= 0) {
 329                 return NT_STATUS_OK;
 330         }
 331
 332         status = read_fd_with_timeout(fd, buffer, len, len, timeout, NULL);
 333         if (!NT_STATUS_IS_OK(status)) {
 334                 char addr[INET6_ADDRSTRLEN];
 335                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 336                           "error = %s.\n",
 337                           get_peer_addr(fd, addr, sizeof(addr)),
 338                           nt_errstr(status)));
 339         }
 340         return status;
 341 }
 342
 343 /****************************************************************************
 344  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 345 ****************************************************************************/
 346
 347 /*
 348  * Unfortunately, earlier versions of smbclient/libsmbclient
 349  * don't send this "standard" writeX header. I've fixed this
 350  * for 3.2 but we'll use the old method with earlier versions.
 351  * Windows and CIFSFS at least use this standard size. Not
 352  * sure about MacOSX.
 353  */
 354
 355 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 356                                 (2*14) + /* word count (including bcc) */ \
 357                                 1 /* pad byte */)
 358
 359 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 360                                                     const char lenbuf[4],
 361                                                     struct smbXsrv_connection *xconn,
 362                                                     int sock,
 363                                                     char **buffer,
 364                                                     unsigned int timeout,
 365                                                     size_t *p_unread,
 366                                                     size_t *len_ret)
 367 {
 368         /* Size of a WRITEX call (+4 byte len). */
 369         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 370         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 371         ssize_t toread;
 372         NTSTATUS status;
 373
 374         memcpy(writeX_header, lenbuf, 4);
 375
 376         status = read_fd_with_timeout(
 377                 sock, writeX_header + 4,
 378                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 379                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 380                 timeout, NULL);
 381
 382         if (!NT_STATUS_IS_OK(status)) {
 383                 DEBUG(0, ("read_fd_with_timeout failed for client %s read "
 384                           "error = %s.\n",
 385                           smbXsrv_connection_dbg(xconn),
 386                           nt_errstr(status)));
 387                 return status;
 388         }
 389
 390         /*
 391          * Ok - now try and see if this is a possible
 392          * valid writeX call.
 393          */
 394
 395         if (is_valid_writeX_buffer(xconn, (uint8_t *)writeX_header)) {
 396                 /*
 397                  * If the data offset is beyond what
 398                  * we've read, drain the extra bytes.
 399                  */
 400                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 401                 ssize_t newlen;
 402
 403                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 404                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 405                         if (drain_socket(sock, drain) != drain) {
 406                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 407                                         " failed to drain pending bytes");
 408                         }
 409                 } else {
 410                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 411                 }
 412
 413                 /* Spoof down the length and null out the bcc. */
 414                 set_message_bcc(writeX_header, 0);
 415                 newlen = smb_len(writeX_header);
 416
 417                 /* Copy the header we've written. */
 418
 419                 *buffer = (char *)talloc_memdup(mem_ctx,
 420                                 writeX_header,
 421                                 sizeof(writeX_header));
 422
 423                 if (*buffer == NULL) {
 424                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 425                                   (int)sizeof(writeX_header)));
 426                         return NT_STATUS_NO_MEMORY;
 427                 }
 428
 429                 /* Work out the remaining bytes. */
 430                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 431                 *len_ret = newlen + 4;
 432                 return NT_STATUS_OK;
 433         }
 434
 435         if (!valid_packet_size(len)) {
 436                 return NT_STATUS_INVALID_PARAMETER;
 437         }
 438
 439         /*
 440          * Not a valid writeX call. Just do the standard
 441          * talloc and return.
 442          */
 443
 444         *buffer = talloc_array(mem_ctx, char, len+4);
 445
 446         if (*buffer == NULL) {
 447                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 448                           (int)len+4));
 449                 return NT_STATUS_NO_MEMORY;
 450         }
 451
 452         /* Copy in what we already read. */
 453         memcpy(*buffer,
 454                 writeX_header,
 455                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 456         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 457
 458         if(toread > 0) {
 459                 status = read_packet_remainder(
 460                         sock,
 461                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 462                         timeout, toread);
 463
 464                 if (!NT_STATUS_IS_OK(status)) {
 465                         DEBUG(10, ("receive_smb_raw_talloc_partial_read: %s\n",
 466                                    nt_errstr(status)));
 467                         return status;
 468                 }
 469         }
 470
 471         *len_ret = len + 4;
 472         return NT_STATUS_OK;
 473 }
 474
 475 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 476                                        struct smbXsrv_connection *xconn,
 477                                        int sock,
 478                                        char **buffer, unsigned int timeout,
 479                                        size_t *p_unread, size_t *plen)
 480 {
 481         char lenbuf[4];
 482         size_t len;
 483         int min_recv_size = lp_min_receive_file_size();
 484         NTSTATUS status;
 485
 486         *p_unread = 0;
 487
 488         status = read_smb_length_return_keepalive(sock, lenbuf, timeout,
 489                                                   &len);
 490         if (!NT_STATUS_IS_OK(status)) {
 491                 return status;
 492         }
 493
 494         if (CVAL(lenbuf,0) == 0 && min_recv_size &&
 495             (smb_len_large(lenbuf) > /* Could be a UNIX large writeX. */
 496                 (min_recv_size + STANDARD_WRITE_AND_X_HEADER_SIZE)) &&
 497             !srv_is_signing_active(xconn) &&
 498             xconn->smb1.echo_handler.trusted_fde == NULL) {
 499
 500                 return receive_smb_raw_talloc_partial_read(
 501                         mem_ctx, lenbuf, xconn, sock, buffer, timeout,
 502                         p_unread, plen);
 503         }
 504
 505         if (!valid_packet_size(len)) {
 506                 return NT_STATUS_INVALID_PARAMETER;
 507         }
 508
 509         /*
 510          * The +4 here can't wrap, we've checked the length above already.
 511          */
 512
 513         *buffer = talloc_array(mem_ctx, char, len+4);
 514
 515         if (*buffer == NULL) {
 516                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 517                           (int)len+4));
 518                 return NT_STATUS_NO_MEMORY;
 519         }
 520
 521         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 522
 523         status = read_packet_remainder(sock, (*buffer)+4, timeout, len);
 524         if (!NT_STATUS_IS_OK(status)) {
 525                 return status;
 526         }
 527
 528         *plen = len + 4;
 529         return NT_STATUS_OK;
 530 }
 531
 532 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx,
 533                                    struct smbXsrv_connection *xconn,
 534                                    int sock,
 535                                    char **buffer, unsigned int timeout,
 536                                    size_t *p_unread, bool *p_encrypted,
 537                                    size_t *p_len,
 538                                    uint32_t *seqnum,
 539                                    bool trusted_channel)
 540 {
 541         size_t len = 0;
 542         NTSTATUS status;
 543
 544         *p_encrypted = false;
 545
 546         status = receive_smb_raw_talloc(mem_ctx, xconn, sock, buffer, timeout,
 547                                         p_unread, &len);
 548         if (!NT_STATUS_IS_OK(status)) {
 549                 DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
 550                       ("receive_smb_raw_talloc failed for client %s "
 551                        "read error = %s.\n",
 552                        smbXsrv_connection_dbg(xconn),
 553                        nt_errstr(status)) );
 554                 return status;
 555         }
 556
 557         if (is_encrypted_packet((uint8_t *)*buffer)) {
 558                 status = srv_decrypt_buffer(xconn, *buffer);
 559                 if (!NT_STATUS_IS_OK(status)) {
 560                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 561                                 "incoming packet! Error %s\n",
 562                                 nt_errstr(status) ));
 563                         return status;
 564                 }
 565                 *p_encrypted = true;
 566         }
 567
 568         /* Check the incoming SMB signature. */
 569         if (!srv_check_sign_mac(xconn, *buffer, seqnum, trusted_channel)) {
 570                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 571                           "incoming packet!\n"));
 572                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 573         }
 574
 575         *p_len = len;
 576         return NT_STATUS_OK;
 577 }
 578
 579 /*
 580  * Initialize a struct smb_request from an inbuf
 581  */
 582
 583 static bool init_smb_request(struct smb_request *req,
 584                              struct smbd_server_connection *sconn,
 585                              struct smbXsrv_connection *xconn,
 586                              const uint8 *inbuf,
 587                              size_t unread_bytes, bool encrypted,
 588                              uint32_t seqnum)
 589 {
 590         struct smbXsrv_tcon *tcon;
 591         NTSTATUS status;
 592         NTTIME now;
 593         size_t req_size = smb_len(inbuf) + 4;
 594
 595         /* Ensure we have at least smb_size bytes. */
 596         if (req_size < smb_size) {
 597                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 598                         (unsigned int)req_size ));
 599                 return false;
 600         }
 601
 602         req->request_time = timeval_current();
 603         now = timeval_to_nttime(&req->request_time);
 604
 605         req->cmd    = CVAL(inbuf, smb_com);
 606         req->flags2 = SVAL(inbuf, smb_flg2);
 607         req->smbpid = SVAL(inbuf, smb_pid);
 608         req->mid    = (uint64_t)SVAL(inbuf, smb_mid);
 609         req->seqnum = seqnum;
 610         req->vuid   = SVAL(inbuf, smb_uid);
 611         req->tid    = SVAL(inbuf, smb_tid);
 612         req->wct    = CVAL(inbuf, smb_wct);
 613         req->vwv    = (const uint16_t *)(inbuf+smb_vwv);
 614         req->buflen = smb_buflen(inbuf);
 615         req->buf    = (const uint8_t *)smb_buf_const(inbuf);
 616         req->unread_bytes = unread_bytes;
 617         req->encrypted = encrypted;
 618         req->sconn = sconn;
 619         req->xconn = xconn;
 620         req->conn = NULL;
 621         if (xconn != NULL) {
 622                 status = smb1srv_tcon_lookup(xconn, req->tid, now, &tcon);
 623                 if (NT_STATUS_IS_OK(status)) {
 624                         req->conn = tcon->compat;
 625                 }
 626         }
 627         req->chain_fsp = NULL;
 628         req->smb2req = NULL;
 629         req->priv_paths = NULL;
 630         req->chain = NULL;
 631         smb_init_perfcount_data(&req->pcd);
 632
 633         /* Ensure we have at least wct words and 2 bytes of bcc. */
 634         if (smb_size + req->wct*2 > req_size) {
 635                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 636                         (unsigned int)req->wct,
 637                         (unsigned int)req_size));
 638                 return false;
 639         }
 640         /* Ensure bcc is correct. */
 641         if (((const uint8_t *)smb_buf_const(inbuf)) + req->buflen > inbuf + req_size) {
 642                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 643                         "(wct = %u, size %u)\n",
 644                         (unsigned int)req->buflen,
 645                         (unsigned int)req->wct,
 646                         (unsigned int)req_size));
 647                 return false;
 648         }
 649
 650         req->outbuf = NULL;
 651         return true;
 652 }
 653
 654 static void process_smb(struct smbXsrv_connection *xconn,
 655                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
 656                         uint32_t seqnum, bool encrypted,
 657                         struct smb_perfcount_data *deferred_pcd);
 658
 659 static void smbd_deferred_open_timer(struct tevent_context *ev,
 660                                      struct tevent_timer *te,
 661                                      struct timeval _tval,
 662                                      void *private_data)
 663 {
 664         struct pending_message_list *msg = talloc_get_type(private_data,
 665                                            struct pending_message_list);
 666         struct smbd_server_connection *sconn = msg->sconn;
 667         struct smbXsrv_connection *xconn = msg->xconn;
 668         TALLOC_CTX *mem_ctx = talloc_tos();
 669         uint64_t mid = (uint64_t)SVAL(msg->buf.data,smb_mid);
 670         uint8_t *inbuf;
 671
 672         inbuf = (uint8_t *)talloc_memdup(mem_ctx, msg->buf.data,
 673                                          msg->buf.length);
 674         if (inbuf == NULL) {
 675                 exit_server("smbd_deferred_open_timer: talloc failed\n");
 676                 return;
 677         }
 678
 679         /* We leave this message on the queue so the open code can
 680            know this is a retry. */
 681         DEBUG(5,("smbd_deferred_open_timer: trigger mid %llu.\n",
 682                 (unsigned long long)mid ));
 683
 684         /* Mark the message as processed so this is not
 685          * re-processed in error. */
 686         msg->processed = true;
 687
 688         process_smb(xconn, inbuf,
 689                     msg->buf.length, 0,
 690                     msg->seqnum, msg->encrypted, &msg->pcd);
 691
 692         /* If it's still there and was processed, remove it. */
 693         msg = get_deferred_open_message_smb(sconn, mid);
 694         if (msg && msg->processed) {
 695                 remove_deferred_open_message_smb(xconn, mid);
 696         }
 697 }
 698
 699 /****************************************************************************
 700  Function to push a message onto the tail of a linked list of smb messages ready
 701  for processing.
 702 ****************************************************************************/
 703
 704 static bool push_queued_message(struct smb_request *req,
 705                                 struct timeval request_time,
 706                                 struct timeval end_time,
 707                                 struct deferred_open_record *open_rec)
 708 {
 709         int msg_len = smb_len(req->inbuf) + 4;
 710         struct pending_message_list *msg;
 711
 712         msg = talloc_zero(NULL, struct pending_message_list);
 713
 714         if(msg == NULL) {
 715                 DEBUG(0,("push_message: malloc fail (1)\n"));
 716                 return False;
 717         }
 718         msg->sconn = req->sconn;
 719         msg->xconn = req->xconn;
 720
 721         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 722         if(msg->buf.data == NULL) {
 723                 DEBUG(0,("push_message: malloc fail (2)\n"));
 724                 TALLOC_FREE(msg);
 725                 return False;
 726         }
 727
 728         msg->request_time = request_time;
 729         msg->seqnum = req->seqnum;
 730         msg->encrypted = req->encrypted;
 731         msg->processed = false;
 732         SMB_PERFCOUNT_DEFER_OP(&req->pcd, &msg->pcd);
 733
 734         if (open_rec) {
 735                 msg->open_rec = talloc_move(msg, &open_rec);
 736         }
 737
 738 #if 0
 739         msg->te = tevent_add_timer(msg->sconn->ev_ctx,
 740                                    msg,
 741                                    end_time,
 742                                    smbd_deferred_open_timer,
 743                                    msg);
 744         if (!msg->te) {
 745                 DEBUG(0,("push_message: event_add_timed failed\n"));
 746                 TALLOC_FREE(msg);
 747                 return false;
 748         }
 749 #endif
 750
 751         DLIST_ADD_END(req->sconn->deferred_open_queue, msg,
 752                       struct pending_message_list *);
 753
 754         DEBUG(10,("push_message: pushed message length %u on "
 755                   "deferred_open_queue\n", (unsigned int)msg_len));
 756
 757         return True;
 758 }
 759
 760 /****************************************************************************
 761  Function to delete a sharing violation open message by mid.
 762 ****************************************************************************/
 763
 764 void remove_deferred_open_message_smb(struct smbXsrv_connection *xconn,
 765                                       uint64_t mid)
 766 {
 767         struct smbd_server_connection *sconn = xconn->client->sconn;
 768         struct pending_message_list *pml;
 769
 770         if (sconn->using_smb2) {
 771                 remove_deferred_open_message_smb2(xconn, mid);
 772                 return;
 773         }
 774
 775         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 776                 if (mid == (uint64_t)SVAL(pml->buf.data,smb_mid)) {
 777                         DEBUG(10,("remove_deferred_open_message_smb: "
 778                                   "deleting mid %llu len %u\n",
 779                                   (unsigned long long)mid,
 780                                   (unsigned int)pml->buf.length ));
 781                         DLIST_REMOVE(sconn->deferred_open_queue, pml);
 782                         TALLOC_FREE(pml);
 783                         return;
 784                 }
 785         }
 786 }
 787
 788 /****************************************************************************
 789  Move a sharing violation open retry message to the front of the list and
 790  schedule it for immediate processing.
 791 ****************************************************************************/
 792
 793 bool schedule_deferred_open_message_smb(struct smbXsrv_connection *xconn,
 794                                         uint64_t mid)
 795 {
 796         struct smbd_server_connection *sconn = xconn->client->sconn;
 797         struct pending_message_list *pml;
 798         int i = 0;
 799
 800         if (sconn->using_smb2) {
 801                 return schedule_deferred_open_message_smb2(xconn, mid);
 802         }
 803
 804         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 805                 uint64_t msg_mid = (uint64_t)SVAL(pml->buf.data,smb_mid);
 806
 807                 DEBUG(10,("schedule_deferred_open_message_smb: [%d] "
 808                         "msg_mid = %llu\n",
 809                         i++,
 810                         (unsigned long long)msg_mid ));
 811
 812                 if (mid == msg_mid) {
 813                         struct tevent_timer *te;
 814
 815                         if (pml->processed) {
 816                                 /* A processed message should not be
 817                                  * rescheduled. */
 818                                 DEBUG(0,("schedule_deferred_open_message_smb: LOGIC ERROR "
 819                                         "message mid %llu was already processed\n",
 820                                         (unsigned long long)msg_mid ));
 821                                 continue;
 822                         }
 823
 824                         DEBUG(10,("schedule_deferred_open_message_smb: "
 825                                 "scheduling mid %llu\n",
 826                                 (unsigned long long)mid ));
 827
 828                         te = tevent_add_timer(pml->sconn->ev_ctx,
 829                                               pml,
 830                                               timeval_zero(),
 831                                               smbd_deferred_open_timer,
 832                                               pml);
 833                         if (!te) {
 834                                 DEBUG(10,("schedule_deferred_open_message_smb: "
 835                                         "event_add_timed() failed, "
 836                                         "skipping mid %llu\n",
 837                                         (unsigned long long)msg_mid ));
 838                         }
 839
 840                         TALLOC_FREE(pml->te);
 841                         pml->te = te;
 842                         DLIST_PROMOTE(sconn->deferred_open_queue, pml);
 843                         return true;
 844                 }
 845         }
 846
 847         DEBUG(10,("schedule_deferred_open_message_smb: failed to "
 848                 "find message mid %llu\n",
 849                 (unsigned long long)mid ));
 850
 851         return false;
 852 }
 853
 854 /****************************************************************************
 855  Return true if this mid is on the deferred queue and was not yet processed.
 856 ****************************************************************************/
 857
 858 bool open_was_deferred(struct smbXsrv_connection *xconn, uint64_t mid)
 859 {
 860         struct smbd_server_connection *sconn = xconn->client->sconn;
 861         struct pending_message_list *pml;
 862
 863         if (sconn->using_smb2) {
 864                 return open_was_deferred_smb2(xconn, mid);
 865         }
 866
 867         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 868                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid && !pml->processed) {
 869                         return True;
 870                 }
 871         }
 872         return False;
 873 }
 874
 875 /****************************************************************************
 876  Return the message queued by this mid.
 877 ****************************************************************************/
 878
 879 static struct pending_message_list *get_deferred_open_message_smb(
 880         struct smbd_server_connection *sconn, uint64_t mid)
 881 {
 882         struct pending_message_list *pml;
 883
 884         for (pml = sconn->deferred_open_queue; pml; pml = pml->next) {
 885                 if (((uint64_t)SVAL(pml->buf.data,smb_mid)) == mid) {
 886                         return pml;
 887                 }
 888         }
 889         return NULL;
 890 }
 891
 892 /****************************************************************************
 893  Get the state data queued by this mid.
 894 ****************************************************************************/
 895
 896 bool get_deferred_open_message_state(struct smb_request *smbreq,
 897                                 struct timeval *p_request_time,
 898                                 struct deferred_open_record **open_rec)
 899 {
 900         struct pending_message_list *pml;
 901
 902         if (smbreq->sconn->using_smb2) {
 903                 return get_deferred_open_message_state_smb2(smbreq->smb2req,
 904                                         p_request_time,
 905                                         open_rec);
 906         }
 907
 908         pml = get_deferred_open_message_smb(smbreq->sconn, smbreq->mid);
 909         if (!pml) {
 910                 return false;
 911         }
 912         if (p_request_time) {
 913                 *p_request_time = pml->request_time;
 914         }
 915         if (open_rec != NULL) {
 916                 *open_rec = pml->open_rec;
 917         }
 918         return true;
 919 }
 920
 921 /****************************************************************************
 922  Function to push a deferred open smb message onto a linked list of local smb
 923  messages ready for processing.
 924 ****************************************************************************/
 925
 926 bool push_deferred_open_message_smb(struct smb_request *req,
 927                                struct timeval request_time,
 928                                struct timeval timeout,
 929                                struct file_id id,
 930                                struct deferred_open_record *open_rec)
 931 {
 932         struct timeval end_time;
 933
 934         if (req->smb2req) {
 935                 return push_deferred_open_message_smb2(req->smb2req,
 936                                                 request_time,
 937                                                 timeout,
 938                                                 id,
 939                                                 open_rec);
 940         }
 941
 942         if (req->unread_bytes) {
 943                 DEBUG(0,("push_deferred_open_message_smb: logic error ! "
 944                         "unread_bytes = %u\n",
 945                         (unsigned int)req->unread_bytes ));
 946                 smb_panic("push_deferred_open_message_smb: "
 947                         "logic error unread_bytes != 0" );
 948         }
 949
 950         end_time = timeval_sum(&request_time, &timeout);
 951
 952         DEBUG(10,("push_deferred_open_message_smb: pushing message "
 953                 "len %u mid %llu timeout time [%u.%06u]\n",
 954                 (unsigned int) smb_len(req->inbuf)+4,
 955                 (unsigned long long)req->mid,
 956                 (unsigned int)end_time.tv_sec,
 957                 (unsigned int)end_time.tv_usec));
 958
 959         return push_queued_message(req, request_time, end_time, open_rec);
 960 }
 961
 962 static void smbd_sig_term_handler(struct tevent_context *ev,
 963                                   struct tevent_signal *se,
 964                                   int signum,
 965                                   int count,
 966                                   void *siginfo,
 967                                   void *private_data)
 968 {
 969         exit_server_cleanly("termination signal");
 970 }
 971
 972 void smbd_setup_sig_term_handler(struct smbd_server_connection *sconn)
 973 {
 974         struct tevent_signal *se;
 975
 976         se = tevent_add_signal(sconn->ev_ctx,
 977                                sconn,
 978                                SIGTERM, 0,
 979                                smbd_sig_term_handler,
 980                                sconn);
 981         if (!se) {
 982                 exit_server("failed to setup SIGTERM handler");
 983         }
 984 }
 985
 986 static void smbd_sig_hup_handler(struct tevent_context *ev,
 987                                   struct tevent_signal *se,
 988                                   int signum,
 989                                   int count,
 990                                   void *siginfo,
 991                                   void *private_data)
 992 {
 993         struct smbd_server_connection *sconn =
 994                 talloc_get_type_abort(private_data,
 995                 struct smbd_server_connection);
 996
 997         change_to_root_user();
 998         DEBUG(1,("Reloading services after SIGHUP\n"));
 999         reload_services(sconn, conn_snum_used, false);
1000 }
1001
1002 void smbd_setup_sig_hup_handler(struct smbd_server_connection *sconn)
1003 {
1004         struct tevent_signal *se;
1005
1006         se = tevent_add_signal(sconn->ev_ctx,
1007                                sconn,
1008                                SIGHUP, 0,
1009                                smbd_sig_hup_handler,
1010                                sconn);
1011         if (!se) {
1012                 exit_server("failed to setup SIGHUP handler");
1013         }
1014 }
1015
1016 static void smbd_conf_updated(struct messaging_context *msg,
1017                               void *private_data,
1018                               uint32_t msg_type,
1019                               struct server_id server_id,
1020                               DATA_BLOB *data)
1021 {
1022         struct smbd_server_connection *sconn =
1023                 talloc_get_type_abort(private_data,
1024                 struct smbd_server_connection);
1025
1026         DEBUG(10,("smbd_conf_updated: Got message saying smb.conf was "
1027                   "updated. Reloading.\n"));
1028         change_to_root_user();
1029         reload_services(sconn, conn_snum_used, false);
1030 }
1031
1032 /*
1033  * Only allow 5 outstanding trans requests. We're allocating memory, so
1034  * prevent a DoS.
1035  */
1036
1037 NTSTATUS allow_new_trans(struct trans_state *list, uint64_t mid)
1038 {
1039         int count = 0;
1040         for (; list != NULL; list = list->next) {
1041
1042                 if (list->mid == mid) {
1043                         return NT_STATUS_INVALID_PARAMETER;
1044                 }
1045
1046                 count += 1;
1047         }
1048         if (count > 5) {
1049                 return NT_STATUS_INSUFFICIENT_RESOURCES;
1050         }
1051
1052         return NT_STATUS_OK;
1053 }
1054
1055 /*
1056 These flags determine some of the permissions required to do an operation
1057
1058 Note that I don't set NEED_WRITE on some write operations because they
1059 are used by some brain-dead clients when printing, and I don't want to
1060 force write permissions on print services.
1061 */
1062 #define AS_USER (1<<0)
1063 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1064 #define TIME_INIT (1<<2)
1065 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1066 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1067 #define DO_CHDIR (1<<6)
1068
1069 /*
1070    define a list of possible SMB messages and their corresponding
1071    functions. Any message that has a NULL function is unimplemented -
1072    please feel free to contribute implementations!
1073 */
1074 static const struct smb_message_struct {
1075         const char *name;
1076         void (*fn)(struct smb_request *req);
1077         int flags;
1078 } smb_messages[256] = {
1079
1080 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1081 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1082 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1083 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1084 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1085 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1086 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1087 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1088 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1089 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1090 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1091 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1092 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1093 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1094 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1095 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1096 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1097 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1098 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1099 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1100 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1101 /* 0x15 */ { NULL, NULL, 0 },
1102 /* 0x16 */ { NULL, NULL, 0 },
1103 /* 0x17 */ { NULL, NULL, 0 },
1104 /* 0x18 */ { NULL, NULL, 0 },
1105 /* 0x19 */ { NULL, NULL, 0 },
1106 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1107 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1108 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1109 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1110 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1111 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1112 /* 0x20 */ { "SMBwritec", NULL,0},
1113 /* 0x21 */ { NULL, NULL, 0 },
1114 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1115 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1116 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1117 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1118 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1119 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1120 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1121 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1122 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1123 /* 0x2b */ { "SMBecho",reply_echo,0},
1124 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1125 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1126 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1127 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1128 /* 0x30 */ { NULL, NULL, 0 },
1129 /* 0x31 */ { NULL, NULL, 0 },
1130 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1131 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER | CAN_IPC },
1132 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1133 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1134 /* 0x36 */ { NULL, NULL, 0 },
1135 /* 0x37 */ { NULL, NULL, 0 },
1136 /* 0x38 */ { NULL, NULL, 0 },
1137 /* 0x39 */ { NULL, NULL, 0 },
1138 /* 0x3a */ { NULL, NULL, 0 },
1139 /* 0x3b */ { NULL, NULL, 0 },
1140 /* 0x3c */ { NULL, NULL, 0 },
1141 /* 0x3d */ { NULL, NULL, 0 },
1142 /* 0x3e */ { NULL, NULL, 0 },
1143 /* 0x3f */ { NULL, NULL, 0 },
1144 /* 0x40 */ { NULL, NULL, 0 },
1145 /* 0x41 */ { NULL, NULL, 0 },
1146 /* 0x42 */ { NULL, NULL, 0 },
1147 /* 0x43 */ { NULL, NULL, 0 },
1148 /* 0x44 */ { NULL, NULL, 0 },
1149 /* 0x45 */ { NULL, NULL, 0 },
1150 /* 0x46 */ { NULL, NULL, 0 },
1151 /* 0x47 */ { NULL, NULL, 0 },
1152 /* 0x48 */ { NULL, NULL, 0 },
1153 /* 0x49 */ { NULL, NULL, 0 },
1154 /* 0x4a */ { NULL, NULL, 0 },
1155 /* 0x4b */ { NULL, NULL, 0 },
1156 /* 0x4c */ { NULL, NULL, 0 },
1157 /* 0x4d */ { NULL, NULL, 0 },
1158 /* 0x4e */ { NULL, NULL, 0 },
1159 /* 0x4f */ { NULL, NULL, 0 },
1160 /* 0x50 */ { NULL, NULL, 0 },
1161 /* 0x51 */ { NULL, NULL, 0 },
1162 /* 0x52 */ { NULL, NULL, 0 },
1163 /* 0x53 */ { NULL, NULL, 0 },
1164 /* 0x54 */ { NULL, NULL, 0 },
1165 /* 0x55 */ { NULL, NULL, 0 },
1166 /* 0x56 */ { NULL, NULL, 0 },
1167 /* 0x57 */ { NULL, NULL, 0 },
1168 /* 0x58 */ { NULL, NULL, 0 },
1169 /* 0x59 */ { NULL, NULL, 0 },
1170 /* 0x5a */ { NULL, NULL, 0 },
1171 /* 0x5b */ { NULL, NULL, 0 },
1172 /* 0x5c */ { NULL, NULL, 0 },
1173 /* 0x5d */ { NULL, NULL, 0 },
1174 /* 0x5e */ { NULL, NULL, 0 },
1175 /* 0x5f */ { NULL, NULL, 0 },
1176 /* 0x60 */ { NULL, NULL, 0 },
1177 /* 0x61 */ { NULL, NULL, 0 },
1178 /* 0x62 */ { NULL, NULL, 0 },
1179 /* 0x63 */ { NULL, NULL, 0 },
1180 /* 0x64 */ { NULL, NULL, 0 },
1181 /* 0x65 */ { NULL, NULL, 0 },
1182 /* 0x66 */ { NULL, NULL, 0 },
1183 /* 0x67 */ { NULL, NULL, 0 },
1184 /* 0x68 */ { NULL, NULL, 0 },
1185 /* 0x69 */ { NULL, NULL, 0 },
1186 /* 0x6a */ { NULL, NULL, 0 },
1187 /* 0x6b */ { NULL, NULL, 0 },
1188 /* 0x6c */ { NULL, NULL, 0 },
1189 /* 0x6d */ { NULL, NULL, 0 },
1190 /* 0x6e */ { NULL, NULL, 0 },
1191 /* 0x6f */ { NULL, NULL, 0 },
1192 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1193 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1194 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1195 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1196 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1197 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1198 /* 0x76 */ { NULL, NULL, 0 },
1199 /* 0x77 */ { NULL, NULL, 0 },
1200 /* 0x78 */ { NULL, NULL, 0 },
1201 /* 0x79 */ { NULL, NULL, 0 },
1202 /* 0x7a */ { NULL, NULL, 0 },
1203 /* 0x7b */ { NULL, NULL, 0 },
1204 /* 0x7c */ { NULL, NULL, 0 },
1205 /* 0x7d */ { NULL, NULL, 0 },
1206 /* 0x7e */ { NULL, NULL, 0 },
1207 /* 0x7f */ { NULL, NULL, 0 },
1208 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1209 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1210 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1211 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1212 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1213 /* 0x85 */ { NULL, NULL, 0 },
1214 /* 0x86 */ { NULL, NULL, 0 },
1215 /* 0x87 */ { NULL, NULL, 0 },
1216 /* 0x88 */ { NULL, NULL, 0 },
1217 /* 0x89 */ { NULL, NULL, 0 },
1218 /* 0x8a */ { NULL, NULL, 0 },
1219 /* 0x8b */ { NULL, NULL, 0 },
1220 /* 0x8c */ { NULL, NULL, 0 },
1221 /* 0x8d */ { NULL, NULL, 0 },
1222 /* 0x8e */ { NULL, NULL, 0 },
1223 /* 0x8f */ { NULL, NULL, 0 },
1224 /* 0x90 */ { NULL, NULL, 0 },
1225 /* 0x91 */ { NULL, NULL, 0 },
1226 /* 0x92 */ { NULL, NULL, 0 },
1227 /* 0x93 */ { NULL, NULL, 0 },
1228 /* 0x94 */ { NULL, NULL, 0 },
1229 /* 0x95 */ { NULL, NULL, 0 },
1230 /* 0x96 */ { NULL, NULL, 0 },
1231 /* 0x97 */ { NULL, NULL, 0 },
1232 /* 0x98 */ { NULL, NULL, 0 },
1233 /* 0x99 */ { NULL, NULL, 0 },
1234 /* 0x9a */ { NULL, NULL, 0 },
1235 /* 0x9b */ { NULL, NULL, 0 },
1236 /* 0x9c */ { NULL, NULL, 0 },
1237 /* 0x9d */ { NULL, NULL, 0 },
1238 /* 0x9e */ { NULL, NULL, 0 },
1239 /* 0x9f */ { NULL, NULL, 0 },
1240 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1241 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1242 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1243 /* 0xa3 */ { NULL, NULL, 0 },
1244 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1245 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1246 /* 0xa6 */ { NULL, NULL, 0 },
1247 /* 0xa7 */ { NULL, NULL, 0 },
1248 /* 0xa8 */ { NULL, NULL, 0 },
1249 /* 0xa9 */ { NULL, NULL, 0 },
1250 /* 0xaa */ { NULL, NULL, 0 },
1251 /* 0xab */ { NULL, NULL, 0 },
1252 /* 0xac */ { NULL, NULL, 0 },
1253 /* 0xad */ { NULL, NULL, 0 },
1254 /* 0xae */ { NULL, NULL, 0 },
1255 /* 0xaf */ { NULL, NULL, 0 },
1256 /* 0xb0 */ { NULL, NULL, 0 },
1257 /* 0xb1 */ { NULL, NULL, 0 },
1258 /* 0xb2 */ { NULL, NULL, 0 },
1259 /* 0xb3 */ { NULL, NULL, 0 },
1260 /* 0xb4 */ { NULL, NULL, 0 },
1261 /* 0xb5 */ { NULL, NULL, 0 },
1262 /* 0xb6 */ { NULL, NULL, 0 },
1263 /* 0xb7 */ { NULL, NULL, 0 },
1264 /* 0xb8 */ { NULL, NULL, 0 },
1265 /* 0xb9 */ { NULL, NULL, 0 },
1266 /* 0xba */ { NULL, NULL, 0 },
1267 /* 0xbb */ { NULL, NULL, 0 },
1268 /* 0xbc */ { NULL, NULL, 0 },
1269 /* 0xbd */ { NULL, NULL, 0 },
1270 /* 0xbe */ { NULL, NULL, 0 },
1271 /* 0xbf */ { NULL, NULL, 0 },
1272 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1273 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1274 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1275 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1276 /* 0xc4 */ { NULL, NULL, 0 },
1277 /* 0xc5 */ { NULL, NULL, 0 },
1278 /* 0xc6 */ { NULL, NULL, 0 },
1279 /* 0xc7 */ { NULL, NULL, 0 },
1280 /* 0xc8 */ { NULL, NULL, 0 },
1281 /* 0xc9 */ { NULL, NULL, 0 },
1282 /* 0xca */ { NULL, NULL, 0 },
1283 /* 0xcb */ { NULL, NULL, 0 },
1284 /* 0xcc */ { NULL, NULL, 0 },
1285 /* 0xcd */ { NULL, NULL, 0 },
1286 /* 0xce */ { NULL, NULL, 0 },
1287 /* 0xcf */ { NULL, NULL, 0 },
1288 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1289 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1290 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1291 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1292 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1293 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1294 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1295 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1296 /* 0xd8 */ { NULL, NULL, 0 },
1297 /* 0xd9 */ { NULL, NULL, 0 },
1298 /* 0xda */ { NULL, NULL, 0 },
1299 /* 0xdb */ { NULL, NULL, 0 },
1300 /* 0xdc */ { NULL, NULL, 0 },
1301 /* 0xdd */ { NULL, NULL, 0 },
1302 /* 0xde */ { NULL, NULL, 0 },
1303 /* 0xdf */ { NULL, NULL, 0 },
1304 /* 0xe0 */ { NULL, NULL, 0 },
1305 /* 0xe1 */ { NULL, NULL, 0 },
1306 /* 0xe2 */ { NULL, NULL, 0 },
1307 /* 0xe3 */ { NULL, NULL, 0 },
1308 /* 0xe4 */ { NULL, NULL, 0 },
1309 /* 0xe5 */ { NULL, NULL, 0 },
1310 /* 0xe6 */ { NULL, NULL, 0 },
1311 /* 0xe7 */ { NULL, NULL, 0 },
1312 /* 0xe8 */ { NULL, NULL, 0 },
1313 /* 0xe9 */ { NULL, NULL, 0 },
1314 /* 0xea */ { NULL, NULL, 0 },
1315 /* 0xeb */ { NULL, NULL, 0 },
1316 /* 0xec */ { NULL, NULL, 0 },
1317 /* 0xed */ { NULL, NULL, 0 },
1318 /* 0xee */ { NULL, NULL, 0 },
1319 /* 0xef */ { NULL, NULL, 0 },
1320 /* 0xf0 */ { NULL, NULL, 0 },
1321 /* 0xf1 */ { NULL, NULL, 0 },
1322 /* 0xf2 */ { NULL, NULL, 0 },
1323 /* 0xf3 */ { NULL, NULL, 0 },
1324 /* 0xf4 */ { NULL, NULL, 0 },
1325 /* 0xf5 */ { NULL, NULL, 0 },
1326 /* 0xf6 */ { NULL, NULL, 0 },
1327 /* 0xf7 */ { NULL, NULL, 0 },
1328 /* 0xf8 */ { NULL, NULL, 0 },
1329 /* 0xf9 */ { NULL, NULL, 0 },
1330 /* 0xfa */ { NULL, NULL, 0 },
1331 /* 0xfb */ { NULL, NULL, 0 },
1332 /* 0xfc */ { NULL, NULL, 0 },
1333 /* 0xfd */ { NULL, NULL, 0 },
1334 /* 0xfe */ { NULL, NULL, 0 },
1335 /* 0xff */ { NULL, NULL, 0 }
1336
1337 };
1338
1339 /*******************************************************************
1340  allocate and initialize a reply packet
1341 ********************************************************************/
1342
1343 static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
1344                           const char *inbuf, char **outbuf, uint8_t num_words,
1345                           uint32_t num_bytes)
1346 {
1347         size_t smb_len = MIN_SMB_SIZE + VWV(num_words) + num_bytes;
1348
1349         /*
1350          * Protect against integer wrap.
1351          * The SMB layer reply can be up to 0xFFFFFF bytes.
1352          */
1353         if ((num_bytes > 0xffffff) || (smb_len > 0xffffff)) {
1354                 char *msg;
1355                 if (asprintf(&msg, "num_bytes too large: %u",
1356                              (unsigned)num_bytes) == -1) {
1357                         msg = discard_const_p(char, "num_bytes too large");
1358                 }
1359                 smb_panic(msg);
1360         }
1361
1362         /*
1363          * Here we include the NBT header for now.
1364          */
1365         *outbuf = talloc_array(mem_ctx, char,
1366                                NBT_HDR_SIZE + smb_len);
1367         if (*outbuf == NULL) {
1368                 return false;
1369         }
1370
1371         construct_reply_common(req, inbuf, *outbuf);
1372         srv_set_message(*outbuf, num_words, num_bytes, false);
1373         /*
1374          * Zero out the word area, the caller has to take care of the bcc area
1375          * himself
1376          */
1377         if (num_words != 0) {
1378                 memset(*outbuf + (NBT_HDR_SIZE + HDR_VWV), 0, VWV(num_words));
1379         }
1380
1381         return true;
1382 }
1383
1384 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1385 {
1386         char *outbuf;
1387         if (!create_outbuf(req, req, (const char *)req->inbuf, &outbuf, num_words,
1388                            num_bytes)) {
1389                 smb_panic("could not allocate output buffer\n");
1390         }
1391         req->outbuf = (uint8_t *)outbuf;
1392 }
1393
1394
1395 /*******************************************************************
1396  Dump a packet to a file.
1397 ********************************************************************/
1398
1399 static void smb_dump(const char *name, int type, const char *data)
1400 {
1401         size_t len;
1402         int fd, i;
1403         char *fname = NULL;
1404         if (DEBUGLEVEL < 50) {
1405                 return;
1406         }
1407
1408         len = smb_len_tcp(data)+4;
1409         for (i=1;i<100;i++) {
1410                 fname = talloc_asprintf(talloc_tos(),
1411                                 "/tmp/%s.%d.%s",
1412                                 name,
1413                                 i,
1414                                 type ? "req" : "resp");
1415                 if (fname == NULL) {
1416                         return;
1417                 }
1418                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1419                 if (fd != -1 || errno != EEXIST) break;
1420                 TALLOC_FREE(fname);
1421         }
1422         if (fd != -1) {
1423                 ssize_t ret = write(fd, data, len);
1424                 if (ret != len)
1425                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1426                 close(fd);
1427                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1428         }
1429         TALLOC_FREE(fname);
1430 }
1431
1432 /****************************************************************************
1433  Prepare everything for calling the actual request function, and potentially
1434  call the request function via the "new" interface.
1435
1436  Return False if the "legacy" function needs to be called, everything is
1437  prepared.
1438
1439  Return True if we're done.
1440
1441  I know this API sucks, but it is the one with the least code change I could
1442  find.
1443 ****************************************************************************/
1444
1445 static connection_struct *switch_message(uint8 type, struct smb_request *req)
1446 {
1447         int flags;
1448         uint64_t session_tag;
1449         connection_struct *conn = NULL;
1450         struct smbXsrv_connection *xconn = req->xconn;
1451         NTTIME now = timeval_to_nttime(&req->request_time);
1452         struct smbXsrv_session *session = NULL;
1453         NTSTATUS status;
1454
1455         errno = 0;
1456
1457         if (!xconn->smb1.negprot.done) {
1458                 switch (type) {
1459                         /*
1460                          * Without a negprot the request must
1461                          * either be a negprot, or one of the
1462                          * evil old SMB mailslot messaging types.
1463                          */
1464                         case SMBnegprot:
1465                         case SMBsendstrt:
1466                         case SMBsendend:
1467                         case SMBsendtxt:
1468                                 break;
1469                         default:
1470                                 exit_server_cleanly("The first request "
1471                                         "should be a negprot");
1472                 }
1473         }
1474
1475         if (smb_messages[type].fn == NULL) {
1476                 DEBUG(0,("Unknown message type %d!\n",type));
1477                 smb_dump("Unknown", 1, (const char *)req->inbuf);
1478                 reply_unknown_new(req, type);
1479                 return NULL;
1480         }
1481
1482         flags = smb_messages[type].flags;
1483
1484         /* In share mode security we must ignore the vuid. */
1485         session_tag = req->vuid;
1486         conn = req->conn;
1487
1488         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1489                  (int)getpid(), (unsigned long)conn));
1490
1491         smb_dump(smb_fn_name(type), 1, (const char *)req->inbuf);
1492
1493         /* Ensure this value is replaced in the incoming packet. */
1494         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_uid,session_tag);
1495
1496         /*
1497          * Ensure the correct username is in current_user_info.  This is a
1498          * really ugly bugfix for problems with multiple session_setup_and_X's
1499          * being done and allowing %U and %G substitutions to work correctly.
1500          * There is a reason this code is done here, don't move it unless you
1501          * know what you're doing... :-).
1502          * JRA.
1503          */
1504
1505         /*
1506          * lookup an existing session
1507          *
1508          * Note: for now we only check for NT_STATUS_NETWORK_SESSION_EXPIRED
1509          * here, the main check is still in change_to_user()
1510          */
1511         status = smb1srv_session_lookup(xconn,
1512                                         session_tag,
1513                                         now,
1514                                         &session);
1515         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
1516                 switch (type) {
1517                 case SMBsesssetupX:
1518                         status = NT_STATUS_OK;
1519                         break;
1520                 default:
1521                         DEBUG(1,("Error: session %llu is expired, mid=%llu.\n",
1522                                  (unsigned long long)session_tag,
1523                                  (unsigned long long)req->mid));
1524                         reply_nterror(req, NT_STATUS_NETWORK_SESSION_EXPIRED);
1525                         return conn;
1526                 }
1527         }
1528
1529         if (session_tag != xconn->client->last_session_id) {
1530                 struct user_struct *vuser = NULL;
1531
1532                 xconn->client->last_session_id = session_tag;
1533                 if (session) {
1534                         vuser = session->compat;
1535                 }
1536                 if (vuser) {
1537                         set_current_user_info(
1538                                 vuser->session_info->unix_info->sanitized_username,
1539                                 vuser->session_info->unix_info->unix_name,
1540                                 vuser->session_info->info->domain_name);
1541                 }
1542         }
1543
1544         /* Does this call need to be run as the connected user? */
1545         if (flags & AS_USER) {
1546
1547                 /* Does this call need a valid tree connection? */
1548                 if (!conn) {
1549                         /*
1550                          * Amazingly, the error code depends on the command
1551                          * (from Samba4).
1552                          */
1553                         if (type == SMBntcreateX) {
1554                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1555                         } else {
1556                                 reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
1557                         }
1558                         return NULL;
1559                 }
1560
1561                 if (!change_to_user(conn,session_tag)) {
1562                         DEBUG(0, ("Error: Could not change to user. Removing "
1563                                 "deferred open, mid=%llu.\n",
1564                                 (unsigned long long)req->mid));
1565                         reply_force_doserror(req, ERRSRV, ERRbaduid);
1566                         return conn;
1567                 }
1568
1569                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1570
1571                 /* Does it need write permission? */
1572                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1573                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1574                         return conn;
1575                 }
1576
1577                 /* IPC services are limited */
1578                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1579                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1580                         return conn;
1581                 }
1582         } else {
1583                 /* This call needs to be run as root */
1584                 change_to_root_user();
1585         }
1586
1587         /* load service specific parameters */
1588         if (conn) {
1589                 if (req->encrypted) {
1590                         conn->encrypted_tid = true;
1591                         /* encrypted required from now on. */
1592                         conn->encrypt_level = SMB_SIGNING_REQUIRED;
1593                 } else if (ENCRYPTION_REQUIRED(conn)) {
1594                         if (req->cmd != SMBtrans2 && req->cmd != SMBtranss2) {
1595                                 DEBUG(1,("service[%s] requires encryption"
1596                                         "%s ACCESS_DENIED. mid=%llu\n",
1597                                         lp_servicename(talloc_tos(), SNUM(conn)),
1598                                         smb_fn_name(type),
1599                                         (unsigned long long)req->mid));
1600                                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1601                                 return conn;
1602                         }
1603                 }
1604
1605                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1606                                          (flags & (AS_USER|DO_CHDIR)
1607                                           ?True:False))) {
1608                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1609                         return conn;
1610                 }
1611                 conn->num_smb_operations++;
1612         }
1613
1614         /*
1615          * Does this protocol need to be run as guest? (Only archane
1616          * messenger service requests have this...)
1617          */
1618         if (flags & AS_GUEST) {
1619                 char *raddr;
1620                 bool ok;
1621
1622                 if (!change_to_guest()) {
1623                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1624                         return conn;
1625                 }
1626
1627                 raddr = tsocket_address_inet_addr_string(xconn->remote_address,
1628                                                          talloc_tos());
1629                 if (raddr == NULL) {
1630                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1631                         return conn;
1632                 }
1633
1634                 /*
1635                  * Haven't we checked this in smbd_process already???
1636                  */
1637
1638                 ok = allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
1639                                   xconn->remote_hostname, raddr);
1640                 TALLOC_FREE(raddr);
1641
1642                 if (!ok) {
1643                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1644                         return conn;
1645                 }
1646         }
1647
1648         smb_messages[type].fn(req);
1649         return req->conn;
1650 }
1651
1652 /****************************************************************************
1653  Construct a reply to the incoming packet.
1654 ****************************************************************************/
1655
1656 static void construct_reply(struct smbXsrv_connection *xconn,
1657                             char *inbuf, int size, size_t unread_bytes,
1658                             uint32_t seqnum, bool encrypted,
1659                             struct smb_perfcount_data *deferred_pcd)
1660 {
1661         struct smbd_server_connection *sconn = xconn->client->sconn;
1662         struct smb_request *req;
1663
1664         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1665                 smb_panic("could not allocate smb_request");
1666         }
1667
1668         if (!init_smb_request(req, sconn, xconn, (uint8 *)inbuf, unread_bytes,
1669                               encrypted, seqnum)) {
1670                 exit_server_cleanly("Invalid SMB request");
1671         }
1672
1673         req->inbuf  = (uint8_t *)talloc_move(req, &inbuf);
1674
1675         /* we popped this message off the queue - keep original perf data */
1676         if (deferred_pcd)
1677                 req->pcd = *deferred_pcd;
1678         else {
1679                 SMB_PERFCOUNT_START(&req->pcd);
1680                 SMB_PERFCOUNT_SET_OP(&req->pcd, req->cmd);
1681                 SMB_PERFCOUNT_SET_MSGLEN_IN(&req->pcd, size);
1682         }
1683
1684         req->conn = switch_message(req->cmd, req);
1685
1686         if (req->outbuf == NULL) {
1687                 /*
1688                  * Request has suspended itself, will come
1689                  * back here.
1690                  */
1691                 return;
1692         }
1693         if (CVAL(req->outbuf,0) == 0) {
1694                 show_msg((char *)req->outbuf);
1695         }
1696         smb_request_done(req);
1697 }
1698
1699 static void construct_reply_chain(struct smbXsrv_connection *xconn,
1700                                   char *inbuf, int size, uint32_t seqnum,
1701                                   bool encrypted,
1702                                   struct smb_perfcount_data *deferred_pcd)
1703 {
1704         struct smb_request **reqs = NULL;
1705         struct smb_request *req;
1706         unsigned num_reqs;
1707         bool ok;
1708
1709         ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, xconn, encrypted,
1710                               seqnum, &reqs, &num_reqs);
1711         if (!ok) {
1712                 char errbuf[smb_size];
1713                 error_packet(errbuf, 0, 0, NT_STATUS_INVALID_PARAMETER,
1714                              __LINE__, __FILE__);
1715                 if (!srv_send_smb(xconn, errbuf, true, seqnum, encrypted,
1716                                   NULL)) {
1717                         exit_server_cleanly("construct_reply_chain: "
1718                                             "srv_send_smb failed.");
1719                 }
1720                 return;
1721         }
1722
1723         req = reqs[0];
1724         req->inbuf = (uint8_t *)talloc_move(reqs, &inbuf);
1725
1726         req->conn = switch_message(req->cmd, req);
1727
1728         if (req->outbuf == NULL) {
1729                 /*
1730                  * Request has suspended itself, will come
1731                  * back here.
1732                  */
1733                 return;
1734         }
1735         smb_request_done(req);
1736 }
1737
1738 /*
1739  * To be called from an async SMB handler that is potentially chained
1740  * when it is finished for shipping.
1741  */
1742
1743 void smb_request_done(struct smb_request *req)
1744 {
1745         struct smb_request **reqs = NULL;
1746         struct smb_request *first_req;
1747         size_t i, num_reqs, next_index;
1748         NTSTATUS status;
1749
1750         if (req->chain == NULL) {
1751                 first_req = req;
1752                 goto shipit;
1753         }
1754
1755         reqs = req->chain;
1756         num_reqs = talloc_array_length(reqs);
1757
1758         for (i=0; i<num_reqs; i++) {
1759                 if (reqs[i] == req) {
1760                         break;
1761                 }
1762         }
1763         if (i == num_reqs) {
1764                 /*
1765                  * Invalid chain, should not happen
1766                  */
1767                 status = NT_STATUS_INTERNAL_ERROR;
1768                 goto error;
1769         }
1770         next_index = i+1;
1771
1772         while ((next_index < num_reqs) && (IVAL(req->outbuf, smb_rcls) == 0)) {
1773                 struct smb_request *next = reqs[next_index];
1774                 struct smbXsrv_tcon *tcon;
1775                 NTTIME now = timeval_to_nttime(&req->request_time);
1776
1777                 next->vuid = SVAL(req->outbuf, smb_uid);
1778                 next->tid  = SVAL(req->outbuf, smb_tid);
1779                 status = smb1srv_tcon_lookup(req->xconn, req->tid,
1780                                              now, &tcon);
1781                 if (NT_STATUS_IS_OK(status)) {
1782                         req->conn = tcon->compat;
1783                 } else {
1784                         req->conn = NULL;
1785                 }
1786                 next->chain_fsp = req->chain_fsp;
1787                 next->inbuf = req->inbuf;
1788
1789                 req = next;
1790                 req->conn = switch_message(req->cmd, req);
1791
1792                 if (req->outbuf == NULL) {
1793                         /*
1794                          * Request has suspended itself, will come
1795                          * back here.
1796                          */
1797                         return;
1798                 }
1799                 next_index += 1;
1800         }
1801
1802         first_req = reqs[0];
1803
1804         for (i=1; i<next_index; i++) {
1805                 bool ok;
1806
1807                 ok = smb_splice_chain(&first_req->outbuf, reqs[i]->outbuf);
1808                 if (!ok) {
1809                         status = NT_STATUS_INTERNAL_ERROR;
1810                         goto error;
1811                 }
1812         }
1813
1814         SSVAL(first_req->outbuf, smb_uid, SVAL(req->outbuf, smb_uid));
1815         SSVAL(first_req->outbuf, smb_tid, SVAL(req->outbuf, smb_tid));
1816
1817         /*
1818          * This scary statement intends to set the
1819          * FLAGS2_32_BIT_ERROR_CODES flg2 field in first_req->outbuf
1820          * to the value last_req->outbuf carries
1821          */
1822         SSVAL(first_req->outbuf, smb_flg2,
1823               (SVAL(first_req->outbuf, smb_flg2) & ~FLAGS2_32_BIT_ERROR_CODES)
1824               |(SVAL(req->outbuf, smb_flg2) & FLAGS2_32_BIT_ERROR_CODES));
1825
1826         /*
1827          * Transfer the error codes from the subrequest to the main one
1828          */
1829         SSVAL(first_req->outbuf, smb_rcls, SVAL(req->outbuf, smb_rcls));
1830         SSVAL(first_req->outbuf, smb_err,  SVAL(req->outbuf, smb_err));
1831
1832         _smb_setlen_large(
1833                 first_req->outbuf, talloc_get_size(first_req->outbuf) - 4);
1834
1835 shipit:
1836         if (!srv_send_smb(first_req->xconn,
1837                           (char *)first_req->outbuf,
1838                           true, first_req->seqnum+1,
1839                           IS_CONN_ENCRYPTED(req->conn)||first_req->encrypted,
1840                           &first_req->pcd)) {
1841                 exit_server_cleanly("construct_reply_chain: srv_send_smb "
1842                                     "failed.");
1843         }
1844         TALLOC_FREE(req);       /* non-chained case */
1845         TALLOC_FREE(reqs);      /* chained case */
1846         return;
1847
1848 error:
1849         {
1850                 char errbuf[smb_size];
1851                 error_packet(errbuf, 0, 0, status, __LINE__, __FILE__);
1852                 if (!srv_send_smb(req->xconn, errbuf, true,
1853                                   req->seqnum+1, req->encrypted,
1854                                   NULL)) {
1855                         exit_server_cleanly("construct_reply_chain: "
1856                                             "srv_send_smb failed.");
1857                 }
1858         }
1859         TALLOC_FREE(req);       /* non-chained case */
1860         TALLOC_FREE(reqs);      /* chained case */
1861 }
1862
1863 /****************************************************************************
1864  Process an smb from the client
1865 ****************************************************************************/
1866 static void process_smb(struct smbXsrv_connection *xconn,
1867                         uint8_t *inbuf, size_t nread, size_t unread_bytes,
1868                         uint32_t seqnum, bool encrypted,
1869                         struct smb_perfcount_data *deferred_pcd)
1870 {
1871         struct smbd_server_connection *sconn = xconn->client->sconn;
1872         int msg_type = CVAL(inbuf,0);
1873
1874         DO_PROFILE_INC(smb_count);
1875
1876         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1877                     smb_len(inbuf) ) );
1878         DEBUG(3, ("Transaction %d of length %d (%u toread)\n",
1879                   sconn->trans_num, (int)nread, (unsigned int)unread_bytes));
1880
1881         if (msg_type != NBSSmessage) {
1882                 /*
1883                  * NetBIOS session request, keepalive, etc.
1884                  */
1885                 reply_special(xconn, (char *)inbuf, nread);
1886                 goto done;
1887         }
1888
1889         if (sconn->using_smb2) {
1890                 /* At this point we're not really using smb2,
1891                  * we make the decision here.. */
1892                 if (smbd_is_smb2_header(inbuf, nread)) {
1893                         const uint8_t *inpdu = inbuf + NBT_HDR_SIZE;
1894                         size_t pdulen = nread - NBT_HDR_SIZE;
1895                         smbd_smb2_first_negprot(xconn, inpdu, pdulen);
1896                         return;
1897                 } else if (nread >= smb_size && valid_smb_header(inbuf)
1898                                 && CVAL(inbuf, smb_com) != 0x72) {
1899                         /* This is a non-negprot SMB1 packet.
1900                            Disable SMB2 from now on. */
1901                         sconn->using_smb2 = false;
1902                 }
1903         }
1904
1905         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1906          * so subtract 4 from it. */
1907         if ((nread < (smb_size - 4)) || !valid_smb_header(inbuf)) {
1908                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1909                          smb_len(inbuf)));
1910
1911                 /* special magic for immediate exit */
1912                 if ((nread == 9) &&
1913                     (IVAL(inbuf, 4) == 0x74697865) &&
1914                     lp_parm_bool(-1, "smbd", "suicide mode", false)) {
1915                         uint8_t exitcode = CVAL(inbuf, 8);
1916                         DEBUG(1, ("Exiting immediately with code %d\n",
1917                                   (int)exitcode));
1918                         exit(exitcode);
1919                 }
1920
1921                 exit_server_cleanly("Non-SMB packet");
1922         }
1923
1924         show_msg((char *)inbuf);
1925
1926         if ((unread_bytes == 0) && smb1_is_chain(inbuf)) {
1927                 construct_reply_chain(xconn, (char *)inbuf, nread,
1928                                       seqnum, encrypted, deferred_pcd);
1929         } else {
1930                 construct_reply(xconn, (char *)inbuf, nread, unread_bytes,
1931                                 seqnum, encrypted, deferred_pcd);
1932         }
1933
1934         sconn->trans_num++;
1935
1936 done:
1937         sconn->num_requests++;
1938
1939         /* The timeout_processing function isn't run nearly
1940            often enough to implement 'max log size' without
1941            overrunning the size of the file by many megabytes.
1942            This is especially true if we are running at debug
1943            level 10.  Checking every 50 SMBs is a nice
1944            tradeoff of performance vs log file size overrun. */
1945
1946         if ((sconn->num_requests % 50) == 0 &&
1947             need_to_check_log_size()) {
1948                 change_to_root_user();
1949                 check_log_size();
1950         }
1951 }
1952
1953 /****************************************************************************
1954  Return a string containing the function name of a SMB command.
1955 ****************************************************************************/
1956
1957 const char *smb_fn_name(int type)
1958 {
1959         const char *unknown_name = "SMBunknown";
1960
1961         if (smb_messages[type].name == NULL)
1962                 return(unknown_name);
1963
1964         return(smb_messages[type].name);
1965 }
1966
1967 /****************************************************************************
1968  Helper functions for contruct_reply.
1969 ****************************************************************************/
1970
1971 void add_to_common_flags2(uint32 v)
1972 {
1973         common_flags2 |= v;
1974 }
1975
1976 void remove_from_common_flags2(uint32 v)
1977 {
1978         common_flags2 &= ~v;
1979 }
1980
1981 static void construct_reply_common(struct smb_request *req, const char *inbuf,
1982                                    char *outbuf)
1983 {
1984         uint16_t in_flags2 = SVAL(inbuf,smb_flg2);
1985         uint16_t out_flags2 = common_flags2;
1986
1987         out_flags2 |= in_flags2 & FLAGS2_UNICODE_STRINGS;
1988         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES;
1989         out_flags2 |= in_flags2 & FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED;
1990
1991         srv_set_message(outbuf,0,0,false);
1992
1993         SCVAL(outbuf, smb_com, req->cmd);
1994         SIVAL(outbuf,smb_rcls,0);
1995         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1996         SSVAL(outbuf,smb_flg2, out_flags2);
1997         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1998         memcpy(outbuf+smb_ss_field, inbuf+smb_ss_field, 8);
1999
2000         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
2001         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
2002         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
2003         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
2004 }
2005
2006 void construct_reply_common_req(struct smb_request *req, char *outbuf)
2007 {
2008         construct_reply_common(req, (const char *)req->inbuf, outbuf);
2009 }
2010
2011 /**
2012  * @brief Find the smb_cmd offset of the last command pushed
2013  * @param[in] buf       The buffer we're building up
2014  * @retval              Where can we put our next andx cmd?
2015  *
2016  * While chaining requests, the "next" request we're looking at needs to put
2017  * its SMB_Command before the data the previous request already built up added
2018  * to the chain. Find the offset to the place where we have to put our cmd.
2019  */
2020
2021 static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
2022 {
2023         uint8_t cmd;
2024         size_t ofs;
2025
2026         cmd = CVAL(buf, smb_com);
2027
2028         if (!is_andx_req(cmd)) {
2029                 return false;
2030         }
2031
2032         ofs = smb_vwv0;
2033
2034         while (CVAL(buf, ofs) != 0xff) {
2035
2036                 if (!is_andx_req(CVAL(buf, ofs))) {
2037                         return false;
2038                 }
2039
2040                 /*
2041                  * ofs is from start of smb header, so add the 4 length
2042                  * bytes. The next cmd is right after the wct field.
2043                  */
2044                 ofs = SVAL(buf, ofs+2) + 4 + 1;
2045
2046                 if (ofs+4 >= talloc_get_size(buf)) {
2047                         return false;
2048                 }
2049         }
2050
2051         *pofs = ofs;
2052         return true;
2053 }
2054
2055 /**
2056  * @brief Do the smb chaining at a buffer level
2057  * @param[in] poutbuf           Pointer to the talloc'ed buffer to be modified
2058  * @param[in] andx_buf          Buffer to be appended
2059  */
2060
2061 static bool smb_splice_chain(uint8_t **poutbuf, const uint8_t *andx_buf)
2062 {
2063         uint8_t smb_command     = CVAL(andx_buf, smb_com);
2064         uint8_t wct             = CVAL(andx_buf, smb_wct);
2065         const uint16_t *vwv     = (const uint16_t *)(andx_buf + smb_vwv);
2066         uint32_t num_bytes      = smb_buflen(andx_buf);
2067         const uint8_t *bytes    = (const uint8_t *)smb_buf_const(andx_buf);
2068
2069         uint8_t *outbuf;
2070         size_t old_size, new_size;
2071         size_t ofs;
2072         size_t chain_padding = 0;
2073         size_t andx_cmd_ofs;
2074
2075
2076         old_size = talloc_get_size(*poutbuf);
2077
2078         if ((old_size % 4) != 0) {
2079                 /*
2080                  * Align the wct field of subsequent requests to a 4-byte
2081                  * boundary
2082                  */
2083                 chain_padding = 4 - (old_size % 4);
2084         }
2085
2086         /*
2087          * After the old request comes the new wct field (1 byte), the vwv's
2088          * and the num_bytes field.
2089          */
2090
2091         new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
2092         new_size += num_bytes;
2093
2094         if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
2095                 DEBUG(1, ("smb_splice_chain: %u bytes won't fit\n",
2096                           (unsigned)new_size));
2097                 return false;
2098         }
2099
2100         outbuf = talloc_realloc(NULL, *poutbuf, uint8_t, new_size);
2101         if (outbuf == NULL) {
2102                 DEBUG(0, ("talloc failed\n"));
2103                 return false;
2104         }
2105         *poutbuf = outbuf;
2106
2107         if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
2108                 DEBUG(1, ("invalid command chain\n"));
2109                 *poutbuf = talloc_realloc(NULL, *poutbuf, uint8_t, old_size);
2110                 return false;
2111         }
2112
2113         if (chain_padding != 0) {
2114                 memset(outbuf + old_size, 0, chain_padding);
2115                 old_size += chain_padding;
2116         }
2117
2118         SCVAL(outbuf, andx_cmd_ofs, smb_command);
2119         SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
2120
2121         ofs = old_size;
2122
2123         /*
2124          * Push the chained request:
2125          *
2126          * wct field
2127          */
2128
2129         SCVAL(outbuf, ofs, wct);
2130         ofs += 1;
2131
2132         /*
2133          * vwv array
2134          */
2135
2136         memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
2137
2138         /*
2139          * HACK ALERT
2140          *
2141          * Read&X has an offset into its data buffer at
2142          * vwv[6]. reply_read_andx has no idea anymore that it's
2143          * running from within a chain, so we have to fix up the
2144          * offset here.
2145          *
2146          * Although it looks disgusting at this place, I want to keep
2147          * it here. The alternative would be to push knowledge about
2148          * the andx chain down into read&x again.
2149          */
2150
2151         if (smb_command == SMBreadX) {
2152                 uint8_t *bytes_addr;
2153
2154                 if (wct < 7) {
2155                         /*
2156                          * Invalid read&x response
2157                          */
2158                         return false;
2159                 }
2160
2161                 bytes_addr = outbuf + ofs        /* vwv start */
2162                         + sizeof(uint16_t) * wct /* vwv array */
2163                         + sizeof(uint16_t)       /* bcc */
2164                         + 1;                     /* padding byte */
2165
2166                 SSVAL(outbuf + ofs, 6 * sizeof(uint16_t),
2167                       bytes_addr - outbuf - 4);
2168         }
2169
2170         ofs += sizeof(uint16_t) * wct;
2171
2172         /*
2173          * bcc (byte count)
2174          */
2175
2176         SSVAL(outbuf, ofs, num_bytes);
2177         ofs += sizeof(uint16_t);
2178
2179         /*
2180          * The bytes field
2181          */
2182
2183         memcpy(outbuf + ofs, bytes, num_bytes);
2184
2185         return true;
2186 }
2187
2188 bool smb1_is_chain(const uint8_t *buf)
2189 {
2190         uint8_t cmd, wct, andx_cmd;
2191
2192         cmd = CVAL(buf, smb_com);
2193         if (!is_andx_req(cmd)) {
2194                 return false;
2195         }
2196         wct = CVAL(buf, smb_wct);
2197         if (wct < 2) {
2198                 return false;
2199         }
2200         andx_cmd = CVAL(buf, smb_vwv);
2201         return (andx_cmd != 0xFF);
2202 }
2203
2204 bool smb1_walk_chain(const uint8_t *buf,
2205                      bool (*fn)(uint8_t cmd,
2206                                 uint8_t wct, const uint16_t *vwv,
2207                                 uint16_t num_bytes, const uint8_t *bytes,
2208                                 void *private_data),
2209                      void *private_data)
2210 {
2211         size_t smblen = smb_len(buf);
2212         const char *smb_buf = smb_base(buf);
2213         uint8_t cmd, chain_cmd;
2214         uint8_t wct;
2215         const uint16_t *vwv;
2216         uint16_t num_bytes;
2217         const uint8_t *bytes;
2218
2219         cmd = CVAL(buf, smb_com);
2220         wct = CVAL(buf, smb_wct);
2221         vwv = (const uint16_t *)(buf + smb_vwv);
2222         num_bytes = smb_buflen(buf);
2223         bytes = (const uint8_t *)smb_buf_const(buf);
2224
2225         if (!fn(cmd, wct, vwv, num_bytes, bytes, private_data)) {
2226                 return false;
2227         }
2228
2229         if (!is_andx_req(cmd)) {
2230                 return true;
2231         }
2232         if (wct < 2) {
2233                 return false;
2234         }
2235
2236         chain_cmd = CVAL(vwv, 0);
2237
2238         while (chain_cmd != 0xff) {
2239                 uint32_t chain_offset;  /* uint32_t to avoid overflow */
2240                 size_t length_needed;
2241                 ptrdiff_t vwv_offset;
2242
2243                 chain_offset = SVAL(vwv+1, 0);
2244
2245                 /*
2246                  * Check if the client tries to fool us. The chain
2247                  * offset needs to point beyond the current request in
2248                  * the chain, it needs to strictly grow. Otherwise we
2249                  * might be tricked into an endless loop always
2250                  * processing the same request over and over again. We
2251                  * used to assume that vwv and the byte buffer array
2252                  * in a chain are always attached, but OS/2 the
2253                  * Write&X/Read&X chain puts the Read&X vwv array
2254                  * right behind the Write&X vwv chain. The Write&X bcc
2255                  * array is put behind the Read&X vwv array. So now we
2256                  * check whether the chain offset points strictly
2257                  * behind the previous vwv array. req->buf points
2258                  * right after the vwv array of the previous
2259                  * request. See
2260                  * https://bugzilla.samba.org/show_bug.cgi?id=8360 for
2261                  * more information.
2262                  */
2263
2264                 vwv_offset = ((const char *)vwv - smb_buf);
2265                 if (chain_offset <= vwv_offset) {
2266                         return false;
2267                 }
2268
2269                 /*
2270                  * Next check: Make sure the chain offset does not
2271                  * point beyond the overall smb request length.
2272                  */
2273
2274                 length_needed = chain_offset+1; /* wct */
2275                 if (length_needed > smblen) {
2276                         return false;
2277                 }
2278
2279                 /*
2280                  * Now comes the pointer magic. Goal here is to set up
2281                  * vwv and buf correctly again. The chain offset (the
2282                  * former vwv[1]) points at the new wct field.
2283                  */
2284
2285                 wct = CVAL(smb_buf, chain_offset);
2286
2287                 if (is_andx_req(chain_cmd) && (wct < 2)) {
2288                         return false;
2289                 }
2290
2291                 /*
2292                  * Next consistency check: Make the new vwv array fits
2293                  * in the overall smb request.
2294                  */
2295
2296                 length_needed += (wct+1)*sizeof(uint16_t); /* vwv+buflen */
2297                 if (length_needed > smblen) {
2298                         return false;
2299                 }
2300                 vwv = (const uint16_t *)(smb_buf + chain_offset + 1);
2301
2302                 /*
2303                  * Now grab the new byte buffer....
2304                  */
2305
2306                 num_bytes = SVAL(vwv+wct, 0);
2307
2308                 /*
2309                  * .. and check that it fits.
2310                  */
2311
2312                 length_needed += num_bytes;
2313                 if (length_needed > smblen) {
2314                         return false;
2315                 }
2316                 bytes = (const uint8_t *)(vwv+wct+1);
2317
2318                 if (!fn(chain_cmd, wct, vwv, num_bytes, bytes, private_data)) {
2319                         return false;
2320                 }
2321
2322                 if (!is_andx_req(chain_cmd)) {
2323                         return true;
2324                 }
2325                 chain_cmd = CVAL(vwv, 0);
2326         }
2327         return true;
2328 }
2329
2330 static bool smb1_chain_length_cb(uint8_t cmd,
2331                                  uint8_t wct, const uint16_t *vwv,
2332                                  uint16_t num_bytes, const uint8_t *bytes,
2333                                  void *private_data)
2334 {
2335         unsigned *count = (unsigned *)private_data;
2336         *count += 1;
2337         return true;
2338 }
2339
2340 unsigned smb1_chain_length(const uint8_t *buf)
2341 {
2342         unsigned count = 0;
2343
2344         if (!smb1_walk_chain(buf, smb1_chain_length_cb, &count)) {
2345                 return 0;
2346         }
2347         return count;
2348 }
2349
2350 struct smb1_parse_chain_state {
2351         TALLOC_CTX *mem_ctx;
2352         const uint8_t *buf;
2353         struct smbd_server_connection *sconn;
2354         struct smbXsrv_connection *xconn;
2355         bool encrypted;
2356         uint32_t seqnum;
2357
2358         struct smb_request **reqs;
2359         unsigned num_reqs;
2360 };
2361
2362 static bool smb1_parse_chain_cb(uint8_t cmd,
2363                                 uint8_t wct, const uint16_t *vwv,
2364                                 uint16_t num_bytes, const uint8_t *bytes,
2365                                 void *private_data)
2366 {
2367         struct smb1_parse_chain_state *state =
2368                 (struct smb1_parse_chain_state *)private_data;
2369         struct smb_request **reqs;
2370         struct smb_request *req;
2371         bool ok;
2372
2373         reqs = talloc_realloc(state->mem_ctx, state->reqs,
2374                               struct smb_request *, state->num_reqs+1);
2375         if (reqs == NULL) {
2376                 return false;
2377         }
2378         state->reqs = reqs;
2379
2380         req = talloc(reqs, struct smb_request);
2381         if (req == NULL) {
2382                 return false;
2383         }
2384
2385         ok = init_smb_request(req, state->sconn, state->xconn, state->buf, 0,
2386                               state->encrypted, state->seqnum);
2387         if (!ok) {
2388                 return false;
2389         }
2390         req->cmd = cmd;
2391         req->wct = wct;
2392         req->vwv = vwv;
2393         req->buflen = num_bytes;
2394         req->buf = bytes;
2395
2396         reqs[state->num_reqs] = req;
2397         state->num_reqs += 1;
2398         return true;
2399 }
2400
2401 bool smb1_parse_chain(TALLOC_CTX *mem_ctx, const uint8_t *buf,
2402                       struct smbXsrv_connection *xconn,
2403                       bool encrypted, uint32_t seqnum,
2404                       struct smb_request ***reqs, unsigned *num_reqs)
2405 {
2406         struct smbd_server_connection *sconn = NULL;
2407         struct smb1_parse_chain_state state;
2408         unsigned i;
2409
2410         if (xconn != NULL) {
2411                 sconn = xconn->client->sconn;
2412         }
2413
2414         state.mem_ctx = mem_ctx;
2415         state.buf = buf;
2416         state.sconn = sconn;
2417         state.xconn = xconn;
2418         state.encrypted = encrypted;
2419         state.seqnum = seqnum;
2420         state.reqs = NULL;
2421         state.num_reqs = 0;
2422
2423         if (!smb1_walk_chain(buf, smb1_parse_chain_cb, &state)) {
2424                 TALLOC_FREE(state.reqs);
2425                 return false;
2426         }
2427         for (i=0; i<state.num_reqs; i++) {
2428                 state.reqs[i]->chain = state.reqs;
2429         }
2430         *reqs = state.reqs;
2431         *num_reqs = state.num_reqs;
2432         return true;
2433 }
2434
2435 /****************************************************************************
2436  Check if services need reloading.
2437 ****************************************************************************/
2438
2439 static void check_reload(struct smbd_server_connection *sconn, time_t t)
2440 {
2441
2442         if (last_smb_conf_reload_time == 0) {
2443                 last_smb_conf_reload_time = t;
2444         }
2445
2446         if (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK) {
2447                 reload_services(sconn, conn_snum_used, true);
2448                 last_smb_conf_reload_time = t;
2449         }
2450 }
2451
2452 static bool fd_is_readable(int fd)
2453 {
2454         int ret, revents;
2455
2456         ret = poll_one_fd(fd, POLLIN|POLLHUP, 0, &revents);
2457
2458         return ((ret > 0) && ((revents & (POLLIN|POLLHUP|POLLERR)) != 0));
2459
2460 }
2461
2462 static void smbd_server_connection_write_handler(
2463         struct smbXsrv_connection *xconn)
2464 {
2465         /* TODO: make write nonblocking */
2466 }
2467
2468 static void smbd_server_connection_read_handler(
2469         struct smbXsrv_connection *xconn, int fd)
2470 {
2471         uint8_t *inbuf = NULL;
2472         size_t inbuf_len = 0;
2473         size_t unread_bytes = 0;
2474         bool encrypted = false;
2475         TALLOC_CTX *mem_ctx = talloc_tos();
2476         NTSTATUS status;
2477         uint32_t seqnum;
2478
2479         bool async_echo = lp_async_smb_echo_handler();
2480         bool from_client = false;
2481
2482         if (async_echo) {
2483                 if (fd_is_readable(xconn->smb1.echo_handler.trusted_fd)) {
2484                         /*
2485                          * This is the super-ugly hack to prefer the packets
2486                          * forwarded by the echo handler over the ones by the
2487                          * client directly
2488                          */
2489                         fd = xconn->smb1.echo_handler.trusted_fd;
2490                 }
2491         }
2492
2493         from_client = (xconn->transport.sock == fd);
2494
2495         if (async_echo && from_client) {
2496                 smbd_lock_socket(xconn);
2497
2498                 if (!fd_is_readable(fd)) {
2499                         DEBUG(10,("the echo listener was faster\n"));
2500                         smbd_unlock_socket(xconn);
2501                         return;
2502                 }
2503         }
2504
2505         /* TODO: make this completely nonblocking */
2506         status = receive_smb_talloc(mem_ctx, xconn, fd,
2507                                     (char **)(void *)&inbuf,
2508                                     0, /* timeout */
2509                                     &unread_bytes,
2510                                     &encrypted,
2511                                     &inbuf_len, &seqnum,
2512                                     !from_client /* trusted channel */);
2513
2514         if (async_echo && from_client) {
2515                 smbd_unlock_socket(xconn);
2516         }
2517
2518         if (NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
2519                 goto process;
2520         }
2521         if (NT_STATUS_IS_ERR(status)) {
2522                 exit_server_cleanly("failed to receive smb request");
2523         }
2524         if (!NT_STATUS_IS_OK(status)) {
2525                 return;
2526         }
2527
2528 process:
2529         process_smb(xconn, inbuf, inbuf_len, unread_bytes,
2530                     seqnum, encrypted, NULL);
2531 }
2532
2533 static void smbd_server_connection_handler(struct tevent_context *ev,
2534                                            struct tevent_fd *fde,
2535                                            uint16_t flags,
2536                                            void *private_data)
2537 {
2538         struct smbXsrv_connection *xconn =
2539                 talloc_get_type_abort(private_data,
2540                 struct smbXsrv_connection);
2541
2542         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2543                 /*
2544                  * we're not supposed to do any io
2545                  */
2546                 TEVENT_FD_NOT_READABLE(xconn->transport.fde);
2547                 TEVENT_FD_NOT_WRITEABLE(xconn->transport.fde);
2548                 return;
2549         }
2550
2551         if (flags & TEVENT_FD_WRITE) {
2552                 smbd_server_connection_write_handler(xconn);
2553                 return;
2554         }
2555         if (flags & TEVENT_FD_READ) {
2556                 smbd_server_connection_read_handler(xconn, xconn->transport.sock);
2557                 return;
2558         }
2559 }
2560
2561 static void smbd_server_echo_handler(struct tevent_context *ev,
2562                                      struct tevent_fd *fde,
2563                                      uint16_t flags,
2564                                      void *private_data)
2565 {
2566         struct smbXsrv_connection *xconn =
2567                 talloc_get_type_abort(private_data,
2568                 struct smbXsrv_connection);
2569
2570         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2571                 /*
2572                  * we're not supposed to do any io
2573                  */
2574                 TEVENT_FD_NOT_READABLE(xconn->smb1.echo_handler.trusted_fde);
2575                 TEVENT_FD_NOT_WRITEABLE(xconn->smb1.echo_handler.trusted_fde);
2576                 return;
2577         }
2578
2579         if (flags & TEVENT_FD_WRITE) {
2580                 smbd_server_connection_write_handler(xconn);
2581                 return;
2582         }
2583         if (flags & TEVENT_FD_READ) {
2584                 smbd_server_connection_read_handler(
2585                         xconn, xconn->smb1.echo_handler.trusted_fd);
2586                 return;
2587         }
2588 }
2589
2590 struct smbd_release_ip_state {
2591         struct smbXsrv_connection *xconn;
2592         struct tevent_immediate *im;
2593         char addr[INET6_ADDRSTRLEN];
2594 };
2595
2596 static void smbd_release_ip_immediate(struct tevent_context *ctx,
2597                                       struct tevent_immediate *im,
2598                                       void *private_data)
2599 {
2600         struct smbd_release_ip_state *state =
2601                 talloc_get_type_abort(private_data,
2602                 struct smbd_release_ip_state);
2603         struct smbXsrv_connection *xconn = state->xconn;
2604
2605         if (!NT_STATUS_EQUAL(xconn->transport.status, NT_STATUS_ADDRESS_CLOSED)) {
2606                 /*
2607                  * smbd_server_connection_terminate() already triggered ?
2608                  */
2609                 return;
2610         }
2611
2612         smbd_server_connection_terminate(xconn, "CTDB_SRVID_RELEASE_IP");
2613 }
2614
2615 /****************************************************************************
2616 received when we should release a specific IP
2617 ****************************************************************************/
2618 static bool release_ip(const char *ip, void *priv)
2619 {
2620         struct smbd_release_ip_state *state =
2621                 talloc_get_type_abort(priv,
2622                 struct smbd_release_ip_state);
2623         struct smbXsrv_connection *xconn = state->xconn;
2624         const char *addr = state->addr;
2625         const char *p = addr;
2626
2627         if (!NT_STATUS_IS_OK(xconn->transport.status)) {
2628                 /* avoid recursion */
2629                 return false;
2630         }
2631
2632         if (strncmp("::ffff:", addr, 7) == 0) {
2633                 p = addr + 7;
2634         }
2635
2636         DEBUG(10, ("Got release IP message for %s, "
2637                    "our address is %s\n", ip, p));
2638
2639         if ((strcmp(p, ip) == 0) || ((p != addr) && strcmp(addr, ip) == 0)) {
2640                 DEBUG(0,("Got release IP message for our IP %s - exiting immediately\n",
2641                         ip));
2642                 /*
2643                  * With SMB2 we should do a clean disconnect,
2644                  * the previous_session_id in the session setup
2645                  * will cleanup the old session, tcons and opens.
2646                  *
2647                  * A clean disconnect is needed in order to support
2648                  * durable handles.
2649                  *
2650                  * Note: typically this is never triggered
2651                  *       as we got a TCP RST (triggered by ctdb event scripts)
2652                  *       before we get CTDB_SRVID_RELEASE_IP.
2653                  *
2654                  * We used to call _exit(1) here, but as this was mostly never
2655                  * triggered and has implication on our process model,
2656                  * we can just use smbd_server_connection_terminate()
2657                  * (also for SMB1).
2658                  *
2659                  * We don't call smbd_server_connection_terminate() directly
2660                  * as we might be called from within ctdbd_migrate(),
2661                  * we need to defer our action to the next event loop
2662                  */
2663                 tevent_schedule_immediate(state->im, xconn->ev_ctx,
2664                                           smbd_release_ip_immediate, state);
2665
2666                 /*
2667                  * Make sure we don't get any io on the connection.
2668                  */
2669                 xconn->transport.status = NT_STATUS_ADDRESS_CLOSED;
2670                 return true;
2671         }
2672
2673         return false;
2674 }
2675
2676 static NTSTATUS smbd_register_ips(struct smbXsrv_connection *xconn,
2677                                   struct sockaddr_storage *srv,
2678                                   struct sockaddr_storage *clnt)
2679 {
2680         struct smbd_release_ip_state *state;
2681         struct ctdbd_connection *cconn;
2682
2683         cconn = messaging_ctdbd_connection();
2684         if (cconn == NULL) {
2685                 return NT_STATUS_NO_MEMORY;
2686         }
2687
2688         state = talloc_zero(xconn, struct smbd_release_ip_state);
2689         if (state == NULL) {
2690                 return NT_STATUS_NO_MEMORY;
2691         }
2692         state->xconn = xconn;
2693         state->im = tevent_create_immediate(state);
2694         if (state->im == NULL) {
2695                 return NT_STATUS_NO_MEMORY;
2696         }
2697         if (print_sockaddr(state->addr, sizeof(state->addr), srv) == NULL) {
2698                 return NT_STATUS_NO_MEMORY;
2699         }
2700
2701         return ctdbd_register_ips(cconn, srv, clnt, release_ip, state);
2702 }
2703
2704 static void msg_kill_client_ip(struct messaging_context *msg_ctx,
2705                                   void *private_data, uint32_t msg_type,
2706                                   struct server_id server_id, DATA_BLOB *data)
2707 {
2708         struct smbd_server_connection *sconn = talloc_get_type_abort(
2709                 private_data, struct smbd_server_connection);
2710         const char *ip = (char *) data->data;
2711         char *client_ip;
2712
2713         DEBUG(10, ("Got kill request for client IP %s\n", ip));
2714
2715         client_ip = tsocket_address_inet_addr_string(sconn->remote_address,
2716                                                      talloc_tos());
2717         if (client_ip == NULL) {
2718                 return;
2719         }
2720
2721         if (strequal(ip, client_ip)) {
2722                 DEBUG(1, ("Got kill client message for %s - "
2723                           "exiting immediately\n", ip));
2724                 exit_server_cleanly("Forced disconnect for client");
2725         }
2726
2727         TALLOC_FREE(client_ip);
2728 }
2729
2730 /*
2731  * Send keepalive packets to our client
2732  */
2733 static bool keepalive_fn(const struct timeval *now, void *private_data)
2734 {
2735         struct smbd_server_connection *sconn = talloc_get_type_abort(
2736                 private_data, struct smbd_server_connection);
2737         struct smbXsrv_connection *xconn = NULL;
2738         bool ret;
2739
2740         if (sconn->using_smb2) {
2741                 /* Don't do keepalives on an SMB2 connection. */
2742                 return false;
2743         }
2744
2745         /*
2746          * With SMB1 we only have 1 connection
2747          */
2748         xconn = sconn->client->connections;
2749         smbd_lock_socket(xconn);
2750         ret = send_keepalive(xconn->transport.sock);
2751         smbd_unlock_socket(xconn);
2752
2753         if (!ret) {
2754                 int saved_errno = errno;
2755                 /*
2756                  * Try and give an error message saying what
2757                  * client failed.
2758                  */
2759                 DEBUG(0, ("send_keepalive failed for client %s. "
2760                           "Error %s - exiting\n",
2761                           smbXsrv_connection_dbg(xconn),
2762                           strerror(saved_errno)));
2763                 errno = saved_errno;
2764                 return False;
2765         }
2766         return True;
2767 }
2768
2769 /*
2770  * Do the recurring check if we're idle
2771  */
2772 static bool deadtime_fn(const struct timeval *now, void *private_data)
2773 {
2774         struct smbd_server_connection *sconn =
2775                 (struct smbd_server_connection *)private_data;
2776
2777         if ((conn_num_open(sconn) == 0)
2778             || (conn_idle_all(sconn, now->tv_sec))) {
2779                 DEBUG( 2, ( "Closing idle connection\n" ) );
2780                 messaging_send(sconn->msg_ctx,
2781                                messaging_server_id(sconn->msg_ctx),
2782                                MSG_SHUTDOWN, &data_blob_null);
2783                 return False;
2784         }
2785
2786         return True;
2787 }
2788
2789 /*
2790  * Do the recurring log file and smb.conf reload checks.
2791  */
2792
2793 static bool housekeeping_fn(const struct timeval *now, void *private_data)
2794 {
2795         struct smbd_server_connection *sconn = talloc_get_type_abort(
2796                 private_data, struct smbd_server_connection);
2797
2798         DEBUG(5, ("housekeeping\n"));
2799
2800         change_to_root_user();
2801
2802         /* update printer queue caches if necessary */
2803         update_monitored_printq_cache(sconn->msg_ctx);
2804
2805         /* check if we need to reload services */
2806         check_reload(sconn, time_mono(NULL));
2807
2808         /*
2809          * Force a log file check.
2810          */
2811         force_check_log_size();
2812         check_log_size();
2813         return true;
2814 }
2815
2816 /*
2817  * Read an smb packet in the echo handler child, giving the parent
2818  * smbd one second to react once the socket becomes readable.
2819  */
2820
2821 struct smbd_echo_read_state {
2822         struct tevent_context *ev;
2823         struct smbXsrv_connection *xconn;
2824
2825         char *buf;
2826         size_t buflen;
2827         uint32_t seqnum;
2828 };
2829
2830 static void smbd_echo_read_readable(struct tevent_req *subreq);
2831 static void smbd_echo_read_waited(struct tevent_req *subreq);
2832
2833 static struct tevent_req *smbd_echo_read_send(
2834         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
2835         struct smbXsrv_connection *xconn)
2836 {
2837         struct tevent_req *req, *subreq;
2838         struct smbd_echo_read_state *state;
2839
2840         req = tevent_req_create(mem_ctx, &state,
2841                                 struct smbd_echo_read_state);
2842         if (req == NULL) {
2843                 return NULL;
2844         }
2845         state->ev = ev;
2846         state->xconn = xconn;
2847
2848         subreq = wait_for_read_send(state, ev, xconn->transport.sock);
2849         if (tevent_req_nomem(subreq, req)) {
2850                 return tevent_req_post(req, ev);
2851         }
2852         tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2853         return req;
2854 }
2855
2856 static void smbd_echo_read_readable(struct tevent_req *subreq)
2857 {
2858         struct tevent_req *req = tevent_req_callback_data(
2859                 subreq, struct tevent_req);
2860         struct smbd_echo_read_state *state = tevent_req_data(
2861                 req, struct smbd_echo_read_state);
2862         bool ok;
2863         int err;
2864
2865         ok = wait_for_read_recv(subreq, &err);
2866         TALLOC_FREE(subreq);
2867         if (!ok) {
2868                 tevent_req_nterror(req, map_nt_error_from_unix(err));
2869                 return;
2870         }
2871
2872         /*
2873          * Give the parent smbd one second to step in
2874          */
2875
2876         subreq = tevent_wakeup_send(
2877                 state, state->ev, timeval_current_ofs(1, 0));
2878         if (tevent_req_nomem(subreq, req)) {
2879                 return;
2880         }
2881         tevent_req_set_callback(subreq, smbd_echo_read_waited, req);
2882 }
2883
2884 static void smbd_echo_read_waited(struct tevent_req *subreq)
2885 {
2886         struct tevent_req *req = tevent_req_callback_data(
2887                 subreq, struct tevent_req);
2888         struct smbd_echo_read_state *state = tevent_req_data(
2889                 req, struct smbd_echo_read_state);
2890         struct smbXsrv_connection *xconn = state->xconn;
2891         bool ok;
2892         NTSTATUS status;
2893         size_t unread = 0;
2894         bool encrypted;
2895
2896         ok = tevent_wakeup_recv(subreq);
2897         TALLOC_FREE(subreq);
2898         if (!ok) {
2899                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
2900                 return;
2901         }
2902
2903         ok = smbd_lock_socket_internal(xconn);
2904         if (!ok) {
2905                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2906                 DEBUG(0, ("%s: failed to lock socket\n", __location__));
2907                 return;
2908         }
2909
2910         if (!fd_is_readable(xconn->transport.sock)) {
2911                 DEBUG(10,("echo_handler[%d] the parent smbd was faster\n",
2912                           (int)getpid()));
2913
2914                 ok = smbd_unlock_socket_internal(xconn);
2915                 if (!ok) {
2916                         tevent_req_nterror(req, map_nt_error_from_unix(errno));
2917                         DEBUG(1, ("%s: failed to unlock socket\n",
2918                                 __location__));
2919                         return;
2920                 }
2921
2922                 subreq = wait_for_read_send(state, state->ev,
2923                                             xconn->transport.sock);
2924                 if (tevent_req_nomem(subreq, req)) {
2925                         return;
2926                 }
2927                 tevent_req_set_callback(subreq, smbd_echo_read_readable, req);
2928                 return;
2929         }
2930
2931         status = receive_smb_talloc(state, xconn,
2932                                     xconn->transport.sock,
2933                                     &state->buf,
2934                                     0 /* timeout */,
2935                                     &unread,
2936                                     &encrypted,
2937                                     &state->buflen,
2938                                     &state->seqnum,
2939                                     false /* trusted_channel*/);
2940
2941         if (tevent_req_nterror(req, status)) {
2942                 tevent_req_nterror(req, status);
2943                 DEBUG(1, ("echo_handler[%d]: receive_smb_raw_talloc failed: %s\n",
2944                           (int)getpid(), nt_errstr(status)));
2945                 return;
2946         }
2947
2948         ok = smbd_unlock_socket_internal(xconn);
2949         if (!ok) {
2950                 tevent_req_nterror(req, map_nt_error_from_unix(errno));
2951                 DEBUG(1, ("%s: failed to unlock socket\n", __location__));
2952                 return;
2953         }
2954         tevent_req_done(req);
2955 }
2956
2957 static NTSTATUS smbd_echo_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2958                                     char **pbuf, size_t *pbuflen, uint32_t *pseqnum)
2959 {
2960         struct smbd_echo_read_state *state = tevent_req_data(
2961                 req, struct smbd_echo_read_state);
2962         NTSTATUS status;
2963
2964         if (tevent_req_is_nterror(req, &status)) {
2965                 return status;
2966         }
2967         *pbuf = talloc_move(mem_ctx, &state->buf);
2968         *pbuflen = state->buflen;
2969         *pseqnum = state->seqnum;
2970         return NT_STATUS_OK;
2971 }
2972
2973 struct smbd_echo_state {
2974         struct tevent_context *ev;
2975         struct iovec *pending;
2976         struct smbd_server_connection *sconn;
2977         struct smbXsrv_connection *xconn;
2978         int parent_pipe;
2979
2980         struct tevent_fd *parent_fde;
2981
2982         struct tevent_req *write_req;
2983 };
2984
2985 static void smbd_echo_writer_done(struct tevent_req *req);
2986
2987 static void smbd_echo_activate_writer(struct smbd_echo_state *state)
2988 {
2989         int num_pending;
2990
2991         if (state->write_req != NULL) {
2992                 return;
2993         }
2994
2995         num_pending = talloc_array_length(state->pending);
2996         if (num_pending == 0) {
2997                 return;
2998         }
2999
3000         state->write_req = writev_send(state, state->ev, NULL,
3001                                        state->parent_pipe, false,
3002                                        state->pending, num_pending);
3003         if (state->write_req == NULL) {
3004                 DEBUG(1, ("writev_send failed\n"));
3005                 exit(1);
3006         }
3007
3008         talloc_steal(state->write_req, state->pending);
3009         state->pending = NULL;
3010
3011         tevent_req_set_callback(state->write_req, smbd_echo_writer_done,
3012                                 state);
3013 }
3014
3015 static void smbd_echo_writer_done(struct tevent_req *req)
3016 {
3017         struct smbd_echo_state *state = tevent_req_callback_data(
3018                 req, struct smbd_echo_state);
3019         ssize_t written;
3020         int err;
3021
3022         written = writev_recv(req, &err);
3023         TALLOC_FREE(req);
3024         state->write_req = NULL;
3025         if (written == -1) {
3026                 DEBUG(1, ("writev to parent failed: %s\n", strerror(err)));
3027                 exit(1);
3028         }
3029         DEBUG(10,("echo_handler[%d]: forwarded pdu to main\n", (int)getpid()));
3030         smbd_echo_activate_writer(state);
3031 }
3032
3033 static bool smbd_echo_reply(struct smbd_echo_state *state,
3034                             uint8_t *inbuf, size_t inbuf_len,
3035                             uint32_t seqnum)
3036 {
3037         struct smb_request req;
3038         uint16_t num_replies;
3039         char *outbuf;
3040         bool ok;
3041
3042         if ((inbuf_len == 4) && (CVAL(inbuf, 0) == NBSSkeepalive)) {
3043                 DEBUG(10, ("Got netbios keepalive\n"));
3044                 /*
3045                  * Just swallow it
3046                  */
3047                 return true;
3048         }
3049
3050         if (inbuf_len < smb_size) {
3051                 DEBUG(10, ("Got short packet: %d bytes\n", (int)inbuf_len));
3052                 return false;
3053         }
3054         if (!valid_smb_header(inbuf)) {
3055                 DEBUG(10, ("Got invalid SMB header\n"));
3056                 return false;
3057         }
3058
3059         if (!init_smb_request(&req, state->sconn, state->xconn, inbuf, 0, false,
3060                               seqnum)) {
3061                 return false;
3062         }
3063         req.inbuf = inbuf;
3064
3065         DEBUG(10, ("smbecho handler got cmd %d (%s)\n", (int)req.cmd,
3066                    smb_messages[req.cmd].name
3067                    ? smb_messages[req.cmd].name : "unknown"));
3068
3069         if (req.cmd != SMBecho) {
3070                 return false;
3071         }
3072         if (req.wct < 1) {
3073                 return false;
3074         }
3075
3076         num_replies = SVAL(req.vwv+0, 0);
3077         if (num_replies != 1) {
3078                 /* Not a Windows "Hey, you're still there?" request */
3079                 return false;
3080         }
3081
3082         if (!create_outbuf(talloc_tos(), &req, (const char *)req.inbuf, &outbuf,
3083                            1, req.buflen)) {
3084                 DEBUG(10, ("create_outbuf failed\n"));
3085                 return false;
3086         }
3087         req.outbuf = (uint8_t *)outbuf;
3088
3089         SSVAL(req.outbuf, smb_vwv0, num_replies);
3090
3091         if (req.buflen > 0) {
3092                 memcpy(smb_buf(req.outbuf), req.buf, req.buflen);
3093         }
3094
3095         ok = srv_send_smb(req.xconn,
3096                           (char *)outbuf,
3097                           true, seqnum+1,
3098                           false, &req.pcd);
3099         TALLOC_FREE(outbuf);
3100         if (!ok) {
3101                 exit(1);
3102         }
3103
3104         return true;
3105 }
3106
3107 static void smbd_echo_exit(struct tevent_context *ev,
3108                            struct tevent_fd *fde, uint16_t flags,
3109                            void *private_data)
3110 {
3111         DEBUG(2, ("smbd_echo_exit: lost connection to parent\n"));
3112         exit(0);
3113 }
3114
3115 static void smbd_echo_got_packet(struct tevent_req *req);
3116
3117 static void smbd_echo_loop(struct smbXsrv_connection *xconn,
3118                            int parent_pipe)
3119 {
3120         struct smbd_echo_state *state;
3121         struct tevent_req *read_req;
3122
3123         state = talloc_zero(xconn, struct smbd_echo_state);
3124         if (state == NULL) {
3125                 DEBUG(1, ("talloc failed\n"));
3126                 return;
3127         }
3128         state->xconn = xconn;
3129         state->parent_pipe = parent_pipe;
3130         state->ev = s3_tevent_context_init(state);
3131         if (state->ev == NULL) {
3132                 DEBUG(1, ("tevent_context_init failed\n"));
3133                 TALLOC_FREE(state);
3134                 return;
3135         }
3136         state->parent_fde = tevent_add_fd(state->ev, state, parent_pipe,
3137                                         TEVENT_FD_READ, smbd_echo_exit,
3138                                         state);
3139         if (state->parent_fde == NULL) {
3140                 DEBUG(1, ("tevent_add_fd failed\n"));
3141                 TALLOC_FREE(state);
3142                 return;
3143         }
3144
3145         read_req = smbd_echo_read_send(state, state->ev, xconn);
3146         if (read_req == NULL) {
3147                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3148                 TALLOC_FREE(state);
3149                 return;
3150         }
3151         tevent_req_set_callback(read_req, smbd_echo_got_packet, state);
3152
3153         while (true) {
3154                 if (tevent_loop_once(state->ev) == -1) {
3155                         DEBUG(1, ("tevent_loop_once failed: %s\n",
3156                                   strerror(errno)));
3157                         break;
3158                 }
3159         }
3160         TALLOC_FREE(state);
3161 }
3162
3163 static void smbd_echo_got_packet(struct tevent_req *req)
3164 {
3165         struct smbd_echo_state *state = tevent_req_callback_data(
3166                 req, struct smbd_echo_state);
3167         NTSTATUS status;
3168         char *buf = NULL;
3169         size_t buflen = 0;
3170         uint32_t seqnum = 0;
3171         bool reply;
3172
3173         status = smbd_echo_read_recv(req, state, &buf, &buflen, &seqnum);
3174         TALLOC_FREE(req);
3175         if (!NT_STATUS_IS_OK(status)) {
3176                 DEBUG(1, ("smbd_echo_read_recv returned %s\n",
3177                           nt_errstr(status)));
3178                 exit(1);
3179         }
3180
3181         reply = smbd_echo_reply(state, (uint8_t *)buf, buflen, seqnum);
3182         if (!reply) {
3183                 size_t num_pending;
3184                 struct iovec *tmp;
3185                 struct iovec *iov;
3186
3187                 num_pending = talloc_array_length(state->pending);
3188                 tmp = talloc_realloc(state, state->pending, struct iovec,
3189                                      num_pending+1);
3190                 if (tmp == NULL) {
3191                         DEBUG(1, ("talloc_realloc failed\n"));
3192                         exit(1);
3193                 }
3194                 state->pending = tmp;
3195
3196                 if (buflen >= smb_size) {
3197                         /*
3198                          * place the seqnum in the packet so that the main process
3199                          * can reply with signing
3200                          */
3201                         SIVAL(buf, smb_ss_field, seqnum);
3202                         SIVAL(buf, smb_ss_field+4, NT_STATUS_V(NT_STATUS_OK));
3203                 }
3204
3205                 iov = &state->pending[num_pending];
3206                 iov->iov_base = talloc_move(state->pending, &buf);
3207                 iov->iov_len = buflen;
3208
3209                 DEBUG(10,("echo_handler[%d]: forward to main\n",
3210                           (int)getpid()));
3211                 smbd_echo_activate_writer(state);
3212         }
3213
3214         req = smbd_echo_read_send(state, state->ev, state->xconn);
3215         if (req == NULL) {
3216                 DEBUG(1, ("smbd_echo_read_send failed\n"));
3217                 exit(1);
3218         }
3219         tevent_req_set_callback(req, smbd_echo_got_packet, state);
3220 }
3221
3222
3223 /*
3224  * Handle SMBecho requests in a forked child process
3225  */
3226 bool fork_echo_handler(struct smbXsrv_connection *xconn)
3227 {
3228         int listener_pipe[2];
3229         int res;
3230         pid_t child;
3231         bool use_mutex = false;
3232
3233         res = pipe(listener_pipe);
3234         if (res == -1) {
3235                 DEBUG(1, ("pipe() failed: %s\n", strerror(errno)));
3236                 return false;
3237         }
3238
3239 #ifdef HAVE_ROBUST_MUTEXES
3240         use_mutex = tdb_runtime_check_for_robust_mutexes();
3241
3242         if (use_mutex) {
3243                 pthread_mutexattr_t a;
3244
3245                 xconn->smb1.echo_handler.socket_mutex =
3246                         anonymous_shared_allocate(sizeof(pthread_mutex_t));
3247                 if (xconn->smb1.echo_handler.socket_mutex == NULL) {
3248                         DEBUG(1, ("Could not create mutex shared memory: %s\n",
3249                                   strerror(errno)));
3250                         goto fail;
3251                 }
3252
3253                 res = pthread_mutexattr_init(&a);
3254                 if (res != 0) {
3255                         DEBUG(1, ("pthread_mutexattr_init failed: %s\n",
3256                                   strerror(res)));
3257                         goto fail;
3258                 }
3259                 res = pthread_mutexattr_settype(&a, PTHREAD_MUTEX_ERRORCHECK);
3260                 if (res != 0) {
3261                         DEBUG(1, ("pthread_mutexattr_settype failed: %s\n",
3262                                   strerror(res)));
3263                         pthread_mutexattr_destroy(&a);
3264                         goto fail;
3265                 }
3266                 res = pthread_mutexattr_setpshared(&a, PTHREAD_PROCESS_SHARED);
3267                 if (res != 0) {
3268                         DEBUG(1, ("pthread_mutexattr_setpshared failed: %s\n",
3269                                   strerror(res)));
3270                         pthread_mutexattr_destroy(&a);
3271                         goto fail;
3272                 }
3273                 res = pthread_mutexattr_setrobust(&a, PTHREAD_MUTEX_ROBUST);
3274                 if (res != 0) {
3275                         DEBUG(1, ("pthread_mutexattr_setrobust failed: "
3276                                   "%s\n", strerror(res)));
3277                         pthread_mutexattr_destroy(&a);
3278                         goto fail;
3279                 }
3280                 res = pthread_mutex_init(xconn->smb1.echo_handler.socket_mutex,
3281                                          &a);
3282                 pthread_mutexattr_destroy(&a);
3283                 if (res != 0) {
3284                         DEBUG(1, ("pthread_mutex_init failed: %s\n",
3285                                   strerror(res)));
3286                         goto fail;
3287                 }
3288         }
3289 #endif
3290
3291         if (!use_mutex) {
3292                 xconn->smb1.echo_handler.socket_lock_fd =
3293                         create_unlink_tmp(lp_lock_directory());
3294                 if (xconn->smb1.echo_handler.socket_lock_fd == -1) {
3295                         DEBUG(1, ("Could not create lock fd: %s\n",
3296                                   strerror(errno)));
3297                         goto fail;
3298                 }
3299         }
3300
3301         child = fork();
3302         if (child == 0) {
3303                 NTSTATUS status;
3304
3305                 close(listener_pipe[0]);
3306                 set_blocking(listener_pipe[1], false);
3307
3308                 status = reinit_after_fork(xconn->msg_ctx,
3309                                            xconn->ev_ctx,
3310                                            true);
3311                 if (!NT_STATUS_IS_OK(status)) {
3312                         DEBUG(1, ("reinit_after_fork failed: %s\n",
3313                                   nt_errstr(status)));
3314                         exit(1);
3315                 }
3316                 smbd_echo_loop(xconn, listener_pipe[1]);
3317                 exit(0);
3318         }
3319         close(listener_pipe[1]);
3320         listener_pipe[1] = -1;
3321         xconn->smb1.echo_handler.trusted_fd = listener_pipe[0];
3322
3323         DEBUG(10,("fork_echo_handler: main[%d] echo_child[%d]\n", (int)getpid(), (int)child));
3324
3325         /*
3326          * Without smb signing this is the same as the normal smbd
3327          * listener. This needs to change once signing comes in.
3328          */
3329         xconn->smb1.echo_handler.trusted_fde = tevent_add_fd(xconn->ev_ctx,
3330                                         xconn,
3331                                         xconn->smb1.echo_handler.trusted_fd,
3332                                         TEVENT_FD_READ,
3333                                         smbd_server_echo_handler,
3334                                         xconn);
3335         if (xconn->smb1.echo_handler.trusted_fde == NULL) {
3336                 DEBUG(1, ("event_add_fd failed\n"));
3337                 goto fail;
3338         }
3339
3340         return true;
3341
3342 fail:
3343         if (listener_pipe[0] != -1) {
3344                 close(listener_pipe[0]);
3345         }
3346         if (listener_pipe[1] != -1) {
3347                 close(listener_pipe[1]);
3348         }
3349         if (xconn->smb1.echo_handler.socket_lock_fd != -1) {
3350                 close(xconn->smb1.echo_handler.socket_lock_fd);
3351         }
3352 #ifdef HAVE_ROBUST_MUTEXES
3353         if (xconn->smb1.echo_handler.socket_mutex != NULL) {
3354                 pthread_mutex_destroy(xconn->smb1.echo_handler.socket_mutex);
3355                 anonymous_shared_free(xconn->smb1.echo_handler.socket_mutex);
3356         }
3357 #endif
3358         smbd_echo_init(xconn);
3359
3360         return false;
3361 }
3362
3363 static bool uid_in_use(const struct user_struct *user, uid_t uid)
3364 {
3365         while (user) {
3366                 if (user->session_info &&
3367                     (user->session_info->unix_token->uid == uid)) {
3368                         return true;
3369                 }
3370                 user = user->next;
3371         }
3372         return false;
3373 }
3374
3375 static bool gid_in_use(const struct user_struct *user, gid_t gid)
3376 {
3377         while (user) {
3378                 if (user->session_info != NULL) {
3379                         int i;
3380                         struct security_unix_token *utok;
3381
3382                         utok = user->session_info->unix_token;
3383                         if (utok->gid == gid) {
3384                                 return true;
3385                         }
3386                         for(i=0; i<utok->ngroups; i++) {
3387                                 if (utok->groups[i] == gid) {
3388                                         return true;
3389                                 }
3390                         }
3391                 }
3392                 user = user->next;
3393         }
3394         return false;
3395 }
3396
3397 static bool sid_in_use(const struct user_struct *user,
3398                        const struct dom_sid *psid)
3399 {
3400         while (user) {
3401                 struct security_token *tok;
3402
3403                 if (user->session_info == NULL) {
3404                         continue;
3405                 }
3406                 tok = user->session_info->security_token;
3407                 if (tok == NULL) {
3408                         /*
3409                          * Not sure session_info->security_token can
3410                          * ever be NULL. This check might be not
3411                          * necessary.
3412                          */
3413                         continue;
3414                 }
3415                 if (security_token_has_sid(tok, psid)) {
3416                         return true;
3417                 }
3418                 user = user->next;
3419         }
3420         return false;
3421 }
3422
3423 static bool id_in_use(const struct user_struct *user,
3424                       const struct id_cache_ref *id)
3425 {
3426         switch(id->type) {
3427         case UID:
3428                 return uid_in_use(user, id->id.uid);
3429         case GID:
3430                 return gid_in_use(user, id->id.gid);
3431         case SID:
3432                 return sid_in_use(user, &id->id.sid);
3433         default:
3434                 break;
3435         }
3436         return false;
3437 }
3438
3439 static void smbd_id_cache_kill(struct messaging_context *msg_ctx,
3440                                void *private_data,
3441                                uint32_t msg_type,
3442                                struct server_id server_id,
3443                                DATA_BLOB* data)
3444 {
3445         const char *msg = (data && data->data)
3446                 ? (const char *)data->data : "<NULL>";
3447         struct id_cache_ref id;
3448         struct smbd_server_connection *sconn =
3449                 talloc_get_type_abort(private_data,
3450                 struct smbd_server_connection);
3451
3452         if (!id_cache_ref_parse(msg, &id)) {
3453                 DEBUG(0, ("Invalid ?ID: %s\n", msg));
3454                 return;
3455         }
3456
3457         if (id_in_use(sconn->users, &id)) {
3458                 exit_server_cleanly(msg);
3459         }
3460         id_cache_delete_from_cache(&id);
3461 }
3462
3463 NTSTATUS smbXsrv_connection_init_tables(struct smbXsrv_connection *conn,
3464                                         enum protocol_types protocol)
3465 {
3466         NTSTATUS status;
3467
3468         set_Protocol(protocol);
3469         conn->protocol = protocol;
3470
3471         if (protocol >= PROTOCOL_SMB2_02) {
3472                 status = smb2srv_session_table_init(conn);
3473                 if (!NT_STATUS_IS_OK(status)) {
3474                         return status;
3475                 }
3476
3477                 status = smb2srv_open_table_init(conn);
3478                 if (!NT_STATUS_IS_OK(status)) {
3479                         return status;
3480                 }
3481         } else {
3482                 status = smb1srv_session_table_init(conn);
3483                 if (!NT_STATUS_IS_OK(status)) {
3484                         return status;
3485                 }
3486
3487                 status = smb1srv_tcon_table_init(conn);
3488                 if (!NT_STATUS_IS_OK(status)) {
3489                         return status;
3490                 }
3491
3492                 status = smb1srv_open_table_init(conn);
3493                 if (!NT_STATUS_IS_OK(status)) {
3494                         return status;
3495                 }
3496         }
3497
3498         return NT_STATUS_OK;
3499 }
3500
3501 struct smbd_tevent_trace_state {
3502         TALLOC_CTX *frame;
3503         uint64_t smbd_idle_profstamp;
3504 };
3505
3506 static void smbd_tevent_trace_callback(enum tevent_trace_point point,
3507                                        void *private_data)
3508 {
3509         struct smbd_tevent_trace_state *state =
3510                 (struct smbd_tevent_trace_state *)private_data;
3511
3512         switch (point) {
3513         case TEVENT_TRACE_BEFORE_WAIT:
3514                 /*
3515                  * This just removes compiler warning
3516                  * without profile support
3517                  */
3518                 state->smbd_idle_profstamp = 0;
3519                 START_PROFILE_STAMP(smbd_idle, state->smbd_idle_profstamp);
3520                 break;
3521         case TEVENT_TRACE_AFTER_WAIT:
3522                 END_PROFILE_STAMP(smbd_idle, state->smbd_idle_profstamp);
3523                 break;
3524         case TEVENT_TRACE_BEFORE_LOOP_ONCE:
3525                 TALLOC_FREE(state->frame);
3526                 state->frame = talloc_stackframe_pool(8192);
3527                 break;
3528         case TEVENT_TRACE_AFTER_LOOP_ONCE:
3529                 TALLOC_FREE(state->frame);
3530                 break;
3531         }
3532
3533         errno = 0;
3534 }
3535
3536 /**
3537  * Create a debug string for the connection
3538  *
3539  * This is allocated to talloc_tos() or a string constant
3540  * in certain corner cases. The returned string should
3541  * hence not be free'd directly but only via the talloc stack.
3542  */
3543 const char *smbXsrv_connection_dbg(const struct smbXsrv_connection *xconn)
3544 {
3545         const char *ret;
3546
3547         /*
3548          * TODO: this can be improved later
3549          * maybe including the client guid or more
3550          */
3551         ret = tsocket_address_string(xconn->remote_address, talloc_tos());
3552         if (ret == NULL) {
3553                 return "<tsocket_address_string() failed>";
3554         }
3555
3556         return ret;
3557 }
3558
3559 NTSTATUS smbd_add_connection(struct smbXsrv_client *client, int sock_fd,
3560                              struct smbXsrv_connection **_xconn)
3561 {
3562         TALLOC_CTX *frame = talloc_stackframe();
3563         struct smbXsrv_connection *xconn;
3564         struct sockaddr_storage ss_srv;
3565         void *sp_srv = (void *)&ss_srv;
3566         struct sockaddr *sa_srv = (struct sockaddr *)sp_srv;
3567         struct sockaddr_storage ss_clnt;
3568         void *sp_clnt = (void *)&ss_clnt;
3569         struct sockaddr *sa_clnt = (struct sockaddr *)sp_clnt;
3570         socklen_t sa_socklen;
3571         struct tsocket_address *local_address = NULL;
3572         struct tsocket_address *remote_address = NULL;
3573         const char *remaddr = NULL;
3574         char *p;
3575         const char *rhost = NULL;
3576         int ret;
3577         int tmp;
3578
3579         *_xconn = NULL;
3580
3581         xconn = talloc_zero(client, struct smbXsrv_connection);
3582         if (xconn == NULL) {
3583                 DEBUG(0,("talloc_zero(struct smbXsrv_connection)\n"));
3584                 TALLOC_FREE(frame);
3585                 return NT_STATUS_NO_MEMORY;
3586         }
3587         talloc_steal(frame, xconn);
3588
3589         xconn->ev_ctx = client->ev_ctx;
3590         xconn->msg_ctx = client->msg_ctx;
3591         xconn->transport.sock = sock_fd;
3592         smbd_echo_init(xconn);
3593         xconn->protocol = PROTOCOL_NONE;
3594
3595         /* Ensure child is set to blocking mode */
3596         set_blocking(sock_fd,True);
3597
3598         set_socket_options(sock_fd, "SO_KEEPALIVE");
3599         set_socket_options(sock_fd, lp_socket_options());
3600
3601         sa_socklen = sizeof(ss_clnt);
3602         ret = getpeername(sock_fd, sa_clnt, &sa_socklen);
3603         if (ret != 0) {
3604                 int saved_errno = errno;
3605                 int level = (errno == ENOTCONN)?2:0;
3606                 DEBUG(level,("getpeername() failed - %s\n",
3607                       strerror(saved_errno)));
3608                 TALLOC_FREE(frame);
3609                 return map_nt_error_from_unix_common(saved_errno);
3610         }
3611         ret = tsocket_address_bsd_from_sockaddr(xconn,
3612                                                 sa_clnt, sa_socklen,
3613                                                 &remote_address);
3614         if (ret != 0) {
3615                 int saved_errno = errno;
3616                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3617                         __location__, strerror(saved_errno)));
3618                 TALLOC_FREE(frame);
3619                 return map_nt_error_from_unix_common(saved_errno);
3620         }
3621
3622         sa_socklen = sizeof(ss_srv);
3623         ret = getsockname(sock_fd, sa_srv, &sa_socklen);
3624         if (ret != 0) {
3625                 int saved_errno = errno;
3626                 int level = (errno == ENOTCONN)?2:0;
3627                 DEBUG(level,("getsockname() failed - %s\n",
3628                       strerror(saved_errno)));
3629                 TALLOC_FREE(frame);
3630                 return map_nt_error_from_unix_common(saved_errno);
3631         }
3632         ret = tsocket_address_bsd_from_sockaddr(xconn,
3633                                                 sa_srv, sa_socklen,
3634                                                 &local_address);
3635         if (ret != 0) {
3636                 int saved_errno = errno;
3637                 DEBUG(0,("%s: tsocket_address_bsd_from_sockaddr remote failed - %s\n",
3638                         __location__, strerror(saved_errno)));
3639                 TALLOC_FREE(frame);
3640                 return map_nt_error_from_unix_common(saved_errno);
3641         }
3642
3643         if (tsocket_address_is_inet(remote_address, "ip")) {
3644                 remaddr = tsocket_address_inet_addr_string(remote_address,
3645                                                            talloc_tos());
3646                 if (remaddr == NULL) {
3647                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3648                                  __location__, strerror(errno)));
3649                         TALLOC_FREE(frame);
3650                         return NT_STATUS_NO_MEMORY;
3651                 }
3652         } else {
3653                 remaddr = "0.0.0.0";
3654         }
3655
3656         /*
3657          * Before the first packet, check the global hosts allow/ hosts deny
3658          * parameters before doing any parsing of packets passed to us by the
3659          * client. This prevents attacks on our parsing code from hosts not in
3660          * the hosts allow list.
3661          */
3662
3663         ret = get_remote_hostname(remote_address,
3664                                   &p, talloc_tos());
3665         if (ret < 0) {
3666                 int saved_errno = errno;
3667                 DEBUG(0,("%s: get_remote_hostname failed - %s\n",
3668                         __location__, strerror(saved_errno)));
3669                 TALLOC_FREE(frame);
3670                 return map_nt_error_from_unix_common(saved_errno);
3671         }
3672         rhost = p;
3673         if (strequal(rhost, "UNKNOWN")) {
3674                 rhost = remaddr;
3675         }
3676
3677         xconn->local_address = local_address;
3678         xconn->remote_address = remote_address;
3679         xconn->remote_hostname = talloc_strdup(xconn, rhost);
3680         if (xconn->remote_hostname == NULL) {
3681                 return NT_STATUS_NO_MEMORY;
3682         }
3683
3684         if (!srv_init_signing(xconn)) {
3685                 DEBUG(0, ("Failed to init smb_signing\n"));
3686                 TALLOC_FREE(frame);
3687                 return NT_STATUS_INTERNAL_ERROR;
3688         }
3689
3690         if (!allow_access(lp_hosts_deny(-1), lp_hosts_allow(-1),
3691                           xconn->remote_hostname,
3692                           remaddr)) {
3693                 DEBUG( 1, ("Connection denied from %s to %s\n",
3694                            tsocket_address_string(remote_address, talloc_tos()),
3695                            tsocket_address_string(local_address, talloc_tos())));
3696
3697                 /*
3698                  * We return a valid xconn
3699                  * so that the caller can return an error message
3700                  * to the client
3701                  */
3702                 client->connections = xconn;
3703                 xconn->client = client;
3704                 talloc_steal(client, xconn);
3705
3706                 *_xconn = xconn;
3707                 TALLOC_FREE(frame);
3708                 return NT_STATUS_NETWORK_ACCESS_DENIED;
3709         }
3710
3711         DEBUG(10, ("Connection allowed from %s to %s\n",
3712                    tsocket_address_string(remote_address, talloc_tos()),
3713                    tsocket_address_string(local_address, talloc_tos())));
3714
3715         if (lp_clustering()) {
3716                 /*
3717                  * We need to tell ctdb about our client's TCP
3718                  * connection, so that for failover ctdbd can send
3719                  * tickle acks, triggering a reconnection by the
3720                  * client.
3721                  */
3722                 NTSTATUS status;
3723
3724                 status = smbd_register_ips(xconn, &ss_srv, &ss_clnt);
3725                 if (!NT_STATUS_IS_OK(status)) {
3726                         DEBUG(0, ("ctdbd_register_ips failed: %s\n",
3727                                   nt_errstr(status)));
3728                 }
3729         }
3730
3731         tmp = lp_max_xmit();
3732         tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
3733         tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
3734
3735         xconn->smb1.negprot.max_recv = tmp;
3736
3737         xconn->smb1.sessions.done_sesssetup = false;
3738         xconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
3739
3740         xconn->transport.fde = tevent_add_fd(client->ev_ctx,
3741                                              xconn,
3742                                              sock_fd,
3743                                              TEVENT_FD_READ,
3744                                              smbd_server_connection_handler,
3745                                              xconn);
3746         if (!xconn->transport.fde) {
3747                 TALLOC_FREE(frame);
3748                 return NT_STATUS_NO_MEMORY;
3749         }
3750
3751         /* for now we only have one connection */
3752         DLIST_ADD_END(client->connections, xconn, NULL);
3753         xconn->client = client;
3754         talloc_steal(client, xconn);
3755
3756         *_xconn = xconn;
3757         TALLOC_FREE(frame);
3758         return NT_STATUS_OK;
3759 }
3760
3761 /****************************************************************************
3762  Process commands from the client
3763 ****************************************************************************/
3764
3765 void smbd_process(struct tevent_context *ev_ctx,
3766                   struct messaging_context *msg_ctx,
3767                   int sock_fd,
3768                   bool interactive)
3769 {
3770         struct smbd_tevent_trace_state trace_state = {
3771                 .frame = talloc_stackframe(),
3772         };
3773         struct smbXsrv_client *client = NULL;
3774         struct smbd_server_connection *sconn = NULL;
3775         struct smbXsrv_connection *xconn = NULL;
3776         const char *locaddr = NULL;
3777         const char *remaddr = NULL;
3778         int ret;
3779         NTSTATUS status;
3780
3781         client = talloc_zero(ev_ctx, struct smbXsrv_client);
3782         if (client == NULL) {
3783                 DEBUG(0,("talloc_zero(struct smbXsrv_client)\n"));
3784                 exit_server_cleanly("talloc_zero(struct smbXsrv_client).\n");
3785         }
3786
3787         /*
3788          * TODO: remove this...:-)
3789          */
3790         global_smbXsrv_client = client;
3791
3792         client->ev_ctx = ev_ctx;
3793         client->msg_ctx = msg_ctx;
3794
3795         sconn = talloc_zero(client, struct smbd_server_connection);
3796         if (sconn == NULL) {
3797                 exit_server("failed to create smbd_server_connection");
3798         }
3799
3800         client->sconn = sconn;
3801         sconn->client = client;
3802
3803         sconn->ev_ctx = ev_ctx;
3804         sconn->msg_ctx = msg_ctx;
3805
3806         if (lp_server_max_protocol() >= PROTOCOL_SMB2_02) {
3807                 /*
3808                  * We're not making the decision here,
3809                  * we're just allowing the client
3810                  * to decide between SMB1 and SMB2
3811                  * with the first negprot
3812                  * packet.
3813                  */
3814                 sconn->using_smb2 = true;
3815         }
3816
3817         if (!interactive) {
3818                 smbd_setup_sig_term_handler(sconn);
3819                 smbd_setup_sig_hup_handler(sconn);
3820
3821                 if (!serverid_register(messaging_server_id(msg_ctx),
3822                                        FLAG_MSG_GENERAL|FLAG_MSG_SMBD
3823                                        |FLAG_MSG_DBWRAP
3824                                        |FLAG_MSG_PRINT_GENERAL)) {
3825                         exit_server_cleanly("Could not register myself in "
3826                                             "serverid.tdb");
3827                 }
3828         }
3829
3830         status = smbd_add_connection(client, sock_fd, &xconn);
3831         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3832                 /*
3833                  * send a negative session response "not listening on calling
3834                  * name"
3835                  */
3836                 unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
3837                 (void)srv_send_smb(xconn,(char *)buf, false,
3838                                    0, false, NULL);
3839                 exit_server_cleanly("connection denied");
3840         } else if (!NT_STATUS_IS_OK(status)) {
3841                 exit_server_cleanly(nt_errstr(status));
3842         }
3843
3844         sconn->local_address =
3845                 tsocket_address_copy(xconn->local_address, sconn);
3846         if (sconn->local_address == NULL) {
3847                 exit_server_cleanly("tsocket_address_copy() failed");
3848         }
3849         sconn->remote_address =
3850                 tsocket_address_copy(xconn->remote_address, sconn);
3851         if (sconn->remote_address == NULL) {
3852                 exit_server_cleanly("tsocket_address_copy() failed");
3853         }
3854         sconn->remote_hostname =
3855                 talloc_strdup(sconn, xconn->remote_hostname);
3856         if (sconn->remote_hostname == NULL) {
3857                 exit_server_cleanly("tsocket_strdup() failed");
3858         }
3859
3860         if (tsocket_address_is_inet(sconn->local_address, "ip")) {
3861                 locaddr = tsocket_address_inet_addr_string(
3862                                 sconn->local_address,
3863                                 talloc_tos());
3864                 if (locaddr == NULL) {
3865                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3866                                  __location__, strerror(errno)));
3867                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3868                 }
3869         } else {
3870                 locaddr = "0.0.0.0";
3871         }
3872
3873         if (tsocket_address_is_inet(sconn->remote_address, "ip")) {
3874                 remaddr = tsocket_address_inet_addr_string(
3875                                 sconn->remote_address,
3876                                 talloc_tos());
3877                 if (remaddr == NULL) {
3878                         DEBUG(0,("%s: tsocket_address_inet_addr_string remote failed - %s\n",
3879                                  __location__, strerror(errno)));
3880                         exit_server_cleanly("tsocket_address_inet_addr_string remote failed.\n");
3881                 }
3882         } else {
3883                 remaddr = "0.0.0.0";
3884         }
3885
3886         /* this is needed so that we get decent entries
3887            in smbstatus for port 445 connects */
3888         set_remote_machine_name(remaddr, false);
3889         reload_services(sconn, conn_snum_used, true);
3890         sub_set_socket_ids(remaddr,
3891                            sconn->remote_hostname,
3892                            locaddr);
3893
3894         if (lp_preload_modules()) {
3895                 smb_load_modules(lp_preload_modules());
3896         }
3897
3898         smb_perfcount_init();
3899
3900         if (!init_account_policy()) {
3901                 exit_server("Could not open account policy tdb.\n");
3902         }
3903
3904         if (*lp_root_directory(talloc_tos())) {
3905                 if (chroot(lp_root_directory(talloc_tos())) != 0) {
3906                         DEBUG(0,("Failed to change root to %s\n",
3907                                  lp_root_directory(talloc_tos())));
3908                         exit_server("Failed to chroot()");
3909                 }
3910                 if (chdir("/") == -1) {
3911                         DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_root_directory(talloc_tos())));
3912                         exit_server("Failed to chroot()");
3913                 }
3914                 DEBUG(0,("Changed root to %s\n", lp_root_directory(talloc_tos())));
3915         }
3916
3917         if (!file_init(sconn)) {
3918                 exit_server("file_init() failed");
3919         }
3920
3921         /* Setup oplocks */
3922         if (!init_oplocks(sconn))
3923                 exit_server("Failed to init oplocks");
3924
3925         /* register our message handlers */
3926         messaging_register(sconn->msg_ctx, sconn,
3927                            MSG_SMB_FORCE_TDIS, msg_force_tdis);
3928         messaging_register(sconn->msg_ctx, sconn,
3929                            MSG_SMB_CLOSE_FILE, msg_close_file);
3930         messaging_register(sconn->msg_ctx, sconn,
3931                            MSG_SMB_FILE_RENAME, msg_file_was_renamed);
3932
3933         id_cache_register_msgs(sconn->msg_ctx);
3934         messaging_deregister(sconn->msg_ctx, ID_CACHE_KILL, NULL);
3935         messaging_register(sconn->msg_ctx, sconn,
3936                            ID_CACHE_KILL, smbd_id_cache_kill);
3937
3938         messaging_deregister(sconn->msg_ctx,
3939                              MSG_SMB_CONF_UPDATED, sconn->ev_ctx);
3940         messaging_register(sconn->msg_ctx, sconn,
3941                            MSG_SMB_CONF_UPDATED, smbd_conf_updated);
3942
3943         messaging_deregister(sconn->msg_ctx, MSG_SMB_KILL_CLIENT_IP,
3944                              NULL);
3945         messaging_register(sconn->msg_ctx, sconn,
3946                            MSG_SMB_KILL_CLIENT_IP,
3947                            msg_kill_client_ip);
3948
3949         messaging_deregister(sconn->msg_ctx, MSG_SMB_TELL_NUM_CHILDREN, NULL);
3950
3951         /*
3952          * Use the default MSG_DEBUG handler to avoid rebroadcasting
3953          * MSGs to all child processes
3954          */
3955         messaging_deregister(sconn->msg_ctx,
3956                              MSG_DEBUG, NULL);
3957         messaging_register(sconn->msg_ctx, NULL,
3958                            MSG_DEBUG, debug_message);
3959
3960         if ((lp_keepalive() != 0)
3961             && !(event_add_idle(ev_ctx, NULL,
3962                                 timeval_set(lp_keepalive(), 0),
3963                                 "keepalive", keepalive_fn,
3964                                 sconn))) {
3965                 DEBUG(0, ("Could not add keepalive event\n"));
3966                 exit(1);
3967         }
3968
3969         if (!(event_add_idle(ev_ctx, NULL,
3970                              timeval_set(IDLE_CLOSED_TIMEOUT, 0),
3971                              "deadtime", deadtime_fn, sconn))) {
3972                 DEBUG(0, ("Could not add deadtime event\n"));
3973                 exit(1);
3974         }
3975
3976         if (!(event_add_idle(ev_ctx, NULL,
3977                              timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
3978                              "housekeeping", housekeeping_fn, sconn))) {
3979                 DEBUG(0, ("Could not add housekeeping event\n"));
3980                 exit(1);
3981         }
3982
3983         if (!init_dptrs(sconn)) {
3984                 exit_server("init_dptrs() failed");
3985         }
3986
3987         TALLOC_FREE(trace_state.frame);
3988
3989         tevent_set_trace_callback(ev_ctx, smbd_tevent_trace_callback,
3990                                   &trace_state);
3991
3992         ret = tevent_loop_wait(ev_ctx);
3993         if (ret != 0) {
3994                 DEBUG(1, ("tevent_loop_wait failed: %d, %s,"
3995                           " exiting\n", ret, strerror(errno)));
3996         }
3997
3998         TALLOC_FREE(trace_state.frame);
3999
4000         exit_server_cleanly(NULL);
4001 }
4002
4003 bool req_is_in_chain(const struct smb_request *req)
4004 {
4005         if (req->vwv != (const uint16_t *)(req->inbuf+smb_vwv)) {
4006                 /*
4007                  * We're right now handling a subsequent request, so we must
4008                  * be in a chain
4009                  */
4010                 return true;
4011         }
4012
4013         if (!is_andx_req(req->cmd)) {
4014                 return false;
4015         }
4016
4017         if (req->wct < 2) {
4018                 /*
4019                  * Okay, an illegal request, but definitely not chained :-)
4020                  */
4021                 return false;
4022         }
4023
4024         return (CVAL(req->vwv+0, 0) != 0xFF);
4025 }