source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 uint16 global_smbpid;
  25 extern int keepalive;
  26 extern struct auth_context *negprot_global_auth_context;
  27 extern int smb_echo_count;
  28
  29 static char *InBuffer = NULL;
  30 static char *OutBuffer = NULL;
  31 static char *current_inbuf = NULL;
  32
  33 /*
  34  * Size of data we can send to client. Set
  35  *  by the client for all protocols above CORE.
  36  *  Set by us for CORE protocol.
  37  */
  38 int max_send = BUFFER_SIZE;
  39 /*
  40  * Size of the data we can receive. Set by us.
  41  * Can be modified by the max xmit parameter.
  42  */
  43 int max_recv = BUFFER_SIZE;
  44
  45 extern int last_message;
  46 extern int smb_read_error;
  47 SIG_ATOMIC_T reload_after_sighup = 0;
  48 SIG_ATOMIC_T got_sig_term = 0;
  49 extern BOOL global_machine_password_needs_changing;
  50 extern int max_send;
  51
  52 /****************************************************************************
  53  Function to return the current request mid from Inbuffer.
  54 ****************************************************************************/
  55
  56 uint16 get_current_mid(void)
  57 {
  58         return SVAL(InBuffer,smb_mid);
  59 }
  60
  61 /****************************************************************************
  62  structure to hold a linked list of queued messages.
  63  for processing.
  64 ****************************************************************************/
  65
  66 static struct pending_message_list *deferred_open_queue;
  67
  68 /****************************************************************************
  69  Function to push a message onto the tail of a linked list of smb messages ready
  70  for processing.
  71 ****************************************************************************/
  72
  73 static BOOL push_queued_message(char *buf, int msg_len,
  74                                 struct timeval request_time,
  75                                 struct timeval end_time,
  76                                 char *private_data, size_t private_len)
  77 {
  78         struct pending_message_list *msg;
  79
  80         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
  81
  82         if(msg == NULL) {
  83                 DEBUG(0,("push_message: malloc fail (1)\n"));
  84                 return False;
  85         }
  86
  87         msg->buf = data_blob_talloc(msg, buf, msg_len);
  88         if(msg->buf.data == NULL) {
  89                 DEBUG(0,("push_message: malloc fail (2)\n"));
  90                 TALLOC_FREE(msg);
  91                 return False;
  92         }
  93
  94         msg->request_time = request_time;
  95         msg->end_time = end_time;
  96
  97         if (private_data) {
  98                 msg->private_data = data_blob_talloc(msg, private_data,
  99                                                      private_len);
 100                 if (msg->private_data.data == NULL) {
 101                         DEBUG(0,("push_message: malloc fail (3)\n"));
 102                         TALLOC_FREE(msg);
 103                         return False;
 104                 }
 105         }
 106
 107         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 108
 109         DEBUG(10,("push_message: pushed message length %u on "
 110                   "deferred_open_queue\n", (unsigned int)msg_len));
 111
 112         return True;
 113 }
 114
 115 /****************************************************************************
 116  Function to delete a sharing violation open message by mid.
 117 ****************************************************************************/
 118
 119 void remove_deferred_open_smb_message(uint16 mid)
 120 {
 121         struct pending_message_list *pml;
 122
 123         for (pml = deferred_open_queue; pml; pml = pml->next) {
 124                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 125                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 126                                   "deleting mid %u len %u\n",
 127                                   (unsigned int)mid,
 128                                   (unsigned int)pml->buf.length ));
 129                         DLIST_REMOVE(deferred_open_queue, pml);
 130                         TALLOC_FREE(pml);
 131                         return;
 132                 }
 133         }
 134 }
 135
 136 /****************************************************************************
 137  Move a sharing violation open retry message to the front of the list and
 138  schedule it for immediate processing.
 139 ****************************************************************************/
 140
 141 void schedule_deferred_open_smb_message(uint16 mid)
 142 {
 143         struct pending_message_list *pml;
 144         int i = 0;
 145
 146         for (pml = deferred_open_queue; pml; pml = pml->next) {
 147                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 148                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 149                         (unsigned int)msg_mid ));
 150                 if (mid == msg_mid) {
 151                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 152                                 mid ));
 153                         pml->end_time.tv_sec = 0;
 154                         pml->end_time.tv_usec = 0;
 155                         DLIST_PROMOTE(deferred_open_queue, pml);
 156                         return;
 157                 }
 158         }
 159
 160         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 161                 mid ));
 162 }
 163
 164 /****************************************************************************
 165  Return true if this mid is on the deferred queue.
 166 ****************************************************************************/
 167
 168 BOOL open_was_deferred(uint16 mid)
 169 {
 170         struct pending_message_list *pml;
 171
 172         for (pml = deferred_open_queue; pml; pml = pml->next) {
 173                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 174                         return True;
 175                 }
 176         }
 177         return False;
 178 }
 179
 180 /****************************************************************************
 181  Return the message queued by this mid.
 182 ****************************************************************************/
 183
 184 struct pending_message_list *get_open_deferred_message(uint16 mid)
 185 {
 186         struct pending_message_list *pml;
 187
 188         for (pml = deferred_open_queue; pml; pml = pml->next) {
 189                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 190                         return pml;
 191                 }
 192         }
 193         return NULL;
 194 }
 195
 196 /****************************************************************************
 197  Function to push a deferred open smb message onto a linked list of local smb
 198  messages ready for processing.
 199 ****************************************************************************/
 200
 201 BOOL push_deferred_smb_message(uint16 mid,
 202                                struct timeval request_time,
 203                                struct timeval timeout,
 204                                char *private_data, size_t priv_len)
 205 {
 206         struct timeval end_time;
 207
 208         end_time = timeval_sum(&request_time, &timeout);
 209
 210         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 211                   "timeout time [%u.%06u]\n",
 212                   (unsigned int) smb_len(current_inbuf)+4, (unsigned int)mid,
 213                   (unsigned int)end_time.tv_sec,
 214                   (unsigned int)end_time.tv_usec));
 215
 216         return push_queued_message(current_inbuf, smb_len(current_inbuf)+4,
 217                                    request_time, end_time,
 218                                    private_data, priv_len);
 219 }
 220
 221 struct idle_event {
 222         struct timed_event *te;
 223         struct timeval interval;
 224         BOOL (*handler)(const struct timeval *now, void *private_data);
 225         void *private_data;
 226 };
 227
 228 static void idle_event_handler(struct event_context *ctx,
 229                                struct timed_event *te,
 230                                const struct timeval *now,
 231                                void *private_data)
 232 {
 233         struct idle_event *event =
 234                 talloc_get_type_abort(private_data, struct idle_event);
 235
 236         TALLOC_FREE(event->te);
 237
 238         if (!event->handler(now, event->private_data)) {
 239                 /* Don't repeat, delete ourselves */
 240                 TALLOC_FREE(event);
 241                 return;
 242         }
 243
 244         event->te = event_add_timed(smbd_event_context(), event,
 245                                     timeval_sum(now, &event->interval),
 246                                     "idle_event_handler",
 247                                     idle_event_handler, event);
 248
 249         /* We can't do much but fail here. */
 250         SMB_ASSERT(event->te != NULL);
 251 }
 252
 253 struct idle_event *add_idle_event(TALLOC_CTX *mem_ctx,
 254                                   struct timeval interval,
 255                                   BOOL (*handler)(const struct timeval *now,
 256                                                   void *private_data),
 257                                   void *private_data)
 258 {
 259         struct idle_event *result;
 260         struct timeval now = timeval_current();
 261
 262         result = TALLOC_P(mem_ctx, struct idle_event);
 263         if (result == NULL) {
 264                 DEBUG(0, ("talloc failed\n"));
 265                 return NULL;
 266         }
 267
 268         result->interval = interval;
 269         result->handler = handler;
 270         result->private_data = private_data;
 271
 272         result->te = event_add_timed(smbd_event_context(), result,
 273                                      timeval_sum(&now, &interval),
 274                                      "idle_event_handler",
 275                                      idle_event_handler, result);
 276         if (result->te == NULL) {
 277                 DEBUG(0, ("event_add_timed failed\n"));
 278                 TALLOC_FREE(result);
 279                 return NULL;
 280         }
 281
 282         return result;
 283 }
 284
 285 /****************************************************************************
 286  Do all async processing in here. This includes kernel oplock messages, change
 287  notify events etc.
 288 ****************************************************************************/
 289
 290 static void async_processing(fd_set *pfds)
 291 {
 292         DEBUG(10,("async_processing: Doing async processing.\n"));
 293
 294         process_aio_queue();
 295
 296         process_kernel_oplocks(pfds);
 297
 298         /* Do the aio check again after receive_local_message as it does a
 299            select and may have eaten our signal. */
 300         /* Is this till true? -- vl */
 301         process_aio_queue();
 302
 303         if (got_sig_term) {
 304                 exit_server_cleanly("termination signal");
 305         }
 306
 307         /* check for sighup processing */
 308         if (reload_after_sighup) {
 309                 change_to_root_user();
 310                 DEBUG(1,("Reloading services after SIGHUP\n"));
 311                 reload_services(False);
 312                 reload_after_sighup = 0;
 313         }
 314 }
 315
 316 /****************************************************************************
 317  Add a fd to the set we will be select(2)ing on.
 318 ****************************************************************************/
 319
 320 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 321 {
 322         if (fd != -1) {
 323                 FD_SET(fd, fds);
 324                 maxfd = MAX(maxfd, fd);
 325         }
 326
 327         return maxfd;
 328 }
 329
 330 /****************************************************************************
 331   Do a select on an two fd's - with timeout.
 332
 333   If a local udp message has been pushed onto the
 334   queue (this can only happen during oplock break
 335   processing) call async_processing()
 336
 337   If a pending smb message has been pushed onto the
 338   queue (this can only happen during oplock break
 339   processing) return this next.
 340
 341   If the first smbfd is ready then read an smb from it.
 342   if the second (loopback UDP) fd is ready then read a message
 343   from it and setup the buffer header to identify the length
 344   and from address.
 345   Returns False on timeout or error.
 346   Else returns True.
 347
 348 The timeout is in milliseconds
 349 ****************************************************************************/
 350
 351 static BOOL receive_message_or_smb(char *buffer, int buffer_len, int timeout)
 352 {
 353         fd_set r_fds, w_fds;
 354         int selrtn;
 355         struct timeval to;
 356         int maxfd = 0;
 357
 358         smb_read_error = 0;
 359
 360  again:
 361
 362         if (timeout >= 0) {
 363                 to.tv_sec = timeout / 1000;
 364                 to.tv_usec = (timeout % 1000) * 1000;
 365         } else {
 366                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 367                 to.tv_usec = 0;
 368         }
 369
 370         /*
 371          * Note that this call must be before processing any SMB
 372          * messages as we need to synchronously process any messages
 373          * we may have sent to ourselves from the previous SMB.
 374          */
 375         message_dispatch();
 376
 377         /*
 378          * Check to see if we already have a message on the deferred open queue
 379          * and it's time to schedule.
 380          */
 381         if(deferred_open_queue != NULL) {
 382                 BOOL pop_message = False;
 383                 struct pending_message_list *msg = deferred_open_queue;
 384
 385                 if (timeval_is_zero(&msg->end_time)) {
 386                         pop_message = True;
 387                 } else {
 388                         struct timeval tv;
 389                         SMB_BIG_INT tdif;
 390
 391                         GetTimeOfDay(&tv);
 392                         tdif = usec_time_diff(&msg->end_time, &tv);
 393                         if (tdif <= 0) {
 394                                 /* Timed out. Schedule...*/
 395                                 pop_message = True;
 396                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 397                         } else {
 398                                 /* Make a more accurate select timeout. */
 399                                 to.tv_sec = tdif / 1000000;
 400                                 to.tv_usec = tdif % 1000000;
 401                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 402                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 403                         }
 404                 }
 405
 406                 if (pop_message) {
 407                         memcpy(buffer, msg->buf.data, MIN(buffer_len, msg->buf.length));
 408
 409                         /* We leave this message on the queue so the open code can
 410                            know this is a retry. */
 411                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 412                         return True;
 413                 }
 414         }
 415
 416         /*
 417          * Setup the select fd sets.
 418          */
 419
 420         FD_ZERO(&r_fds);
 421         FD_ZERO(&w_fds);
 422
 423         /*
 424          * Ensure we process oplock break messages by preference.
 425          * We have to do this before the select, after the select
 426          * and if the select returns EINTR. This is due to the fact
 427          * that the selects called from async_processing can eat an EINTR
 428          * caused by a signal (we can't take the break message there).
 429          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 430          */
 431
 432         if (oplock_message_waiting(&r_fds)) {
 433                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 434                 async_processing(&r_fds);
 435                 /*
 436                  * After async processing we must go and do the select again, as
 437                  * the state of the flag in fds for the server file descriptor is
 438                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 439                  */
 440                 goto again;
 441         }
 442
 443         /*
 444          * Are there any timed events waiting ? If so, ensure we don't
 445          * select for longer than it would take to wait for them.
 446          */
 447
 448         {
 449                 struct timeval now;
 450                 GetTimeOfDay(&now);
 451
 452                 event_add_to_select_args(smbd_event_context(), &now,
 453                                          &r_fds, &w_fds, &to, &maxfd);
 454         }
 455
 456         if (timeval_is_zero(&to)) {
 457                 /* Process a timed event now... */
 458                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 459                         goto again;
 460                 }
 461         }
 462
 463         {
 464                 int sav;
 465                 START_PROFILE(smbd_idle);
 466
 467                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 468                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 469
 470                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 471                 sav = errno;
 472
 473                 END_PROFILE(smbd_idle);
 474                 errno = sav;
 475         }
 476
 477         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 478                 goto again;
 479         }
 480
 481         /* if we get EINTR then maybe we have received an oplock
 482            signal - treat this as select returning 1. This is ugly, but
 483            is the best we can do until the oplock code knows more about
 484            signals */
 485         if (selrtn == -1 && errno == EINTR) {
 486                 async_processing(&r_fds);
 487                 /*
 488                  * After async processing we must go and do the select again, as
 489                  * the state of the flag in fds for the server file descriptor is
 490                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 491                  */
 492                 goto again;
 493         }
 494
 495         /* Check if error */
 496         if (selrtn == -1) {
 497                 /* something is wrong. Maybe the socket is dead? */
 498                 smb_read_error = READ_ERROR;
 499                 return False;
 500         }
 501
 502         /* Did we timeout ? */
 503         if (selrtn == 0) {
 504                 smb_read_error = READ_TIMEOUT;
 505                 return False;
 506         }
 507
 508         /*
 509          * Ensure we process oplock break messages by preference.
 510          * This is IMPORTANT ! Otherwise we can starve other processes
 511          * sending us an oplock break message. JRA.
 512          */
 513
 514         if (oplock_message_waiting(&r_fds)) {
 515                 async_processing(&r_fds);
 516                 /*
 517                  * After async processing we must go and do the select again, as
 518                  * the state of the flag in fds for the server file descriptor is
 519                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 520                  */
 521                 goto again;
 522         }
 523
 524         return receive_smb(smbd_server_fd(), buffer, 0);
 525 }
 526
 527 /*
 528  * Only allow 5 outstanding trans requests. We're allocating memory, so
 529  * prevent a DoS.
 530  */
 531
 532 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 533 {
 534         int count = 0;
 535         for (; list != NULL; list = list->next) {
 536
 537                 if (list->mid == mid) {
 538                         return NT_STATUS_INVALID_PARAMETER;
 539                 }
 540
 541                 count += 1;
 542         }
 543         if (count > 5) {
 544                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 545         }
 546
 547         return NT_STATUS_OK;
 548 }
 549
 550 /****************************************************************************
 551  We're terminating and have closed all our files/connections etc.
 552  If there are any pending local messages we need to respond to them
 553  before termination so that other smbds don't think we just died whilst
 554  holding oplocks.
 555 ****************************************************************************/
 556
 557 void respond_to_all_remaining_local_messages(void)
 558 {
 559         /*
 560          * Assert we have no exclusive open oplocks.
 561          */
 562
 563         if(get_number_of_exclusive_open_oplocks()) {
 564                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 565                         get_number_of_exclusive_open_oplocks() ));
 566                 return;
 567         }
 568
 569         process_kernel_oplocks(NULL);
 570
 571         return;
 572 }
 573
 574
 575 /*
 576 These flags determine some of the permissions required to do an operation
 577
 578 Note that I don't set NEED_WRITE on some write operations because they
 579 are used by some brain-dead clients when printing, and I don't want to
 580 force write permissions on print services.
 581 */
 582 #define AS_USER (1<<0)
 583 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 584 #define TIME_INIT (1<<2)
 585 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 586 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 587 #define DO_CHDIR (1<<6)
 588
 589 /*
 590    define a list of possible SMB messages and their corresponding
 591    functions. Any message that has a NULL function is unimplemented -
 592    please feel free to contribute implementations!
 593 */
 594 static const struct smb_message_struct {
 595         const char *name;
 596         int (*fn)(connection_struct *conn, char *, char *, int, int);
 597         int flags;
 598 } smb_messages[256] = {
 599
 600 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
 601 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
 602 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
 603 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
 604 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
 605 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
 606 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
 607 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
 608 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
 609 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
 610 /* 0x0a */ { "SMBread",reply_read,AS_USER},
 611 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
 612 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
 613 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
 614 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
 615 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
 616 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
 617 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
 618 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
 619 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
 620 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
 621 /* 0x15 */ { NULL, NULL, 0 },
 622 /* 0x16 */ { NULL, NULL, 0 },
 623 /* 0x17 */ { NULL, NULL, 0 },
 624 /* 0x18 */ { NULL, NULL, 0 },
 625 /* 0x19 */ { NULL, NULL, 0 },
 626 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
 627 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
 628 /* 0x1c */ { "SMBreadBs",NULL,0 },
 629 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
 630 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
 631 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
 632 /* 0x20 */ { "SMBwritec",NULL,0},
 633 /* 0x21 */ { NULL, NULL, 0 },
 634 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
 635 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
 636 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
 637 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
 638 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
 639 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
 640 /* 0x28 */ { "SMBioctls",NULL,AS_USER},
 641 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
 642 /* 0x2a */ { "SMBmove",NULL,AS_USER | NEED_WRITE },
 643 /* 0x2b */ { "SMBecho",reply_echo,0},
 644 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
 645 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
 646 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
 647 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
 648 /* 0x30 */ { NULL, NULL, 0 },
 649 /* 0x31 */ { NULL, NULL, 0 },
 650 /* 0x32 */ { "SMBtrans2", reply_trans2, AS_USER | CAN_IPC },
 651 /* 0x33 */ { "SMBtranss2", reply_transs2, AS_USER},
 652 /* 0x34 */ { "SMBfindclose", reply_findclose,AS_USER},
 653 /* 0x35 */ { "SMBfindnclose", reply_findnclose, AS_USER},
 654 /* 0x36 */ { NULL, NULL, 0 },
 655 /* 0x37 */ { NULL, NULL, 0 },
 656 /* 0x38 */ { NULL, NULL, 0 },
 657 /* 0x39 */ { NULL, NULL, 0 },
 658 /* 0x3a */ { NULL, NULL, 0 },
 659 /* 0x3b */ { NULL, NULL, 0 },
 660 /* 0x3c */ { NULL, NULL, 0 },
 661 /* 0x3d */ { NULL, NULL, 0 },
 662 /* 0x3e */ { NULL, NULL, 0 },
 663 /* 0x3f */ { NULL, NULL, 0 },
 664 /* 0x40 */ { NULL, NULL, 0 },
 665 /* 0x41 */ { NULL, NULL, 0 },
 666 /* 0x42 */ { NULL, NULL, 0 },
 667 /* 0x43 */ { NULL, NULL, 0 },
 668 /* 0x44 */ { NULL, NULL, 0 },
 669 /* 0x45 */ { NULL, NULL, 0 },
 670 /* 0x46 */ { NULL, NULL, 0 },
 671 /* 0x47 */ { NULL, NULL, 0 },
 672 /* 0x48 */ { NULL, NULL, 0 },
 673 /* 0x49 */ { NULL, NULL, 0 },
 674 /* 0x4a */ { NULL, NULL, 0 },
 675 /* 0x4b */ { NULL, NULL, 0 },
 676 /* 0x4c */ { NULL, NULL, 0 },
 677 /* 0x4d */ { NULL, NULL, 0 },
 678 /* 0x4e */ { NULL, NULL, 0 },
 679 /* 0x4f */ { NULL, NULL, 0 },
 680 /* 0x50 */ { NULL, NULL, 0 },
 681 /* 0x51 */ { NULL, NULL, 0 },
 682 /* 0x52 */ { NULL, NULL, 0 },
 683 /* 0x53 */ { NULL, NULL, 0 },
 684 /* 0x54 */ { NULL, NULL, 0 },
 685 /* 0x55 */ { NULL, NULL, 0 },
 686 /* 0x56 */ { NULL, NULL, 0 },
 687 /* 0x57 */ { NULL, NULL, 0 },
 688 /* 0x58 */ { NULL, NULL, 0 },
 689 /* 0x59 */ { NULL, NULL, 0 },
 690 /* 0x5a */ { NULL, NULL, 0 },
 691 /* 0x5b */ { NULL, NULL, 0 },
 692 /* 0x5c */ { NULL, NULL, 0 },
 693 /* 0x5d */ { NULL, NULL, 0 },
 694 /* 0x5e */ { NULL, NULL, 0 },
 695 /* 0x5f */ { NULL, NULL, 0 },
 696 /* 0x60 */ { NULL, NULL, 0 },
 697 /* 0x61 */ { NULL, NULL, 0 },
 698 /* 0x62 */ { NULL, NULL, 0 },
 699 /* 0x63 */ { NULL, NULL, 0 },
 700 /* 0x64 */ { NULL, NULL, 0 },
 701 /* 0x65 */ { NULL, NULL, 0 },
 702 /* 0x66 */ { NULL, NULL, 0 },
 703 /* 0x67 */ { NULL, NULL, 0 },
 704 /* 0x68 */ { NULL, NULL, 0 },
 705 /* 0x69 */ { NULL, NULL, 0 },
 706 /* 0x6a */ { NULL, NULL, 0 },
 707 /* 0x6b */ { NULL, NULL, 0 },
 708 /* 0x6c */ { NULL, NULL, 0 },
 709 /* 0x6d */ { NULL, NULL, 0 },
 710 /* 0x6e */ { NULL, NULL, 0 },
 711 /* 0x6f */ { NULL, NULL, 0 },
 712 /* 0x70 */ { "SMBtcon",reply_tcon,0},
 713 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
 714 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
 715 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
 716 /* 0x74 */ { "SMBulogoffX", reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
 717 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
 718 /* 0x76 */ { NULL, NULL, 0 },
 719 /* 0x77 */ { NULL, NULL, 0 },
 720 /* 0x78 */ { NULL, NULL, 0 },
 721 /* 0x79 */ { NULL, NULL, 0 },
 722 /* 0x7a */ { NULL, NULL, 0 },
 723 /* 0x7b */ { NULL, NULL, 0 },
 724 /* 0x7c */ { NULL, NULL, 0 },
 725 /* 0x7d */ { NULL, NULL, 0 },
 726 /* 0x7e */ { NULL, NULL, 0 },
 727 /* 0x7f */ { NULL, NULL, 0 },
 728 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
 729 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
 730 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
 731 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
 732 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
 733 /* 0x85 */ { NULL, NULL, 0 },
 734 /* 0x86 */ { NULL, NULL, 0 },
 735 /* 0x87 */ { NULL, NULL, 0 },
 736 /* 0x88 */ { NULL, NULL, 0 },
 737 /* 0x89 */ { NULL, NULL, 0 },
 738 /* 0x8a */ { NULL, NULL, 0 },
 739 /* 0x8b */ { NULL, NULL, 0 },
 740 /* 0x8c */ { NULL, NULL, 0 },
 741 /* 0x8d */ { NULL, NULL, 0 },
 742 /* 0x8e */ { NULL, NULL, 0 },
 743 /* 0x8f */ { NULL, NULL, 0 },
 744 /* 0x90 */ { NULL, NULL, 0 },
 745 /* 0x91 */ { NULL, NULL, 0 },
 746 /* 0x92 */ { NULL, NULL, 0 },
 747 /* 0x93 */ { NULL, NULL, 0 },
 748 /* 0x94 */ { NULL, NULL, 0 },
 749 /* 0x95 */ { NULL, NULL, 0 },
 750 /* 0x96 */ { NULL, NULL, 0 },
 751 /* 0x97 */ { NULL, NULL, 0 },
 752 /* 0x98 */ { NULL, NULL, 0 },
 753 /* 0x99 */ { NULL, NULL, 0 },
 754 /* 0x9a */ { NULL, NULL, 0 },
 755 /* 0x9b */ { NULL, NULL, 0 },
 756 /* 0x9c */ { NULL, NULL, 0 },
 757 /* 0x9d */ { NULL, NULL, 0 },
 758 /* 0x9e */ { NULL, NULL, 0 },
 759 /* 0x9f */ { NULL, NULL, 0 },
 760 /* 0xa0 */ { "SMBnttrans", reply_nttrans, AS_USER | CAN_IPC },
 761 /* 0xa1 */ { "SMBnttranss", reply_nttranss, AS_USER | CAN_IPC },
 762 /* 0xa2 */ { "SMBntcreateX", reply_ntcreate_and_X, AS_USER | CAN_IPC },
 763 /* 0xa3 */ { NULL, NULL, 0 },
 764 /* 0xa4 */ { "SMBntcancel", reply_ntcancel, 0 },
 765 /* 0xa5 */ { "SMBntrename", reply_ntrename, AS_USER | NEED_WRITE },
 766 /* 0xa6 */ { NULL, NULL, 0 },
 767 /* 0xa7 */ { NULL, NULL, 0 },
 768 /* 0xa8 */ { NULL, NULL, 0 },
 769 /* 0xa9 */ { NULL, NULL, 0 },
 770 /* 0xaa */ { NULL, NULL, 0 },
 771 /* 0xab */ { NULL, NULL, 0 },
 772 /* 0xac */ { NULL, NULL, 0 },
 773 /* 0xad */ { NULL, NULL, 0 },
 774 /* 0xae */ { NULL, NULL, 0 },
 775 /* 0xaf */ { NULL, NULL, 0 },
 776 /* 0xb0 */ { NULL, NULL, 0 },
 777 /* 0xb1 */ { NULL, NULL, 0 },
 778 /* 0xb2 */ { NULL, NULL, 0 },
 779 /* 0xb3 */ { NULL, NULL, 0 },
 780 /* 0xb4 */ { NULL, NULL, 0 },
 781 /* 0xb5 */ { NULL, NULL, 0 },
 782 /* 0xb6 */ { NULL, NULL, 0 },
 783 /* 0xb7 */ { NULL, NULL, 0 },
 784 /* 0xb8 */ { NULL, NULL, 0 },
 785 /* 0xb9 */ { NULL, NULL, 0 },
 786 /* 0xba */ { NULL, NULL, 0 },
 787 /* 0xbb */ { NULL, NULL, 0 },
 788 /* 0xbc */ { NULL, NULL, 0 },
 789 /* 0xbd */ { NULL, NULL, 0 },
 790 /* 0xbe */ { NULL, NULL, 0 },
 791 /* 0xbf */ { NULL, NULL, 0 },
 792 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
 793 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
 794 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
 795 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
 796 /* 0xc4 */ { NULL, NULL, 0 },
 797 /* 0xc5 */ { NULL, NULL, 0 },
 798 /* 0xc6 */ { NULL, NULL, 0 },
 799 /* 0xc7 */ { NULL, NULL, 0 },
 800 /* 0xc8 */ { NULL, NULL, 0 },
 801 /* 0xc9 */ { NULL, NULL, 0 },
 802 /* 0xca */ { NULL, NULL, 0 },
 803 /* 0xcb */ { NULL, NULL, 0 },
 804 /* 0xcc */ { NULL, NULL, 0 },
 805 /* 0xcd */ { NULL, NULL, 0 },
 806 /* 0xce */ { NULL, NULL, 0 },
 807 /* 0xcf */ { NULL, NULL, 0 },
 808 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
 809 /* 0xd1 */ { "SMBsendb",NULL,AS_GUEST},
 810 /* 0xd2 */ { "SMBfwdname",NULL,AS_GUEST},
 811 /* 0xd3 */ { "SMBcancelf",NULL,AS_GUEST},
 812 /* 0xd4 */ { "SMBgetmac",NULL,AS_GUEST},
 813 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
 814 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
 815 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
 816 /* 0xd8 */ { NULL, NULL, 0 },
 817 /* 0xd9 */ { NULL, NULL, 0 },
 818 /* 0xda */ { NULL, NULL, 0 },
 819 /* 0xdb */ { NULL, NULL, 0 },
 820 /* 0xdc */ { NULL, NULL, 0 },
 821 /* 0xdd */ { NULL, NULL, 0 },
 822 /* 0xde */ { NULL, NULL, 0 },
 823 /* 0xdf */ { NULL, NULL, 0 },
 824 /* 0xe0 */ { NULL, NULL, 0 },
 825 /* 0xe1 */ { NULL, NULL, 0 },
 826 /* 0xe2 */ { NULL, NULL, 0 },
 827 /* 0xe3 */ { NULL, NULL, 0 },
 828 /* 0xe4 */ { NULL, NULL, 0 },
 829 /* 0xe5 */ { NULL, NULL, 0 },
 830 /* 0xe6 */ { NULL, NULL, 0 },
 831 /* 0xe7 */ { NULL, NULL, 0 },
 832 /* 0xe8 */ { NULL, NULL, 0 },
 833 /* 0xe9 */ { NULL, NULL, 0 },
 834 /* 0xea */ { NULL, NULL, 0 },
 835 /* 0xeb */ { NULL, NULL, 0 },
 836 /* 0xec */ { NULL, NULL, 0 },
 837 /* 0xed */ { NULL, NULL, 0 },
 838 /* 0xee */ { NULL, NULL, 0 },
 839 /* 0xef */ { NULL, NULL, 0 },
 840 /* 0xf0 */ { NULL, NULL, 0 },
 841 /* 0xf1 */ { NULL, NULL, 0 },
 842 /* 0xf2 */ { NULL, NULL, 0 },
 843 /* 0xf3 */ { NULL, NULL, 0 },
 844 /* 0xf4 */ { NULL, NULL, 0 },
 845 /* 0xf5 */ { NULL, NULL, 0 },
 846 /* 0xf6 */ { NULL, NULL, 0 },
 847 /* 0xf7 */ { NULL, NULL, 0 },
 848 /* 0xf8 */ { NULL, NULL, 0 },
 849 /* 0xf9 */ { NULL, NULL, 0 },
 850 /* 0xfa */ { NULL, NULL, 0 },
 851 /* 0xfb */ { NULL, NULL, 0 },
 852 /* 0xfc */ { NULL, NULL, 0 },
 853 /* 0xfd */ { NULL, NULL, 0 },
 854 /* 0xfe */ { NULL, NULL, 0 },
 855 /* 0xff */ { NULL, NULL, 0 }
 856
 857 };
 858
 859 /*******************************************************************
 860  Dump a packet to a file.
 861 ********************************************************************/
 862
 863 static void smb_dump(const char *name, int type, char *data, ssize_t len)
 864 {
 865         int fd, i;
 866         pstring fname;
 867         if (DEBUGLEVEL < 50) return;
 868
 869         if (len < 4) len = smb_len(data)+4;
 870         for (i=1;i<100;i++) {
 871                 slprintf(fname,sizeof(fname)-1, "/tmp/%s.%d.%s", name, i,
 872                                 type ? "req" : "resp");
 873                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
 874                 if (fd != -1 || errno != EEXIST) break;
 875         }
 876         if (fd != -1) {
 877                 ssize_t ret = write(fd, data, len);
 878                 if (ret != len)
 879                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
 880                 close(fd);
 881                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
 882         }
 883 }
 884
 885
 886 /****************************************************************************
 887  Do a switch on the message type, and return the response size
 888 ****************************************************************************/
 889
 890 static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize)
 891 {
 892         static pid_t pid= (pid_t)-1;
 893         int outsize = 0;
 894
 895         type &= 0xff;
 896
 897         if (pid == (pid_t)-1)
 898                 pid = sys_getpid();
 899
 900         errno = 0;
 901
 902         last_message = type;
 903
 904         /* Make sure this is an SMB packet. smb_size contains NetBIOS header so subtract 4 from it. */
 905         if ((strncmp(smb_base(inbuf),"\377SMB",4) != 0) || (size < (smb_size - 4))) {
 906                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",smb_len(inbuf)));
 907                 exit_server_cleanly("Non-SMB packet");
 908                 return(-1);
 909         }
 910
 911         /* yuck! this is an interim measure before we get rid of our
 912                 current inbuf/outbuf system */
 913         global_smbpid = SVAL(inbuf,smb_pid);
 914
 915         if (smb_messages[type].fn == NULL) {
 916                 DEBUG(0,("Unknown message type %d!\n",type));
 917                 smb_dump("Unknown", 1, inbuf, size);
 918                 outsize = reply_unknown(inbuf,outbuf);
 919         } else {
 920                 int flags = smb_messages[type].flags;
 921                 static uint16 last_session_tag = UID_FIELD_INVALID;
 922                 /* In share mode security we must ignore the vuid. */
 923                 uint16 session_tag = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : SVAL(inbuf,smb_uid);
 924                 connection_struct *conn = conn_find(SVAL(inbuf,smb_tid));
 925
 926                 DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n",smb_fn_name(type),(int)pid,(unsigned long)conn));
 927
 928                 smb_dump(smb_fn_name(type), 1, inbuf, size);
 929
 930                 /* Ensure this value is replaced in the incoming packet. */
 931                 SSVAL(inbuf,smb_uid,session_tag);
 932
 933                 /*
 934                  * Ensure the correct username is in current_user_info.
 935                  * This is a really ugly bugfix for problems with
 936                  * multiple session_setup_and_X's being done and
 937                  * allowing %U and %G substitutions to work correctly.
 938                  * There is a reason this code is done here, don't
 939                  * move it unless you know what you're doing... :-).
 940                  * JRA.
 941                  */
 942
 943                 if (session_tag != last_session_tag) {
 944                         user_struct *vuser = NULL;
 945
 946                         last_session_tag = session_tag;
 947                         if(session_tag != UID_FIELD_INVALID) {
 948                                 vuser = get_valid_user_struct(session_tag);
 949                                 if (vuser) {
 950                                         set_current_user_info(&vuser->user);
 951                                 }
 952                         }
 953                 }
 954
 955                 /* Does this call need to be run as the connected user? */
 956                 if (flags & AS_USER) {
 957
 958                         /* Does this call need a valid tree connection? */
 959                         if (!conn) {
 960                                 /* Amazingly, the error code depends on the command (from Samba4). */
 961                                 if (type == SMBntcreateX) {
 962                                         return ERROR_NT(NT_STATUS_INVALID_HANDLE);
 963                                 } else {
 964                                         return ERROR_DOS(ERRSRV, ERRinvnid);
 965                                 }
 966                         }
 967
 968                         if (!change_to_user(conn,session_tag)) {
 969                                 return(ERROR_NT(NT_STATUS_DOS(ERRSRV,ERRbaduid)));
 970                         }
 971
 972                         /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
 973
 974                         /* Does it need write permission? */
 975                         if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
 976                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 977                         }
 978
 979                         /* IPC services are limited */
 980                         if (IS_IPC(conn) && !(flags & CAN_IPC)) {
 981                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 982                         }
 983                 } else {
 984                         /* This call needs to be run as root */
 985                         change_to_root_user();
 986                 }
 987
 988                 /* load service specific parameters */
 989                 if (conn) {
 990                         if (!set_current_service(conn,SVAL(inbuf,smb_flg),(flags & (AS_USER|DO_CHDIR)?True:False))) {
 991                                 return(ERROR_DOS(ERRSRV,ERRaccess));
 992                         }
 993                         conn->num_smb_operations++;
 994                 }
 995
 996                 /* does this protocol need to be run as guest? */
 997                 if ((flags & AS_GUEST) && (!change_to_guest() ||
 998                                 !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1)))) {
 999                         return(ERROR_DOS(ERRSRV,ERRaccess));
1000                 }
1001
1002                 current_inbuf = inbuf; /* In case we need to defer this message in open... */
1003                 outsize = smb_messages[type].fn(conn, inbuf,outbuf,size,bufsize);
1004         }
1005
1006         smb_dump(smb_fn_name(type), 0, outbuf, outsize);
1007
1008         return(outsize);
1009 }
1010
1011 /****************************************************************************
1012  Construct a reply to the incoming packet.
1013 ****************************************************************************/
1014
1015 static int construct_reply(char *inbuf,char *outbuf,int size,int bufsize)
1016 {
1017         int type = CVAL(inbuf,smb_com);
1018         int outsize = 0;
1019         int msg_type = CVAL(inbuf,0);
1020
1021         chain_size = 0;
1022         file_chain_reset();
1023         reset_chain_p();
1024
1025         if (msg_type != 0)
1026                 return(reply_special(inbuf,outbuf));
1027
1028         construct_reply_common(inbuf, outbuf);
1029
1030         outsize = switch_message(type,inbuf,outbuf,size,bufsize);
1031
1032         outsize += chain_size;
1033
1034         if(outsize > 4)
1035                 smb_setlen(outbuf,outsize - 4);
1036         return(outsize);
1037 }
1038
1039 /****************************************************************************
1040  Process an smb from the client
1041 ****************************************************************************/
1042
1043 static void process_smb(char *inbuf, char *outbuf)
1044 {
1045         static int trans_num;
1046         int msg_type = CVAL(inbuf,0);
1047         int32 len = smb_len(inbuf);
1048         int nread = len + 4;
1049
1050         DO_PROFILE_INC(smb_count);
1051
1052         if (trans_num == 0) {
1053                 /* on the first packet, check the global hosts allow/ hosts
1054                 deny parameters before doing any parsing of the packet
1055                 passed to us by the client.  This prevents attacks on our
1056                 parsing code from hosts not in the hosts allow list */
1057                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1058                                   lp_hostsdeny(-1))) {
1059                         /* send a negative session response "not listening on calling name" */
1060                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1061                         DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) );
1062                         (void)send_smb(smbd_server_fd(),(char *)buf);
1063                         exit_server_cleanly("connection denied");
1064                 }
1065         }
1066
1067         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) );
1068         DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) );
1069
1070         if (msg_type == 0)
1071                 show_msg(inbuf);
1072         else if(msg_type == SMBkeepalive)
1073                 return; /* Keepalive packet. */
1074
1075         nread = construct_reply(inbuf,outbuf,nread,max_send);
1076
1077         if(nread > 0) {
1078                 if (CVAL(outbuf,0) == 0)
1079                         show_msg(outbuf);
1080
1081                 if (nread != smb_len(outbuf) + 4) {
1082                         DEBUG(0,("ERROR: Invalid message response size! %d %d\n",
1083                                 nread, smb_len(outbuf)));
1084                 } else if (!send_smb(smbd_server_fd(),outbuf)) {
1085                         exit_server_cleanly("process_smb: send_smb failed.");
1086                 }
1087         }
1088         trans_num++;
1089 }
1090
1091 /****************************************************************************
1092  Return a string containing the function name of a SMB command.
1093 ****************************************************************************/
1094
1095 const char *smb_fn_name(int type)
1096 {
1097         const char *unknown_name = "SMBunknown";
1098
1099         if (smb_messages[type].name == NULL)
1100                 return(unknown_name);
1101
1102         return(smb_messages[type].name);
1103 }
1104
1105 /****************************************************************************
1106  Helper functions for contruct_reply.
1107 ****************************************************************************/
1108
1109 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1110
1111 void add_to_common_flags2(uint32 v)
1112 {
1113         common_flags2 |= v;
1114 }
1115
1116 void remove_from_common_flags2(uint32 v)
1117 {
1118         common_flags2 &= ~v;
1119 }
1120
1121 void construct_reply_common(const char *inbuf, char *outbuf)
1122 {
1123         set_message(outbuf,0,0,False);
1124
1125         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1126         SIVAL(outbuf,smb_rcls,0);
1127         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1128         SSVAL(outbuf,smb_flg2,
1129                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1130                 common_flags2);
1131         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1132
1133         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1134         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1135         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1136         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1137 }
1138
1139 /****************************************************************************
1140  Construct a chained reply and add it to the already made reply
1141 ****************************************************************************/
1142
1143 int chain_reply(char *inbuf,char *outbuf,int size,int bufsize)
1144 {
1145         static char *orig_inbuf;
1146         static char *orig_outbuf;
1147         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1148         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1149         char *inbuf2, *outbuf2;
1150         int outsize2;
1151         char inbuf_saved[smb_wct];
1152         char outbuf_saved[smb_wct];
1153         int outsize = smb_len(outbuf) + 4;
1154
1155         /* maybe its not chained */
1156         if (smb_com2 == 0xFF) {
1157                 SCVAL(outbuf,smb_vwv0,0xFF);
1158                 return outsize;
1159         }
1160
1161         if (chain_size == 0) {
1162                 /* this is the first part of the chain */
1163                 orig_inbuf = inbuf;
1164                 orig_outbuf = outbuf;
1165         }
1166
1167         /*
1168          * The original Win95 redirector dies on a reply to
1169          * a lockingX and read chain unless the chain reply is
1170          * 4 byte aligned. JRA.
1171          */
1172
1173         outsize = (outsize + 3) & ~3;
1174
1175         /* we need to tell the client where the next part of the reply will be */
1176         SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf));
1177         SCVAL(outbuf,smb_vwv0,smb_com2);
1178
1179         /* remember how much the caller added to the chain, only counting stuff
1180                 after the parameter words */
1181         chain_size += outsize - smb_wct;
1182
1183         /* work out pointers into the original packets. The
1184                 headers on these need to be filled in */
1185         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1186         outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct;
1187
1188         /* remember the original command type */
1189         smb_com1 = CVAL(orig_inbuf,smb_com);
1190
1191         /* save the data which will be overwritten by the new headers */
1192         memcpy(inbuf_saved,inbuf2,smb_wct);
1193         memcpy(outbuf_saved,outbuf2,smb_wct);
1194
1195         /* give the new packet the same header as the last part of the SMB */
1196         memmove(inbuf2,inbuf,smb_wct);
1197
1198         /* create the in buffer */
1199         SCVAL(inbuf2,smb_com,smb_com2);
1200
1201         /* create the out buffer */
1202         construct_reply_common(inbuf2, outbuf2);
1203
1204         DEBUG(3,("Chained message\n"));
1205         show_msg(inbuf2);
1206
1207         /* process the request */
1208         outsize2 = switch_message(smb_com2,inbuf2,outbuf2,size-chain_size,
1209                                 bufsize-chain_size);
1210
1211         /* copy the new reply and request headers over the old ones, but
1212                 preserve the smb_com field */
1213         memmove(orig_outbuf,outbuf2,smb_wct);
1214         SCVAL(orig_outbuf,smb_com,smb_com1);
1215
1216         /* restore the saved data, being careful not to overwrite any
1217                 data from the reply header */
1218         memcpy(inbuf2,inbuf_saved,smb_wct);
1219
1220         {
1221                 int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf);
1222                 if (ofs < 0) ofs = 0;
1223                         memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs);
1224         }
1225
1226         return outsize2;
1227 }
1228
1229 /****************************************************************************
1230  Setup the needed select timeout in milliseconds.
1231 ****************************************************************************/
1232
1233 static int setup_select_timeout(void)
1234 {
1235         int select_timeout;
1236
1237         select_timeout = blocking_locks_timeout_ms(SMBD_SELECT_TIMEOUT*1000);
1238
1239         if (print_notify_messages_pending()) {
1240                 select_timeout = MIN(select_timeout, 1000);
1241         }
1242
1243         return select_timeout;
1244 }
1245
1246 /****************************************************************************
1247  Check if services need reloading.
1248 ****************************************************************************/
1249
1250 void check_reload(time_t t)
1251 {
1252         static pid_t mypid = 0;
1253         static time_t last_smb_conf_reload_time = 0;
1254         static time_t last_printer_reload_time = 0;
1255         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1256
1257         if(last_smb_conf_reload_time == 0) {
1258                 last_smb_conf_reload_time = t;
1259                 /* Our printing subsystem might not be ready at smbd start up.
1260                    Then no printer is available till the first printers check
1261                    is performed.  A lower initial interval circumvents this. */
1262                 if ( printcap_cache_time > 60 )
1263                         last_printer_reload_time = t - printcap_cache_time + 60;
1264                 else
1265                         last_printer_reload_time = t;
1266         }
1267
1268         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1269                 /* randomize over 60 second the printcap reload to avoid all
1270                  * process hitting cupsd at the same time */
1271                 int time_range = 60;
1272
1273                 last_printer_reload_time += random() % time_range;
1274                 mypid = getpid();
1275         }
1276
1277         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1278                 reload_services(True);
1279                 reload_after_sighup = False;
1280                 last_smb_conf_reload_time = t;
1281         }
1282
1283         /* 'printcap cache time = 0' disable the feature */
1284
1285         if ( printcap_cache_time != 0 )
1286         {
1287                 /* see if it's time to reload or if the clock has been set back */
1288
1289                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1290                         || (t-last_printer_reload_time  < 0) )
1291                 {
1292                         DEBUG( 3,( "Printcap cache time expired.\n"));
1293                         reload_printers();
1294                         last_printer_reload_time = t;
1295                 }
1296         }
1297 }
1298
1299 /****************************************************************************
1300  Process any timeout housekeeping. Return False if the caller should exit.
1301 ****************************************************************************/
1302
1303 static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time)
1304 {
1305         static time_t last_keepalive_sent_time = 0;
1306         static time_t last_idle_closed_check = 0;
1307         time_t t;
1308         BOOL allidle = True;
1309
1310         if (smb_read_error == READ_EOF) {
1311                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1312                 return False;
1313         }
1314
1315         if (smb_read_error == READ_ERROR) {
1316                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1317                         strerror(errno)));
1318                 return False;
1319         }
1320
1321         if (smb_read_error == READ_BAD_SIG) {
1322                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1323                 return False;
1324         }
1325
1326         *last_timeout_processing_time = t = time(NULL);
1327
1328         if(last_keepalive_sent_time == 0)
1329                 last_keepalive_sent_time = t;
1330
1331         if(last_idle_closed_check == 0)
1332                 last_idle_closed_check = t;
1333
1334         /* become root again if waiting */
1335         change_to_root_user();
1336
1337         /* run all registered idle events */
1338         smb_run_idle_events(t);
1339
1340         /* check if we need to reload services */
1341         check_reload(t);
1342
1343         /* automatic timeout if all connections are closed */
1344         if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) {
1345                 DEBUG( 2, ( "Closing idle connection\n" ) );
1346                 return False;
1347         } else {
1348                 last_idle_closed_check = t;
1349         }
1350
1351         if (keepalive && (t - last_keepalive_sent_time)>keepalive) {
1352                 if (!send_keepalive(smbd_server_fd())) {
1353                         DEBUG( 2, ( "Keepalive failed - exiting.\n" ) );
1354                         return False;
1355                 }
1356
1357                 /* send a keepalive for a password server or the like.
1358                         This is attached to the auth_info created in the
1359                 negprot */
1360                 if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method
1361                                 && negprot_global_auth_context->challenge_set_method->send_keepalive) {
1362
1363                         negprot_global_auth_context->challenge_set_method->send_keepalive
1364                         (&negprot_global_auth_context->challenge_set_method->private_data);
1365                 }
1366
1367                 last_keepalive_sent_time = t;
1368         }
1369
1370         /* check for connection timeouts */
1371         allidle = conn_idle_all(t, deadtime);
1372
1373         if (allidle && conn_num_open()>0) {
1374                 DEBUG(2,("Closing idle connection 2.\n"));
1375                 return False;
1376         }
1377
1378         if(global_machine_password_needs_changing &&
1379                         /* for ADS we need to do a regular ADS password change, not a domain
1380                                         password change */
1381                         lp_security() == SEC_DOMAIN) {
1382
1383                 unsigned char trust_passwd_hash[16];
1384                 time_t lct;
1385
1386                 /*
1387                  * We're in domain level security, and the code that
1388                  * read the machine password flagged that the machine
1389                  * password needs changing.
1390                  */
1391
1392                 /*
1393                  * First, open the machine password file with an exclusive lock.
1394                  */
1395
1396                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1397                         DEBUG(0,("process: unable to lock the machine account password for \
1398 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1399                         return True;
1400                 }
1401
1402                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1403                         DEBUG(0,("process: unable to read the machine account password for \
1404 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1405                         secrets_lock_trust_account_password(lp_workgroup(), False);
1406                         return True;
1407                 }
1408
1409                 /*
1410                  * Make sure someone else hasn't already done this.
1411                  */
1412
1413                 if(t < lct + lp_machine_password_timeout()) {
1414                         global_machine_password_needs_changing = False;
1415                         secrets_lock_trust_account_password(lp_workgroup(), False);
1416                         return True;
1417                 }
1418
1419                 /* always just contact the PDC here */
1420
1421                 change_trust_account_password( lp_workgroup(), NULL);
1422                 global_machine_password_needs_changing = False;
1423                 secrets_lock_trust_account_password(lp_workgroup(), False);
1424         }
1425
1426         /*
1427          * Check to see if we have any blocking locks
1428          * outstanding on the queue.
1429          */
1430         process_blocking_lock_queue();
1431
1432         /* update printer queue caches if necessary */
1433
1434         update_monitored_printq_cache();
1435
1436         /*
1437          * Now we are root, check if the log files need pruning.
1438          * Force a log file check.
1439          */
1440         force_check_log_size();
1441         check_log_size();
1442
1443         /* Send any queued printer notify message to interested smbd's. */
1444
1445         print_notify_send_messages(0);
1446
1447         /*
1448          * Modify the select timeout depending upon
1449          * what we have remaining in our queues.
1450          */
1451
1452         *select_timeout = setup_select_timeout();
1453
1454         return True;
1455 }
1456
1457 /****************************************************************************
1458  Accessor functions for InBuffer, OutBuffer.
1459 ****************************************************************************/
1460
1461 char *get_InBuffer(void)
1462 {
1463         return InBuffer;
1464 }
1465
1466 void set_InBuffer(char *new_inbuf)
1467 {
1468         InBuffer = new_inbuf;
1469         current_inbuf = InBuffer;
1470 }
1471
1472 char *get_OutBuffer(void)
1473 {
1474         return OutBuffer;
1475 }
1476
1477 void set_OutBuffer(char *new_outbuf)
1478 {
1479         OutBuffer = new_outbuf;
1480 }
1481
1482 /****************************************************************************
1483  Free an InBuffer. Checks if not in use by aio system.
1484  Must have been allocated by NewInBuffer.
1485 ****************************************************************************/
1486
1487 void free_InBuffer(char *inbuf)
1488 {
1489         if (!aio_inbuffer_in_use(inbuf)) {
1490                 if (current_inbuf == inbuf) {
1491                         current_inbuf = NULL;
1492                 }
1493                 SAFE_FREE(inbuf);
1494         }
1495 }
1496
1497 /****************************************************************************
1498  Free an OutBuffer. No outbuffers currently stolen by aio system.
1499  Must have been allocated by NewInBuffer.
1500 ****************************************************************************/
1501
1502 void free_OutBuffer(char *outbuf)
1503 {
1504         SAFE_FREE(outbuf);
1505 }
1506
1507 const int total_buffer_size = (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE + SAFETY_MARGIN);
1508
1509 /****************************************************************************
1510  Allocate a new InBuffer. Returns the new and old ones.
1511 ****************************************************************************/
1512
1513 char *NewInBuffer(char **old_inbuf)
1514 {
1515         char *new_inbuf = (char *)SMB_MALLOC(total_buffer_size);
1516         if (!new_inbuf) {
1517                 return NULL;
1518         }
1519         if (old_inbuf) {
1520                 *old_inbuf = InBuffer;
1521         }
1522         InBuffer = new_inbuf;
1523 #if defined(DEVELOPER)
1524         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1525 #endif
1526         return InBuffer;
1527 }
1528
1529 /****************************************************************************
1530  Allocate a new OutBuffer. Returns the new and old ones.
1531 ****************************************************************************/
1532
1533 char *NewOutBuffer(char **old_outbuf)
1534 {
1535         char *new_outbuf = (char *)SMB_MALLOC(total_buffer_size);
1536         if (!new_outbuf) {
1537                 return NULL;
1538         }
1539         if (old_outbuf) {
1540                 *old_outbuf = OutBuffer;
1541         }
1542         OutBuffer = new_outbuf;
1543 #if defined(DEVELOPER)
1544         clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1545 #endif
1546         return OutBuffer;
1547 }
1548
1549 /****************************************************************************
1550  Process commands from the client
1551 ****************************************************************************/
1552
1553 void smbd_process(void)
1554 {
1555         time_t last_timeout_processing_time = time(NULL);
1556         unsigned int num_smbs = 0;
1557
1558         /* Allocate the primary Inbut/Output buffers. */
1559
1560         if ((NewInBuffer(NULL) == NULL) || (NewOutBuffer(NULL) == NULL))
1561                 return;
1562
1563         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
1564
1565         while (True) {
1566                 int deadtime = lp_deadtime()*60;
1567                 int select_timeout = setup_select_timeout();
1568                 int num_echos;
1569
1570                 if (deadtime <= 0)
1571                         deadtime = DEFAULT_SMBD_TIMEOUT;
1572
1573                 errno = 0;
1574
1575                 /* free up temporary memory */
1576                 lp_TALLOC_FREE();
1577                 main_loop_TALLOC_FREE();
1578
1579                 /* Did someone ask for immediate checks on things like blocking locks ? */
1580                 if (select_timeout == 0) {
1581                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1582                                 return;
1583                         num_smbs = 0; /* Reset smb counter. */
1584                 }
1585
1586                 run_events(smbd_event_context(), 0, NULL, NULL);
1587
1588 #if defined(DEVELOPER)
1589                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size);
1590 #endif
1591
1592                 while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) {
1593                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1594                                 return;
1595                         num_smbs = 0; /* Reset smb counter. */
1596                 }
1597
1598                 /*
1599                  * Ensure we do timeout processing if the SMB we just got was
1600                  * only an echo request. This allows us to set the select
1601                  * timeout in 'receive_message_or_smb()' to any value we like
1602                  * without worrying that the client will send echo requests
1603                  * faster than the select timeout, thus starving out the
1604                  * essential processing (change notify, blocking locks) that
1605                  * the timeout code does. JRA.
1606                  */
1607                 num_echos = smb_echo_count;
1608
1609                 clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size);
1610
1611                 process_smb(InBuffer, OutBuffer);
1612
1613                 if (smb_echo_count != num_echos) {
1614                         if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1615                                 return;
1616                         num_smbs = 0; /* Reset smb counter. */
1617                 }
1618
1619                 num_smbs++;
1620
1621                 /*
1622                  * If we are getting smb requests in a constant stream
1623                  * with no echos, make sure we attempt timeout processing
1624                  * every select_timeout milliseconds - but only check for this
1625                  * every 200 smb requests.
1626                  */
1627
1628                 if ((num_smbs % 200) == 0) {
1629                         time_t new_check_time = time(NULL);
1630                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
1631                                 if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time))
1632                                         return;
1633                                 num_smbs = 0; /* Reset smb counter. */
1634                                 last_timeout_processing_time = new_check_time; /* Reset time. */
1635                         }
1636                 }
1637
1638                 /* The timeout_processing function isn't run nearly
1639                    often enough to implement 'max log size' without
1640                    overrunning the size of the file by many megabytes.
1641                    This is especially true if we are running at debug
1642                    level 10.  Checking every 50 SMBs is a nice
1643                    tradeoff of performance vs log file size overrun. */
1644
1645                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
1646                         change_to_root_user();
1647                         check_log_size();
1648                 }
1649         }
1650 }