source3/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern int smb_echo_count;
  24
  25 static enum smb_read_errors smb_read_error = SMB_READ_OK;
  26
  27 /*
  28  * Size of data we can send to client. Set
  29  *  by the client for all protocols above CORE.
  30  *  Set by us for CORE protocol.
  31  */
  32 int max_send = BUFFER_SIZE;
  33 /*
  34  * Size of the data we can receive. Set by us.
  35  * Can be modified by the max xmit parameter.
  36  */
  37 int max_recv = BUFFER_SIZE;
  38
  39 SIG_ATOMIC_T reload_after_sighup = 0;
  40 SIG_ATOMIC_T got_sig_term = 0;
  41 extern bool global_machine_password_needs_changing;
  42 extern int max_send;
  43
  44 /* Accessor function for smb_read_error for smbd functions. */
  45
  46 enum smb_read_errors *get_srv_read_error(void)
  47 {
  48         return &smb_read_error;
  49 }
  50
  51 /****************************************************************************
  52  Send an smb to a fd.
  53 ****************************************************************************/
  54
  55 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  56 {
  57         size_t len;
  58         size_t nwritten=0;
  59         ssize_t ret;
  60         char *buf_out = buffer;
  61
  62         /* Sign the outgoing packet if required. */
  63         srv_calculate_sign_mac(buf_out);
  64
  65         if (do_encrypt) {
  66                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  67                 if (!NT_STATUS_IS_OK(status)) {
  68                         DEBUG(0, ("send_smb: SMB encryption failed "
  69                                 "on outgoing packet! Error %s\n",
  70                                 nt_errstr(status) ));
  71                         return false;
  72                 }
  73         }
  74
  75         len = smb_len(buf_out) + 4;
  76
  77         while (nwritten < len) {
  78                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  79                 if (ret <= 0) {
  80                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  81                                 (int)len,(int)ret, strerror(errno) ));
  82                         srv_free_enc_buffer(buf_out);
  83                         return false;
  84                 }
  85                 nwritten += ret;
  86         }
  87
  88         srv_free_enc_buffer(buf_out);
  89         return true;
  90 }
  91
  92 /*******************************************************************
  93  Setup the word count and byte count for a smb message.
  94 ********************************************************************/
  95
  96 int srv_set_message(char *buf,
  97                         int num_words,
  98                         int num_bytes,
  99                         bool zero)
 100 {
 101         if (zero && (num_words || num_bytes)) {
 102                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 103         }
 104         SCVAL(buf,smb_wct,num_words);
 105         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 106         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 107         return (smb_size + num_words*2 + num_bytes);
 108 }
 109
 110 static bool valid_smb_header(const uint8_t *inbuf)
 111 {
 112         if (is_encrypted_packet(inbuf)) {
 113                 return true;
 114         }
 115         return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
 116 }
 117
 118 /* Socket functions for smbd packet processing. */
 119
 120 static bool valid_packet_size(size_t len)
 121 {
 122         /*
 123          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 124          * of header. Don't print the error if this fits.... JRA.
 125          */
 126
 127         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 128                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 129                                         (unsigned long)len));
 130                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
 131
 132                         /*
 133                          * Correct fix. smb_read_error may have already been
 134                          * set. Only set it here if not already set. Global
 135                          * variables still suck :-). JRA.
 136                          */
 137
 138                         cond_set_smb_read_error(get_srv_read_error(),
 139                                                 SMB_READ_ERROR);
 140                         return false;
 141                 }
 142         }
 143         return true;
 144 }
 145
 146 static ssize_t read_packet_remainder(int fd,
 147                                         char *buffer,
 148                                         unsigned int timeout,
 149                                         ssize_t len)
 150 {
 151         NTSTATUS status;
 152
 153         if (len <= 0) {
 154                 return len;
 155         }
 156
 157         set_smb_read_error(get_srv_read_error(), SMB_READ_OK);
 158
 159         status = read_socket_with_timeout_ntstatus(fd, buffer, len, len,
 160                                                    timeout, NULL);
 161
 162         if (NT_STATUS_IS_OK(status)) {
 163                 return len;
 164         }
 165
 166         if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 167                 set_smb_read_error(get_srv_read_error(), SMB_READ_EOF);
 168                 return -1;
 169         }
 170
 171         if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 172                 set_smb_read_error(get_srv_read_error(),
 173                                    SMB_READ_TIMEOUT);
 174                 return -1;
 175         }
 176
 177         set_smb_read_error(get_srv_read_error(), SMB_READ_ERROR);
 178         return -1;
 179 }
 180
 181 /****************************************************************************
 182  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 183 ****************************************************************************/
 184
 185 /*
 186  * Unfortunately, earlier versions of smbclient/libsmbclient
 187  * don't send this "standard" writeX header. I've fixed this
 188  * for 3.2 but we'll use the old method with earlier versions.
 189  * Windows and CIFSFS at least use this standard size. Not
 190  * sure about MacOSX.
 191  */
 192
 193 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 194                                 (2*14) + /* word count (including bcc) */ \
 195                                 1 /* pad byte */)
 196
 197 static ssize_t receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 198                                         const char lenbuf[4],
 199                                         int fd,
 200                                         char **buffer,
 201                                         unsigned int timeout,
 202                                         size_t *p_unread)
 203 {
 204         /* Size of a WRITEX call (+4 byte len). */
 205         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 206         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 207         ssize_t toread;
 208         ssize_t ret;
 209
 210         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 211
 212         ret = read_socket_with_timeout(fd, writeX_header + 4,
 213                                        STANDARD_WRITE_AND_X_HEADER_SIZE,
 214                                        STANDARD_WRITE_AND_X_HEADER_SIZE,
 215                                        timeout, get_srv_read_error());
 216
 217         if (ret != STANDARD_WRITE_AND_X_HEADER_SIZE) {
 218                 cond_set_smb_read_error(get_srv_read_error(),
 219                                         SMB_READ_ERROR);
 220                 return -1;
 221         }
 222
 223         /*
 224          * Ok - now try and see if this is a possible
 225          * valid writeX call.
 226          */
 227
 228         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 229                 /*
 230                  * If the data offset is beyond what
 231                  * we've read, drain the extra bytes.
 232                  */
 233                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 234                 ssize_t newlen;
 235
 236                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 237                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 238                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 239                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 240                                         " failed to drain pending bytes");
 241                         }
 242                 } else {
 243                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 244                 }
 245
 246                 /* Spoof down the length and null out the bcc. */
 247                 set_message_bcc(writeX_header, 0);
 248                 newlen = smb_len(writeX_header);
 249
 250                 /* Copy the header we've written. */
 251
 252                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 253                                 writeX_header,
 254                                 sizeof(writeX_header));
 255
 256                 if (*buffer == NULL) {
 257                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 258                                   (int)sizeof(writeX_header)));
 259                         cond_set_smb_read_error(get_srv_read_error(),
 260                                                 SMB_READ_ERROR);
 261                         return -1;
 262                 }
 263
 264                 /* Work out the remaining bytes. */
 265                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 266
 267                 return newlen + 4;
 268         }
 269
 270         if (!valid_packet_size(len)) {
 271                 return -1;
 272         }
 273
 274         /*
 275          * Not a valid writeX call. Just do the standard
 276          * talloc and return.
 277          */
 278
 279         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 280
 281         if (*buffer == NULL) {
 282                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 283                           (int)len+4));
 284                 cond_set_smb_read_error(get_srv_read_error(),
 285                                         SMB_READ_ERROR);
 286                 return -1;
 287         }
 288
 289         /* Copy in what we already read. */
 290         memcpy(*buffer,
 291                 writeX_header,
 292                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 293         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 294
 295         if(toread > 0) {
 296                 ret = read_packet_remainder(fd,
 297                         (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 298                                         timeout,
 299                                         toread);
 300                 if (ret != toread) {
 301                         return -1;
 302                 }
 303         }
 304
 305         return len + 4;
 306 }
 307
 308 static ssize_t receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 309                                         int fd,
 310                                         char **buffer,
 311                                         unsigned int timeout,
 312                                         size_t *p_unread)
 313 {
 314         char lenbuf[4];
 315         size_t len;
 316         ssize_t ret;
 317         int min_recv_size = lp_min_receive_file_size();
 318         NTSTATUS status;
 319
 320         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 321         *p_unread = 0;
 322
 323         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 324         if (!NT_STATUS_IS_OK(status)) {
 325                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 326
 327                 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 328                         set_smb_read_error(get_srv_read_error(), SMB_READ_EOF);
 329                         return -1;
 330                 }
 331
 332                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 333                         set_smb_read_error(get_srv_read_error(),
 334                                            SMB_READ_TIMEOUT);
 335                         return -1;
 336                 }
 337
 338                 set_smb_read_error(get_srv_read_error(), SMB_READ_ERROR);
 339                 return -1;
 340         }
 341
 342         if (CVAL(lenbuf,0) == 0 &&
 343                         min_recv_size &&
 344                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 345                         !srv_is_signing_active()) {
 346
 347                 return receive_smb_raw_talloc_partial_read(mem_ctx,
 348                                                         lenbuf,
 349                                                         fd,
 350                                                         buffer,
 351                                                         timeout,
 352                                                         p_unread);
 353         }
 354
 355         if (!valid_packet_size(len)) {
 356                 return -1;
 357         }
 358
 359         /*
 360          * The +4 here can't wrap, we've checked the length above already.
 361          */
 362
 363         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 364
 365         if (*buffer == NULL) {
 366                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 367                           (int)len+4));
 368                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 369                 return -1;
 370         }
 371
 372         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 373
 374         ret = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 375         if (ret != len) {
 376                 return -1;
 377         }
 378
 379         return len + 4;
 380 }
 381
 382 static ssize_t receive_smb_talloc(TALLOC_CTX *mem_ctx,
 383                                 int fd,
 384                                 char **buffer,
 385                                 unsigned int timeout,
 386                                 size_t *p_unread,
 387                                 bool *p_encrypted)
 388 {
 389         ssize_t len;
 390
 391         *p_encrypted = false;
 392
 393         len = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout, p_unread);
 394
 395         if (len < 0) {
 396                 return -1;
 397         }
 398
 399         if (is_encrypted_packet((uint8_t *)*buffer)) {
 400                 NTSTATUS status = srv_decrypt_buffer(*buffer);
 401                 if (!NT_STATUS_IS_OK(status)) {
 402                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 403                                 "incoming packet! Error %s\n",
 404                                 nt_errstr(status) ));
 405                         cond_set_smb_read_error(get_srv_read_error(),
 406                                         SMB_READ_BAD_DECRYPT);
 407                         return -1;
 408                 }
 409                 *p_encrypted = true;
 410         }
 411
 412         /* Check the incoming SMB signature. */
 413         if (!srv_check_sign_mac(*buffer, true)) {
 414                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 415                           "incoming packet!\n"));
 416                 cond_set_smb_read_error(get_srv_read_error(),SMB_READ_BAD_SIG);
 417                 return -1;
 418         }
 419
 420         return len;
 421 }
 422
 423 /*
 424  * Initialize a struct smb_request from an inbuf
 425  */
 426
 427 void init_smb_request(struct smb_request *req,
 428                         const uint8 *inbuf,
 429                         size_t unread_bytes,
 430                         bool encrypted)
 431 {
 432         size_t req_size = smb_len(inbuf) + 4;
 433         /* Ensure we have at least smb_size bytes. */
 434         if (req_size < smb_size) {
 435                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 436                         (unsigned int)req_size ));
 437                 exit_server_cleanly("Invalid SMB request");
 438         }
 439         req->flags2 = SVAL(inbuf, smb_flg2);
 440         req->smbpid = SVAL(inbuf, smb_pid);
 441         req->mid    = SVAL(inbuf, smb_mid);
 442         req->vuid   = SVAL(inbuf, smb_uid);
 443         req->tid    = SVAL(inbuf, smb_tid);
 444         req->wct    = CVAL(inbuf, smb_wct);
 445         req->unread_bytes = unread_bytes;
 446         req->encrypted = encrypted;
 447         req->conn = conn_find(req->tid);
 448
 449         /* Ensure we have at least wct words and 2 bytes of bcc. */
 450         if (smb_size + req->wct*2 > req_size) {
 451                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 452                         (unsigned int)req->wct,
 453                         (unsigned int)req_size));
 454                 exit_server_cleanly("Invalid SMB request");
 455         }
 456         /* Ensure bcc is correct. */
 457         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 458                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 459                         "(wct = %u, size %u)\n",
 460                         (unsigned int)smb_buflen(inbuf),
 461                         (unsigned int)req->wct,
 462                         (unsigned int)req_size));
 463                 exit_server_cleanly("Invalid SMB request");
 464         }
 465         req->inbuf  = inbuf;
 466         req->outbuf = NULL;
 467 }
 468
 469 /****************************************************************************
 470  structure to hold a linked list of queued messages.
 471  for processing.
 472 ****************************************************************************/
 473
 474 static struct pending_message_list *deferred_open_queue;
 475
 476 /****************************************************************************
 477  Function to push a message onto the tail of a linked list of smb messages ready
 478  for processing.
 479 ****************************************************************************/
 480
 481 static bool push_queued_message(struct smb_request *req,
 482                                 struct timeval request_time,
 483                                 struct timeval end_time,
 484                                 char *private_data, size_t private_len)
 485 {
 486         int msg_len = smb_len(req->inbuf) + 4;
 487         struct pending_message_list *msg;
 488
 489         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 490
 491         if(msg == NULL) {
 492                 DEBUG(0,("push_message: malloc fail (1)\n"));
 493                 return False;
 494         }
 495
 496         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 497         if(msg->buf.data == NULL) {
 498                 DEBUG(0,("push_message: malloc fail (2)\n"));
 499                 TALLOC_FREE(msg);
 500                 return False;
 501         }
 502
 503         msg->request_time = request_time;
 504         msg->end_time = end_time;
 505         msg->encrypted = req->encrypted;
 506
 507         if (private_data) {
 508                 msg->private_data = data_blob_talloc(msg, private_data,
 509                                                      private_len);
 510                 if (msg->private_data.data == NULL) {
 511                         DEBUG(0,("push_message: malloc fail (3)\n"));
 512                         TALLOC_FREE(msg);
 513                         return False;
 514                 }
 515         }
 516
 517         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 518
 519         DEBUG(10,("push_message: pushed message length %u on "
 520                   "deferred_open_queue\n", (unsigned int)msg_len));
 521
 522         return True;
 523 }
 524
 525 /****************************************************************************
 526  Function to delete a sharing violation open message by mid.
 527 ****************************************************************************/
 528
 529 void remove_deferred_open_smb_message(uint16 mid)
 530 {
 531         struct pending_message_list *pml;
 532
 533         for (pml = deferred_open_queue; pml; pml = pml->next) {
 534                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 535                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 536                                   "deleting mid %u len %u\n",
 537                                   (unsigned int)mid,
 538                                   (unsigned int)pml->buf.length ));
 539                         DLIST_REMOVE(deferred_open_queue, pml);
 540                         TALLOC_FREE(pml);
 541                         return;
 542                 }
 543         }
 544 }
 545
 546 /****************************************************************************
 547  Move a sharing violation open retry message to the front of the list and
 548  schedule it for immediate processing.
 549 ****************************************************************************/
 550
 551 void schedule_deferred_open_smb_message(uint16 mid)
 552 {
 553         struct pending_message_list *pml;
 554         int i = 0;
 555
 556         for (pml = deferred_open_queue; pml; pml = pml->next) {
 557                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 558                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 559                         (unsigned int)msg_mid ));
 560                 if (mid == msg_mid) {
 561                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 562                                 mid ));
 563                         pml->end_time.tv_sec = 0;
 564                         pml->end_time.tv_usec = 0;
 565                         DLIST_PROMOTE(deferred_open_queue, pml);
 566                         return;
 567                 }
 568         }
 569
 570         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 571                 mid ));
 572 }
 573
 574 /****************************************************************************
 575  Return true if this mid is on the deferred queue.
 576 ****************************************************************************/
 577
 578 bool open_was_deferred(uint16 mid)
 579 {
 580         struct pending_message_list *pml;
 581
 582         for (pml = deferred_open_queue; pml; pml = pml->next) {
 583                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 584                         return True;
 585                 }
 586         }
 587         return False;
 588 }
 589
 590 /****************************************************************************
 591  Return the message queued by this mid.
 592 ****************************************************************************/
 593
 594 struct pending_message_list *get_open_deferred_message(uint16 mid)
 595 {
 596         struct pending_message_list *pml;
 597
 598         for (pml = deferred_open_queue; pml; pml = pml->next) {
 599                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 600                         return pml;
 601                 }
 602         }
 603         return NULL;
 604 }
 605
 606 /****************************************************************************
 607  Function to push a deferred open smb message onto a linked list of local smb
 608  messages ready for processing.
 609 ****************************************************************************/
 610
 611 bool push_deferred_smb_message(struct smb_request *req,
 612                                struct timeval request_time,
 613                                struct timeval timeout,
 614                                char *private_data, size_t priv_len)
 615 {
 616         struct timeval end_time;
 617
 618         if (req->unread_bytes) {
 619                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 620                         "unread_bytes = %u\n",
 621                         (unsigned int)req->unread_bytes ));
 622                 smb_panic("push_deferred_smb_message: "
 623                         "logic error unread_bytes != 0" );
 624         }
 625
 626         end_time = timeval_sum(&request_time, &timeout);
 627
 628         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 629                   "timeout time [%u.%06u]\n",
 630                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 631                   (unsigned int)end_time.tv_sec,
 632                   (unsigned int)end_time.tv_usec));
 633
 634         return push_queued_message(req, request_time, end_time,
 635                                    private_data, priv_len);
 636 }
 637
 638 struct idle_event {
 639         struct timed_event *te;
 640         struct timeval interval;
 641         char *name;
 642         bool (*handler)(const struct timeval *now, void *private_data);
 643         void *private_data;
 644 };
 645
 646 static void idle_event_handler(struct event_context *ctx,
 647                                struct timed_event *te,
 648                                const struct timeval *now,
 649                                void *private_data)
 650 {
 651         struct idle_event *event =
 652                 talloc_get_type_abort(private_data, struct idle_event);
 653
 654         TALLOC_FREE(event->te);
 655
 656         if (!event->handler(now, event->private_data)) {
 657                 /* Don't repeat, delete ourselves */
 658                 TALLOC_FREE(event);
 659                 return;
 660         }
 661
 662         event->te = event_add_timed(ctx, event,
 663                                     timeval_sum(now, &event->interval),
 664                                     event->name,
 665                                     idle_event_handler, event);
 666
 667         /* We can't do much but fail here. */
 668         SMB_ASSERT(event->te != NULL);
 669 }
 670
 671 struct idle_event *event_add_idle(struct event_context *event_ctx,
 672                                   TALLOC_CTX *mem_ctx,
 673                                   struct timeval interval,
 674                                   const char *name,
 675                                   bool (*handler)(const struct timeval *now,
 676                                                   void *private_data),
 677                                   void *private_data)
 678 {
 679         struct idle_event *result;
 680         struct timeval now = timeval_current();
 681
 682         result = TALLOC_P(mem_ctx, struct idle_event);
 683         if (result == NULL) {
 684                 DEBUG(0, ("talloc failed\n"));
 685                 return NULL;
 686         }
 687
 688         result->interval = interval;
 689         result->handler = handler;
 690         result->private_data = private_data;
 691
 692         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 693                 DEBUG(0, ("talloc failed\n"));
 694                 TALLOC_FREE(result);
 695                 return NULL;
 696         }
 697
 698         result->te = event_add_timed(event_ctx, result,
 699                                      timeval_sum(&now, &interval),
 700                                      result->name,
 701                                      idle_event_handler, result);
 702         if (result->te == NULL) {
 703                 DEBUG(0, ("event_add_timed failed\n"));
 704                 TALLOC_FREE(result);
 705                 return NULL;
 706         }
 707
 708         return result;
 709 }
 710
 711 /****************************************************************************
 712  Do all async processing in here. This includes kernel oplock messages, change
 713  notify events etc.
 714 ****************************************************************************/
 715
 716 static void async_processing(fd_set *pfds)
 717 {
 718         DEBUG(10,("async_processing: Doing async processing.\n"));
 719
 720         process_aio_queue();
 721
 722         process_kernel_oplocks(smbd_messaging_context(), pfds);
 723
 724         /* Do the aio check again after receive_local_message as it does a
 725            select and may have eaten our signal. */
 726         /* Is this till true? -- vl */
 727         process_aio_queue();
 728
 729         if (got_sig_term) {
 730                 exit_server_cleanly("termination signal");
 731         }
 732
 733         /* check for sighup processing */
 734         if (reload_after_sighup) {
 735                 change_to_root_user();
 736                 DEBUG(1,("Reloading services after SIGHUP\n"));
 737                 reload_services(False);
 738                 reload_after_sighup = 0;
 739         }
 740 }
 741
 742 /****************************************************************************
 743  Add a fd to the set we will be select(2)ing on.
 744 ****************************************************************************/
 745
 746 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 747 {
 748         if (fd != -1) {
 749                 FD_SET(fd, fds);
 750                 maxfd = MAX(maxfd, fd);
 751         }
 752
 753         return maxfd;
 754 }
 755
 756 /****************************************************************************
 757   Do a select on an two fd's - with timeout.
 758
 759   If a local udp message has been pushed onto the
 760   queue (this can only happen during oplock break
 761   processing) call async_processing()
 762
 763   If a pending smb message has been pushed onto the
 764   queue (this can only happen during oplock break
 765   processing) return this next.
 766
 767   If the first smbfd is ready then read an smb from it.
 768   if the second (loopback UDP) fd is ready then read a message
 769   from it and setup the buffer header to identify the length
 770   and from address.
 771   Returns False on timeout or error.
 772   Else returns True.
 773
 774 The timeout is in milliseconds
 775 ****************************************************************************/
 776
 777 static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 778                                 char **buffer,
 779                                 size_t *buffer_len,
 780                                 int timeout,
 781                                 size_t *p_unread,
 782                                 bool *p_encrypted)
 783 {
 784         fd_set r_fds, w_fds;
 785         int selrtn;
 786         struct timeval to;
 787         int maxfd = 0;
 788         ssize_t len;
 789
 790         *p_unread = 0;
 791         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 792
 793  again:
 794
 795         if (timeout >= 0) {
 796                 to.tv_sec = timeout / 1000;
 797                 to.tv_usec = (timeout % 1000) * 1000;
 798         } else {
 799                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 800                 to.tv_usec = 0;
 801         }
 802
 803         /*
 804          * Note that this call must be before processing any SMB
 805          * messages as we need to synchronously process any messages
 806          * we may have sent to ourselves from the previous SMB.
 807          */
 808         message_dispatch(smbd_messaging_context());
 809
 810         /*
 811          * Check to see if we already have a message on the deferred open queue
 812          * and it's time to schedule.
 813          */
 814         if(deferred_open_queue != NULL) {
 815                 bool pop_message = False;
 816                 struct pending_message_list *msg = deferred_open_queue;
 817
 818                 if (timeval_is_zero(&msg->end_time)) {
 819                         pop_message = True;
 820                 } else {
 821                         struct timeval tv;
 822                         SMB_BIG_INT tdif;
 823
 824                         GetTimeOfDay(&tv);
 825                         tdif = usec_time_diff(&msg->end_time, &tv);
 826                         if (tdif <= 0) {
 827                                 /* Timed out. Schedule...*/
 828                                 pop_message = True;
 829                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 830                         } else {
 831                                 /* Make a more accurate select timeout. */
 832                                 to.tv_sec = tdif / 1000000;
 833                                 to.tv_usec = tdif % 1000000;
 834                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 835                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 836                         }
 837                 }
 838
 839                 if (pop_message) {
 840
 841                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 842                                                         msg->buf.length);
 843                         if (*buffer == NULL) {
 844                                 DEBUG(0, ("talloc failed\n"));
 845                                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 846                                 return False;
 847                         }
 848                         *buffer_len = msg->buf.length;
 849                         *p_encrypted = msg->encrypted;
 850
 851                         /* We leave this message on the queue so the open code can
 852                            know this is a retry. */
 853                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 854                         return True;
 855                 }
 856         }
 857
 858         /*
 859          * Setup the select fd sets.
 860          */
 861
 862         FD_ZERO(&r_fds);
 863         FD_ZERO(&w_fds);
 864
 865         /*
 866          * Ensure we process oplock break messages by preference.
 867          * We have to do this before the select, after the select
 868          * and if the select returns EINTR. This is due to the fact
 869          * that the selects called from async_processing can eat an EINTR
 870          * caused by a signal (we can't take the break message there).
 871          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 872          */
 873
 874         if (oplock_message_waiting(&r_fds)) {
 875                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 876                 async_processing(&r_fds);
 877                 /*
 878                  * After async processing we must go and do the select again, as
 879                  * the state of the flag in fds for the server file descriptor is
 880                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 881                  */
 882                 goto again;
 883         }
 884
 885         /*
 886          * Are there any timed events waiting ? If so, ensure we don't
 887          * select for longer than it would take to wait for them.
 888          */
 889
 890         {
 891                 struct timeval now;
 892                 GetTimeOfDay(&now);
 893
 894                 event_add_to_select_args(smbd_event_context(), &now,
 895                                          &r_fds, &w_fds, &to, &maxfd);
 896         }
 897
 898         if (timeval_is_zero(&to)) {
 899                 /* Process a timed event now... */
 900                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 901                         goto again;
 902                 }
 903         }
 904
 905         {
 906                 int sav;
 907                 START_PROFILE(smbd_idle);
 908
 909                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 910                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 911
 912                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 913                 sav = errno;
 914
 915                 END_PROFILE(smbd_idle);
 916                 errno = sav;
 917         }
 918
 919         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 920                 goto again;
 921         }
 922
 923         /* if we get EINTR then maybe we have received an oplock
 924            signal - treat this as select returning 1. This is ugly, but
 925            is the best we can do until the oplock code knows more about
 926            signals */
 927         if (selrtn == -1 && errno == EINTR) {
 928                 async_processing(&r_fds);
 929                 /*
 930                  * After async processing we must go and do the select again, as
 931                  * the state of the flag in fds for the server file descriptor is
 932                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 933                  */
 934                 goto again;
 935         }
 936
 937         /* Check if error */
 938         if (selrtn == -1) {
 939                 /* something is wrong. Maybe the socket is dead? */
 940                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 941                 return False;
 942         }
 943
 944         /* Did we timeout ? */
 945         if (selrtn == 0) {
 946                 set_smb_read_error(get_srv_read_error(),SMB_READ_TIMEOUT);
 947                 return False;
 948         }
 949
 950         /*
 951          * Ensure we process oplock break messages by preference.
 952          * This is IMPORTANT ! Otherwise we can starve other processes
 953          * sending us an oplock break message. JRA.
 954          */
 955
 956         if (oplock_message_waiting(&r_fds)) {
 957                 async_processing(&r_fds);
 958                 /*
 959                  * After async processing we must go and do the select again, as
 960                  * the state of the flag in fds for the server file descriptor is
 961                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 962                  */
 963                 goto again;
 964         }
 965
 966         len = receive_smb_talloc(mem_ctx, smbd_server_fd(),
 967                                 buffer, 0, p_unread, p_encrypted);
 968
 969         if (len == -1) {
 970                 return False;
 971         }
 972
 973         *buffer_len = (size_t)len;
 974
 975         return True;
 976 }
 977
 978 /*
 979  * Only allow 5 outstanding trans requests. We're allocating memory, so
 980  * prevent a DoS.
 981  */
 982
 983 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 984 {
 985         int count = 0;
 986         for (; list != NULL; list = list->next) {
 987
 988                 if (list->mid == mid) {
 989                         return NT_STATUS_INVALID_PARAMETER;
 990                 }
 991
 992                 count += 1;
 993         }
 994         if (count > 5) {
 995                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 996         }
 997
 998         return NT_STATUS_OK;
 999 }
1000
1001 /****************************************************************************
1002  We're terminating and have closed all our files/connections etc.
1003  If there are any pending local messages we need to respond to them
1004  before termination so that other smbds don't think we just died whilst
1005  holding oplocks.
1006 ****************************************************************************/
1007
1008 void respond_to_all_remaining_local_messages(void)
1009 {
1010         /*
1011          * Assert we have no exclusive open oplocks.
1012          */
1013
1014         if(get_number_of_exclusive_open_oplocks()) {
1015                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
1016                         get_number_of_exclusive_open_oplocks() ));
1017                 return;
1018         }
1019
1020         process_kernel_oplocks(smbd_messaging_context(), NULL);
1021
1022         return;
1023 }
1024
1025
1026 /*
1027 These flags determine some of the permissions required to do an operation
1028
1029 Note that I don't set NEED_WRITE on some write operations because they
1030 are used by some brain-dead clients when printing, and I don't want to
1031 force write permissions on print services.
1032 */
1033 #define AS_USER (1<<0)
1034 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
1035 #define TIME_INIT (1<<2)
1036 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
1037 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
1038 #define DO_CHDIR (1<<6)
1039
1040 /*
1041    define a list of possible SMB messages and their corresponding
1042    functions. Any message that has a NULL function is unimplemented -
1043    please feel free to contribute implementations!
1044 */
1045 static const struct smb_message_struct {
1046         const char *name;
1047         void (*fn_new)(struct smb_request *req);
1048         int flags;
1049 } smb_messages[256] = {
1050
1051 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1052 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1053 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1054 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1055 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1056 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1057 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1058 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1059 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1060 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1061 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1062 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1063 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1064 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1065 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1066 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1067 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1068 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1069 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1070 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1071 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1072 /* 0x15 */ { NULL, NULL, 0 },
1073 /* 0x16 */ { NULL, NULL, 0 },
1074 /* 0x17 */ { NULL, NULL, 0 },
1075 /* 0x18 */ { NULL, NULL, 0 },
1076 /* 0x19 */ { NULL, NULL, 0 },
1077 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1078 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1079 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1080 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1081 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1082 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1083 /* 0x20 */ { "SMBwritec", NULL,0},
1084 /* 0x21 */ { NULL, NULL, 0 },
1085 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1086 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1087 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1088 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1089 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1090 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1091 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1092 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1093 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1094 /* 0x2b */ { "SMBecho",reply_echo,0},
1095 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1096 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1097 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1098 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1099 /* 0x30 */ { NULL, NULL, 0 },
1100 /* 0x31 */ { NULL, NULL, 0 },
1101 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1102 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1103 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1104 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1105 /* 0x36 */ { NULL, NULL, 0 },
1106 /* 0x37 */ { NULL, NULL, 0 },
1107 /* 0x38 */ { NULL, NULL, 0 },
1108 /* 0x39 */ { NULL, NULL, 0 },
1109 /* 0x3a */ { NULL, NULL, 0 },
1110 /* 0x3b */ { NULL, NULL, 0 },
1111 /* 0x3c */ { NULL, NULL, 0 },
1112 /* 0x3d */ { NULL, NULL, 0 },
1113 /* 0x3e */ { NULL, NULL, 0 },
1114 /* 0x3f */ { NULL, NULL, 0 },
1115 /* 0x40 */ { NULL, NULL, 0 },
1116 /* 0x41 */ { NULL, NULL, 0 },
1117 /* 0x42 */ { NULL, NULL, 0 },
1118 /* 0x43 */ { NULL, NULL, 0 },
1119 /* 0x44 */ { NULL, NULL, 0 },
1120 /* 0x45 */ { NULL, NULL, 0 },
1121 /* 0x46 */ { NULL, NULL, 0 },
1122 /* 0x47 */ { NULL, NULL, 0 },
1123 /* 0x48 */ { NULL, NULL, 0 },
1124 /* 0x49 */ { NULL, NULL, 0 },
1125 /* 0x4a */ { NULL, NULL, 0 },
1126 /* 0x4b */ { NULL, NULL, 0 },
1127 /* 0x4c */ { NULL, NULL, 0 },
1128 /* 0x4d */ { NULL, NULL, 0 },
1129 /* 0x4e */ { NULL, NULL, 0 },
1130 /* 0x4f */ { NULL, NULL, 0 },
1131 /* 0x50 */ { NULL, NULL, 0 },
1132 /* 0x51 */ { NULL, NULL, 0 },
1133 /* 0x52 */ { NULL, NULL, 0 },
1134 /* 0x53 */ { NULL, NULL, 0 },
1135 /* 0x54 */ { NULL, NULL, 0 },
1136 /* 0x55 */ { NULL, NULL, 0 },
1137 /* 0x56 */ { NULL, NULL, 0 },
1138 /* 0x57 */ { NULL, NULL, 0 },
1139 /* 0x58 */ { NULL, NULL, 0 },
1140 /* 0x59 */ { NULL, NULL, 0 },
1141 /* 0x5a */ { NULL, NULL, 0 },
1142 /* 0x5b */ { NULL, NULL, 0 },
1143 /* 0x5c */ { NULL, NULL, 0 },
1144 /* 0x5d */ { NULL, NULL, 0 },
1145 /* 0x5e */ { NULL, NULL, 0 },
1146 /* 0x5f */ { NULL, NULL, 0 },
1147 /* 0x60 */ { NULL, NULL, 0 },
1148 /* 0x61 */ { NULL, NULL, 0 },
1149 /* 0x62 */ { NULL, NULL, 0 },
1150 /* 0x63 */ { NULL, NULL, 0 },
1151 /* 0x64 */ { NULL, NULL, 0 },
1152 /* 0x65 */ { NULL, NULL, 0 },
1153 /* 0x66 */ { NULL, NULL, 0 },
1154 /* 0x67 */ { NULL, NULL, 0 },
1155 /* 0x68 */ { NULL, NULL, 0 },
1156 /* 0x69 */ { NULL, NULL, 0 },
1157 /* 0x6a */ { NULL, NULL, 0 },
1158 /* 0x6b */ { NULL, NULL, 0 },
1159 /* 0x6c */ { NULL, NULL, 0 },
1160 /* 0x6d */ { NULL, NULL, 0 },
1161 /* 0x6e */ { NULL, NULL, 0 },
1162 /* 0x6f */ { NULL, NULL, 0 },
1163 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1164 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1165 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1166 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1167 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1168 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1169 /* 0x76 */ { NULL, NULL, 0 },
1170 /* 0x77 */ { NULL, NULL, 0 },
1171 /* 0x78 */ { NULL, NULL, 0 },
1172 /* 0x79 */ { NULL, NULL, 0 },
1173 /* 0x7a */ { NULL, NULL, 0 },
1174 /* 0x7b */ { NULL, NULL, 0 },
1175 /* 0x7c */ { NULL, NULL, 0 },
1176 /* 0x7d */ { NULL, NULL, 0 },
1177 /* 0x7e */ { NULL, NULL, 0 },
1178 /* 0x7f */ { NULL, NULL, 0 },
1179 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1180 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1181 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1182 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1183 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1184 /* 0x85 */ { NULL, NULL, 0 },
1185 /* 0x86 */ { NULL, NULL, 0 },
1186 /* 0x87 */ { NULL, NULL, 0 },
1187 /* 0x88 */ { NULL, NULL, 0 },
1188 /* 0x89 */ { NULL, NULL, 0 },
1189 /* 0x8a */ { NULL, NULL, 0 },
1190 /* 0x8b */ { NULL, NULL, 0 },
1191 /* 0x8c */ { NULL, NULL, 0 },
1192 /* 0x8d */ { NULL, NULL, 0 },
1193 /* 0x8e */ { NULL, NULL, 0 },
1194 /* 0x8f */ { NULL, NULL, 0 },
1195 /* 0x90 */ { NULL, NULL, 0 },
1196 /* 0x91 */ { NULL, NULL, 0 },
1197 /* 0x92 */ { NULL, NULL, 0 },
1198 /* 0x93 */ { NULL, NULL, 0 },
1199 /* 0x94 */ { NULL, NULL, 0 },
1200 /* 0x95 */ { NULL, NULL, 0 },
1201 /* 0x96 */ { NULL, NULL, 0 },
1202 /* 0x97 */ { NULL, NULL, 0 },
1203 /* 0x98 */ { NULL, NULL, 0 },
1204 /* 0x99 */ { NULL, NULL, 0 },
1205 /* 0x9a */ { NULL, NULL, 0 },
1206 /* 0x9b */ { NULL, NULL, 0 },
1207 /* 0x9c */ { NULL, NULL, 0 },
1208 /* 0x9d */ { NULL, NULL, 0 },
1209 /* 0x9e */ { NULL, NULL, 0 },
1210 /* 0x9f */ { NULL, NULL, 0 },
1211 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1212 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1213 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1214 /* 0xa3 */ { NULL, NULL, 0 },
1215 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1216 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1217 /* 0xa6 */ { NULL, NULL, 0 },
1218 /* 0xa7 */ { NULL, NULL, 0 },
1219 /* 0xa8 */ { NULL, NULL, 0 },
1220 /* 0xa9 */ { NULL, NULL, 0 },
1221 /* 0xaa */ { NULL, NULL, 0 },
1222 /* 0xab */ { NULL, NULL, 0 },
1223 /* 0xac */ { NULL, NULL, 0 },
1224 /* 0xad */ { NULL, NULL, 0 },
1225 /* 0xae */ { NULL, NULL, 0 },
1226 /* 0xaf */ { NULL, NULL, 0 },
1227 /* 0xb0 */ { NULL, NULL, 0 },
1228 /* 0xb1 */ { NULL, NULL, 0 },
1229 /* 0xb2 */ { NULL, NULL, 0 },
1230 /* 0xb3 */ { NULL, NULL, 0 },
1231 /* 0xb4 */ { NULL, NULL, 0 },
1232 /* 0xb5 */ { NULL, NULL, 0 },
1233 /* 0xb6 */ { NULL, NULL, 0 },
1234 /* 0xb7 */ { NULL, NULL, 0 },
1235 /* 0xb8 */ { NULL, NULL, 0 },
1236 /* 0xb9 */ { NULL, NULL, 0 },
1237 /* 0xba */ { NULL, NULL, 0 },
1238 /* 0xbb */ { NULL, NULL, 0 },
1239 /* 0xbc */ { NULL, NULL, 0 },
1240 /* 0xbd */ { NULL, NULL, 0 },
1241 /* 0xbe */ { NULL, NULL, 0 },
1242 /* 0xbf */ { NULL, NULL, 0 },
1243 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1244 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1245 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1246 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1247 /* 0xc4 */ { NULL, NULL, 0 },
1248 /* 0xc5 */ { NULL, NULL, 0 },
1249 /* 0xc6 */ { NULL, NULL, 0 },
1250 /* 0xc7 */ { NULL, NULL, 0 },
1251 /* 0xc8 */ { NULL, NULL, 0 },
1252 /* 0xc9 */ { NULL, NULL, 0 },
1253 /* 0xca */ { NULL, NULL, 0 },
1254 /* 0xcb */ { NULL, NULL, 0 },
1255 /* 0xcc */ { NULL, NULL, 0 },
1256 /* 0xcd */ { NULL, NULL, 0 },
1257 /* 0xce */ { NULL, NULL, 0 },
1258 /* 0xcf */ { NULL, NULL, 0 },
1259 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1260 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1261 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1262 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1263 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1264 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1265 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1266 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1267 /* 0xd8 */ { NULL, NULL, 0 },
1268 /* 0xd9 */ { NULL, NULL, 0 },
1269 /* 0xda */ { NULL, NULL, 0 },
1270 /* 0xdb */ { NULL, NULL, 0 },
1271 /* 0xdc */ { NULL, NULL, 0 },
1272 /* 0xdd */ { NULL, NULL, 0 },
1273 /* 0xde */ { NULL, NULL, 0 },
1274 /* 0xdf */ { NULL, NULL, 0 },
1275 /* 0xe0 */ { NULL, NULL, 0 },
1276 /* 0xe1 */ { NULL, NULL, 0 },
1277 /* 0xe2 */ { NULL, NULL, 0 },
1278 /* 0xe3 */ { NULL, NULL, 0 },
1279 /* 0xe4 */ { NULL, NULL, 0 },
1280 /* 0xe5 */ { NULL, NULL, 0 },
1281 /* 0xe6 */ { NULL, NULL, 0 },
1282 /* 0xe7 */ { NULL, NULL, 0 },
1283 /* 0xe8 */ { NULL, NULL, 0 },
1284 /* 0xe9 */ { NULL, NULL, 0 },
1285 /* 0xea */ { NULL, NULL, 0 },
1286 /* 0xeb */ { NULL, NULL, 0 },
1287 /* 0xec */ { NULL, NULL, 0 },
1288 /* 0xed */ { NULL, NULL, 0 },
1289 /* 0xee */ { NULL, NULL, 0 },
1290 /* 0xef */ { NULL, NULL, 0 },
1291 /* 0xf0 */ { NULL, NULL, 0 },
1292 /* 0xf1 */ { NULL, NULL, 0 },
1293 /* 0xf2 */ { NULL, NULL, 0 },
1294 /* 0xf3 */ { NULL, NULL, 0 },
1295 /* 0xf4 */ { NULL, NULL, 0 },
1296 /* 0xf5 */ { NULL, NULL, 0 },
1297 /* 0xf6 */ { NULL, NULL, 0 },
1298 /* 0xf7 */ { NULL, NULL, 0 },
1299 /* 0xf8 */ { NULL, NULL, 0 },
1300 /* 0xf9 */ { NULL, NULL, 0 },
1301 /* 0xfa */ { NULL, NULL, 0 },
1302 /* 0xfb */ { NULL, NULL, 0 },
1303 /* 0xfc */ { NULL, NULL, 0 },
1304 /* 0xfd */ { NULL, NULL, 0 },
1305 /* 0xfe */ { NULL, NULL, 0 },
1306 /* 0xff */ { NULL, NULL, 0 }
1307
1308 };
1309
1310 /*******************************************************************
1311  allocate and initialize a reply packet
1312 ********************************************************************/
1313
1314 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1315 {
1316         /*
1317          * Protect against integer wrap
1318          */
1319         if ((num_bytes > 0xffffff)
1320             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1321                 char *msg;
1322                 asprintf(&msg, "num_bytes too large: %u",
1323                          (unsigned)num_bytes);
1324                 smb_panic(msg);
1325         }
1326
1327         if (!(req->outbuf = TALLOC_ARRAY(
1328                       req, uint8,
1329                       smb_size + num_words*2 + num_bytes))) {
1330                 smb_panic("could not allocate output buffer\n");
1331         }
1332
1333         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1334         srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1335         /*
1336          * Zero out the word area, the caller has to take care of the bcc area
1337          * himself
1338          */
1339         if (num_words != 0) {
1340                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1341         }
1342
1343         return;
1344 }
1345
1346
1347 /*******************************************************************
1348  Dump a packet to a file.
1349 ********************************************************************/
1350
1351 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1352 {
1353         int fd, i;
1354         char *fname = NULL;
1355         if (DEBUGLEVEL < 50) {
1356                 return;
1357         }
1358
1359         if (len < 4) len = smb_len(data)+4;
1360         for (i=1;i<100;i++) {
1361                 asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1362                                 type ? "req" : "resp");
1363                 if (!fname) {
1364                         return;
1365                 }
1366                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1367                 if (fd != -1 || errno != EEXIST) break;
1368         }
1369         if (fd != -1) {
1370                 ssize_t ret = write(fd, data, len);
1371                 if (ret != len)
1372                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1373                 close(fd);
1374                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1375         }
1376         SAFE_FREE(fname);
1377 }
1378
1379 /****************************************************************************
1380  Prepare everything for calling the actual request function, and potentially
1381  call the request function via the "new" interface.
1382
1383  Return False if the "legacy" function needs to be called, everything is
1384  prepared.
1385
1386  Return True if we're done.
1387
1388  I know this API sucks, but it is the one with the least code change I could
1389  find.
1390 ****************************************************************************/
1391
1392 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1393 {
1394         int flags;
1395         uint16 session_tag;
1396         connection_struct *conn = NULL;
1397
1398         static uint16 last_session_tag = UID_FIELD_INVALID;
1399
1400         errno = 0;
1401
1402         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1403          * so subtract 4 from it. */
1404         if (!valid_smb_header(req->inbuf)
1405             || (size < (smb_size - 4))) {
1406                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1407                          smb_len(req->inbuf)));
1408                 exit_server_cleanly("Non-SMB packet");
1409         }
1410
1411         if (smb_messages[type].fn_new == NULL) {
1412                 DEBUG(0,("Unknown message type %d!\n",type));
1413                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1414                 reply_unknown_new(req, type);
1415                 return NULL;
1416         }
1417
1418         flags = smb_messages[type].flags;
1419
1420         /* In share mode security we must ignore the vuid. */
1421         session_tag = (lp_security() == SEC_SHARE)
1422                 ? UID_FIELD_INVALID : req->vuid;
1423         conn = req->conn;
1424
1425         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1426                  (int)sys_getpid(), (unsigned long)conn));
1427
1428         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1429
1430         /* Ensure this value is replaced in the incoming packet. */
1431         SSVAL(req->inbuf,smb_uid,session_tag);
1432
1433         /*
1434          * Ensure the correct username is in current_user_info.  This is a
1435          * really ugly bugfix for problems with multiple session_setup_and_X's
1436          * being done and allowing %U and %G substitutions to work correctly.
1437          * There is a reason this code is done here, don't move it unless you
1438          * know what you're doing... :-).
1439          * JRA.
1440          */
1441
1442         if (session_tag != last_session_tag) {
1443                 user_struct *vuser = NULL;
1444
1445                 last_session_tag = session_tag;
1446                 if(session_tag != UID_FIELD_INVALID) {
1447                         vuser = get_valid_user_struct(session_tag);
1448                         if (vuser) {
1449                                 set_current_user_info(&vuser->user);
1450                         }
1451                 }
1452         }
1453
1454         /* Does this call need to be run as the connected user? */
1455         if (flags & AS_USER) {
1456
1457                 /* Does this call need a valid tree connection? */
1458                 if (!conn) {
1459                         /*
1460                          * Amazingly, the error code depends on the command
1461                          * (from Samba4).
1462                          */
1463                         if (type == SMBntcreateX) {
1464                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1465                         } else {
1466                                 reply_doserror(req, ERRSRV, ERRinvnid);
1467                         }
1468                         return NULL;
1469                 }
1470
1471                 if (!change_to_user(conn,session_tag)) {
1472                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1473                         return conn;
1474                 }
1475
1476                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1477
1478                 /* Does it need write permission? */
1479                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1480                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1481                         return conn;
1482                 }
1483
1484                 /* IPC services are limited */
1485                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1486                         reply_doserror(req, ERRSRV,ERRaccess);
1487                         return conn;
1488                 }
1489         } else {
1490                 /* This call needs to be run as root */
1491                 change_to_root_user();
1492         }
1493
1494         /* load service specific parameters */
1495         if (conn) {
1496                 if (req->encrypted) {
1497                         conn->encrypted_tid = true;
1498                         /* encrypted required from now on. */
1499                         conn->encrypt_level = Required;
1500                 } else if (ENCRYPTION_REQUIRED(conn)) {
1501                         uint8 com = CVAL(req->inbuf,smb_com);
1502                         if (com != SMBtrans2 && com != SMBtranss2) {
1503                                 exit_server_cleanly("encryption required "
1504                                         "on connection");
1505                                 return conn;
1506                         }
1507                 }
1508
1509                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1510                                          (flags & (AS_USER|DO_CHDIR)
1511                                           ?True:False))) {
1512                         reply_doserror(req, ERRSRV, ERRaccess);
1513                         return conn;
1514                 }
1515                 conn->num_smb_operations++;
1516         }
1517
1518         /* does this protocol need to be run as guest? */
1519         if ((flags & AS_GUEST)
1520             && (!change_to_guest() ||
1521                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1522                               lp_hostsdeny(-1)))) {
1523                 reply_doserror(req, ERRSRV, ERRaccess);
1524                 return conn;
1525         }
1526
1527         smb_messages[type].fn_new(req);
1528         return req->conn;
1529 }
1530
1531 /****************************************************************************
1532  Construct a reply to the incoming packet.
1533 ****************************************************************************/
1534
1535 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1536 {
1537         uint8 type = CVAL(inbuf,smb_com);
1538         connection_struct *conn;
1539         struct smb_request *req;
1540
1541         chain_size = 0;
1542         file_chain_reset();
1543         reset_chain_p();
1544
1545         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1546                 smb_panic("could not allocate smb_request");
1547         }
1548         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1549
1550         conn = switch_message(type, req, size);
1551
1552         if (req->unread_bytes) {
1553                 /* writeX failed. drain socket. */
1554                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1555                                 req->unread_bytes) {
1556                         smb_panic("failed to drain pending bytes");
1557                 }
1558                 req->unread_bytes = 0;
1559         }
1560
1561         if (req->outbuf == NULL) {
1562                 return;
1563         }
1564
1565         if (CVAL(req->outbuf,0) == 0) {
1566                 show_msg((char *)req->outbuf);
1567         }
1568
1569         if (!srv_send_smb(smbd_server_fd(),
1570                         (char *)req->outbuf,
1571                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1572                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1573         }
1574
1575         TALLOC_FREE(req);
1576
1577         return;
1578 }
1579
1580 /****************************************************************************
1581  Process an smb from the client
1582 ****************************************************************************/
1583
1584 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1585 {
1586         static int trans_num;
1587         int msg_type = CVAL(inbuf,0);
1588
1589         DO_PROFILE_INC(smb_count);
1590
1591         if (trans_num == 0) {
1592                 char addr[INET6_ADDRSTRLEN];
1593
1594                 /* on the first packet, check the global hosts allow/ hosts
1595                 deny parameters before doing any parsing of the packet
1596                 passed to us by the client.  This prevents attacks on our
1597                 parsing code from hosts not in the hosts allow list */
1598
1599                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1600                                   lp_hostsdeny(-1))) {
1601                         /* send a negative session response "not listening on calling name" */
1602                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1603                         DEBUG( 1, ( "Connection denied from %s\n",
1604                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1605                         (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1606                         exit_server_cleanly("connection denied");
1607                 }
1608         }
1609
1610         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1611                     smb_len(inbuf) ) );
1612         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1613                                 (int)nread,
1614                                 (unsigned int)unread_bytes ));
1615
1616         if (msg_type != 0) {
1617                 /*
1618                  * NetBIOS session request, keepalive, etc.
1619                  */
1620                 reply_special(inbuf);
1621                 return;
1622         }
1623
1624         show_msg(inbuf);
1625
1626         construct_reply(inbuf,nread,unread_bytes,encrypted);
1627
1628         trans_num++;
1629 }
1630
1631 /****************************************************************************
1632  Return a string containing the function name of a SMB command.
1633 ****************************************************************************/
1634
1635 const char *smb_fn_name(int type)
1636 {
1637         const char *unknown_name = "SMBunknown";
1638
1639         if (smb_messages[type].name == NULL)
1640                 return(unknown_name);
1641
1642         return(smb_messages[type].name);
1643 }
1644
1645 /****************************************************************************
1646  Helper functions for contruct_reply.
1647 ****************************************************************************/
1648
1649 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1650
1651 void add_to_common_flags2(uint32 v)
1652 {
1653         common_flags2 |= v;
1654 }
1655
1656 void remove_from_common_flags2(uint32 v)
1657 {
1658         common_flags2 &= ~v;
1659 }
1660
1661 void construct_reply_common(const char *inbuf, char *outbuf)
1662 {
1663         srv_set_message(outbuf,0,0,false);
1664
1665         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1666         SIVAL(outbuf,smb_rcls,0);
1667         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1668         SSVAL(outbuf,smb_flg2,
1669                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1670                 common_flags2);
1671         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1672
1673         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1674         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1675         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1676         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1677 }
1678
1679 /****************************************************************************
1680  Construct a chained reply and add it to the already made reply
1681 ****************************************************************************/
1682
1683 void chain_reply(struct smb_request *req)
1684 {
1685         static char *orig_inbuf;
1686
1687         /*
1688          * Dirty little const_discard: We mess with req->inbuf, which is
1689          * declared as const. If maybe at some point this routine gets
1690          * rewritten, this const_discard could go away.
1691          */
1692         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1693         int size = smb_len(req->inbuf)+4;
1694
1695         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1696         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1697         char *inbuf2;
1698         int outsize2;
1699         int new_size;
1700         char inbuf_saved[smb_wct];
1701         char *outbuf = (char *)req->outbuf;
1702         size_t outsize = smb_len(outbuf) + 4;
1703         size_t outsize_padded;
1704         size_t ofs, to_move;
1705
1706         struct smb_request *req2;
1707         size_t caller_outputlen;
1708         char *caller_output;
1709
1710         /* Maybe its not chained, or it's an error packet. */
1711         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1712                 SCVAL(outbuf,smb_vwv0,0xFF);
1713                 return;
1714         }
1715
1716         if (chain_size == 0) {
1717                 /* this is the first part of the chain */
1718                 orig_inbuf = inbuf;
1719         }
1720
1721         /*
1722          * We need to save the output the caller added to the chain so that we
1723          * can splice it into the final output buffer later.
1724          */
1725
1726         caller_outputlen = outsize - smb_wct;
1727
1728         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1729
1730         if (caller_output == NULL) {
1731                 /* TODO: NT_STATUS_NO_MEMORY */
1732                 smb_panic("could not dup outbuf");
1733         }
1734
1735         /*
1736          * The original Win95 redirector dies on a reply to
1737          * a lockingX and read chain unless the chain reply is
1738          * 4 byte aligned. JRA.
1739          */
1740
1741         outsize_padded = (outsize + 3) & ~3;
1742
1743         /*
1744          * remember how much the caller added to the chain, only counting
1745          * stuff after the parameter words
1746          */
1747         chain_size += outsize_padded - smb_wct;
1748
1749         /*
1750          * work out pointers into the original packets. The
1751          * headers on these need to be filled in
1752          */
1753         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1754
1755         /* remember the original command type */
1756         smb_com1 = CVAL(orig_inbuf,smb_com);
1757
1758         /* save the data which will be overwritten by the new headers */
1759         memcpy(inbuf_saved,inbuf2,smb_wct);
1760
1761         /* give the new packet the same header as the last part of the SMB */
1762         memmove(inbuf2,inbuf,smb_wct);
1763
1764         /* create the in buffer */
1765         SCVAL(inbuf2,smb_com,smb_com2);
1766
1767         /* work out the new size for the in buffer. */
1768         new_size = size - (inbuf2 - inbuf);
1769         if (new_size < 0) {
1770                 DEBUG(0,("chain_reply: chain packet size incorrect "
1771                          "(orig size = %d, offset = %d)\n",
1772                          size, (int)(inbuf2 - inbuf) ));
1773                 exit_server_cleanly("Bad chained packet");
1774                 return;
1775         }
1776
1777         /* And set it in the header. */
1778         smb_setlen(inbuf2, new_size - 4);
1779
1780         DEBUG(3,("Chained message\n"));
1781         show_msg(inbuf2);
1782
1783         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1784                 smb_panic("could not allocate smb_request");
1785         }
1786         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1787
1788         /* process the request */
1789         switch_message(smb_com2, req2, new_size);
1790
1791         /*
1792          * We don't accept deferred operations in chained requests.
1793          */
1794         SMB_ASSERT(req2->outbuf != NULL);
1795         outsize2 = smb_len(req2->outbuf)+4;
1796
1797         /*
1798          * Move away the new command output so that caller_output fits in,
1799          * copy in the caller_output saved above.
1800          */
1801
1802         SMB_ASSERT(outsize_padded >= smb_wct);
1803
1804         /*
1805          * "ofs" is the space we need for caller_output. Equal to
1806          * caller_outputlen plus the padding.
1807          */
1808
1809         ofs = outsize_padded - smb_wct;
1810
1811         /*
1812          * "to_move" is the amount of bytes the secondary routine gave us
1813          */
1814
1815         to_move = outsize2 - smb_wct;
1816
1817         if (to_move + ofs + smb_wct + chain_size > max_send) {
1818                 smb_panic("replies too large -- would have to cut");
1819         }
1820
1821         /*
1822          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1823          * the first request in the chain. So we have to re-allocate it. In
1824          * the "old" API the only outbuf ever used is the global OutBuffer
1825          * which is always large enough.
1826          */
1827
1828         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1829                                       to_move + ofs + smb_wct);
1830         if (outbuf == NULL) {
1831                 smb_panic("could not realloc outbuf");
1832         }
1833
1834         req->outbuf = (uint8 *)outbuf;
1835
1836         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1837         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1838
1839         /*
1840          * copy the new reply header over the old one but preserve the smb_com
1841          * field
1842          */
1843         memmove(outbuf, req2->outbuf, smb_wct);
1844         SCVAL(outbuf, smb_com, smb_com1);
1845
1846         /*
1847          * We've just copied in the whole "wct" area from the secondary
1848          * function. Fix up the chaining: com2 and the offset need to be
1849          * readjusted.
1850          */
1851
1852         SCVAL(outbuf, smb_vwv0, smb_com2);
1853         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1854
1855         if (outsize_padded > outsize) {
1856
1857                 /*
1858                  * Due to padding we have some uninitialized bytes after the
1859                  * caller's output
1860                  */
1861
1862                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1863         }
1864
1865         smb_setlen(outbuf, outsize2 + chain_size - 4);
1866
1867         /*
1868          * restore the saved data, being careful not to overwrite any data
1869          * from the reply header
1870          */
1871         memcpy(inbuf2,inbuf_saved,smb_wct);
1872
1873         SAFE_FREE(caller_output);
1874         TALLOC_FREE(req2);
1875
1876         return;
1877 }
1878
1879 /****************************************************************************
1880  Setup the needed select timeout in milliseconds.
1881 ****************************************************************************/
1882
1883 static int setup_select_timeout(void)
1884 {
1885         int select_timeout;
1886
1887         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1888
1889         if (print_notify_messages_pending()) {
1890                 select_timeout = MIN(select_timeout, 1000);
1891         }
1892
1893         return select_timeout;
1894 }
1895
1896 /****************************************************************************
1897  Check if services need reloading.
1898 ****************************************************************************/
1899
1900 void check_reload(time_t t)
1901 {
1902         static pid_t mypid = 0;
1903         static time_t last_smb_conf_reload_time = 0;
1904         static time_t last_printer_reload_time = 0;
1905         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1906
1907         if(last_smb_conf_reload_time == 0) {
1908                 last_smb_conf_reload_time = t;
1909                 /* Our printing subsystem might not be ready at smbd start up.
1910                    Then no printer is available till the first printers check
1911                    is performed.  A lower initial interval circumvents this. */
1912                 if ( printcap_cache_time > 60 )
1913                         last_printer_reload_time = t - printcap_cache_time + 60;
1914                 else
1915                         last_printer_reload_time = t;
1916         }
1917
1918         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1919                 /* randomize over 60 second the printcap reload to avoid all
1920                  * process hitting cupsd at the same time */
1921                 int time_range = 60;
1922
1923                 last_printer_reload_time += random() % time_range;
1924                 mypid = getpid();
1925         }
1926
1927         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1928                 reload_services(True);
1929                 reload_after_sighup = False;
1930                 last_smb_conf_reload_time = t;
1931         }
1932
1933         /* 'printcap cache time = 0' disable the feature */
1934
1935         if ( printcap_cache_time != 0 )
1936         {
1937                 /* see if it's time to reload or if the clock has been set back */
1938
1939                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1940                         || (t-last_printer_reload_time  < 0) )
1941                 {
1942                         DEBUG( 3,( "Printcap cache time expired.\n"));
1943                         reload_printers();
1944                         last_printer_reload_time = t;
1945                 }
1946         }
1947 }
1948
1949 /****************************************************************************
1950  Process any timeout housekeeping. Return False if the caller should exit.
1951 ****************************************************************************/
1952
1953 static bool timeout_processing(int *select_timeout,
1954                                time_t *last_timeout_processing_time)
1955 {
1956         time_t t;
1957
1958         if (*get_srv_read_error() == SMB_READ_EOF) {
1959                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1960                 return false;
1961         }
1962
1963         if (*get_srv_read_error() == SMB_READ_ERROR) {
1964                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1965                         strerror(errno)));
1966                 return false;
1967         }
1968
1969         if (*get_srv_read_error() == SMB_READ_BAD_SIG) {
1970                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1971                 return false;
1972         }
1973
1974         *last_timeout_processing_time = t = time(NULL);
1975
1976         /* become root again if waiting */
1977         change_to_root_user();
1978
1979         /* check if we need to reload services */
1980         check_reload(t);
1981
1982         if(global_machine_password_needs_changing &&
1983                         /* for ADS we need to do a regular ADS password change, not a domain
1984                                         password change */
1985                         lp_security() == SEC_DOMAIN) {
1986
1987                 unsigned char trust_passwd_hash[16];
1988                 time_t lct;
1989
1990                 /*
1991                  * We're in domain level security, and the code that
1992                  * read the machine password flagged that the machine
1993                  * password needs changing.
1994                  */
1995
1996                 /*
1997                  * First, open the machine password file with an exclusive lock.
1998                  */
1999
2000                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
2001                         DEBUG(0,("process: unable to lock the machine account password for \
2002 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
2003                         return True;
2004                 }
2005
2006                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
2007                         DEBUG(0,("process: unable to read the machine account password for \
2008 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
2009                         secrets_lock_trust_account_password(lp_workgroup(), False);
2010                         return True;
2011                 }
2012
2013                 /*
2014                  * Make sure someone else hasn't already done this.
2015                  */
2016
2017                 if(t < lct + lp_machine_password_timeout()) {
2018                         global_machine_password_needs_changing = False;
2019                         secrets_lock_trust_account_password(lp_workgroup(), False);
2020                         return True;
2021                 }
2022
2023                 /* always just contact the PDC here */
2024
2025                 change_trust_account_password( lp_workgroup(), NULL);
2026                 global_machine_password_needs_changing = False;
2027                 secrets_lock_trust_account_password(lp_workgroup(), False);
2028         }
2029
2030         /* update printer queue caches if necessary */
2031
2032         update_monitored_printq_cache();
2033
2034         /*
2035          * Now we are root, check if the log files need pruning.
2036          * Force a log file check.
2037          */
2038         force_check_log_size();
2039         check_log_size();
2040
2041         /* Send any queued printer notify message to interested smbd's. */
2042
2043         print_notify_send_messages(smbd_messaging_context(), 0);
2044
2045         /*
2046          * Modify the select timeout depending upon
2047          * what we have remaining in our queues.
2048          */
2049
2050         *select_timeout = setup_select_timeout();
2051
2052         return True;
2053 }
2054
2055 /****************************************************************************
2056  Process commands from the client
2057 ****************************************************************************/
2058
2059 void smbd_process(void)
2060 {
2061         time_t last_timeout_processing_time = time(NULL);
2062         unsigned int num_smbs = 0;
2063         size_t unread_bytes = 0;
2064
2065         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2066
2067         while (True) {
2068                 int select_timeout = setup_select_timeout();
2069                 int num_echos;
2070                 char *inbuf;
2071                 size_t inbuf_len;
2072                 bool encrypted = false;
2073                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2074
2075                 errno = 0;
2076
2077                 /* Did someone ask for immediate checks on things like blocking locks ? */
2078                 if (select_timeout == 0) {
2079                         if(!timeout_processing(&select_timeout,
2080                                                &last_timeout_processing_time))
2081                                 return;
2082                         num_smbs = 0; /* Reset smb counter. */
2083                 }
2084
2085                 run_events(smbd_event_context(), 0, NULL, NULL);
2086
2087                 while (!receive_message_or_smb(talloc_tos(), &inbuf, &inbuf_len,
2088                                                 select_timeout,
2089                                                 &unread_bytes,
2090                                                 &encrypted)) {
2091                         if(!timeout_processing(&select_timeout,
2092                                                &last_timeout_processing_time))
2093                                 return;
2094                         num_smbs = 0; /* Reset smb counter. */
2095                 }
2096
2097
2098                 /*
2099                  * Ensure we do timeout processing if the SMB we just got was
2100                  * only an echo request. This allows us to set the select
2101                  * timeout in 'receive_message_or_smb()' to any value we like
2102                  * without worrying that the client will send echo requests
2103                  * faster than the select timeout, thus starving out the
2104                  * essential processing (change notify, blocking locks) that
2105                  * the timeout code does. JRA.
2106                  */
2107                 num_echos = smb_echo_count;
2108
2109                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2110
2111                 TALLOC_FREE(inbuf);
2112
2113                 if (smb_echo_count != num_echos) {
2114                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
2115                                 return;
2116                         num_smbs = 0; /* Reset smb counter. */
2117                 }
2118
2119                 num_smbs++;
2120
2121                 /*
2122                  * If we are getting smb requests in a constant stream
2123                  * with no echos, make sure we attempt timeout processing
2124                  * every select_timeout milliseconds - but only check for this
2125                  * every 200 smb requests.
2126                  */
2127
2128                 if ((num_smbs % 200) == 0) {
2129                         time_t new_check_time = time(NULL);
2130                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2131                                 if(!timeout_processing(
2132                                            &select_timeout,
2133                                            &last_timeout_processing_time))
2134                                         return;
2135                                 num_smbs = 0; /* Reset smb counter. */
2136                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2137                         }
2138                 }
2139
2140                 /* The timeout_processing function isn't run nearly
2141                    often enough to implement 'max log size' without
2142                    overrunning the size of the file by many megabytes.
2143                    This is especially true if we are running at debug
2144                    level 10.  Checking every 50 SMBs is a nice
2145                    tradeoff of performance vs log file size overrun. */
2146
2147                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2148                         change_to_root_user();
2149                         check_log_size();
2150                 }
2151                 TALLOC_FREE(frame);
2152         }
2153 }