source/smbd/process.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    process incoming packets - main loop
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Volker Lendecke 2005-2007
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22
  23 extern int smb_echo_count;
  24
  25 static enum smb_read_errors smb_read_error = SMB_READ_OK;
  26
  27 /*
  28  * Size of data we can send to client. Set
  29  *  by the client for all protocols above CORE.
  30  *  Set by us for CORE protocol.
  31  */
  32 int max_send = BUFFER_SIZE;
  33 /*
  34  * Size of the data we can receive. Set by us.
  35  * Can be modified by the max xmit parameter.
  36  */
  37 int max_recv = BUFFER_SIZE;
  38
  39 SIG_ATOMIC_T reload_after_sighup = 0;
  40 SIG_ATOMIC_T got_sig_term = 0;
  41 extern bool global_machine_password_needs_changing;
  42 extern int max_send;
  43
  44 /* Accessor function for smb_read_error for smbd functions. */
  45
  46 static enum smb_read_errors *get_srv_read_error(void)
  47 {
  48         return &smb_read_error;
  49 }
  50
  51 /****************************************************************************
  52  Send an smb to a fd.
  53 ****************************************************************************/
  54
  55 bool srv_send_smb(int fd, char *buffer, bool do_encrypt)
  56 {
  57         size_t len;
  58         size_t nwritten=0;
  59         ssize_t ret;
  60         char *buf_out = buffer;
  61
  62         /* Sign the outgoing packet if required. */
  63         srv_calculate_sign_mac(buf_out);
  64
  65         if (do_encrypt) {
  66                 NTSTATUS status = srv_encrypt_buffer(buffer, &buf_out);
  67                 if (!NT_STATUS_IS_OK(status)) {
  68                         DEBUG(0, ("send_smb: SMB encryption failed "
  69                                 "on outgoing packet! Error %s\n",
  70                                 nt_errstr(status) ));
  71                         return false;
  72                 }
  73         }
  74
  75         len = smb_len(buf_out) + 4;
  76
  77         while (nwritten < len) {
  78                 ret = write_data(fd,buf_out+nwritten,len - nwritten);
  79                 if (ret <= 0) {
  80                         DEBUG(0,("Error writing %d bytes to client. %d. (%s)\n",
  81                                 (int)len,(int)ret, strerror(errno) ));
  82                         srv_free_enc_buffer(buf_out);
  83                         return false;
  84                 }
  85                 nwritten += ret;
  86         }
  87
  88         srv_free_enc_buffer(buf_out);
  89         return true;
  90 }
  91
  92 /*******************************************************************
  93  Setup the word count and byte count for a smb message.
  94 ********************************************************************/
  95
  96 int srv_set_message(char *buf,
  97                         int num_words,
  98                         int num_bytes,
  99                         bool zero)
 100 {
 101         if (zero && (num_words || num_bytes)) {
 102                 memset(buf + smb_size,'\0',num_words*2 + num_bytes);
 103         }
 104         SCVAL(buf,smb_wct,num_words);
 105         SSVAL(buf,smb_vwv + num_words*SIZEOFWORD,num_bytes);
 106         smb_setlen(buf,(smb_size + num_words*2 + num_bytes - 4));
 107         return (smb_size + num_words*2 + num_bytes);
 108 }
 109
 110 static bool valid_smb_header(const uint8_t *inbuf)
 111 {
 112         if (is_encrypted_packet(inbuf)) {
 113                 return true;
 114         }
 115         return (strncmp(smb_base(inbuf),"\377SMB",4) == 0);
 116 }
 117
 118 /* Socket functions for smbd packet processing. */
 119
 120 static bool valid_packet_size(size_t len)
 121 {
 122         /*
 123          * A WRITEX with CAP_LARGE_WRITEX can be 64k worth of data plus 65 bytes
 124          * of header. Don't print the error if this fits.... JRA.
 125          */
 126
 127         if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 128                 DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 129                                         (unsigned long)len));
 130                 if (len > BUFFER_SIZE + (SAFETY_MARGIN/2)) {
 131                         return false;
 132                 }
 133         }
 134         return true;
 135 }
 136
 137 static NTSTATUS read_packet_remainder(int fd, char *buffer,
 138                                       unsigned int timeout, ssize_t len)
 139 {
 140         if (len <= 0) {
 141                 return NT_STATUS_OK;
 142         }
 143
 144         return read_socket_with_timeout(fd, buffer, len, len, timeout, NULL);
 145 }
 146
 147 /****************************************************************************
 148  Attempt a zerocopy writeX read. We know here that len > smb_size-4
 149 ****************************************************************************/
 150
 151 /*
 152  * Unfortunately, earlier versions of smbclient/libsmbclient
 153  * don't send this "standard" writeX header. I've fixed this
 154  * for 3.2 but we'll use the old method with earlier versions.
 155  * Windows and CIFSFS at least use this standard size. Not
 156  * sure about MacOSX.
 157  */
 158
 159 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
 160                                 (2*14) + /* word count (including bcc) */ \
 161                                 1 /* pad byte */)
 162
 163 static NTSTATUS receive_smb_raw_talloc_partial_read(TALLOC_CTX *mem_ctx,
 164                                                     const char lenbuf[4],
 165                                                     int fd, char **buffer,
 166                                                     unsigned int timeout,
 167                                                     size_t *p_unread,
 168                                                     size_t *len_ret)
 169 {
 170         /* Size of a WRITEX call (+4 byte len). */
 171         char writeX_header[4 + STANDARD_WRITE_AND_X_HEADER_SIZE];
 172         ssize_t len = smb_len_large(lenbuf); /* Could be a UNIX large writeX. */
 173         ssize_t toread;
 174         NTSTATUS status;
 175
 176         memcpy(writeX_header, lenbuf, sizeof(lenbuf));
 177
 178         status = read_socket_with_timeout(
 179                 fd, writeX_header + 4,
 180                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 181                 STANDARD_WRITE_AND_X_HEADER_SIZE,
 182                 timeout, NULL);
 183
 184         if (!NT_STATUS_IS_OK(status)) {
 185                 return status;
 186         }
 187
 188         /*
 189          * Ok - now try and see if this is a possible
 190          * valid writeX call.
 191          */
 192
 193         if (is_valid_writeX_buffer((uint8_t *)writeX_header)) {
 194                 /*
 195                  * If the data offset is beyond what
 196                  * we've read, drain the extra bytes.
 197                  */
 198                 uint16_t doff = SVAL(writeX_header,smb_vwv11);
 199                 ssize_t newlen;
 200
 201                 if (doff > STANDARD_WRITE_AND_X_HEADER_SIZE) {
 202                         size_t drain = doff - STANDARD_WRITE_AND_X_HEADER_SIZE;
 203                         if (drain_socket(smbd_server_fd(), drain) != drain) {
 204                                 smb_panic("receive_smb_raw_talloc_partial_read:"
 205                                         " failed to drain pending bytes");
 206                         }
 207                 } else {
 208                         doff = STANDARD_WRITE_AND_X_HEADER_SIZE;
 209                 }
 210
 211                 /* Spoof down the length and null out the bcc. */
 212                 set_message_bcc(writeX_header, 0);
 213                 newlen = smb_len(writeX_header);
 214
 215                 /* Copy the header we've written. */
 216
 217                 *buffer = (char *)TALLOC_MEMDUP(mem_ctx,
 218                                 writeX_header,
 219                                 sizeof(writeX_header));
 220
 221                 if (*buffer == NULL) {
 222                         DEBUG(0, ("Could not allocate inbuf of length %d\n",
 223                                   (int)sizeof(writeX_header)));
 224                         return NT_STATUS_NO_MEMORY;
 225                 }
 226
 227                 /* Work out the remaining bytes. */
 228                 *p_unread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 229                 *len_ret = newlen + 4;
 230                 return NT_STATUS_OK;
 231         }
 232
 233         if (!valid_packet_size(len)) {
 234                 return NT_STATUS_INVALID_PARAMETER;
 235         }
 236
 237         /*
 238          * Not a valid writeX call. Just do the standard
 239          * talloc and return.
 240          */
 241
 242         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 243
 244         if (*buffer == NULL) {
 245                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 246                           (int)len+4));
 247                 return NT_STATUS_NO_MEMORY;
 248         }
 249
 250         /* Copy in what we already read. */
 251         memcpy(*buffer,
 252                 writeX_header,
 253                 4 + STANDARD_WRITE_AND_X_HEADER_SIZE);
 254         toread = len - STANDARD_WRITE_AND_X_HEADER_SIZE;
 255
 256         if(toread > 0) {
 257                 status = read_packet_remainder(
 258                         fd, (*buffer) + 4 + STANDARD_WRITE_AND_X_HEADER_SIZE,
 259                         timeout, toread);
 260
 261                 if (!NT_STATUS_IS_OK(status)) {
 262                         return status;
 263                 }
 264         }
 265
 266         *len_ret = len + 4;
 267         return NT_STATUS_OK;
 268 }
 269
 270 static NTSTATUS receive_smb_raw_talloc(TALLOC_CTX *mem_ctx, int fd,
 271                                        char **buffer, unsigned int timeout,
 272                                        size_t *p_unread, size_t *plen)
 273 {
 274         char lenbuf[4];
 275         size_t len;
 276         int min_recv_size = lp_min_receive_file_size();
 277         NTSTATUS status;
 278
 279         *p_unread = 0;
 280
 281         status = read_smb_length_return_keepalive(fd, lenbuf, timeout, &len);
 282         if (!NT_STATUS_IS_OK(status)) {
 283                 DEBUG(10, ("receive_smb_raw: %s\n", nt_errstr(status)));
 284                 return status;
 285         }
 286
 287         if (CVAL(lenbuf,0) == 0 &&
 288                         min_recv_size &&
 289                         smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
 290                         !srv_is_signing_active()) {
 291
 292                 status = receive_smb_raw_talloc_partial_read(
 293                         mem_ctx, lenbuf, fd, buffer, timeout, p_unread, &len);
 294
 295                 if (!NT_STATUS_IS_OK(status)) {
 296                         DEBUG(10, ("receive_smb_raw: %s\n",
 297                                    nt_errstr(status)));
 298                         return status;
 299                 }
 300         }
 301
 302         if (!valid_packet_size(len)) {
 303                 return NT_STATUS_INVALID_PARAMETER;
 304         }
 305
 306         /*
 307          * The +4 here can't wrap, we've checked the length above already.
 308          */
 309
 310         *buffer = TALLOC_ARRAY(mem_ctx, char, len+4);
 311
 312         if (*buffer == NULL) {
 313                 DEBUG(0, ("Could not allocate inbuf of length %d\n",
 314                           (int)len+4));
 315                 return NT_STATUS_NO_MEMORY;
 316         }
 317
 318         memcpy(*buffer, lenbuf, sizeof(lenbuf));
 319
 320         status = read_packet_remainder(fd, (*buffer)+4, timeout, len);
 321         if (!NT_STATUS_IS_OK(status)) {
 322                 return status;
 323         }
 324
 325         *plen = len + 4;
 326         return NT_STATUS_OK;
 327 }
 328
 329 static NTSTATUS receive_smb_talloc(TALLOC_CTX *mem_ctx, int fd,
 330                                    char **buffer, unsigned int timeout,
 331                                    size_t *p_unread, bool *p_encrypted,
 332                                    size_t *p_len)
 333 {
 334         size_t len;
 335         NTSTATUS status;
 336
 337         *p_encrypted = false;
 338
 339         status = receive_smb_raw_talloc(mem_ctx, fd, buffer, timeout,
 340                                         p_unread, &len);
 341         if (!NT_STATUS_IS_OK(status)) {
 342                 return status;
 343         }
 344
 345         if (is_encrypted_packet((uint8_t *)*buffer)) {
 346                 status = srv_decrypt_buffer(*buffer);
 347                 if (!NT_STATUS_IS_OK(status)) {
 348                         DEBUG(0, ("receive_smb_talloc: SMB decryption failed on "
 349                                 "incoming packet! Error %s\n",
 350                                 nt_errstr(status) ));
 351                         return status;
 352                 }
 353                 *p_encrypted = true;
 354         }
 355
 356         /* Check the incoming SMB signature. */
 357         if (!srv_check_sign_mac(*buffer, true)) {
 358                 DEBUG(0, ("receive_smb: SMB Signature verification failed on "
 359                           "incoming packet!\n"));
 360                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 361         }
 362
 363         *p_len = len;
 364         return NT_STATUS_OK;
 365 }
 366
 367 /*
 368  * Initialize a struct smb_request from an inbuf
 369  */
 370
 371 void init_smb_request(struct smb_request *req,
 372                         const uint8 *inbuf,
 373                         size_t unread_bytes,
 374                         bool encrypted)
 375 {
 376         size_t req_size = smb_len(inbuf) + 4;
 377         /* Ensure we have at least smb_size bytes. */
 378         if (req_size < smb_size) {
 379                 DEBUG(0,("init_smb_request: invalid request size %u\n",
 380                         (unsigned int)req_size ));
 381                 exit_server_cleanly("Invalid SMB request");
 382         }
 383         req->flags2 = SVAL(inbuf, smb_flg2);
 384         req->smbpid = SVAL(inbuf, smb_pid);
 385         req->mid    = SVAL(inbuf, smb_mid);
 386         req->vuid   = SVAL(inbuf, smb_uid);
 387         req->tid    = SVAL(inbuf, smb_tid);
 388         req->wct    = CVAL(inbuf, smb_wct);
 389         req->unread_bytes = unread_bytes;
 390         req->encrypted = encrypted;
 391         req->conn = conn_find(req->tid);
 392
 393         /* Ensure we have at least wct words and 2 bytes of bcc. */
 394         if (smb_size + req->wct*2 > req_size) {
 395                 DEBUG(0,("init_smb_request: invalid wct number %u (size %u)\n",
 396                         (unsigned int)req->wct,
 397                         (unsigned int)req_size));
 398                 exit_server_cleanly("Invalid SMB request");
 399         }
 400         /* Ensure bcc is correct. */
 401         if (((uint8 *)smb_buf(inbuf)) + smb_buflen(inbuf) > inbuf + req_size) {
 402                 DEBUG(0,("init_smb_request: invalid bcc number %u "
 403                         "(wct = %u, size %u)\n",
 404                         (unsigned int)smb_buflen(inbuf),
 405                         (unsigned int)req->wct,
 406                         (unsigned int)req_size));
 407                 exit_server_cleanly("Invalid SMB request");
 408         }
 409         req->inbuf  = inbuf;
 410         req->outbuf = NULL;
 411 }
 412
 413 /****************************************************************************
 414  structure to hold a linked list of queued messages.
 415  for processing.
 416 ****************************************************************************/
 417
 418 static struct pending_message_list *deferred_open_queue;
 419
 420 /****************************************************************************
 421  Function to push a message onto the tail of a linked list of smb messages ready
 422  for processing.
 423 ****************************************************************************/
 424
 425 static bool push_queued_message(struct smb_request *req,
 426                                 struct timeval request_time,
 427                                 struct timeval end_time,
 428                                 char *private_data, size_t private_len)
 429 {
 430         int msg_len = smb_len(req->inbuf) + 4;
 431         struct pending_message_list *msg;
 432
 433         msg = TALLOC_ZERO_P(NULL, struct pending_message_list);
 434
 435         if(msg == NULL) {
 436                 DEBUG(0,("push_message: malloc fail (1)\n"));
 437                 return False;
 438         }
 439
 440         msg->buf = data_blob_talloc(msg, req->inbuf, msg_len);
 441         if(msg->buf.data == NULL) {
 442                 DEBUG(0,("push_message: malloc fail (2)\n"));
 443                 TALLOC_FREE(msg);
 444                 return False;
 445         }
 446
 447         msg->request_time = request_time;
 448         msg->end_time = end_time;
 449         msg->encrypted = req->encrypted;
 450
 451         if (private_data) {
 452                 msg->private_data = data_blob_talloc(msg, private_data,
 453                                                      private_len);
 454                 if (msg->private_data.data == NULL) {
 455                         DEBUG(0,("push_message: malloc fail (3)\n"));
 456                         TALLOC_FREE(msg);
 457                         return False;
 458                 }
 459         }
 460
 461         DLIST_ADD_END(deferred_open_queue, msg, struct pending_message_list *);
 462
 463         DEBUG(10,("push_message: pushed message length %u on "
 464                   "deferred_open_queue\n", (unsigned int)msg_len));
 465
 466         return True;
 467 }
 468
 469 /****************************************************************************
 470  Function to delete a sharing violation open message by mid.
 471 ****************************************************************************/
 472
 473 void remove_deferred_open_smb_message(uint16 mid)
 474 {
 475         struct pending_message_list *pml;
 476
 477         for (pml = deferred_open_queue; pml; pml = pml->next) {
 478                 if (mid == SVAL(pml->buf.data,smb_mid)) {
 479                         DEBUG(10,("remove_sharing_violation_open_smb_message: "
 480                                   "deleting mid %u len %u\n",
 481                                   (unsigned int)mid,
 482                                   (unsigned int)pml->buf.length ));
 483                         DLIST_REMOVE(deferred_open_queue, pml);
 484                         TALLOC_FREE(pml);
 485                         return;
 486                 }
 487         }
 488 }
 489
 490 /****************************************************************************
 491  Move a sharing violation open retry message to the front of the list and
 492  schedule it for immediate processing.
 493 ****************************************************************************/
 494
 495 void schedule_deferred_open_smb_message(uint16 mid)
 496 {
 497         struct pending_message_list *pml;
 498         int i = 0;
 499
 500         for (pml = deferred_open_queue; pml; pml = pml->next) {
 501                 uint16 msg_mid = SVAL(pml->buf.data,smb_mid);
 502                 DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++,
 503                         (unsigned int)msg_mid ));
 504                 if (mid == msg_mid) {
 505                         DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n",
 506                                 mid ));
 507                         pml->end_time.tv_sec = 0;
 508                         pml->end_time.tv_usec = 0;
 509                         DLIST_PROMOTE(deferred_open_queue, pml);
 510                         return;
 511                 }
 512         }
 513
 514         DEBUG(10,("schedule_deferred_open_smb_message: failed to find message mid %u\n",
 515                 mid ));
 516 }
 517
 518 /****************************************************************************
 519  Return true if this mid is on the deferred queue.
 520 ****************************************************************************/
 521
 522 bool open_was_deferred(uint16 mid)
 523 {
 524         struct pending_message_list *pml;
 525
 526         for (pml = deferred_open_queue; pml; pml = pml->next) {
 527                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 528                         return True;
 529                 }
 530         }
 531         return False;
 532 }
 533
 534 /****************************************************************************
 535  Return the message queued by this mid.
 536 ****************************************************************************/
 537
 538 struct pending_message_list *get_open_deferred_message(uint16 mid)
 539 {
 540         struct pending_message_list *pml;
 541
 542         for (pml = deferred_open_queue; pml; pml = pml->next) {
 543                 if (SVAL(pml->buf.data,smb_mid) == mid) {
 544                         return pml;
 545                 }
 546         }
 547         return NULL;
 548 }
 549
 550 /****************************************************************************
 551  Function to push a deferred open smb message onto a linked list of local smb
 552  messages ready for processing.
 553 ****************************************************************************/
 554
 555 bool push_deferred_smb_message(struct smb_request *req,
 556                                struct timeval request_time,
 557                                struct timeval timeout,
 558                                char *private_data, size_t priv_len)
 559 {
 560         struct timeval end_time;
 561
 562         if (req->unread_bytes) {
 563                 DEBUG(0,("push_deferred_smb_message: logic error ! "
 564                         "unread_bytes = %u\n",
 565                         (unsigned int)req->unread_bytes ));
 566                 smb_panic("push_deferred_smb_message: "
 567                         "logic error unread_bytes != 0" );
 568         }
 569
 570         end_time = timeval_sum(&request_time, &timeout);
 571
 572         DEBUG(10,("push_deferred_open_smb_message: pushing message len %u mid %u "
 573                   "timeout time [%u.%06u]\n",
 574                   (unsigned int) smb_len(req->inbuf)+4, (unsigned int)req->mid,
 575                   (unsigned int)end_time.tv_sec,
 576                   (unsigned int)end_time.tv_usec));
 577
 578         return push_queued_message(req, request_time, end_time,
 579                                    private_data, priv_len);
 580 }
 581
 582 struct idle_event {
 583         struct timed_event *te;
 584         struct timeval interval;
 585         char *name;
 586         bool (*handler)(const struct timeval *now, void *private_data);
 587         void *private_data;
 588 };
 589
 590 static void idle_event_handler(struct event_context *ctx,
 591                                struct timed_event *te,
 592                                const struct timeval *now,
 593                                void *private_data)
 594 {
 595         struct idle_event *event =
 596                 talloc_get_type_abort(private_data, struct idle_event);
 597
 598         TALLOC_FREE(event->te);
 599
 600         if (!event->handler(now, event->private_data)) {
 601                 /* Don't repeat, delete ourselves */
 602                 TALLOC_FREE(event);
 603                 return;
 604         }
 605
 606         event->te = event_add_timed(ctx, event,
 607                                     timeval_sum(now, &event->interval),
 608                                     event->name,
 609                                     idle_event_handler, event);
 610
 611         /* We can't do much but fail here. */
 612         SMB_ASSERT(event->te != NULL);
 613 }
 614
 615 struct idle_event *event_add_idle(struct event_context *event_ctx,
 616                                   TALLOC_CTX *mem_ctx,
 617                                   struct timeval interval,
 618                                   const char *name,
 619                                   bool (*handler)(const struct timeval *now,
 620                                                   void *private_data),
 621                                   void *private_data)
 622 {
 623         struct idle_event *result;
 624         struct timeval now = timeval_current();
 625
 626         result = TALLOC_P(mem_ctx, struct idle_event);
 627         if (result == NULL) {
 628                 DEBUG(0, ("talloc failed\n"));
 629                 return NULL;
 630         }
 631
 632         result->interval = interval;
 633         result->handler = handler;
 634         result->private_data = private_data;
 635
 636         if (!(result->name = talloc_asprintf(result, "idle_evt(%s)", name))) {
 637                 DEBUG(0, ("talloc failed\n"));
 638                 TALLOC_FREE(result);
 639                 return NULL;
 640         }
 641
 642         result->te = event_add_timed(event_ctx, result,
 643                                      timeval_sum(&now, &interval),
 644                                      result->name,
 645                                      idle_event_handler, result);
 646         if (result->te == NULL) {
 647                 DEBUG(0, ("event_add_timed failed\n"));
 648                 TALLOC_FREE(result);
 649                 return NULL;
 650         }
 651
 652         return result;
 653 }
 654
 655 /****************************************************************************
 656  Do all async processing in here. This includes kernel oplock messages, change
 657  notify events etc.
 658 ****************************************************************************/
 659
 660 static void async_processing(fd_set *pfds)
 661 {
 662         DEBUG(10,("async_processing: Doing async processing.\n"));
 663
 664         process_aio_queue();
 665
 666         process_kernel_oplocks(smbd_messaging_context(), pfds);
 667
 668         /* Do the aio check again after receive_local_message as it does a
 669            select and may have eaten our signal. */
 670         /* Is this till true? -- vl */
 671         process_aio_queue();
 672
 673         if (got_sig_term) {
 674                 exit_server_cleanly("termination signal");
 675         }
 676
 677         /* check for sighup processing */
 678         if (reload_after_sighup) {
 679                 change_to_root_user();
 680                 DEBUG(1,("Reloading services after SIGHUP\n"));
 681                 reload_services(False);
 682                 reload_after_sighup = 0;
 683         }
 684 }
 685
 686 /****************************************************************************
 687  Add a fd to the set we will be select(2)ing on.
 688 ****************************************************************************/
 689
 690 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 691 {
 692         if (fd != -1) {
 693                 FD_SET(fd, fds);
 694                 maxfd = MAX(maxfd, fd);
 695         }
 696
 697         return maxfd;
 698 }
 699
 700 /****************************************************************************
 701   Do a select on an two fd's - with timeout.
 702
 703   If a local udp message has been pushed onto the
 704   queue (this can only happen during oplock break
 705   processing) call async_processing()
 706
 707   If a pending smb message has been pushed onto the
 708   queue (this can only happen during oplock break
 709   processing) return this next.
 710
 711   If the first smbfd is ready then read an smb from it.
 712   if the second (loopback UDP) fd is ready then read a message
 713   from it and setup the buffer header to identify the length
 714   and from address.
 715   Returns False on timeout or error.
 716   Else returns True.
 717
 718 The timeout is in milliseconds
 719 ****************************************************************************/
 720
 721 static bool receive_message_or_smb(TALLOC_CTX *mem_ctx,
 722                                 char **buffer,
 723                                 size_t *buffer_len,
 724                                 int timeout,
 725                                 size_t *p_unread,
 726                                 bool *p_encrypted)
 727 {
 728         fd_set r_fds, w_fds;
 729         int selrtn;
 730         struct timeval to;
 731         int maxfd = 0;
 732         size_t len;
 733         NTSTATUS status;
 734
 735         *p_unread = 0;
 736         set_smb_read_error(get_srv_read_error(),SMB_READ_OK);
 737
 738  again:
 739
 740         if (timeout >= 0) {
 741                 to.tv_sec = timeout / 1000;
 742                 to.tv_usec = (timeout % 1000) * 1000;
 743         } else {
 744                 to.tv_sec = SMBD_SELECT_TIMEOUT;
 745                 to.tv_usec = 0;
 746         }
 747
 748         /*
 749          * Note that this call must be before processing any SMB
 750          * messages as we need to synchronously process any messages
 751          * we may have sent to ourselves from the previous SMB.
 752          */
 753         message_dispatch(smbd_messaging_context());
 754
 755         /*
 756          * Check to see if we already have a message on the deferred open queue
 757          * and it's time to schedule.
 758          */
 759         if(deferred_open_queue != NULL) {
 760                 bool pop_message = False;
 761                 struct pending_message_list *msg = deferred_open_queue;
 762
 763                 if (timeval_is_zero(&msg->end_time)) {
 764                         pop_message = True;
 765                 } else {
 766                         struct timeval tv;
 767                         SMB_BIG_INT tdif;
 768
 769                         GetTimeOfDay(&tv);
 770                         tdif = usec_time_diff(&msg->end_time, &tv);
 771                         if (tdif <= 0) {
 772                                 /* Timed out. Schedule...*/
 773                                 pop_message = True;
 774                                 DEBUG(10,("receive_message_or_smb: queued message timed out.\n"));
 775                         } else {
 776                                 /* Make a more accurate select timeout. */
 777                                 to.tv_sec = tdif / 1000000;
 778                                 to.tv_usec = tdif % 1000000;
 779                                 DEBUG(10,("receive_message_or_smb: select with timeout of [%u.%06u]\n",
 780                                         (unsigned int)to.tv_sec, (unsigned int)to.tv_usec ));
 781                         }
 782                 }
 783
 784                 if (pop_message) {
 785
 786                         *buffer = (char *)talloc_memdup(mem_ctx, msg->buf.data,
 787                                                         msg->buf.length);
 788                         if (*buffer == NULL) {
 789                                 DEBUG(0, ("talloc failed\n"));
 790                                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 791                                 return False;
 792                         }
 793                         *buffer_len = msg->buf.length;
 794                         *p_encrypted = msg->encrypted;
 795
 796                         /* We leave this message on the queue so the open code can
 797                            know this is a retry. */
 798                         DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n"));
 799                         return True;
 800                 }
 801         }
 802
 803         /*
 804          * Setup the select fd sets.
 805          */
 806
 807         FD_ZERO(&r_fds);
 808         FD_ZERO(&w_fds);
 809
 810         /*
 811          * Ensure we process oplock break messages by preference.
 812          * We have to do this before the select, after the select
 813          * and if the select returns EINTR. This is due to the fact
 814          * that the selects called from async_processing can eat an EINTR
 815          * caused by a signal (we can't take the break message there).
 816          * This is hideously complex - *MUST* be simplified for 3.0 ! JRA.
 817          */
 818
 819         if (oplock_message_waiting(&r_fds)) {
 820                 DEBUG(10,("receive_message_or_smb: oplock_message is waiting.\n"));
 821                 async_processing(&r_fds);
 822                 /*
 823                  * After async processing we must go and do the select again, as
 824                  * the state of the flag in fds for the server file descriptor is
 825                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 826                  */
 827                 goto again;
 828         }
 829
 830         /*
 831          * Are there any timed events waiting ? If so, ensure we don't
 832          * select for longer than it would take to wait for them.
 833          */
 834
 835         {
 836                 struct timeval now;
 837                 GetTimeOfDay(&now);
 838
 839                 event_add_to_select_args(smbd_event_context(), &now,
 840                                          &r_fds, &w_fds, &to, &maxfd);
 841         }
 842
 843         if (timeval_is_zero(&to)) {
 844                 /* Process a timed event now... */
 845                 if (run_events(smbd_event_context(), 0, NULL, NULL)) {
 846                         goto again;
 847                 }
 848         }
 849
 850         {
 851                 int sav;
 852                 START_PROFILE(smbd_idle);
 853
 854                 maxfd = select_on_fd(smbd_server_fd(), maxfd, &r_fds);
 855                 maxfd = select_on_fd(oplock_notify_fd(), maxfd, &r_fds);
 856
 857                 selrtn = sys_select(maxfd+1,&r_fds,&w_fds,NULL,&to);
 858                 sav = errno;
 859
 860                 END_PROFILE(smbd_idle);
 861                 errno = sav;
 862         }
 863
 864         if (run_events(smbd_event_context(), selrtn, &r_fds, &w_fds)) {
 865                 goto again;
 866         }
 867
 868         /* if we get EINTR then maybe we have received an oplock
 869            signal - treat this as select returning 1. This is ugly, but
 870            is the best we can do until the oplock code knows more about
 871            signals */
 872         if (selrtn == -1 && errno == EINTR) {
 873                 async_processing(&r_fds);
 874                 /*
 875                  * After async processing we must go and do the select again, as
 876                  * the state of the flag in fds for the server file descriptor is
 877                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 878                  */
 879                 goto again;
 880         }
 881
 882         /* Check if error */
 883         if (selrtn == -1) {
 884                 /* something is wrong. Maybe the socket is dead? */
 885                 set_smb_read_error(get_srv_read_error(),SMB_READ_ERROR);
 886                 return False;
 887         }
 888
 889         /* Did we timeout ? */
 890         if (selrtn == 0) {
 891                 set_smb_read_error(get_srv_read_error(),SMB_READ_TIMEOUT);
 892                 return False;
 893         }
 894
 895         /*
 896          * Ensure we process oplock break messages by preference.
 897          * This is IMPORTANT ! Otherwise we can starve other processes
 898          * sending us an oplock break message. JRA.
 899          */
 900
 901         if (oplock_message_waiting(&r_fds)) {
 902                 async_processing(&r_fds);
 903                 /*
 904                  * After async processing we must go and do the select again, as
 905                  * the state of the flag in fds for the server file descriptor is
 906                  * indeterminate - we may have done I/O on it in the oplock processing. JRA.
 907                  */
 908                 goto again;
 909         }
 910
 911         status = receive_smb_talloc(mem_ctx, smbd_server_fd(), buffer, 0,
 912                                     p_unread, p_encrypted, &len);
 913
 914         if (!NT_STATUS_IS_OK(status)) {
 915                 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 916                         set_smb_read_error(get_srv_read_error(), SMB_READ_EOF);
 917                         return false;
 918                 }
 919
 920                 if (NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 921                         set_smb_read_error(get_srv_read_error(),
 922                                            SMB_READ_TIMEOUT);
 923                         return false;
 924                 }
 925
 926                 set_smb_read_error(get_srv_read_error(), SMB_READ_ERROR);
 927                 return false;
 928         }
 929
 930         *buffer_len = len;
 931
 932         return True;
 933 }
 934
 935 /*
 936  * Only allow 5 outstanding trans requests. We're allocating memory, so
 937  * prevent a DoS.
 938  */
 939
 940 NTSTATUS allow_new_trans(struct trans_state *list, int mid)
 941 {
 942         int count = 0;
 943         for (; list != NULL; list = list->next) {
 944
 945                 if (list->mid == mid) {
 946                         return NT_STATUS_INVALID_PARAMETER;
 947                 }
 948
 949                 count += 1;
 950         }
 951         if (count > 5) {
 952                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 953         }
 954
 955         return NT_STATUS_OK;
 956 }
 957
 958 /****************************************************************************
 959  We're terminating and have closed all our files/connections etc.
 960  If there are any pending local messages we need to respond to them
 961  before termination so that other smbds don't think we just died whilst
 962  holding oplocks.
 963 ****************************************************************************/
 964
 965 void respond_to_all_remaining_local_messages(void)
 966 {
 967         /*
 968          * Assert we have no exclusive open oplocks.
 969          */
 970
 971         if(get_number_of_exclusive_open_oplocks()) {
 972                 DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n",
 973                         get_number_of_exclusive_open_oplocks() ));
 974                 return;
 975         }
 976
 977         process_kernel_oplocks(smbd_messaging_context(), NULL);
 978
 979         return;
 980 }
 981
 982
 983 /*
 984 These flags determine some of the permissions required to do an operation
 985
 986 Note that I don't set NEED_WRITE on some write operations because they
 987 are used by some brain-dead clients when printing, and I don't want to
 988 force write permissions on print services.
 989 */
 990 #define AS_USER (1<<0)
 991 #define NEED_WRITE (1<<1) /* Must be paired with AS_USER */
 992 #define TIME_INIT (1<<2)
 993 #define CAN_IPC (1<<3) /* Must be paired with AS_USER */
 994 #define AS_GUEST (1<<5) /* Must *NOT* be paired with AS_USER */
 995 #define DO_CHDIR (1<<6)
 996
 997 /*
 998    define a list of possible SMB messages and their corresponding
 999    functions. Any message that has a NULL function is unimplemented -
1000    please feel free to contribute implementations!
1001 */
1002 static const struct smb_message_struct {
1003         const char *name;
1004         void (*fn_new)(struct smb_request *req);
1005         int flags;
1006 } smb_messages[256] = {
1007
1008 /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
1009 /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
1010 /* 0x02 */ { "SMBopen",reply_open,AS_USER },
1011 /* 0x03 */ { "SMBcreate",reply_mknew,AS_USER},
1012 /* 0x04 */ { "SMBclose",reply_close,AS_USER | CAN_IPC },
1013 /* 0x05 */ { "SMBflush",reply_flush,AS_USER},
1014 /* 0x06 */ { "SMBunlink",reply_unlink,AS_USER | NEED_WRITE },
1015 /* 0x07 */ { "SMBmv",reply_mv,AS_USER | NEED_WRITE },
1016 /* 0x08 */ { "SMBgetatr",reply_getatr,AS_USER},
1017 /* 0x09 */ { "SMBsetatr",reply_setatr,AS_USER | NEED_WRITE},
1018 /* 0x0a */ { "SMBread",reply_read,AS_USER},
1019 /* 0x0b */ { "SMBwrite",reply_write,AS_USER | CAN_IPC },
1020 /* 0x0c */ { "SMBlock",reply_lock,AS_USER},
1021 /* 0x0d */ { "SMBunlock",reply_unlock,AS_USER},
1022 /* 0x0e */ { "SMBctemp",reply_ctemp,AS_USER },
1023 /* 0x0f */ { "SMBmknew",reply_mknew,AS_USER},
1024 /* 0x10 */ { "SMBcheckpath",reply_checkpath,AS_USER},
1025 /* 0x11 */ { "SMBexit",reply_exit,DO_CHDIR},
1026 /* 0x12 */ { "SMBlseek",reply_lseek,AS_USER},
1027 /* 0x13 */ { "SMBlockread",reply_lockread,AS_USER},
1028 /* 0x14 */ { "SMBwriteunlock",reply_writeunlock,AS_USER},
1029 /* 0x15 */ { NULL, NULL, 0 },
1030 /* 0x16 */ { NULL, NULL, 0 },
1031 /* 0x17 */ { NULL, NULL, 0 },
1032 /* 0x18 */ { NULL, NULL, 0 },
1033 /* 0x19 */ { NULL, NULL, 0 },
1034 /* 0x1a */ { "SMBreadbraw",reply_readbraw,AS_USER},
1035 /* 0x1b */ { "SMBreadBmpx",reply_readbmpx,AS_USER},
1036 /* 0x1c */ { "SMBreadBs",reply_readbs,AS_USER },
1037 /* 0x1d */ { "SMBwritebraw",reply_writebraw,AS_USER},
1038 /* 0x1e */ { "SMBwriteBmpx",reply_writebmpx,AS_USER},
1039 /* 0x1f */ { "SMBwriteBs",reply_writebs,AS_USER},
1040 /* 0x20 */ { "SMBwritec", NULL,0},
1041 /* 0x21 */ { NULL, NULL, 0 },
1042 /* 0x22 */ { "SMBsetattrE",reply_setattrE,AS_USER | NEED_WRITE },
1043 /* 0x23 */ { "SMBgetattrE",reply_getattrE,AS_USER },
1044 /* 0x24 */ { "SMBlockingX",reply_lockingX,AS_USER },
1045 /* 0x25 */ { "SMBtrans",reply_trans,AS_USER | CAN_IPC },
1046 /* 0x26 */ { "SMBtranss",reply_transs,AS_USER | CAN_IPC},
1047 /* 0x27 */ { "SMBioctl",reply_ioctl,0},
1048 /* 0x28 */ { "SMBioctls", NULL,AS_USER},
1049 /* 0x29 */ { "SMBcopy",reply_copy,AS_USER | NEED_WRITE },
1050 /* 0x2a */ { "SMBmove", NULL,AS_USER | NEED_WRITE },
1051 /* 0x2b */ { "SMBecho",reply_echo,0},
1052 /* 0x2c */ { "SMBwriteclose",reply_writeclose,AS_USER},
1053 /* 0x2d */ { "SMBopenX",reply_open_and_X,AS_USER | CAN_IPC },
1054 /* 0x2e */ { "SMBreadX",reply_read_and_X,AS_USER | CAN_IPC },
1055 /* 0x2f */ { "SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC },
1056 /* 0x30 */ { NULL, NULL, 0 },
1057 /* 0x31 */ { NULL, NULL, 0 },
1058 /* 0x32 */ { "SMBtrans2",reply_trans2, AS_USER | CAN_IPC },
1059 /* 0x33 */ { "SMBtranss2",reply_transs2, AS_USER},
1060 /* 0x34 */ { "SMBfindclose",reply_findclose,AS_USER},
1061 /* 0x35 */ { "SMBfindnclose",reply_findnclose,AS_USER},
1062 /* 0x36 */ { NULL, NULL, 0 },
1063 /* 0x37 */ { NULL, NULL, 0 },
1064 /* 0x38 */ { NULL, NULL, 0 },
1065 /* 0x39 */ { NULL, NULL, 0 },
1066 /* 0x3a */ { NULL, NULL, 0 },
1067 /* 0x3b */ { NULL, NULL, 0 },
1068 /* 0x3c */ { NULL, NULL, 0 },
1069 /* 0x3d */ { NULL, NULL, 0 },
1070 /* 0x3e */ { NULL, NULL, 0 },
1071 /* 0x3f */ { NULL, NULL, 0 },
1072 /* 0x40 */ { NULL, NULL, 0 },
1073 /* 0x41 */ { NULL, NULL, 0 },
1074 /* 0x42 */ { NULL, NULL, 0 },
1075 /* 0x43 */ { NULL, NULL, 0 },
1076 /* 0x44 */ { NULL, NULL, 0 },
1077 /* 0x45 */ { NULL, NULL, 0 },
1078 /* 0x46 */ { NULL, NULL, 0 },
1079 /* 0x47 */ { NULL, NULL, 0 },
1080 /* 0x48 */ { NULL, NULL, 0 },
1081 /* 0x49 */ { NULL, NULL, 0 },
1082 /* 0x4a */ { NULL, NULL, 0 },
1083 /* 0x4b */ { NULL, NULL, 0 },
1084 /* 0x4c */ { NULL, NULL, 0 },
1085 /* 0x4d */ { NULL, NULL, 0 },
1086 /* 0x4e */ { NULL, NULL, 0 },
1087 /* 0x4f */ { NULL, NULL, 0 },
1088 /* 0x50 */ { NULL, NULL, 0 },
1089 /* 0x51 */ { NULL, NULL, 0 },
1090 /* 0x52 */ { NULL, NULL, 0 },
1091 /* 0x53 */ { NULL, NULL, 0 },
1092 /* 0x54 */ { NULL, NULL, 0 },
1093 /* 0x55 */ { NULL, NULL, 0 },
1094 /* 0x56 */ { NULL, NULL, 0 },
1095 /* 0x57 */ { NULL, NULL, 0 },
1096 /* 0x58 */ { NULL, NULL, 0 },
1097 /* 0x59 */ { NULL, NULL, 0 },
1098 /* 0x5a */ { NULL, NULL, 0 },
1099 /* 0x5b */ { NULL, NULL, 0 },
1100 /* 0x5c */ { NULL, NULL, 0 },
1101 /* 0x5d */ { NULL, NULL, 0 },
1102 /* 0x5e */ { NULL, NULL, 0 },
1103 /* 0x5f */ { NULL, NULL, 0 },
1104 /* 0x60 */ { NULL, NULL, 0 },
1105 /* 0x61 */ { NULL, NULL, 0 },
1106 /* 0x62 */ { NULL, NULL, 0 },
1107 /* 0x63 */ { NULL, NULL, 0 },
1108 /* 0x64 */ { NULL, NULL, 0 },
1109 /* 0x65 */ { NULL, NULL, 0 },
1110 /* 0x66 */ { NULL, NULL, 0 },
1111 /* 0x67 */ { NULL, NULL, 0 },
1112 /* 0x68 */ { NULL, NULL, 0 },
1113 /* 0x69 */ { NULL, NULL, 0 },
1114 /* 0x6a */ { NULL, NULL, 0 },
1115 /* 0x6b */ { NULL, NULL, 0 },
1116 /* 0x6c */ { NULL, NULL, 0 },
1117 /* 0x6d */ { NULL, NULL, 0 },
1118 /* 0x6e */ { NULL, NULL, 0 },
1119 /* 0x6f */ { NULL, NULL, 0 },
1120 /* 0x70 */ { "SMBtcon",reply_tcon,0},
1121 /* 0x71 */ { "SMBtdis",reply_tdis,DO_CHDIR},
1122 /* 0x72 */ { "SMBnegprot",reply_negprot,0},
1123 /* 0x73 */ { "SMBsesssetupX",reply_sesssetup_and_X,0},
1124 /* 0x74 */ { "SMBulogoffX",reply_ulogoffX, 0}, /* ulogoff doesn't give a valid TID */
1125 /* 0x75 */ { "SMBtconX",reply_tcon_and_X,0},
1126 /* 0x76 */ { NULL, NULL, 0 },
1127 /* 0x77 */ { NULL, NULL, 0 },
1128 /* 0x78 */ { NULL, NULL, 0 },
1129 /* 0x79 */ { NULL, NULL, 0 },
1130 /* 0x7a */ { NULL, NULL, 0 },
1131 /* 0x7b */ { NULL, NULL, 0 },
1132 /* 0x7c */ { NULL, NULL, 0 },
1133 /* 0x7d */ { NULL, NULL, 0 },
1134 /* 0x7e */ { NULL, NULL, 0 },
1135 /* 0x7f */ { NULL, NULL, 0 },
1136 /* 0x80 */ { "SMBdskattr",reply_dskattr,AS_USER},
1137 /* 0x81 */ { "SMBsearch",reply_search,AS_USER},
1138 /* 0x82 */ { "SMBffirst",reply_search,AS_USER},
1139 /* 0x83 */ { "SMBfunique",reply_search,AS_USER},
1140 /* 0x84 */ { "SMBfclose",reply_fclose,AS_USER},
1141 /* 0x85 */ { NULL, NULL, 0 },
1142 /* 0x86 */ { NULL, NULL, 0 },
1143 /* 0x87 */ { NULL, NULL, 0 },
1144 /* 0x88 */ { NULL, NULL, 0 },
1145 /* 0x89 */ { NULL, NULL, 0 },
1146 /* 0x8a */ { NULL, NULL, 0 },
1147 /* 0x8b */ { NULL, NULL, 0 },
1148 /* 0x8c */ { NULL, NULL, 0 },
1149 /* 0x8d */ { NULL, NULL, 0 },
1150 /* 0x8e */ { NULL, NULL, 0 },
1151 /* 0x8f */ { NULL, NULL, 0 },
1152 /* 0x90 */ { NULL, NULL, 0 },
1153 /* 0x91 */ { NULL, NULL, 0 },
1154 /* 0x92 */ { NULL, NULL, 0 },
1155 /* 0x93 */ { NULL, NULL, 0 },
1156 /* 0x94 */ { NULL, NULL, 0 },
1157 /* 0x95 */ { NULL, NULL, 0 },
1158 /* 0x96 */ { NULL, NULL, 0 },
1159 /* 0x97 */ { NULL, NULL, 0 },
1160 /* 0x98 */ { NULL, NULL, 0 },
1161 /* 0x99 */ { NULL, NULL, 0 },
1162 /* 0x9a */ { NULL, NULL, 0 },
1163 /* 0x9b */ { NULL, NULL, 0 },
1164 /* 0x9c */ { NULL, NULL, 0 },
1165 /* 0x9d */ { NULL, NULL, 0 },
1166 /* 0x9e */ { NULL, NULL, 0 },
1167 /* 0x9f */ { NULL, NULL, 0 },
1168 /* 0xa0 */ { "SMBnttrans",reply_nttrans, AS_USER | CAN_IPC },
1169 /* 0xa1 */ { "SMBnttranss",reply_nttranss, AS_USER | CAN_IPC },
1170 /* 0xa2 */ { "SMBntcreateX",reply_ntcreate_and_X, AS_USER | CAN_IPC },
1171 /* 0xa3 */ { NULL, NULL, 0 },
1172 /* 0xa4 */ { "SMBntcancel",reply_ntcancel, 0 },
1173 /* 0xa5 */ { "SMBntrename",reply_ntrename, AS_USER | NEED_WRITE },
1174 /* 0xa6 */ { NULL, NULL, 0 },
1175 /* 0xa7 */ { NULL, NULL, 0 },
1176 /* 0xa8 */ { NULL, NULL, 0 },
1177 /* 0xa9 */ { NULL, NULL, 0 },
1178 /* 0xaa */ { NULL, NULL, 0 },
1179 /* 0xab */ { NULL, NULL, 0 },
1180 /* 0xac */ { NULL, NULL, 0 },
1181 /* 0xad */ { NULL, NULL, 0 },
1182 /* 0xae */ { NULL, NULL, 0 },
1183 /* 0xaf */ { NULL, NULL, 0 },
1184 /* 0xb0 */ { NULL, NULL, 0 },
1185 /* 0xb1 */ { NULL, NULL, 0 },
1186 /* 0xb2 */ { NULL, NULL, 0 },
1187 /* 0xb3 */ { NULL, NULL, 0 },
1188 /* 0xb4 */ { NULL, NULL, 0 },
1189 /* 0xb5 */ { NULL, NULL, 0 },
1190 /* 0xb6 */ { NULL, NULL, 0 },
1191 /* 0xb7 */ { NULL, NULL, 0 },
1192 /* 0xb8 */ { NULL, NULL, 0 },
1193 /* 0xb9 */ { NULL, NULL, 0 },
1194 /* 0xba */ { NULL, NULL, 0 },
1195 /* 0xbb */ { NULL, NULL, 0 },
1196 /* 0xbc */ { NULL, NULL, 0 },
1197 /* 0xbd */ { NULL, NULL, 0 },
1198 /* 0xbe */ { NULL, NULL, 0 },
1199 /* 0xbf */ { NULL, NULL, 0 },
1200 /* 0xc0 */ { "SMBsplopen",reply_printopen,AS_USER},
1201 /* 0xc1 */ { "SMBsplwr",reply_printwrite,AS_USER},
1202 /* 0xc2 */ { "SMBsplclose",reply_printclose,AS_USER},
1203 /* 0xc3 */ { "SMBsplretq",reply_printqueue,AS_USER},
1204 /* 0xc4 */ { NULL, NULL, 0 },
1205 /* 0xc5 */ { NULL, NULL, 0 },
1206 /* 0xc6 */ { NULL, NULL, 0 },
1207 /* 0xc7 */ { NULL, NULL, 0 },
1208 /* 0xc8 */ { NULL, NULL, 0 },
1209 /* 0xc9 */ { NULL, NULL, 0 },
1210 /* 0xca */ { NULL, NULL, 0 },
1211 /* 0xcb */ { NULL, NULL, 0 },
1212 /* 0xcc */ { NULL, NULL, 0 },
1213 /* 0xcd */ { NULL, NULL, 0 },
1214 /* 0xce */ { NULL, NULL, 0 },
1215 /* 0xcf */ { NULL, NULL, 0 },
1216 /* 0xd0 */ { "SMBsends",reply_sends,AS_GUEST},
1217 /* 0xd1 */ { "SMBsendb", NULL,AS_GUEST},
1218 /* 0xd2 */ { "SMBfwdname", NULL,AS_GUEST},
1219 /* 0xd3 */ { "SMBcancelf", NULL,AS_GUEST},
1220 /* 0xd4 */ { "SMBgetmac", NULL,AS_GUEST},
1221 /* 0xd5 */ { "SMBsendstrt",reply_sendstrt,AS_GUEST},
1222 /* 0xd6 */ { "SMBsendend",reply_sendend,AS_GUEST},
1223 /* 0xd7 */ { "SMBsendtxt",reply_sendtxt,AS_GUEST},
1224 /* 0xd8 */ { NULL, NULL, 0 },
1225 /* 0xd9 */ { NULL, NULL, 0 },
1226 /* 0xda */ { NULL, NULL, 0 },
1227 /* 0xdb */ { NULL, NULL, 0 },
1228 /* 0xdc */ { NULL, NULL, 0 },
1229 /* 0xdd */ { NULL, NULL, 0 },
1230 /* 0xde */ { NULL, NULL, 0 },
1231 /* 0xdf */ { NULL, NULL, 0 },
1232 /* 0xe0 */ { NULL, NULL, 0 },
1233 /* 0xe1 */ { NULL, NULL, 0 },
1234 /* 0xe2 */ { NULL, NULL, 0 },
1235 /* 0xe3 */ { NULL, NULL, 0 },
1236 /* 0xe4 */ { NULL, NULL, 0 },
1237 /* 0xe5 */ { NULL, NULL, 0 },
1238 /* 0xe6 */ { NULL, NULL, 0 },
1239 /* 0xe7 */ { NULL, NULL, 0 },
1240 /* 0xe8 */ { NULL, NULL, 0 },
1241 /* 0xe9 */ { NULL, NULL, 0 },
1242 /* 0xea */ { NULL, NULL, 0 },
1243 /* 0xeb */ { NULL, NULL, 0 },
1244 /* 0xec */ { NULL, NULL, 0 },
1245 /* 0xed */ { NULL, NULL, 0 },
1246 /* 0xee */ { NULL, NULL, 0 },
1247 /* 0xef */ { NULL, NULL, 0 },
1248 /* 0xf0 */ { NULL, NULL, 0 },
1249 /* 0xf1 */ { NULL, NULL, 0 },
1250 /* 0xf2 */ { NULL, NULL, 0 },
1251 /* 0xf3 */ { NULL, NULL, 0 },
1252 /* 0xf4 */ { NULL, NULL, 0 },
1253 /* 0xf5 */ { NULL, NULL, 0 },
1254 /* 0xf6 */ { NULL, NULL, 0 },
1255 /* 0xf7 */ { NULL, NULL, 0 },
1256 /* 0xf8 */ { NULL, NULL, 0 },
1257 /* 0xf9 */ { NULL, NULL, 0 },
1258 /* 0xfa */ { NULL, NULL, 0 },
1259 /* 0xfb */ { NULL, NULL, 0 },
1260 /* 0xfc */ { NULL, NULL, 0 },
1261 /* 0xfd */ { NULL, NULL, 0 },
1262 /* 0xfe */ { NULL, NULL, 0 },
1263 /* 0xff */ { NULL, NULL, 0 }
1264
1265 };
1266
1267 /*******************************************************************
1268  allocate and initialize a reply packet
1269 ********************************************************************/
1270
1271 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
1272 {
1273         /*
1274          * Protect against integer wrap
1275          */
1276         if ((num_bytes > 0xffffff)
1277             || ((num_bytes + smb_size + num_words*2) > 0xffffff)) {
1278                 char *msg;
1279                 asprintf(&msg, "num_bytes too large: %u",
1280                          (unsigned)num_bytes);
1281                 smb_panic(msg);
1282         }
1283
1284         if (!(req->outbuf = TALLOC_ARRAY(
1285                       req, uint8,
1286                       smb_size + num_words*2 + num_bytes))) {
1287                 smb_panic("could not allocate output buffer\n");
1288         }
1289
1290         construct_reply_common((char *)req->inbuf, (char *)req->outbuf);
1291         srv_set_message((char *)req->outbuf, num_words, num_bytes, false);
1292         /*
1293          * Zero out the word area, the caller has to take care of the bcc area
1294          * himself
1295          */
1296         if (num_words != 0) {
1297                 memset(req->outbuf + smb_vwv0, 0, num_words*2);
1298         }
1299
1300         return;
1301 }
1302
1303
1304 /*******************************************************************
1305  Dump a packet to a file.
1306 ********************************************************************/
1307
1308 static void smb_dump(const char *name, int type, const char *data, ssize_t len)
1309 {
1310         int fd, i;
1311         char *fname = NULL;
1312         if (DEBUGLEVEL < 50) {
1313                 return;
1314         }
1315
1316         if (len < 4) len = smb_len(data)+4;
1317         for (i=1;i<100;i++) {
1318                 asprintf(&fname, "/tmp/%s.%d.%s", name, i,
1319                                 type ? "req" : "resp");
1320                 if (!fname) {
1321                         return;
1322                 }
1323                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
1324                 if (fd != -1 || errno != EEXIST) break;
1325         }
1326         if (fd != -1) {
1327                 ssize_t ret = write(fd, data, len);
1328                 if (ret != len)
1329                         DEBUG(0,("smb_dump: problem: write returned %d\n", (int)ret ));
1330                 close(fd);
1331                 DEBUG(0,("created %s len %lu\n", fname, (unsigned long)len));
1332         }
1333         SAFE_FREE(fname);
1334 }
1335
1336 /****************************************************************************
1337  Prepare everything for calling the actual request function, and potentially
1338  call the request function via the "new" interface.
1339
1340  Return False if the "legacy" function needs to be called, everything is
1341  prepared.
1342
1343  Return True if we're done.
1344
1345  I know this API sucks, but it is the one with the least code change I could
1346  find.
1347 ****************************************************************************/
1348
1349 static connection_struct *switch_message(uint8 type, struct smb_request *req, int size)
1350 {
1351         int flags;
1352         uint16 session_tag;
1353         connection_struct *conn = NULL;
1354
1355         static uint16 last_session_tag = UID_FIELD_INVALID;
1356
1357         errno = 0;
1358
1359         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
1360          * so subtract 4 from it. */
1361         if (!valid_smb_header(req->inbuf)
1362             || (size < (smb_size - 4))) {
1363                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
1364                          smb_len(req->inbuf)));
1365                 exit_server_cleanly("Non-SMB packet");
1366         }
1367
1368         if (smb_messages[type].fn_new == NULL) {
1369                 DEBUG(0,("Unknown message type %d!\n",type));
1370                 smb_dump("Unknown", 1, (char *)req->inbuf, size);
1371                 reply_unknown_new(req, type);
1372                 return NULL;
1373         }
1374
1375         flags = smb_messages[type].flags;
1376
1377         /* In share mode security we must ignore the vuid. */
1378         session_tag = (lp_security() == SEC_SHARE)
1379                 ? UID_FIELD_INVALID : req->vuid;
1380         conn = req->conn;
1381
1382         DEBUG(3,("switch message %s (pid %d) conn 0x%lx\n", smb_fn_name(type),
1383                  (int)sys_getpid(), (unsigned long)conn));
1384
1385         smb_dump(smb_fn_name(type), 1, (char *)req->inbuf, size);
1386
1387         /* Ensure this value is replaced in the incoming packet. */
1388         SSVAL(req->inbuf,smb_uid,session_tag);
1389
1390         /*
1391          * Ensure the correct username is in current_user_info.  This is a
1392          * really ugly bugfix for problems with multiple session_setup_and_X's
1393          * being done and allowing %U and %G substitutions to work correctly.
1394          * There is a reason this code is done here, don't move it unless you
1395          * know what you're doing... :-).
1396          * JRA.
1397          */
1398
1399         if (session_tag != last_session_tag) {
1400                 user_struct *vuser = NULL;
1401
1402                 last_session_tag = session_tag;
1403                 if(session_tag != UID_FIELD_INVALID) {
1404                         vuser = get_valid_user_struct(session_tag);
1405                         if (vuser) {
1406                                 set_current_user_info(&vuser->user);
1407                         }
1408                 }
1409         }
1410
1411         /* Does this call need to be run as the connected user? */
1412         if (flags & AS_USER) {
1413
1414                 /* Does this call need a valid tree connection? */
1415                 if (!conn) {
1416                         /*
1417                          * Amazingly, the error code depends on the command
1418                          * (from Samba4).
1419                          */
1420                         if (type == SMBntcreateX) {
1421                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1422                         } else {
1423                                 reply_doserror(req, ERRSRV, ERRinvnid);
1424                         }
1425                         return NULL;
1426                 }
1427
1428                 if (!change_to_user(conn,session_tag)) {
1429                         reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
1430                         return conn;
1431                 }
1432
1433                 /* All NEED_WRITE and CAN_IPC flags must also have AS_USER. */
1434
1435                 /* Does it need write permission? */
1436                 if ((flags & NEED_WRITE) && !CAN_WRITE(conn)) {
1437                         reply_nterror(req, NT_STATUS_MEDIA_WRITE_PROTECTED);
1438                         return conn;
1439                 }
1440
1441                 /* IPC services are limited */
1442                 if (IS_IPC(conn) && !(flags & CAN_IPC)) {
1443                         reply_doserror(req, ERRSRV,ERRaccess);
1444                         return conn;
1445                 }
1446         } else {
1447                 /* This call needs to be run as root */
1448                 change_to_root_user();
1449         }
1450
1451         /* load service specific parameters */
1452         if (conn) {
1453                 if (req->encrypted) {
1454                         conn->encrypted_tid = true;
1455                         /* encrypted required from now on. */
1456                         conn->encrypt_level = Required;
1457                 } else if (ENCRYPTION_REQUIRED(conn)) {
1458                         uint8 com = CVAL(req->inbuf,smb_com);
1459                         if (com != SMBtrans2 && com != SMBtranss2) {
1460                                 exit_server_cleanly("encryption required "
1461                                         "on connection");
1462                                 return conn;
1463                         }
1464                 }
1465
1466                 if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
1467                                          (flags & (AS_USER|DO_CHDIR)
1468                                           ?True:False))) {
1469                         reply_doserror(req, ERRSRV, ERRaccess);
1470                         return conn;
1471                 }
1472                 conn->num_smb_operations++;
1473         }
1474
1475         /* does this protocol need to be run as guest? */
1476         if ((flags & AS_GUEST)
1477             && (!change_to_guest() ||
1478                 !check_access(smbd_server_fd(), lp_hostsallow(-1),
1479                               lp_hostsdeny(-1)))) {
1480                 reply_doserror(req, ERRSRV, ERRaccess);
1481                 return conn;
1482         }
1483
1484         smb_messages[type].fn_new(req);
1485         return req->conn;
1486 }
1487
1488 /****************************************************************************
1489  Construct a reply to the incoming packet.
1490 ****************************************************************************/
1491
1492 static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted)
1493 {
1494         uint8 type = CVAL(inbuf,smb_com);
1495         connection_struct *conn;
1496         struct smb_request *req;
1497
1498         chain_size = 0;
1499         file_chain_reset();
1500         reset_chain_p();
1501
1502         if (!(req = talloc(talloc_tos(), struct smb_request))) {
1503                 smb_panic("could not allocate smb_request");
1504         }
1505         init_smb_request(req, (uint8 *)inbuf, unread_bytes, encrypted);
1506
1507         conn = switch_message(type, req, size);
1508
1509         if (req->unread_bytes) {
1510                 /* writeX failed. drain socket. */
1511                 if (drain_socket(smbd_server_fd(), req->unread_bytes) !=
1512                                 req->unread_bytes) {
1513                         smb_panic("failed to drain pending bytes");
1514                 }
1515                 req->unread_bytes = 0;
1516         }
1517
1518         if (req->outbuf == NULL) {
1519                 return;
1520         }
1521
1522         if (CVAL(req->outbuf,0) == 0) {
1523                 show_msg((char *)req->outbuf);
1524         }
1525
1526         if (!srv_send_smb(smbd_server_fd(),
1527                         (char *)req->outbuf,
1528                         IS_CONN_ENCRYPTED(conn)||req->encrypted)) {
1529                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
1530         }
1531
1532         TALLOC_FREE(req);
1533
1534         return;
1535 }
1536
1537 /****************************************************************************
1538  Process an smb from the client
1539 ****************************************************************************/
1540
1541 static void process_smb(char *inbuf, size_t nread, size_t unread_bytes, bool encrypted)
1542 {
1543         static int trans_num;
1544         int msg_type = CVAL(inbuf,0);
1545
1546         DO_PROFILE_INC(smb_count);
1547
1548         if (trans_num == 0) {
1549                 char addr[INET6_ADDRSTRLEN];
1550
1551                 /* on the first packet, check the global hosts allow/ hosts
1552                 deny parameters before doing any parsing of the packet
1553                 passed to us by the client.  This prevents attacks on our
1554                 parsing code from hosts not in the hosts allow list */
1555
1556                 if (!check_access(smbd_server_fd(), lp_hostsallow(-1),
1557                                   lp_hostsdeny(-1))) {
1558                         /* send a negative session response "not listening on calling name" */
1559                         static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81};
1560                         DEBUG( 1, ( "Connection denied from %s\n",
1561                                 client_addr(get_client_fd(),addr,sizeof(addr)) ) );
1562                         (void)srv_send_smb(smbd_server_fd(),(char *)buf,false);
1563                         exit_server_cleanly("connection denied");
1564                 }
1565         }
1566
1567         DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type,
1568                     smb_len(inbuf) ) );
1569         DEBUG( 3, ( "Transaction %d of length %d (%u toread)\n", trans_num,
1570                                 (int)nread,
1571                                 (unsigned int)unread_bytes ));
1572
1573         if (msg_type != 0) {
1574                 /*
1575                  * NetBIOS session request, keepalive, etc.
1576                  */
1577                 reply_special(inbuf);
1578                 return;
1579         }
1580
1581         show_msg(inbuf);
1582
1583         construct_reply(inbuf,nread,unread_bytes,encrypted);
1584
1585         trans_num++;
1586 }
1587
1588 /****************************************************************************
1589  Return a string containing the function name of a SMB command.
1590 ****************************************************************************/
1591
1592 const char *smb_fn_name(int type)
1593 {
1594         const char *unknown_name = "SMBunknown";
1595
1596         if (smb_messages[type].name == NULL)
1597                 return(unknown_name);
1598
1599         return(smb_messages[type].name);
1600 }
1601
1602 /****************************************************************************
1603  Helper functions for contruct_reply.
1604 ****************************************************************************/
1605
1606 static uint32 common_flags2 = FLAGS2_LONG_PATH_COMPONENTS|FLAGS2_32_BIT_ERROR_CODES;
1607
1608 void add_to_common_flags2(uint32 v)
1609 {
1610         common_flags2 |= v;
1611 }
1612
1613 void remove_from_common_flags2(uint32 v)
1614 {
1615         common_flags2 &= ~v;
1616 }
1617
1618 void construct_reply_common(const char *inbuf, char *outbuf)
1619 {
1620         srv_set_message(outbuf,0,0,false);
1621
1622         SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
1623         SIVAL(outbuf,smb_rcls,0);
1624         SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES));
1625         SSVAL(outbuf,smb_flg2,
1626                 (SVAL(inbuf,smb_flg2) & FLAGS2_UNICODE_STRINGS) |
1627                 common_flags2);
1628         memset(outbuf+smb_pidhigh,'\0',(smb_tid-smb_pidhigh));
1629
1630         SSVAL(outbuf,smb_tid,SVAL(inbuf,smb_tid));
1631         SSVAL(outbuf,smb_pid,SVAL(inbuf,smb_pid));
1632         SSVAL(outbuf,smb_uid,SVAL(inbuf,smb_uid));
1633         SSVAL(outbuf,smb_mid,SVAL(inbuf,smb_mid));
1634 }
1635
1636 /****************************************************************************
1637  Construct a chained reply and add it to the already made reply
1638 ****************************************************************************/
1639
1640 void chain_reply(struct smb_request *req)
1641 {
1642         static char *orig_inbuf;
1643
1644         /*
1645          * Dirty little const_discard: We mess with req->inbuf, which is
1646          * declared as const. If maybe at some point this routine gets
1647          * rewritten, this const_discard could go away.
1648          */
1649         char *inbuf = CONST_DISCARD(char *, req->inbuf);
1650         int size = smb_len(req->inbuf)+4;
1651
1652         int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0);
1653         unsigned smb_off2 = SVAL(inbuf,smb_vwv1);
1654         char *inbuf2;
1655         int outsize2;
1656         int new_size;
1657         char inbuf_saved[smb_wct];
1658         char *outbuf = (char *)req->outbuf;
1659         size_t outsize = smb_len(outbuf) + 4;
1660         size_t outsize_padded;
1661         size_t ofs, to_move;
1662
1663         struct smb_request *req2;
1664         size_t caller_outputlen;
1665         char *caller_output;
1666
1667         /* Maybe its not chained, or it's an error packet. */
1668         if (smb_com2 == 0xFF || SVAL(outbuf,smb_rcls) != 0) {
1669                 SCVAL(outbuf,smb_vwv0,0xFF);
1670                 return;
1671         }
1672
1673         if (chain_size == 0) {
1674                 /* this is the first part of the chain */
1675                 orig_inbuf = inbuf;
1676         }
1677
1678         /*
1679          * We need to save the output the caller added to the chain so that we
1680          * can splice it into the final output buffer later.
1681          */
1682
1683         caller_outputlen = outsize - smb_wct;
1684
1685         caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);
1686
1687         if (caller_output == NULL) {
1688                 /* TODO: NT_STATUS_NO_MEMORY */
1689                 smb_panic("could not dup outbuf");
1690         }
1691
1692         /*
1693          * The original Win95 redirector dies on a reply to
1694          * a lockingX and read chain unless the chain reply is
1695          * 4 byte aligned. JRA.
1696          */
1697
1698         outsize_padded = (outsize + 3) & ~3;
1699
1700         /*
1701          * remember how much the caller added to the chain, only counting
1702          * stuff after the parameter words
1703          */
1704         chain_size += outsize_padded - smb_wct;
1705
1706         /*
1707          * work out pointers into the original packets. The
1708          * headers on these need to be filled in
1709          */
1710         inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct;
1711
1712         /* remember the original command type */
1713         smb_com1 = CVAL(orig_inbuf,smb_com);
1714
1715         /* save the data which will be overwritten by the new headers */
1716         memcpy(inbuf_saved,inbuf2,smb_wct);
1717
1718         /* give the new packet the same header as the last part of the SMB */
1719         memmove(inbuf2,inbuf,smb_wct);
1720
1721         /* create the in buffer */
1722         SCVAL(inbuf2,smb_com,smb_com2);
1723
1724         /* work out the new size for the in buffer. */
1725         new_size = size - (inbuf2 - inbuf);
1726         if (new_size < 0) {
1727                 DEBUG(0,("chain_reply: chain packet size incorrect "
1728                          "(orig size = %d, offset = %d)\n",
1729                          size, (int)(inbuf2 - inbuf) ));
1730                 exit_server_cleanly("Bad chained packet");
1731                 return;
1732         }
1733
1734         /* And set it in the header. */
1735         smb_setlen(inbuf2, new_size - 4);
1736
1737         DEBUG(3,("Chained message\n"));
1738         show_msg(inbuf2);
1739
1740         if (!(req2 = talloc(talloc_tos(), struct smb_request))) {
1741                 smb_panic("could not allocate smb_request");
1742         }
1743         init_smb_request(req2, (uint8 *)inbuf2,0, req->encrypted);
1744
1745         /* process the request */
1746         switch_message(smb_com2, req2, new_size);
1747
1748         /*
1749          * We don't accept deferred operations in chained requests.
1750          */
1751         SMB_ASSERT(req2->outbuf != NULL);
1752         outsize2 = smb_len(req2->outbuf)+4;
1753
1754         /*
1755          * Move away the new command output so that caller_output fits in,
1756          * copy in the caller_output saved above.
1757          */
1758
1759         SMB_ASSERT(outsize_padded >= smb_wct);
1760
1761         /*
1762          * "ofs" is the space we need for caller_output. Equal to
1763          * caller_outputlen plus the padding.
1764          */
1765
1766         ofs = outsize_padded - smb_wct;
1767
1768         /*
1769          * "to_move" is the amount of bytes the secondary routine gave us
1770          */
1771
1772         to_move = outsize2 - smb_wct;
1773
1774         if (to_move + ofs + smb_wct + chain_size > max_send) {
1775                 smb_panic("replies too large -- would have to cut");
1776         }
1777
1778         /*
1779          * In the "new" API "outbuf" is allocated via reply_outbuf, just for
1780          * the first request in the chain. So we have to re-allocate it. In
1781          * the "old" API the only outbuf ever used is the global OutBuffer
1782          * which is always large enough.
1783          */
1784
1785         outbuf = TALLOC_REALLOC_ARRAY(NULL, outbuf, char,
1786                                       to_move + ofs + smb_wct);
1787         if (outbuf == NULL) {
1788                 smb_panic("could not realloc outbuf");
1789         }
1790
1791         req->outbuf = (uint8 *)outbuf;
1792
1793         memmove(outbuf + smb_wct + ofs, req2->outbuf + smb_wct, to_move);
1794         memcpy(outbuf + smb_wct, caller_output, caller_outputlen);
1795
1796         /*
1797          * copy the new reply header over the old one but preserve the smb_com
1798          * field
1799          */
1800         memmove(outbuf, req2->outbuf, smb_wct);
1801         SCVAL(outbuf, smb_com, smb_com1);
1802
1803         /*
1804          * We've just copied in the whole "wct" area from the secondary
1805          * function. Fix up the chaining: com2 and the offset need to be
1806          * readjusted.
1807          */
1808
1809         SCVAL(outbuf, smb_vwv0, smb_com2);
1810         SSVAL(outbuf, smb_vwv1, chain_size + smb_wct - 4);
1811
1812         if (outsize_padded > outsize) {
1813
1814                 /*
1815                  * Due to padding we have some uninitialized bytes after the
1816                  * caller's output
1817                  */
1818
1819                 memset(outbuf + outsize, 0, outsize_padded - outsize);
1820         }
1821
1822         smb_setlen(outbuf, outsize2 + chain_size - 4);
1823
1824         /*
1825          * restore the saved data, being careful not to overwrite any data
1826          * from the reply header
1827          */
1828         memcpy(inbuf2,inbuf_saved,smb_wct);
1829
1830         SAFE_FREE(caller_output);
1831         TALLOC_FREE(req2);
1832
1833         return;
1834 }
1835
1836 /****************************************************************************
1837  Setup the needed select timeout in milliseconds.
1838 ****************************************************************************/
1839
1840 static int setup_select_timeout(void)
1841 {
1842         int select_timeout;
1843
1844         select_timeout = SMBD_SELECT_TIMEOUT*1000;
1845
1846         if (print_notify_messages_pending()) {
1847                 select_timeout = MIN(select_timeout, 1000);
1848         }
1849
1850         return select_timeout;
1851 }
1852
1853 /****************************************************************************
1854  Check if services need reloading.
1855 ****************************************************************************/
1856
1857 void check_reload(time_t t)
1858 {
1859         static pid_t mypid = 0;
1860         static time_t last_smb_conf_reload_time = 0;
1861         static time_t last_printer_reload_time = 0;
1862         time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
1863
1864         if(last_smb_conf_reload_time == 0) {
1865                 last_smb_conf_reload_time = t;
1866                 /* Our printing subsystem might not be ready at smbd start up.
1867                    Then no printer is available till the first printers check
1868                    is performed.  A lower initial interval circumvents this. */
1869                 if ( printcap_cache_time > 60 )
1870                         last_printer_reload_time = t - printcap_cache_time + 60;
1871                 else
1872                         last_printer_reload_time = t;
1873         }
1874
1875         if (mypid != getpid()) { /* First time or fork happened meanwhile */
1876                 /* randomize over 60 second the printcap reload to avoid all
1877                  * process hitting cupsd at the same time */
1878                 int time_range = 60;
1879
1880                 last_printer_reload_time += random() % time_range;
1881                 mypid = getpid();
1882         }
1883
1884         if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) {
1885                 reload_services(True);
1886                 reload_after_sighup = False;
1887                 last_smb_conf_reload_time = t;
1888         }
1889
1890         /* 'printcap cache time = 0' disable the feature */
1891
1892         if ( printcap_cache_time != 0 )
1893         {
1894                 /* see if it's time to reload or if the clock has been set back */
1895
1896                 if ( (t >= last_printer_reload_time+printcap_cache_time)
1897                         || (t-last_printer_reload_time  < 0) )
1898                 {
1899                         DEBUG( 3,( "Printcap cache time expired.\n"));
1900                         reload_printers();
1901                         last_printer_reload_time = t;
1902                 }
1903         }
1904 }
1905
1906 /****************************************************************************
1907  Process any timeout housekeeping. Return False if the caller should exit.
1908 ****************************************************************************/
1909
1910 static bool timeout_processing(int *select_timeout,
1911                                time_t *last_timeout_processing_time)
1912 {
1913         time_t t;
1914
1915         if (*get_srv_read_error() == SMB_READ_EOF) {
1916                 DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n"));
1917                 return false;
1918         }
1919
1920         if (*get_srv_read_error() == SMB_READ_ERROR) {
1921                 DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n",
1922                         strerror(errno)));
1923                 return false;
1924         }
1925
1926         if (*get_srv_read_error() == SMB_READ_BAD_SIG) {
1927                 DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n"));
1928                 return false;
1929         }
1930
1931         *last_timeout_processing_time = t = time(NULL);
1932
1933         /* become root again if waiting */
1934         change_to_root_user();
1935
1936         /* check if we need to reload services */
1937         check_reload(t);
1938
1939         if(global_machine_password_needs_changing &&
1940                         /* for ADS we need to do a regular ADS password change, not a domain
1941                                         password change */
1942                         lp_security() == SEC_DOMAIN) {
1943
1944                 unsigned char trust_passwd_hash[16];
1945                 time_t lct;
1946
1947                 /*
1948                  * We're in domain level security, and the code that
1949                  * read the machine password flagged that the machine
1950                  * password needs changing.
1951                  */
1952
1953                 /*
1954                  * First, open the machine password file with an exclusive lock.
1955                  */
1956
1957                 if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) {
1958                         DEBUG(0,("process: unable to lock the machine account password for \
1959 machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
1960                         return True;
1961                 }
1962
1963                 if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) {
1964                         DEBUG(0,("process: unable to read the machine account password for \
1965 machine %s in domain %s.\n", global_myname(), lp_workgroup()));
1966                         secrets_lock_trust_account_password(lp_workgroup(), False);
1967                         return True;
1968                 }
1969
1970                 /*
1971                  * Make sure someone else hasn't already done this.
1972                  */
1973
1974                 if(t < lct + lp_machine_password_timeout()) {
1975                         global_machine_password_needs_changing = False;
1976                         secrets_lock_trust_account_password(lp_workgroup(), False);
1977                         return True;
1978                 }
1979
1980                 /* always just contact the PDC here */
1981
1982                 change_trust_account_password( lp_workgroup(), NULL);
1983                 global_machine_password_needs_changing = False;
1984                 secrets_lock_trust_account_password(lp_workgroup(), False);
1985         }
1986
1987         /* update printer queue caches if necessary */
1988
1989         update_monitored_printq_cache();
1990
1991         /*
1992          * Now we are root, check if the log files need pruning.
1993          * Force a log file check.
1994          */
1995         force_check_log_size();
1996         check_log_size();
1997
1998         /* Send any queued printer notify message to interested smbd's. */
1999
2000         print_notify_send_messages(smbd_messaging_context(), 0);
2001
2002         /*
2003          * Modify the select timeout depending upon
2004          * what we have remaining in our queues.
2005          */
2006
2007         *select_timeout = setup_select_timeout();
2008
2009         return True;
2010 }
2011
2012 /****************************************************************************
2013  Process commands from the client
2014 ****************************************************************************/
2015
2016 void smbd_process(void)
2017 {
2018         time_t last_timeout_processing_time = time(NULL);
2019         unsigned int num_smbs = 0;
2020         size_t unread_bytes = 0;
2021
2022         max_recv = MIN(lp_maxxmit(),BUFFER_SIZE);
2023
2024         while (True) {
2025                 int select_timeout = setup_select_timeout();
2026                 int num_echos;
2027                 char *inbuf;
2028                 size_t inbuf_len;
2029                 bool encrypted = false;
2030                 TALLOC_CTX *frame = talloc_stackframe_pool(8192);
2031
2032                 errno = 0;
2033
2034                 /* Did someone ask for immediate checks on things like blocking locks ? */
2035                 if (select_timeout == 0) {
2036                         if(!timeout_processing(&select_timeout,
2037                                                &last_timeout_processing_time))
2038                                 return;
2039                         num_smbs = 0; /* Reset smb counter. */
2040                 }
2041
2042                 run_events(smbd_event_context(), 0, NULL, NULL);
2043
2044                 while (!receive_message_or_smb(talloc_tos(), &inbuf, &inbuf_len,
2045                                                 select_timeout,
2046                                                 &unread_bytes,
2047                                                 &encrypted)) {
2048                         if(!timeout_processing(&select_timeout,
2049                                                &last_timeout_processing_time))
2050                                 return;
2051                         num_smbs = 0; /* Reset smb counter. */
2052                 }
2053
2054
2055                 /*
2056                  * Ensure we do timeout processing if the SMB we just got was
2057                  * only an echo request. This allows us to set the select
2058                  * timeout in 'receive_message_or_smb()' to any value we like
2059                  * without worrying that the client will send echo requests
2060                  * faster than the select timeout, thus starving out the
2061                  * essential processing (change notify, blocking locks) that
2062                  * the timeout code does. JRA.
2063                  */
2064                 num_echos = smb_echo_count;
2065
2066                 process_smb(inbuf, inbuf_len, unread_bytes, encrypted);
2067
2068                 TALLOC_FREE(inbuf);
2069
2070                 if (smb_echo_count != num_echos) {
2071                         if(!timeout_processing( &select_timeout, &last_timeout_processing_time))
2072                                 return;
2073                         num_smbs = 0; /* Reset smb counter. */
2074                 }
2075
2076                 num_smbs++;
2077
2078                 /*
2079                  * If we are getting smb requests in a constant stream
2080                  * with no echos, make sure we attempt timeout processing
2081                  * every select_timeout milliseconds - but only check for this
2082                  * every 200 smb requests.
2083                  */
2084
2085                 if ((num_smbs % 200) == 0) {
2086                         time_t new_check_time = time(NULL);
2087                         if(new_check_time - last_timeout_processing_time >= (select_timeout/1000)) {
2088                                 if(!timeout_processing(
2089                                            &select_timeout,
2090                                            &last_timeout_processing_time))
2091                                         return;
2092                                 num_smbs = 0; /* Reset smb counter. */
2093                                 last_timeout_processing_time = new_check_time; /* Reset time. */
2094                         }
2095                 }
2096
2097                 /* The timeout_processing function isn't run nearly
2098                    often enough to implement 'max log size' without
2099                    overrunning the size of the file by many megabytes.
2100                    This is especially true if we are running at debug
2101                    level 10.  Checking every 50 SMBs is a nice
2102                    tradeoff of performance vs log file size overrun. */
2103
2104                 if ((num_smbs % 50) == 0 && need_to_check_log_size()) {
2105                         change_to_root_user();
2106                         check_log_size();
2107                 }
2108                 TALLOC_FREE(frame);
2109         }
2110 }